AI Harness 行业规约体系
「模力有方」（HarnessAI）的官方规约体系。一套面向大模型生产落地的工程规约： 以「模型是引擎、Harness 是整车」为基本立场， 覆盖概述、白皮书、行业赋能、市场研究与版本发布共 5 个章节， 用 18 条核心观点回答一个问题——大模型如何从「用起来」走到「敢托付」。
- AI Harness ≠ Prompt / Agent。它是承载 AI 落地的工程化底座：把模型、工具、上下文、权限、记忆、评测、可观测性、人在回路组装成可控、可复现、可治理的运行环境。模型是引擎、Agent 是驾驶员，Harness 是整车 + 交通规则 + 仪表盘 + 行车记录仪。
- Harness 杠杆 > 模型：固定模型只改 harness，Terminal-Bench 2.0 从 52.8% 升至 66.5%（+13.7pp）；SWE-bench Pro 同权重不同 harness 差 9.5pp；换 harness 收益高于换一代模型（约 +6.8pp）。
- 复合错误公式：单步 85% × 8 步 = 27% 全流程成功率。靠提升模型精度救不了长任务，只能靠架构（checkpoint / 回滚 / 分级授权）救——这正是 Harness 的定义域。
- 规约体系 5 章：概述（定义 / 架构 / 历史 / 未来）+ 白皮书（10 篇深度文档）+ 行业赋能（8 组 × 4–7 方向）+ 市场研究（7 赛道 × 8–20 平台）+ 版本发布。本规约体系不自造 DSL、不绑定任何厂商框架。
- 跨行业自主度分级：L0 全手动 / L1 Observe / L2 Advise / L3 Act with Approval（本体系默认级）/ L4 Act Autonomously，统一采用 Gartner 四级并映射 Google SRE L0-L3。
1. 什么是 AI Harness
1.1 定义
AI Harness 是把模型、工具、上下文、权限、记忆、评测、可观测性、人在回路组装成可控、可复现、可治理的运行环境的工程化底座。它是 Agent 的「承载体 + 护栏 + 仪表盘」。
1.2 与相邻概念的边界
| 概念 | 范围 | 是否 Harness |
|---|---|---|
| Prompt | 一次输入 | 否 |
| Agent | 一个能调用工具的推理体 | 否（是 Harness 的运行单位） |
| Workflow | 多步骤的有序流程 | 否（可由 Harness 编排） |
| Harness | 跨会话、跨任务、跨角色的运行时 + 治理面 | 是 |
| 评测平台 | 评测集 + 执行器 + 报告 | 部分重叠（评测是 Harness 子系统） |
1.3 为什么 Harness 是第一性能变量
- LangChain 固定模型只改 harness：Terminal-Bench 2.0 从 52.8% 升至 66.5%（Top30→Top5，+13.7pp）。（来源：竞析报告 §1）
- SWE-bench Pro 上同一 Opus 4.5 在不同 harness 下分别 45.9% / 50.2% / 55.4%，脚手架差异达 9.5pp。（来源：竞析报告 §1）
- Meta-Harness 76.4% 超越所有人工 harness。（来源：竞析报告 §1）
- 对比换一代模型：SWE-bench Verified 上约 +6.8pp。（来源：竞析报告 §1）
- 复合错误公式：单步 85% × 8 步 = 27% 全流程成功率；95% × 20 步 = 36%。（来源：数析）
1.4 一个被低估的可靠性风险面
2026 年 3-4 月 Claude Code 出现六周质量崩塌，官方复盘归因于三个 harness 层改动，模型权重未变。独立审计分析 6,852 会话文件才复现。用户结论：Harness 是未版本化的隐形依赖——本规约体系因此强制要求版本化与变更日志。（来源：瑞思报告）
2. 核心观点
每一条核心观点都锚定一份规约文档 —— 点击卡片，进入对应章节。
2.1 Harness 是整车
“模型是引擎，Agent 是驾驶员，Harness 是整车、交通规则、仪表盘和行车记录仪。Prompt 是一次输入，Agent 是一个推理体，都算不上 Harness。”
只有把模型、工具、上下文、权限、记忆、评测、可观测性和人在回路组装成可控、可复现、可治理的运行环境，才配得上 Harness 这个名字。边界画清了，后面的讨论才不会各说各话。这是整套规约体系的第一条定义，也是所有后续章节的共同前提。
