Repository navigation
Add provider/harness/model configuration schema and binding validator #658
Description
Part of #653 (provider-agnostic harness umbrella). Design source: Proposed Configuration Boundary and Proposed Capability Contract, proposal A. The Markdown source is published by #665.
Scope
Introduce [providers.*], [harnesses.*], and independent harness / provider / model fields on model profiles. Implement ProviderBinding, HarnessCapabilities, and QualifiedHarnessBinding, plus a binding validator that runs before workflow launch.
The capability contract carries:
tools:fs/shellevents:"jsonl" | "rpc" | "final-text-only"sessions:"none" | "resume" | "tree"usage: tokens / cache / costisolation:native|external
Nodes declare what they require (node.requires = { events: "jsonl" }) and the validator matches requirement against capability before launch.
Map every legacy agent = "…" profile forward. No default changes and no new harness in this issue — it is deliberately reviewable in isolation (Phase 0 of the sequencing).
Credential and state rules the schema must encode
- Child environment built from an empty or tightly allowlisted base, never inherited wholesale.
- Exactly one provider credential present, matching the endpoint the harness will actually call.
- Credentials never appear in
argv. - Every harness gets a run-scoped state root (
CODEX_HOME,DSH_HOME, …) outside the operator's real home. - The state root must not live inside a region the harness's own sandbox leaves writable.
Acceptance criteria
- A profile can name a harness and a provider independently;
modelstays an opaque provider catalogue ID with no static allowlist. - Unsupported wire protocol, unsupported reasoning level, missing executable/version, missing credential, missing required cloud portability, or an event class below the node's requirement fails before launch with an actionable diagnostic naming the offending profile field.
- Every existing profile — including
CodexAgent,ClaudeAgent,DeepSeekAgent, andKimiAgent— resolves to the same runtime behavior as today, proven by tests. - Resolved config, snapshots, and artifacts contain no credential values.
-
ultrafuzz validateandultrafuzz doctorreport the resolved binding.
Dependencies
None. This is the root of the tree; every other child issue depends on it.
Credentials
Not blocked. No real provider request is required for this issue.
Activity
docs: separate provider, harness, and model for #653
docs: separate provider, harness, and model for #653
docs: apply harness research review and guard both pages
docs: number the gates and align the contract spelling for #653
docs: resolve the #663 ownership pointer and contract gaps for #653
docs: fix the reasoning-surface count and make cloudPortable expressi…
docs: apply the page's own ownership rule to #661 and #662 for #653
docs: correct the developer-preview source and spell the node require…
docs: source the developer preview from the README and define the eve…
docs: carve out persisted-credential auth and de-collide config_dir for
docs: land the retired section-number map and fix contract accuracy for
docs: fix the child-issue scope and retired-map prose for #653
aviggiano commentedon Aug 20, 2026
Closing as superseded by the tight-adapter ruling.
Every axis this issue proposes to introduce — independent
harness,providerand opaquemodelfields, plus a capability contract — already exists in Smithers. The harness is the agent class, the provider isbaseURL+apiKey, the model is an opaque provider-catalogue ID, andsmithers agents capabilitiesalready publishes each of the 14 built-in harnesses' binary, emitted flags, option mappings and resume kind, withsmithers agents doctorandsmithers agents testvalidating reachability.Ultrafuzz config is also already open where it matters: the model profile's
agentfield is an open agent-ref schema and[agents.*]is a generic record, so adding a harness needs no schema work at all.PR #682 implemented this issue and is closed alongside it. Its own acceptance criterion — that every existing profile resolves to the same runtime behaviour as today — conceded that it changes nothing at execution.
The one durable requirement worth keeping from here (credentials never in argv, run-scoped state roots, no wholesale environment inheritance) is an adapter obligation enforced per-adapter by tests, not a schema. It is carried into the rescoped #653 and its children.
Release/v0.1.0 (#744)