The Harness Engineering Roadmap for 2026–27: From Agent Loops to Proof-Carrying Runtimes

The first generation of agent harnesses answered a functional question: how can a model call tools in a loop until work is done?

The next generation has to answer a harder question: how can an organization prove which system acted, under whose authority, on what evidence, with which effects, and through which recovery path?

That changes the center of gravity. Better planners and larger tool catalogs will continue to matter. The durable roadmap is elsewhere:

• release manifests for the complete model–harness build;
• portable trajectories with decision and effect semantics;
• security evaluation across setup, extension, runtime, memory, action, and recovery;
• paired evaluation of skills and other behavior packages;
• authority that narrows across agent delegation;
• postconditions and compensation for external actions;
• improvement loops that can propose changes without approving themselves;
• economics measured per accepted, trusted outcome.

This is an 18-month field and publishing roadmap from August 2026 through the end of 2027. It is not a vendor forecast. Each horizon is derived from public implementations, current research gaps, and standards roadmaps. Predictions are labeled by confidence rather than presented as inevitabilities.

The earlier production harness roadmap gives one team a 90-day build sequence. This article asks what the discipline itself needs next—and which deep technical work deserves sustained coverage.

The baseline: what is already real

A roadmap should begin from shipped capability, not speculation.

By August 2026:

• OpenAI had described the Codex harness, exposed it through the App Server, documented a repository built through harness engineering, and shipped model-native harness and sandbox capabilities in the Agents SDK.
• Microsoft had made harness selection a Copilot Studio product decision and documented an Agent Framework harness with files, tools, approvals, looping, compaction, and background work.
• DeepSeek had released a plugin-composed harness and experimental self-referential adaptation system.
• Harness-IF, A2E, The Scaffold Effect, HarnessAudit, and HarnessRisk had made instruction following, framework effects, trajectory safety, and lifecycle attacks measurable.
• ACES and NVIDIA SkillEvaluator had implemented static plus live, paired evaluation of skills.
• ATIF v1.7 could represent ordered agent steps, tool calls, observations, metrics, continuation, and embedded subagent trajectories.
• A2A had stable SDKs and a roadmap for authorization metadata, dynamic skill queries, richer task UX, and improved streaming reliability; on August 17 it joined the Agentic AI Foundation.

These pieces are sufficient to build serious systems now. They are not yet a complete production contract.

The destination: a proof-carrying runtime

A proof-carrying harness does not mean formally verifying every model thought. It means every consequential run carries enough independently checkable evidence to support its claims and effects.

For a high-impact action, the evidence packet should answer:

Who asked?
What business purpose was declared?
Which complete release tuple ran?
What evidence entered context?
Which policy version applied?
What authority was granted?
What exact normalized effect was approved?
What tool request executed?
What external state changed?
Which postcondition proves success?
What durable state was written?
What failed or remained uncertain?
How can the effect be compensated or rolled back?

The model can generate part of this packet. It cannot be the sole authority for validating it.

The following horizons describe how the field can get there.

Horizon 1 — Q3 to Q4 2026: make the deployed system enumerable

Confidence: high. The components already exist; the work is adoption and convergence.

1. Release manifests become normal

The release unit will expand from model + app version to a complete tuple:

agent_release:
  id: claims-agent-2026-11-18.2
  model: provider/model-version
  harness: runtime@5.2.0
  instructions_sha256: "..."
  skill_bundle_sha256: "..."
  tool_catalog_sha256: "..."
  policy_sha256: "..."
  memory_schema: 9
  sandbox_profile: "network-deny-default-v5"
  evaluator_set_sha256: "..."

Harness-IF, The Scaffold Effect, HarnessRisk, and ACES all point toward this unit from different directions. Instruction surface, harness, security configuration, and skill availability can each change behavior. A model name alone cannot identify what ran.

Expected implementation work:

• content-addressed manifests;
• environment and extension lockfiles;
• trace binding to the manifest hash;
• candidate-versus-stable diffs;
• compatibility checks for model, tool, policy, and memory-schema changes;
• one-command rollback to a previously attested tuple.

2. Portable trajectory export becomes a release requirement

ATIF provides one practical cross-harness format. OpenTelemetry provides operational spans and metrics. Vendor runtimes retain richer native events. These will coexist.

Teams should use a layered trace model:

The field should resist forcing all four into one schema. The near-term win is stable correlation identifiers and loss-aware conversion.