2.2 购买可托付的环境
“用户买的不是更聪明的模型，是「可托付的运行环境」。Anthropic 2026 数据：开发者约 60% 工作用 AI，但能完全委托的仅 0–20%。”
缺口不在模型能力，在 Harness 层——上下文管理、权限控制、评测体系、回滚机制、审计追踪。产品如果只讲模型多聪明，就讲不到用户真正愿意付钱的地方。这不是技术问题，是信任问题：用户需要的是一套能让他们放心把工作交出去的工程化底座。
2.3 隐形依赖的漂移
“Harness 像未版本化的隐形依赖一样在变。2026 年 3–4 月 Claude Code 六周质量崩塌，官方归因于三个 harness 层改动，模型权重未变。”
独立审计分析了 6,852 个会话文件才复现。它像一条没写进 package.json 的依赖，悄悄变了，全局跟着塌。规约因此强制要求版本化与变更日志——Harness 的每一次变更都必须可追溯、可回滚、可审计，否则它就是一个随时可能引爆的定时炸弹。
2.4 只改 Harness 涨 13.7 个点
“固定模型只改 harness，Terminal-Bench 2.0 从 52.8% 升到 66.5%（+13.7pp），同 Opus 4.5 不同 harness 差 9.5pp。”
LangChain 的实测数据。换一代模型大约只带来 6.8pp，而只动 harness 就涨了 13.7pp。第一个性能变量不在模型侧——这就是整套规约存在的理由。Meta-Harness 76.4% 超越所有人工 harness 的结果更进一步说明：Harness 本身也可以成为优化的对象。
2.5 长任务靠架构救
“靠提升模型精度救不了长任务，只能靠架构救。复合错误公式：单步 85% × 8 步 = 27%；95% × 20 步 = 36%。”
错误按指数累积，磨单步精度是徒劳的。真正的出路是 checkpoint、回滚、分级授权——把「不出错」的幻想，换成「错了能回来」的架构。这正是 Harness 的核心定义域：它不保证模型不犯错，它保证犯错之后能被发现、能被纠正、能被追溯。
2.6 愿用但不敢信任
“84% 在用，仅 3% 高度信任。Stack Overflow 2026：头号槽点 66% 选「几乎对了但差一点」。”
49,000+ 份样本、177 国。45.2% 的开发者说调试 AI 写的代码比自己重写还费时。采用率与信任已经脱钩——这道「愿用但不信任」的缝隙，正是规约要填的地方。用户不是不用 AI，是不敢把关键工作交给 AI，因为缺少一套可验证、可治理的运行保障。
2.7 治理：权限配得上能力
“没有治理的 Agent 不是助手——而是一个拥有管理员权限、又被压着工期的实习生。能力是实习生的，权限是管理员的，时限是最紧的。”
三者凑齐，事故只是时间问题。治理不是限制能力，是让权限配得上能力。这是行业共识——从数据科学到金融合规，每一个领域的实践都在重复同一个教训：不治理的 Agent 迟早会越界，而越界的代价往往远超治理的成本。
2.8 要契约，不要范文
“要「契约」，不要「范文」。复制一次就面目全非的模板是文档；会被反复复用的模板是接口规格。”
瑞思对规约本身的期望调查揭示了一个关键区分：模板的价值不在于覆盖多少字段，而在于每一条是否都能被机器校验。15 字段骨架的意义不在全，而在「可执行」——带不变量、带验收标准、带权限声明、带基线评测的规约，才是能被反复复用的契约。
2.9 按可逆性 × 影响半径设闸
“HITL 按「可逆性 × 影响半径」插入，不按步骤序号。SOC 分析员日均 4,484 条告警，67% 直接忽略。”
给每一步都加审批，只会制造橡皮图章。正确做法是只在动作不可逆、影响跨部门跨组织的地方设闸，平缓处放行。Rippling 已把「过度 HITL」列为威胁 T10——审批疲劳和审批缺失一样危险，关键在于精准定位需要人工介入的决策点。
2.10 四层比例授权模型
“要么锁死到不能用，要么授予未经 earned 的广泛权限——Gartner 指出二元思维是企业治理失败的根因。”
解法是四层比例模型：L1 观察、L2 建议、L3 执行需批（本体系默认级）、L4 有限自治。门该开多大不是是非题，是一个可以逐档调节的量。不同行业、不同场景、不同风险等级，对应的自主度档位不同——规约的价值在于给出统一的分级框架。
2.11 敏感域封顶 L3
“金融、法律、审计不允许 L4，永远停在人批一级。风险合规域商业 P1、规约紧迫度 P0——L3/L4 自主 agent 的可审计要求是监管倒逼。”
