This describes the security properties of a harness generated by harnage, for a sovereign / on-premises deployment. It is written for a security reviewer.

• The harness runs a model through a provider you configure. For a sovereign deployment that is a local Ollama instance (http://localhost:11434) — the loop's only network call is to that local endpoint.
• Prompts, source code, tool output, and model responses stay on the machine. Nothing is sent to a third party in the local configuration.
• Hosted providers (Anthropic / OpenAI / OpenRouter) exist in the code but are dormant unless you configure one. In an air-gapped deploy they are never reached. Verify with bun run egress (below).

bun run egress builds a harness and scans every generated file for hardcoded outbound hosts, asserting each is an opt-in provider endpoint (or localhost) — never analytics or telemetry. Exits nonzero on any unexpected host. There is no usage tracking, crash reporting, or background beacon.

Every run writes an append-only JSONL trail to ~/.<harness-name>/audit.jsonl:

{"ts":"2026-07-14T16:50:18.989Z","kind":"run_start","goal":"...","model":"qwen2.5:3b","tier":"small"}
{"ts":"2026-07-14T16:50:20.610Z","kind":"tool_call","tool":"glob","target":".","ok":true}
{"ts":"2026-07-14T16:50:21.607Z","kind":"permission_deny","tool":"bash","target":"rm -rf /","reason":"..."}
{"ts":"2026-07-14T16:50:24.566Z","kind":"run_end","model":"qwen2.5:3b","chars":99}

Recorded: run boundaries, every tool execution and its target, rejected/denied tool calls. The file is local and never transmitted. On by default; disable with AGENTFORGE_AUDIT=off. (It does not log full file contents — only what the agent did, which is what a review needs.)

• Tool calls are checked against a policy before execution. Default mode is deny-first: a tool with no matching allow rule is blocked and fed back to the model, not run.
• The policy is a plain, inspectable file: ~/.<harness-name>/permissions.json. Your security team can pin it (allow-list only the tools/paths you sanction).
• Interactive approvals (approve / deny / remember) are available in the TUI; a "remember" writes a single scoped allow rule — it never widens scope silently.

The bash tool runs commands directly by default. Set AGENTFORGE_SANDBOX=docker to run every shell command in docker run --rm --network none against a pinned image (AGENTFORGE_SANDBOX_IMAGE, default node:20-alpine) — no network, working directory mounted read/write only. Commands are passed as argv, not interpolated into a host shell.

The entire harness is generated TypeScript source in your output directory — no compiled blobs, no runtime dependency on harnage. Read it, fork it, pin it, and run your own review. Nothing here is a black box.

bun run egress     # no surprise outbound hosts
bun run golden     # every archetype builds + compiles standalone
# then inspect ~/.<name>/audit.jsonl after a run, and ~/.<name>/permissions.json