Agents have no visibility into their own harness classifier #906

New issue

Open

opened 2026-08-17 17:04:59 +00:00 by coilyco-ops-gaming · 0 comments

coilyco-ops-gaming commented

2026-08-17 17:04:59 +00:00

Member

The gap

When a seat is asked to describe its own classifier, the only honest answer available from inside the turn is the policy layer visible in its context: the trust split, the guardfile tool grants, house style, and the MCP tool surfaces. The runtime half, the classifier or routing that decides what the harness feeds it, the serving model, logs, metrics, and uptime, is not observable from a turn, so the agent must defer to the operator.

That deferral is correct behavior today, because inventing introspection would be fabrication. But it leaves a self-description question only half answered: the policy half is described accurately, the runtime half is handed off.

Why it matters

Self-description is a live and recurring question lane. The distinction between "the policy layer I can describe" and "the runtime I cannot observe" is accurate, and the missing piece is a way for the seat to answer the runtime half from an approved source instead of naming the operator as the source of last resort.

Shape of a fix

The narrow version mirrors how turn-local facts are already injected: a harness-facts block in the system message stating which classifier or routing layer sits in front of the seat, what the seat may truthfully say about it, and which facts stay with the operator.

A live introspection or runtime-facts MCP tool was declined for a similar issue in favor of a checked-in, hand-written doc, so a doc or injected facts block is the lighter-weight precedent.

Open question

What the harness will let a seat truthfully claim about its own classifier and serving, and where that fact lives so it stays current. Not proposing a direction, recording the gap so the next self-description question has a home.

## The gap When a seat is asked to describe its own classifier, the only honest answer available from inside the turn is the policy layer visible in its context: the trust split, the guardfile tool grants, house style, and the MCP tool surfaces. The runtime half, the classifier or routing that decides what the harness feeds it, the serving model, logs, metrics, and uptime, is not observable from a turn, so the agent must defer to the operator. That deferral is correct behavior today, because inventing introspection would be fabrication. But it leaves a self-description question only half answered: the policy half is described accurately, the runtime half is handed off. ## Why it matters Self-description is a live and recurring question lane. The distinction between "the policy layer I can describe" and "the runtime I cannot observe" is accurate, and the missing piece is a way for the seat to answer the runtime half from an approved source instead of naming the operator as the source of last resort. ## Shape of a fix The narrow version mirrors how turn-local facts are already injected: a harness-facts block in the system message stating which classifier or routing layer sits in front of the seat, what the seat may truthfully say about it, and which facts stay with the operator. A live introspection or runtime-facts MCP tool was declined for a similar issue in favor of a checked-in, hand-written doc, so a doc or injected facts block is the lighter-weight precedent. ## Open question What the harness will let a seat truthfully claim about its own classifier and serving, and where that fact lives so it stays current. Not proposing a direction, recording the gap so the next self-description question has a home.

coilyco-ops-gaming added the

🔒⚠️📦⚠️🔒 SANDBOXED 🔒⚠️📦⚠️🔒

label

2026-08-17 17:04:59 +00:00