Gartner 预测 2028 年 40% 的 agent 退役，主要就落在这个域。不是因为技术不行，而是因为监管不接受「机器自主决策」作为最终责任主体。在这些领域，Harness 的核心价值不是提升效率，而是确保每一步决策都有人签字、可追溯、可审计。
2.12 MCP 上下文税
“3 个 MCP server 吃掉 200k 上下文里的 143k。三个 server 工具描述占走 72% 窗口，留给任务仅 57k。”
上下文不是越多越好。渐进披露——第一层只放指令骨架和当前任务，细节按需加载——才是让长任务活下来的办法。MCP 的开放协议设计初衷是标准化工具接入，但如果不控制上下文预算，标准化反而成了负担。Harness 需要管理的不只是权限，还有注意力。
2.13 AGENTS.md 是索引
“AGENTS.md 是目录，不是百科全书。OpenAI 团队实践：与其把所有细节堆进入口文件，不如把它当成指向更详细文档的索引。”
HumanLayer 给出的预算是 150 条指令——「预算」这个词本身就是克制：每加一条规则，都在消耗模型对每条规则的注意力。上下文窗口是有限资源，指令越精简、越聚焦，模型的遵循率越高。克制不是偷懒，是工程化的纪律。
2.14 判据优先于步骤
“给成功判据，不要给步骤。Karpathy 的话写进了骨架第 2 字段：用可验证产物定义完成，具体到命令与阈值。”
步骤给得越细，模型越是在执行想象；判据给得越清，它越是朝靶心走。目标模糊时，agent 会大声失败——这反而是好事，因为沉默的失败比大声的失败危险得多。Harness 的评测子系统就是围绕判据构建的：没有可验证的判据，评测无从谈起。
2.15 划出自治边界
“所有成熟规约的第一性条款都不是「怎么让 agent 做更多」，而是「agent 在什么边界内可以不做审批」。”
竞析报告看完 Replit 删库、AWS 瘫痪 13 小时、Linear 悖论之后的总结。规约文件是纸做的，AGENTS.md 的依从率约 70%——凡是「绝不能发生」的规则，必须写进 deny rule 和 hook，让它在物理上无法发生。纸面约束靠自律，代码约束靠物理。
2.16 Linear 悖论
“PR 吞吐翻 3 倍，总交付时间反而上升。2026 年 8 月的数据。局部最优 ≠ 全局最优。”
agent 把产出端加速了，评审端和集成端被淹死。所以推广话术改成「边界内可信任」，不只讲「产出更多」——每域规约都必须带反例章节。效率指标如果只看产出不看瓶颈，就会掉进这个陷阱：产出越多，积压越多，系统反而更慢。
2.17 数据诚实：缺口写明白
“检索不到就写「数据缺失」，不得把外推当事实陈述。「171% 平均 ROI」被六个以上内容农场转载，却找不出一篇原文。”
规约的引用纪律。这种数字一律回避；市场规模必须说明是 L1/L2/L3 哪个口径。数据缺口写明白，比一个漂亮的编造数字值钱得多。这是规约体系对自身的要求——如果规约本身不诚实，它就没有资格要求别人遵守规约。
2.18 真实 TCO 是 3.4 倍
“单个生产 agent 的真实 TCO，是纯 API 估算的 3.4 倍。62% 的基础设施成本花在可观测与编排上，而非模型调用。”
竞析的结论：模型调用只是冰山一角。Uber 曾因缺 turn limit 与 spend cap，四个月烧光预算。所以骨架第 11 字段规定：任何不写成本预算章节的规约，都是不完整的。成本意识不是省钱，是让投资回报可计算、可预测、可治理。
AI Harness Industry Spec System
The official spec system of Moli Youfang (HarnessAI). An engineering spec system for taking LLMs into production: built on the stance that "models are engines, the Harness is the full vehicle", it spans 5 chapters — overview, whitepaper, industry enablement, market research and releases — and answers one question with 18 core perspectives: how do LLMs go from "usable" to "trustworthy"?
