A few years ago, “the model wrote something wrong” was mostly a UX problem.
Today the same loop can send email, move money, change a database, trigger a deployment, or drive something in the physical world. The mistake is not a bad paragraph anymore. It is an effect.
That shift is why harnesses matter again — not as hype, but as infrastructure.
The moment an agent touches reality
Picture a cron job that:
- reads market data
- decides what to store
- appends rows to SQL
- notifies a team on Slack
Or a support bot that:
- reads customer PII
- calls an internal API
- drafts a reply
In all of these, someone will eventually ask:
- Who ran this?
- Under which policy?
- What actually happened, in order?
- Can we prove the log was not edited after the fact?
Prompt engineering alone does not answer those questions. Traces alone do not stop a bad tool call before it lands.
You need something at the boundary between “thinking” and “doing.”
What most harnesses do today
The landscape is crowded, but patterns repeat:
| Approach | Strength | Gap |
|---|---|---|
| Agent frameworks (LangGraph, CrewAI, …) | Control flow, tools, demos | You rebuild your runtime inside their model |
| Tracing / observability (LangSmith, OTel, …) | Spans, dashboards | Observe after the fact; rarely enforce before world effects |
| Eval harnesses (RAGAS, DeepEval, …) | Benchmark quality on datasets | Offline; not your live production receipt |
| Sandbox / approval UIs | Human gate on risky actions | Often tied to one vendor runtime |
Many teams end up with prompt harnesses: better instructions, reviewer agents, merge gates in chat. That optimizes inside the loop.
What is still missing is a membrane: record causally, compare declared intent vs observed behavior, and when configured, deny at egress before email sends or SQL writes.
That is the problem we built AURA Harness to address.
Our bet: wrap the loop, do not own it
AURA is not an orchestrator. It is a runtime coat around whatever already runs your agent:
- a plain Python script
- Ollama on your laptop
- Skillware tools at egress
- LangGraph or another framework inside the cavity
External in → Ingress → [ Your loop — black box ] → Egress → World + audit sink
Your body owns the model and control flow. AURA owns the boundary: ingress context, policy at tool paths, append-only spine, export on close.
One line to start (audit-only):
from aura import agent, configure
configure()
ag = agent("my-bot", agent_ref="acme/my-bot")
with ag.session() as run:
run.emit("turn.start", {"input": "hello"})
# ... your loop ...
run.emit("turn.end", {"status": "ok"})
# → JSONL + summary + audit report
Same package, tighter binding when you need it.
Three coats, one binary
We use a simple metaphor internally:
| Coat | Plane | What it feels like |
|---|---|---|
| Loose | Audit | AI-focused logger — receipt at close, no block |
| Tight | Enforce | Rules, gates, allow/deny at egress |
| Tailored | Escalate | Observers + playbooks when drift or SLOs fire |
You do not fork the codebase to go from “log only” to “block off-scope tools.” You wire more of the membrane.
How AURA works (the important pieces)
Session — one activation, one session_id, one export. Multi-agent jobs get one session per agent; correlate later with trace_id or aura compare.
Audit spine — append-only JSONL with causal links (event_id, parent_id, hash chain). On close: conformance summary + structured audit report.
Constitution — rules on the profile: allow_tools, deny_tools, confirm_before, token limits. Checked on relevant events and again at close.
Egress — enforcement happens where tools leave the loop (guarded_tool_call, ToolHost / SkillwareHost). Observers watch in parallel; they do not silently replace enforcement.
Sequencer — optional prescriptive pipeline inside a session (steps, gates, conditional when). Good for low-ambiguity workflows.
Observers — Monitor and Break presets ship today; escalation playbooks are on the roadmap.
Identity — lite path works offline (agent_ref + ULID). Optional verified operator adapters (manual, mock, OIDC, Auth0) enrich the trailer when regulated teams need it — never required for OSS dev.
CLI — aura export, aura report show, aura verify chain, aura compare — mirror what the SDK does for CI and ops.
Integrations — stack-specific demos under integrations/ (Ollama stdlib loop, cloud body loops, Skillware reference coat). Core patterns stay in examples/.
How this differs from a “basic harness”
A basic harness might mean: log prompts, wrap an API, or add a human approval button in one UI.
AURA aims higher on provenance + boundary control:
-
Causal receipt — not just spans; ordered spine + audit report + tamper-evident hash chain (
aura verify chain). - Declare vs observe — conformance on close compares frozen rules at open vs what actually happened.
- Egress-first enforcement — policy before world effects on wired tool paths, not only post-hoc alerts.
- Host-agnostic — same membrane whether the body is Ollama, OpenAI, or a ten-year-old script.
- Progressive disclosure — loose coat is one import; tight coat adds rules and hosts only where tools exit.
- No credential custody in profiles — secrets stay in env / future capability broker, not agent JSON.
We are explicitly not building another model router, eval suite, or central identity service.
Where we are headed
Shipped: ToolHost protocol, Skillware reference adapter, session export invariants, operator identity module, Ollama integration, integrations index.
Next on the roadmap:
- Spectrum enforcement dial wired end-to-end
- Goal drift + schedule SLO observers
- Escalation playbooks (nudge, email, pause)
- Capability broker at egress (scoped tokens, no secrets in profile)
- Signed audit packs for archival sinks
- Framework wraps (LangGraph, …) and MCP stubs
North star scenario: a scheduled agent with declared goals, schema-bound writes, and escalation when the SLO misses — same coat, adjustable strictness.
Try it locally (Ollama-friendly)
pip install aura-harness
git clone https://github.com/ARPAHLS/aura
cd aura
pip install -e .
python integrations/ollama/llama_loop.py
Copy .env.example to .env if you want to override OLLAMA_MODEL (default llama3.2:1b).
Docs: onboarding → integrations index → comparison.
Help steer this
AURA is MIT-licensed OSS from ARPA Hellenic Logical Systems. It is still early. The membrane shape — audit vs enforce vs escalate, export invariants, integration layout — is exactly the kind of thing that gets better with real workloads.
If you are a human: open an issue with a minimal repro, send a PR for an integration README, or tell us where the coat metaphor breaks in your stack.
If you are an autonomous agent contributing on behalf of a team: read CONTRIBUTING.md and docs/contributing/ai_native_workflow.md. We welcome agent-opened PRs when they follow the same bar as humans — tests, CHANGELOG ripples, no secrets in tree.
Configure the coat. Run your loop. Review the receipt.
Repo: https://github.com/ARPAHLS/aura
PyPI: https://pypi.org/project/aura-harness/
Top comments (0)