3. Lifecycle security enters continuous evaluation

HarnessRisk makes configuration and recovery testable alongside runtime injection. Teams will begin extending its six-phase matrix with domain cases.

Near-term release suites should include:

• unsafe setup defaults;
• extension provenance and permission escalation;
• indirect injection through real workflow artifacts;
• memory poisoning and delayed triggers;
• approval mutation and duplicate effects;
• evidence-preserving incident recovery.

The critical metric will be useful-but-unsafe runs, not only refusals or detection language.

4. Skills acquire evaluation assets

The ACES pattern will push evals/ beside SKILL.md, scripts, and references. Production skill reviews will include:

• explicit, implicit, contextual, and negative activation cases;
• isolation and group-mode trials;
• stable and candidate release tuples;
• deterministic domain graders;
• paired Skill Lift;
• security, latency, and cost gates;
• revocation and rollback metadata.

Static scans remain the fast first tier. Live lift becomes the promotion evidence.

Exit condition for Horizon 1

Any production run can be mapped to immutable behavior-shaping artifacts, exported into an inspectable trajectory, scored across utility and safety, and reproduced in a controlled environment closely enough to explain a regression.

Horizon 2 — H1 2027: govern the seams between agents and tools

Confidence: medium-high. Standards work is active, but enterprise semantics will remain implementation-specific.

5. Delegated authority becomes a first-class contract

A2A lets one agent discover and delegate to another. MCP and APIs let the receiving agent reach tools. The missing layer is authority continuity.

A delegated task should carry an attenuated envelope:

type DelegatedAuthority = {
  runId: string
  parentDecisionId: string
  originatingPrincipalId: string
  accountableOwnerId: string
  businessPurpose: string
  allowedCapabilities: string[]
  resourceConstraints: string[]
  approvalMode: "read_only" | "local_write" | "network" | "delegated" | "destructive"
  expiresAt: string
  maxDelegationDepth: number
  policySha256: string
}

The receiving agent may get less authority, never more by default. Every downstream tool call should remain attributable to the original run and the specialist that proposed it.

Research and standards questions:

• How is business purpose preserved across organizations?
• Which identity signs the delegation?
• Can an Agent Card declare capability without becoming self-authorization?
• How are revocation and cancellation propagated?
• Who compensates a partial external effect?
• How are cross-tenant traces shared without leaking sensitive reasoning or data?

6. Proof-carrying tool calls replace success strings

A tool returning 200 OK or success: true is weak evidence. The harness needs a typed postcondition.

type EffectReceipt = {
  requestId: string
  idempotencyKey: string
  normalizedEffectSha256: string
  authorizationReceiptSha256: string
  externalResourceVersion: string
  observedPostcondition: Record<string, unknown>
  evidenceRefs: string[]
  compensation?: {
    supported: boolean
    action: string
    deadline: string
  }
}

The exact shape will vary. The design principle will not: the tool boundary returns evidence strong enough for the risk of a false success.

Expected implementation areas:

• idempotency by normalized effect;
• precondition and postcondition schemas;
• approval receipts bound to arguments after normalization;
• external version or ledger references;
• asynchronous completion and reconciliation;
• compensation workflows;
• uncertainty states that cannot be collapsed into success or failure.

7. Recovery becomes part of the happy path

Long-running agents will fail during model calls, tool calls, compaction, remote work, handoffs, and streaming. Durable execution and snapshots help, but recovery needs semantic state.

The run state machine should distinguish:

planned
authorized
executing
effect_pending
effect_observed
verification_failed
compensation_pending
recovered
escalated

Horizon 2 benchmarks should score:

• duplicate side effects after retry;
• partial tool output;
• lost or expired worker messages;
• stale approvals after resume;
• compaction that drops constraints;
• cleanup that removes durable memory or protected evidence;
• cancellation across delegated agents;
• restoration after credential or policy rotation.

8. Multi-agent evaluation moves beyond consensus

More agents do not guarantee independent evidence. Multi-agent systems need to measure correlated failure, authority expansion, information leakage, and handoff loss.

Useful metrics will include:

• effective independent reviewer count;
• shared-context and shared-model correlation;
• information-flow violations between roles;
• delegation depth and authority attenuation;
• message delivery, expiry, and duplication;
• parent/subagent trajectory completeness;
• disagreement resolution quality;
• cost and latency per independently verified outcome.

