[ 00 / Autonomous Systems Architecture · Deterministic Governance ]

Deterministic execution harnesses for stochastic AI models

Zero AI Attribution Kernel flock Zero-copy Worktrees Stream Redactor

Foundation models are untrusted, stochastic execution engines. Engineering autonomous software does not reside in prompts, but in the deterministic platform harness that binds them: OS-level kernel concurrency, zero-copy ephemeral sandboxes, in-stream secret redaction, and independent adversarial review gates.

[ 01 / Autonomous Agent Execution Plane ]

Task dispatch, knowledge retrieval via FastMCP, sandboxed worktree execution, and adversarial review.

Every agent operation runs within an isolated Git worktree. Destructive actions trigger a synchronous HITL gate. PRs are audited by an independent model family before reaching human review.

Rendered at build from src/diagrams/harness.architecture.json

[ 02 / The Four Pillars of Deterministic Containment ]

Operating autonomous swarms with deterministic Unix systems engineering.

Isolation

OS Concurrency & Worktree Sandboxing

Zero-copy ephemeral git worktrees sharing the object pool. Kernel POSIX flock semaphores prevent race conditions and branch collisions across concurrent autonomous agents.

› Zero-copy storage isolation
› Kernel-level flock semaphores
› Monotonic deadline timeouts

Security

In-Stream Secret Redaction & JIT Injection

Real-time stream writer scrubbing process stdout/stderr before transcript persistence. Zero plaintext secrets on disk: Age/SOPS decryption piped strictly in-memory.

› In-memory redactWriter stream filter
› Age / SOPS asymmetric encryption
› Immediate HALT on credential leak

Safety

Safety Brakes & Atomic PR Cap

Dynamic AST loop circuit breaker halting recursive tool invocations. Synchronous cryptographic HITL gate for destructive actions and hard ~300 executable LOC cap.

› Dynamic tool loop circuit breaker
› Synchronous HITL approval gate
› ~300 executable LOC PR budget

Verification

Cross-Model Adversarial Audit & Zero Auto-Merge

Independent model family auditing pull request diffs for anti-sycophancy. Strict prohibition of auto-merge: every production change merges under human review.

› Cross-model independent diff review
› Strict zero auto-merge doctrine
› CI regression & mutation suites

[ 03 / Executable Artifacts & Operating Contracts ]

Inspectable rules, kernel mutex scripts, stream redactors, and adversarial review prompts.

Doctrine AGENTS.md

Harness Non-Negotiables & Standing Orders

Core invariants governing all agents: zero AI attribution, atomic commits under ~300 LOC, forbidden auto-merge, and in-flight documentation.

AGENTS.md markdown

## Non-negotiable rules (harness-enforced)

- No AI attribution in git history or GitHub messages (commits, PRs, issues).
- No Co-Authored-By trailers referencing AI agents. All artifacts appear human-authored.
- English only in durable records (commits, PR titles, code comments).
- Auto-merge is strictly forbidden in every repository. Merge is a supervised human action.
- Strict IaC & Idempotence: zero manual operations on remote systems or cloud environments.
- Atomic PRs: ~300 executable LOC hard cap to maintain human reviewability.
- In-flight documentation & zero debt: ADRs and lessons recorded in real time.

Public contract Inspect source / Gist →

Concurrency pkg/semaphore/flock.go

Kernel POSIX File Semaphore (flock)

Mutual exclusion primitive preventing concurrent autonomous agents from colliding on worktrees, branches, or shared lockfiles.

pkg/semaphore/flock.go go

// AcquireWorktreeLock acquires a non-blocking kernel file lock (flock).
// Retries with monotonic deadline. Caller releases via defer file.Close().
// (POSIX primitive for Linux/macOS; Windows uses LockFileEx).
func AcquireWorktreeLock(lockPath string, timeout time.Duration) (*os.File, error) {
    file, err := os.OpenFile(lockPath, os.O_CREATE|os.O_RDWR, 0600)
    if err != nil {
        return nil, fmt.Errorf("failed to open lock file %s: %w", lockPath, err)
    }

    deadline := time.Now().Add(timeout)
    for {
        err = syscall.Flock(int(file.Fd()), syscall.LOCK_EX|syscall.LOCK_NB)
        if err == nil {
            return file, nil // Lock acquired exclusively
        }
        if time.Now().After(deadline) {
            _ = file.Close()
            return nil, fmt.Errorf("semaphore timeout after %v: %w", timeout, err)
        }
        time.Sleep(50 * time.Millisecond)
    }
}

Public contract Inspect source / Gist →

Security pkg/io/redact_writer.go

In-Stream Secret Redaction (redactWriter)

Real-time stream filter intercepting process stdout and stderr, scrubbing cryptographic secrets before they can leak into transcripts or terminals.

pkg/io/redact_writer.go go

// RedactWriter wraps an io.Writer and intercepts outgoing bytes in memory.
// Known secret patterns are substituted before writing to disk or stdout.
type RedactWriter struct {
    out      io.Writer
    patterns []*regexp.Regexp
}

func (w *RedactWriter) Write(p []byte) (int, error) {
    clean := p
    for _, re := range w.patterns {
        clean = re.ReplaceAll(clean, []byte("[REDACTED_SECRET]"))
    }
    if _, err := w.out.Write(clean); err != nil {
        return 0, err
    }
    // Return original length to satisfy standard io.Writer contract
    return len(p), nil
}

Public contract Inspect source / Gist →

Verification skills/adversarial-review/SKILL.md

Cross-Model Anti-Sycophancy Review Gate

Enforces independent model families to audit pull request diffs, systematically rejecting sycophantic self-approvals and unverified completion claims.

skills/adversarial-review/SKILL.md markdown

# Role: Adversarial Reviewer (Independent Model Family)

Operating Invariants:
1. Anti-Sycophancy: You are an independent adversarial auditor. Assume the diff contains
   latent defects, untested regressions, or silent architectural drift.
2. Verification over claims: Never accept "tests pass" without inspecting the test output
   produced during this session. A test checking only happy paths is a critical finding.
3. Strict LOC enforcement: Flag any PR exceeding ~300 executable lines for split.
4. Auto-merge refusal: You have no authority to approve auto-merge. Every disposition
   must be triaged by the human operator under the "## Review triage" header.

Public contract Inspect source / Gist →