- AI Harness ≠ Prompt / Agent. It is the engineering foundation that carries AI into production: assembling models, tools, context, permissions, memory, evaluation, observability, and human-in-the-loop into a controllable, reproducible, governable runtime. The model is the engine, the Agent is the driver, the Harness is the full vehicle + traffic rules + dashboard + dashcam.
- Harness leverage > model: fixing the harness with the same model boosted Terminal-Bench 2.0 from 52.8% to 66.5% (+13.7pp); different harnesses on SWE-bench Pro with the same Opus 4.5 spread 9.5pp; switching harness yields more than switching one model generation (~+6.8pp).
- Compound error formula: 85% per step × 8 steps = 27% end-to-end success. Improving model accuracy alone cannot save long tasks — only architecture (checkpoint / rollback / tiered authorization) can, which is exactly the Harness's domain.
- Spec system, 5 chapters: Overview (definition / architecture / history / future) + Whitepaper (10 deep documents) + Industry (8 groups × 4–7 directions) + Market (7 tracks × 8–20 platforms) + Releases. This spec system invents no DSL and binds to no vendor framework.
- Cross-industry autonomy grading: L0 Fully Manual / L1 Observe / L2 Advise / L3 Act with Approval (default in this system) / L4 Act Autonomously, unified under Gartner's four levels and mapped to Google SRE L0-L3.
1. What Is an AI Harness
1.1 Definition
An AI Harness is an engineering foundation that assembles models, tools, context, permissions, memory, evaluation, observability, and human-in-the-loop into a controllable, reproducible, governable runtime. It is the "carrier + guardrails + dashboard" for Agents.
1.2 Boundaries with Adjacent Concepts
| Concept | Scope | Is it a Harness? |
|---|---|---|
| Prompt | One input | No |
| Agent | A reasoning entity that can call tools | No (is the Harness's runtime unit) |
| Workflow | A multi-step ordered process | No (can be orchestrated by a Harness) |
| Harness | Cross-session, cross-task, cross-role runtime + governance surface | Yes |
| Evaluation platform | Evaluation set + executor + report | Partially overlapping (evaluation is a Harness subsystem) |
1.3 Why Harness Is the First-Order Performance Variable
- LangChain: same model, only changed harness: Terminal-Bench 2.0 went from 52.8% to 66.5% (Top30→Top5, +13.7pp). (Source: Competitive Analysis §1)
- Same Opus 4.5 on SWE-bench Pro under different harnesses scored 45.9% / 50.2% / 55.4%, a 9.5pp spread from scaffolding alone. (Source: Competitive Analysis §1)
- Meta-Harness 76.4% surpassed all human-crafted harnesses. (Source: Competitive Analysis §1)
- Compared to switching one model generation: ~+6.8pp on SWE-bench Verified. (Source: Competitive Analysis §1)
- Compound error formula: 85% per step × 8 steps = 27% end-to-end success; 95% × 20 steps = 36%. (Source: Data Analysis)
1.4 An Underestimated Reliability Risk Surface
In March–April 2026, Claude Code suffered a six-week quality collapse. The official postmortem attributed it to three harness-layer changes; model weights were unchanged. An independent audit analyzed 6,852 session files to reproduce it. User conclusion: the Harness is an un-versioned invisible dependency — this spec system therefore mandates versioning and changelogs. (Source: User Insights Report)
2. Core Perspectives
Every perspective anchors a spec document — click a card to open its chapter.
