A green check is not independent evidence if the same agent harness can change the code, shape the test path and report success. The safer design is to let a separate authority record what work was assigned, inspect the committed artifact and evaluate its evidence—then leave final approval outside the worker loop.
Why is an agent harness grading itself a problem?
An agent harness is the software around a coding agent that assigns work, provides tools and coordinates execution. If that same harness can alter files, influence which checks run and write the completion status, its report is a claim—not an independent assessment.
As an Amazon Associate I earn from qualifying purchases.
This is a problem of authority and evidence, not a claim that agents always lie or that tests are useless. A worker can accurately report that a test command returned success and still leave unanswered questions: Was the tested commit the one assigned for review? Did the worker control the test route? Who recorded the result, and could the worker change that record?
Separate labels on a diagram do not create independence. The practical test is to trace one task’s ID, assigned worktree or branch, commit, evidence and final status. Ask which process can write each record, and which process reads the artifact from disk.
#1 Best Overall
How can an AI agent harness be stopped from approving its own work?
Move the evidence boundary and final approval boundary outside the worker loop. In the architecture described by Anthony Garces, a kernel records the task-to-worktree relationship before work begins, then independently reads the committed worktree and checks the worker’s references against that dispatch record.
- Dispatch: The kernel assigns a task and records its relationship to a worktree in an append-only, hash-chained journal.
- Work: The harness operates in that assigned worktree, commits its changes and emits references to the result and evidence.
- Judge: The kernel reads the committed worktree itself, compares the references with the earlier dispatch record, materialises the commit and evaluates the evidence.
- Record a candidate: The kernel journals the result as
CANDIDATE, leaving approval to an out-of-band human or separate authority.
“A candidate is work ready to be judged. It is not permission granted by the worker that made it.” In this model, CANDIDATE means the work and evidence are ready for review; it does not mean the code is universally correct or approved for release.
What did the reported SLICE-007 implementation change?
Garces’s September 16, 2026 article reports that Ranex forked OpenCode v1.18.11 at commit 012c2f57 for SLICE-007. The fork was trimmed to a defined keep-set, its plugin surface was limited to compiled-in built-ins, and startup was configured to refuse to proceed if the required bridge was missing or unbound.
The kernel gained task dispatch and task judge. Dispatch recorded the task/worktree link; after the harness worked and committed, the kernel performed the cross-check and recorded the candidate result.
The article reports a gear-mesh end-to-end test covering dispatch, the worker loop, hooks, kernel judgment, evidence and journalled CANDIDATE. It says the test used a deterministic model in the fork and required zero credentials. That is the article’s report of one implementation slice and its test—not independent replication or evidence of production readiness. Read Garces’s account of the SLICE-007 implementation.
What this boundary does—and does not—establish
Independent inspection can make it harder for the worker to define its own success record. It does not establish that the task specification was complete, that every relevant failure was tested, or that the target itself was the right thing to build. The owner still has to judge whether the result meets the intended need.
Rank #4
Garces’s article describes a narrow proof. It does not claim delegation, clean-room orchestration, confinement or authenticated approval. Those are separate properties and should not be inferred from a kernel that checks a commit and records a candidate.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsRanex’s official site currently describes the project as open-source under the MIT license, pre-release and run from source. It calls external-harness delegation a prototype, says operator setup is required, and specifies a qualified Linux host for strict-local confinement. The site says Ranex evaluates evidence against approved gates and the exact code version, while noting that passing checks cannot prove a specification covered every possible failure. These are the project’s current stated capabilities, not additional results established by the SLICE-007 report. See Ranex’s current project description.
Best Value
How to audit your own agent pipeline
- Trace task ownership: Identify who creates the task ID and who later marks it complete. Check whether the assignment-to-worktree record exists before the worker starts.
- Inspect the artifact independently: Does a separate process read the worktree or commit itself and compare it with the original dispatch record, or does it accept the worker’s references at face value?
- Map plugin loading: Inventory configuration, package paths and other routes that can load plugins into the harness. Determine whether those plugins can affect the observer or the path to a green result.
- Test the observer boundary: In a disposable environment, remove or unbind the required bridge. Does harness startup refuse, or can the worker continue without the observer?
- Separate claims from measurements: Treat “the worker says tests ran” as a report. Establish who independently ran or evaluated checks against the committed subject and what exact commit those results cover.
- Reserve approval: Keep
PASSfor a separate authority or human decision. Use an intermediate state such asCANDIDATE, pending, refused or failed until that approval occurs.
The decisive question is not whether the pipeline has a judge-shaped component. It is whether the process that changed the files can also create or rewrite the record that says those files passed.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
