Harness Engineering on September 26, 2026: From Agent Loops to Personal-Agent Operating Systems

Harness engineering changed categories in late September 2026. The field began the year focused on coding agents: repository instructions, tool loops, sandboxes, subagents, and evaluation. It now has to govern personal agents that remember a life, operate for days, hold connected identities, browse arbitrary sites, buy goods, appear through glasses, and speak through expressive avatars.

The central engineering problem is no longer only “how do we help the model finish?” It is:

How do we preserve identity, authority, evidence, recovery, and user agency while a model observes more of the world and acts across systems it does not control?

This report covers selected public evidence through September 26, 2026 and focuses on the delta since the September 15 practitioner guide. It distinguishes research preprints, shipped products, official documentation, independent reporting, and practitioner synthesis. Nothing here is an independent certification of a vendor system.

The ten-day evidence ledger

Meta launched Muse on September 8, before the previous review cutoff. The architectural significance became clearer only when combined with its detailed security report, later Connect announcements, and the real-world denial of access by a major commerce platform.

Shift 1: a harness became a personal operating environment

The coding-harness mental model begins with a repository and ends with a patch. Muse begins with a person and may never have a natural end. It maintains a main conversation, side chats, long-running goals, memory files, scheduled work, proactive messages, custom tools, a browser, connected accounts, and multiple agents.

That turns familiar components into lifecycle responsibilities:

Meta’s Secure VM design is notable because it treats these as systems problems. The main agent runs in a constrained cell; credentials and built-in connector logic live outside it; a separate Sentinel mediates connector actions and egress; the browser is brokered; and external content is treated as untrusted.

The lesson is not “copy Meta.” It is that a personal agent with broad authority needs a privileged control plane the agent cannot edit.

Shift 2: minimal and thick harnesses are both advancing

The field is not converging on one amount of machinery.

JAZ, introduced in the September 22 Harness as a Language preprint, asks how much can be expressed through one LLM-backed invoke primitive. The primitive lets the model write executable code that can recursively call invoke, while inputs and interaction history remain available as variables in the code environment. Hooks apply external constraints and monitoring.

The authors report that prompt-only invoke configurations outperform selected specialized memory and self-improvement baselines on parts of StuLife and AppWorld at lower cost. Those results are research claims under the paper’s protocols. They do not show that a minimal agent loop supplies production authorization, secret custody, isolation, or recovery.

Muse sits at the opposite extreme. It uses a thick security and product harness because its authority and persistence demand one. Muse Code also accumulates explicit machinery: event sourcing, approvals, an OS sandbox, goals, memory, skills, hooks, MCP, background observers, subagents, workflows, peer messaging, forks, rewind, and recovery.

These positions are not actually contradictory. A minimal reasoning language can coexist with a thick operating boundary.

Complexity should earn its place. Remove planner layers, memory subsystems, or retries when controlled ablations show that the model no longer needs them. Do not remove the boundary that prevents a persuasive model from obtaining more authority.

Shift 3: event sourcing became an agent primitive

OpenAI’s Agents API, Anthropic’s Managed Agents, and Meta’s Muse Code all make the durable session a first-class object, although their exact contracts differ. Muse Code offers the most explicit public developer documentation in this latest period: every model call, tool result, approval, and control operation enters an append-only log that supports resume, export, replayed views, and workflow recovery.

This matters because long-running agents fail in the middle, not only at clean turn boundaries. A process may die after sending a request but before receiving the response. A user may close a laptop while subagents continue. An approval may be pending during a reconnect. A child may finish while the parent is interrupted.

The durable log lets the harness reconstruct what it knew. It does not by itself resolve the outside world. Production recovery needs three states:

planned effect -> attempted effect -> observed postcondition

If the first two exist and the third is missing, the outcome is unresolved. Retry should follow reconciliation, not optimism.

The emerging practice is to treat replay as both an operational mechanism and an evaluation input. The unresolved standards problem is whether event vocabularies preserve equivalent semantics across harnesses.

Shift 4: counterparties became part of the action boundary

Independent reporting says Amazon blocked Muse from browsing and buying on Amazon after asking Meta to remove the site from the experience. Users saw a message that continued access by an unauthorized AI agent violated Amazon’s conditions of use.

This is not merely a commercial feud. It exposes a missing participant in many agent diagrams. The user can authorize an agent to act, and the agent provider can authorize its runtime, while the destination service can still refuse automation.

An external action may therefore need three grants:

1. Principal authority: the person or organization wants the action.
2. Agent-runtime authority: the harness permits this model and tool to attempt it.
3. Counterparty acceptance: the destination permits this type of agent interaction.

Browser access is not a substitute for a service contract. Technical ability to click a button does not settle whether an agent may do so, which identity it must present, who handles errors and returns, or who owns the resulting data.

Meta’s Connect announcement points toward one response: negotiated connectors with Walmart, Best Buy, PayPal, Shopify-linked commerce, travel, productivity, and other partners. That replaces silent browser automation with an explicit integration surface, but it also creates platform concentration and connector-governance questions.

The future action manifest needs counterparty state:

# Illustrative design, not a normative ContextOS schema.
effect: commerce.purchase
principal: user_approved_scope
runtime_policy: allow_with_confirmation
counterparty:
  integration: native_connector
  agent_access: permitted
  terms_version: "2026-09-24"
payment:
  instrument: single_use_token
  protection: provider_purchase_protection
postcondition:
  require: confirmed_order_id

Shift 5: embodiment increased both latency pressure and trust pressure

Meta’s Realtime Avatar work combines a conversational voice model with an audio-driven diffusion transformer. Voice tokens drive both speech and visual motion. The company reports a distilled two-step student, persistent context, quantization, cache-aware routing, dynamic batching, and approximately 870 ms to first synchronized output in its stated configuration.