2.1 Harness Is the Full Vehicle
“The model is the engine, the agent is the driver, and the harness is the full vehicle — traffic rules, dashboard, and dashcam. A prompt is a single input, an agent is a reasoner — neither qualifies.”
Only when you assemble model, tools, context, permissions, memory, evaluation, observability and human-in-the-loop into a controllable, reproducible, governable runtime does the name earn it. Once the boundary is drawn, later discussion no longer talks past each other. This is the opening definition of the entire spec system, the shared premise for every chapter that follows.
2.2 Buying a Trustworthy Environment
“Users don't buy a smarter model — they buy a runtime they can entrust. Anthropic 2026 data: devs use AI in ~60% of work, but fully delegate only 0–20%.”
The gap isn't model capability — it's the Harness layer: context management, permission control, evaluation systems, rollback mechanisms, audit trails. A product that only touts model smarts misses where users actually pay. This isn't a technical question but a trust question: users need an engineering foundation they can confidently hand work to.
2.3 Invisible Dependency Drift
“Harness drifts like an unversioned invisible dependency. Claude Code's six-week collapse in 2026 Q1 traced to three harness-layer changes — model weights untouched.”
An independent audit analyzed 6,852 session files to reproduce it. It's a dependency never written into package.json: it changed quietly, and the whole stack collapsed. The spec mandates versioning and changelogs — every Harness change must be traceable, rollback-capable and auditable, or it's a ticking bomb.
2.4 13.7 Points from Harness Alone
“Same model, only harness changed: Terminal-Bench 2.0 from 52.8% to 66.5% (+13.7pp). Same Opus 4.5 spreads 9.5pp across harnesses.”
LangChain's measurements. A new model generation brings ~6.8pp, but a harness-only change yields +13.7pp. The first performance variable isn't the model side — that is why this spec system exists. Meta-Harness at 76.4% surpassing all human-crafted harnesses goes further: the Harness itself can be optimized.
2.5 Architecture, Not Accuracy
“Long tasks can't be saved by accuracy — only by architecture. Compound error: 85%/step × 8 steps = 27%; 95% × 20 = 36%.”
Errors accumulate exponentially — polishing single-step accuracy is futile. The real way out is checkpoints, rollback and tiered authorization — trading the fantasy of 'no errors' for an architecture where 'errors can be undone.' This is the Harness's core domain: it doesn't guarantee the model won't err, it guarantees errors can be found, corrected and traced.
2.6 Willing but Not Trusting
“84% are using it, only 3% trust it deeply. SO 2026: top complaint 66% chose 'almost right, but not quite'.”
49,000+ samples, 177 countries. 45.2% say debugging AI code costs more than rewriting. Adoption and trust have decoupled — that gap of 'willing but not trusting' is exactly what the spec fills. Users aren't avoiding AI; they don't dare entrust critical work to it, lacking a verifiable, governable operational guarantee.
2.7 Match Power to Capability
“An agent without governance isn't an assistant — it's an intern with admin access and a deadline. Intern capability, admin permissions, the tightest deadline.”
All three together make an incident a matter of time. Governance isn't limiting capability — it's making permissions match capability. This is industry consensus: from data science to financial compliance, every domain repeats the same lesson — an ungoverned agent will eventually overstep, and the cost of overstepping far exceeds the cost of governance.
2.8 Contracts, Not Templates
“Demand contracts, not templates. A template that falls apart on copy is a document; one reused repeatedly is an interface spec.”
The Ruixi survey on spec expectations reveals a key distinction: a template's value isn't in covering fields, but in whether each field is machine-checkable. The 15-field skeleton matters for 'executability' — specs with invariants, acceptance criteria, permission declarations and baseline evaluation are reusable contracts.
2.9 Gates by Reversibility × Impact
“Insert HITL by reversibility × impact radius, not by step number. SOC analysts face 4,484 alerts/day, 67% ignored outright.”
