Open source · How it works
How the harness works.Try it first.
This is the harness I use every day. Four agents research, build and review the work. When one of them edits the rules that govern it, a check fails and the change waits for me.
01 · The repo
It is plain files in one Git repo.
Tap the files you think set the rules. Then show the answer.
Pick a file
Each one says what it is for. Once the answer is shown, each one also says what happens when an agent edits it.
Two surprises in the real check: a new file under scripts/ passes, but an edit to an existing one waits. And a CLAUDE.md or AGENTS.md anywhere in the tree counts as a rule file.
02 · The sandbox
Be an agent. Then meet the check.
Pick an agent and some files. Guess, then see what the real check decided.
APick an agent
Each agent is a file. Its header lists the tools it may use.
BChange some files
CPredict, then run
The hub opens the pull request, never the agent. Every result was recorded from the real script. Nothing runs here.
# Pick files and run the check.
# It reads the list of changed paths.
- AgentMakes the change.
- Pull requestThe hub opens it as a draft.
- PassesLands on green checks once marked ready.
- WaitsAuto-merge never fires. I merge it, or not.
Predictions: none yet.
The whole decision, in the script
hits = flagged(paths, checker) print("DIFF: %d path(s); existence judged against %s" % (len(paths), pc.ROOT)) for h in hits: print("POLICY: %s" % h) print("RESULT: %s" % ("FAIL (%d policy path(s))" % len(hits) if hits else "PASS")) return 1 if hits else 0
Lines 86 to 91 of scripts/ci_policy_check.py. It reads paths, never the words inside the files. The ten edits here were run in every combination, 1,023 runs, and the page matches each result and exit code.
03 · The chains
Two chains. Where I come in.
Step through, then switch on the steps that wait for me.
No scheduled or unattended firing. A human is present in every session.
04 · Limits
What it does not stop.
The repo says these plainly. They belong next to the parts that work.
Paths, not words.
The check reads which files changed, not what they say. A rule typed into notes.md passes.
The push guard ships unarmed.
The Git push guard stays unarmed until it is configured and installed. Codex hooks ship disabled until setup approves them.
README.md, StatusSome limits are only words.
The reviewers have a Write tool. For ordinary files, what keeps them to their own review is a sentence in their file, not a missing tool.
.claude/agents/adversarial-reviewer.mdRead the code on GitHub ↗Watch the recorded check →All work →
The harness is MIT licensed.