Connect then placed Muse on AI glasses, where the agent can act on what the user is seeing and continue background work during a voice conversation.

The harness implications are larger than media quality:

• consent and identity must survive noisy, multi-speaker environments;
• visual observations need retention and sensitivity rules;
• real-time systems need a fast safe path and a deliberate consequential path;
• generated embodiment should not obscure when a model is uncertain;
• the agent should disclose when an effect is pending, completed, or awaiting confirmation;
• watermarks help trace generated media but do not authorize actions taken through it.

An expressive interface increases perceived agency. That makes calibrated uncertainty and visible state more important, not less.

Shift 6: harness engineering is becoming an institutional category

The phrase has moved beyond research papers and coding-agent teams. BCG described the harness as a five-part operating system for enterprise agents. Gartner published an innovation note on coding-agent harness engineering. Microsoft has been teaching its Agent Framework harness as a product surface. Marmelab’s September 24 review reports inspecting 246 repositories and 57 publications to separate common coding-agent practices from hype.

These are signals of category formation, not scientific consensus. Definitions still vary. Some authors use harness to mean the agent loop. Others include context, tools, memory, sandboxes, policies, evaluators, observability, and improvement. Marketing can turn any middleware into “harness engineering.”

A useful boundary remains:

Harness engineering is the discipline of designing, versioning, evaluating, and operating the controlled system through which a model observes context, invokes capabilities, changes state, produces evidence, and recovers from failure.

That definition includes enforcement and operation. It does not require every implementation to contain every fashionable component.

What is implemented, researched, and merely discussed

The debates practitioners should have now

Should the harness be minimal or comprehensive?

Minimize reasoning scaffolding until evidence justifies another layer. Maximize clarity at authority and effect boundaries. A recursive primitive may replace specialized memory code; it should not replace credential isolation because it produced a better recall score.

Should model providers manage the harness?

Provider-managed harnesses can co-evolve with models and remove undifferentiated infrastructure work. They also create version drift, visibility, portability, and data-boundary concerns. Keep application-owned acceptance criteria, authority policy, business postconditions, and exportable evidence even when the loop is hosted.

Can another model serve as the security boundary?

A separate model can add useful independent signal. It remains probabilistic. Critical invariants—credential access, filesystem scope, network destinations, budgets, and exact approved effects—need deterministic enforcement underneath it.

Does local inference solve privacy?

It can improve data locality. It does not decide which files enter context, where tool outputs go, whether network actions are authorized, or how memory is deleted. Privacy is a property of the whole path.

Is agentic commerce an interface problem or a policy problem?

Both. Protocols can convey identity, intent, mandates, and receipts. Services still decide whether to admit an agent and under what economics and liability. The web may remain human-browsable while becoming selectively agent-writable.

The immediate practitioner roadmap

Over the next 30 days, a production team should do four things.

Week 1: draw the trust domains

Identify the reasoning runtime, secret store, policy authority, privileged workers, browser broker, durable state, evaluator, and external services. Mark which components the agent can modify.

Week 2: build an effect ledger

Record normalized requests, principals, business purpose, policy verdict, approvals, operation identity, attempt state, postcondition, and compensation status. Preserve unresolved outcomes.

Week 3: test the lifecycle

Inject hostile instructions through configuration, skills, memory, pages, documents, tool output, peer messages, and recovery artifacts. Score utility, attack success, persistence, and detection separately.

Week 4: delete one unjustified component

Choose a planner, retry, summarizer, reviewer, or memory layer. Run a paired ablation under the current model and workload. Remove it if quality and control remain intact. This is how a harness stays engineered instead of becoming sediment.

The future research agenda

The next important work is not another catalog of frameworks. It is a set of experiments that connect capability to authority:

1. Compare minimal and specialized reasoning harnesses while holding the enforcement boundary fixed.
2. Measure end-to-end prompt-injection attack success against a Secure-VM-style reference architecture.
3. Test credential surrogation against misuse, not only secret extraction.
4. Reproduce interrupted effects across event-sourced runtimes and real provider semantics.
5. Define portable counterparty mandates for agentic commerce.
6. Measure how avatars and proactive messaging change user approval quality and over-trust.
7. Evaluate memory correction and forgetting across primary state, backups, exports, and training pipelines.
8. Test whether a harness improvement transfers across cloud and local models.

The companion personal-agent harness research roadmap turns those topics into publishable studies with artifacts and stop conditions.

Sources and evidence notes

Primary Meta sources include the Muse security architecture, Muse product design, Muse Code documentation, Realtime Avatar report, and Connect 2026 recap. The minimal-harness research claim comes from the September 22 JAZ preprint.

The Amazon access dispute is based on GeekWire’s reporting, which includes an Amazon statement. It was not technically reproduced. Category-formation evidence includes BCG’s September 16 synthesis and Marmelab’s September 24 practitioner review; neither is treated as causal research.

The series ledger records source classes and limitations. No hosted runtime or model benchmark was executed for this report.

What to read next

• Meta Muse under the hood: architecture and security review.
• Muse Spark, Muse Code, and Glimmer: the full stack.
• The personal-agent harness research roadmap after Muse.
• The September 15 practitioner field guide.