Approving every step only manufactures rubber stamps. The right move: gate only where irreversible and cross-org, let flat stretches pass. Rippling lists 'excessive HITL' as threat T10 — approval fatigue is as dangerous as approval absence. The key is precisely locating decision points that need human intervention.
2.10 Proportional Authorization
“Either locked until unusable, or broad permissions never earned — Gartner says binary thinking is the root of enterprise governance failure.”
The fix: four-tier proportional model — L1 observe, L2 advise, L3 execute with approval (default here), L4 limited autonomy. How wide the door opens is a dial, not a switch. Different industries, scenarios and risk levels map to different autonomy tiers — the spec's value is a unified grading framework.
2.11 Sensitive Domains Cap at L3
“Finance, legal, audit never get L4 — forever at the human-approval tier. Risk & compliance: P1 commercially, P0 for specs — auditability is regulatory-driven.”
Gartner predicts 40% of agents retire by 2028, mostly in this domain. Not because tech fails, but because regulators don't accept 'machine-autonomous decisions' as the final accountability body. Here, the Harness's core value isn't efficiency but ensuring every decision is signed, traceable and auditable.
2.12 The MCP Context Tax
“Three MCP servers eat 143k of a 200k context window. Tool descriptions of three servers eat 72%, leaving just 57k for the task.”
More context isn't better. Progressive disclosure — instruction skeleton and current task in layer one, details on demand — is what keeps long tasks alive. MCP's open protocol aims to standardize tool access, but without context budgeting, standardization becomes a burden. The Harness must manage not just permissions, but attention.
2.13 AGENTS.md as an Index
“AGENTS.md is a table of contents, not an encyclopedia. OpenAI practice: rather than piling every detail into the entry file, treat it as an index pointing to deeper documents.”
HumanLayer's budget is 150 instructions — the word 'budget' is itself restraint: every added rule spends the model's attention on each rule. Context window is finite; the more concise and focused the instructions, the higher the model's compliance rate. Restraint isn't laziness — it's engineering discipline.
2.14 Criteria over Steps
“Give success criteria, not step-by-step instructions. Karpathy's words into field 2: define done by verifiable artifacts, specific to commands and thresholds.”
The finer the steps, the more the model executes an imagination; the clearer the criteria, the closer it walks to the bullseye. With a fuzzy goal, the agent fails loudly — which is actually good, because silent failure is far more dangerous. The Harness's evaluation subsystem is built around criteria: without verifiable criteria, evaluation is meaningless.
2.15 Drawing the Autonomy Line
“The first principle of every mature spec is not how to make the agent do more, but within what boundaries the agent may act without approval.”
The competitive analysis summary after Replit's dropped DB, AWS's 13-hour outage and the Linear paradox. Spec files are paper; AGENTS.md compliance ~70%. Any 'must never happen' rule must go into deny rules and hooks so it's physically impossible. Paper constraints rely on self-discipline; code constraints rely on physics.
2.16 The Linear Paradox
“PR throughput triples, yet total delivery time goes up. August 2026 data. Local optimum ≠ global optimum.”
The agent accelerated output, while review and integration were drowned. So the pitch becomes 'trustworthy within bounds', not just 'more output' — every domain spec must carry a counterexamples chapter. Efficiency metrics that only measure output without bottlenecks fall into this trap: more output, more backlog, slower system.
2.17 Data Honesty
“If it cannot be retrieved, write 'data missing' — never pass extrapolation off as fact. '171% average ROI' syndicated by 6+ content farms, yet no original can be found.”
Citation discipline of the spec. Such numbers are avoided; market size must state its L1/L2/L3 basis. Written data gaps are worth far more than pretty fabricated numbers. This is the spec system's self-requirement — if the spec itself isn't honest, it has no right to demand compliance from others.
2.18 True TCO Is 3.4×
“A production agent's true TCO is 3.4× the pure-API estimate. 62% of infrastructure cost goes to observability and orchestration, not model calls.”
Competitive analysis conclusion: model calls are the tip of the iceberg. Uber burned its budget in four months without turn limits and spend caps. Field 11 mandates: any spec without a cost-budget chapter is incomplete. Cost awareness isn't about saving money — it's making ROI calculable, predictable and governable.