Exit condition for Horizon 2

A task can cross agent and tool boundaries without losing run identity, bounded authority, lifecycle state, effect evidence, or a defined owner for recovery.

Horizon 3 — H2 2027: improve the harness without surrendering control

Confidence: medium. The direction is supported; the safe operating envelope remains a research problem.

9. Harness optimization becomes causal and multi-objective

An improvement loop will search over:

• instruction placement and wording;
• context selection and compression;
• tool descriptions and schemas;
• skill routing and composition;
• retry, timeout, and fan-out policy;
• model and reasoning-budget routing;
• memory retrieval and promotion;
• evaluator prompts and thresholds.

The candidate objective should be a Pareto surface, not one reward:

maximize:
  accepted outcome rate
  instruction compliance
  postcondition coverage
  recovery success
 
minimize:
  attack success
  persistent contamination
  human review burden
  p95 latency
  cost per accepted outcome

The field will need better causal designs because many variables co-move. A model update can make a skill look redundant. A new grader can make a stable system look worse. A context change can improve accuracy while increasing prompt-injection exposure.

Expected practices:

• one-factor and factorial ablations;
• frozen held-out task slices;
• evaluator-version holdbacks;
• repeated paired trials;
• production canaries with stable control groups;
• rollback on critical slice regressions;
• explicit uncertainty and missing-evidence reporting.

10. Adaptive harnesses gain an immutable outer loop

Research on memory reconstruction, harness optimization, and self-referential runtimes suggests real upside. The failure mode is allowing the optimized system to modify its own authority, evaluator, or promotion threshold.

Use two loops:

The outer loop owns:

• policy and authority limits;
• held-out datasets;
• critical security gates;
• evaluator versions;
• promotion approval;
• canary scope;
• rollback and evidence retention.

The inner loop may propose. It may not redefine acceptance.

11. Agent legibility expands from repositories to organizations

OpenAI’s harness-engineering account emphasizes repository-local knowledge, structural tests, agent-readable UI, logs, metrics, and traces. The next step is organizational legibility:

• policies with executable schemas;
• service ownership and dependency maps;
• data classification and purpose constraints;
• decision catalogs;
• incident history and recovery playbooks;
• product scorecards and rollout state;
• human feedback linked to the affected release tuple.

The danger is indiscriminate context loading. Legibility requires discoverability, provenance, and scoped retrieval—not copying every document into the prompt.

12. Economics moves from tokens to trusted throughput

Cost per token is too low-level. Task success alone ignores review and recovery. The useful measure is cost per accepted, trusted outcome:

total model + tool + sandbox + review + recovery cost
-----------------------------------------------------
outcomes that pass utility, policy, safety, and evidence gates

Harness improvements will increasingly target:

• stable, cacheable instruction prefixes;
• progressive skill and tool disclosure;
• smaller observation payloads;
• cache-aware worker staggering;
• model routing by task and risk;
• early termination after sufficient evidence;
• prevention of retry amplification;
• reviewer allocation based on uncertainty and consequence.

Exit condition for Horizon 3

The harness can improve context, skills, orchestration, and economics through measured candidates while authority, evaluation, promotion, and rollback remain outside the optimized surface.

The hard research problems

Some gaps will not close through ordinary integration work.

Semantic replay

A portable trajectory records what happened. Replaying a decision requires the original model behavior, tool state, external data, time, policy, and nondeterministic environment—or a principled substitute. The field needs to distinguish exact replay, causal replay, and counterfactual simulation.

Evaluator integrity

Model judges are useful and vulnerable to prompt injection, shared-model bias, drift, and reward hacking. High-impact claims need objective oracles, calibrated disagreement sets, and judge diversity where interpretation remains necessary.

Delegated identity and liability

Cross-organization agents need more than transport authentication. They need purpose limitation, authority attenuation, revocation, evidence-sharing rules, and a clear accountable owner for downstream effects.

Safe online learning

An agent that learns from production may ingest attacker-controlled outcomes or optimize a proxy. Experience must remain evidence until an independent process validates and promotes it.

Human agency under high throughput

Agents can generate work faster than humans can review it. The answer cannot be either reviewing everything or removing people entirely. Interfaces need uncertainty, consequence, provenance, reversibility, and attention-budget aware escalation.

Embodied and irreversible effects

Robotics, finance, healthcare, infrastructure, and communications raise the cost of false success. Language-model critics cannot replace hard real-time safety, independent interlocks, or domain controls.

What not to optimize for

A good roadmap also declines attractive distractions.

• Do not chase maximum autonomy as the top-level metric. Expand authority only when evidence and recovery mature.
• Do not select a harness from one average benchmark. Evaluate the model–harness pair on the actual task and risk distribution.
• Do not treat instruction volume as control strength. Put consequential invariants in deterministic boundaries.
• Do not let more agents substitute for independent verification. Shared models and context can manufacture consensus.
• Do not let self-improvement edit its own gate. Keep an immutable outer loop.
• Do not call a transcript an audit trail. Record identity, policy, normalized effects, external evidence, and recovery state.
• Do not use one composite score to hide critical failures. Preserve utility, safety, persistence, cost, and uncertainty separately.
• Do not standardize away meaningful semantics. Interchange formats should report loss rather than pretend different runtimes behave identically.

The 2026–27 deep-blog publishing roadmap

The field needs fewer generic “top agent framework” lists and more reproducible engineering artifacts. This is the editorial sequence ContextOS will use to keep the series rigorous.

Track A: release and evidence contracts

1. The Agent Release Manifest: a concrete schema for the model–harness–instruction–skill–tool–policy tuple, compatibility rules, signing, and rollback.
2. ATIF, OpenTelemetry, and DecisionRecord: what each trace layer captures, what conversion loses, and how to correlate them.
3. Proof-Carrying Tool Calls: idempotency, normalized approvals, postcondition evidence, async completion, and compensation.

Track B: security and recovery

4. The Harness Security Regression Suite: configuration, extension, runtime, persistence, action, and recovery cases adapted to enterprise workflows.
5. Agent Extension SBOM: provenance, capability manifests, transitive dependencies, trust roots, updates, revocation, and skill shadowing.
6. Recovery Is a Benchmark: partial effects, resume, cancellation, credential rotation, evidence preservation, and post-recovery validation.

Track C: evaluation and improvement

7. Skill Lift Beyond the Average: paired design, negative lift triage, routing premium, repeated trials, and domain graders.
8. Causal Harness Experiments: ablations, cluster-aware uncertainty, stable controls, evaluator holdbacks, and production canaries.
9. The Immutable Outer Loop: a reference architecture for adaptive context, skills, memory, and orchestration without self-approval.

Track D: interoperability and operations

10. Authority Across A2A and MCP: identity, purpose, attenuation, cancellation, and end-to-end evidence across protocol seams.
11. Cost per Trusted Outcome: cache-aware harness design, model routing, review allocation, retry amplification, and accepted-throughput economics.
12. State of Harness Engineering 2027: a dated evidence ledger separating shipped systems, reproducible research, standards, and unresolved claims.

Each deep dive should ship with at least one of the following: a typed contract, runnable reference, threat matrix, evaluation dataset, decision table, or reproducible measurement protocol. Opinion without an artifact should be labeled as opinion.

Milestones readers can use

These are design targets, not guarantees about vendor delivery. A small team can implement parts earlier. Cross-vendor semantic convergence may take longer.

How to act on the roadmap now

Do three things before adding another autonomous workflow:

1. Name the whole system. Create an immutable release manifest and attach it to every run.
2. Measure the missing failure classes. Add one lifecycle-security matrix and one paired skill evaluation to CI.
3. Strengthen the effect boundary. Bind identity, approval, normalized action, postcondition, and recovery state into the tool protocol.

Those moves create leverage for every later horizon. Without them, the organization cannot tell whether a new model, skill, framework, or self-improvement proposal made the system better—or merely different.

The final bet

The defining harness of 2027 will not win because it has the longest system prompt, the most tools, or the largest fleet of subagents.

It will win because it can make powerful models useful while keeping the run enumerable, the authority bounded, the evidence portable, the effects provable, the failures recoverable, and the improvement loop reversible.

That is the transition from an agent loop to a production runtime.

What to read next

• Harness Engineering in August 2026: The Control Plane Gets Measured
• HarnessRisk in Practice: Turn the Agent Lifecycle Into a Security Test Matrix
• Skill Lift: How to Gate Agent Skills With Paired Live Evals
• The Production Harness Roadmap
• Adaptive Agent Harnesses: What MemoHarness Gets Right