agentcore-harness-builder v0.2.0

agentcore-harness-builder v0.2.0

Broadens the skill from a Harness builder to a full AgentCore builder, with every new code path
verified live on AWS (boto3 1.43.29) — not transcribed from docs.

What's new

• Runtime build path (references/runtime.md) — BedrockAgentCoreApp, @app.entrypoint,
  /invocations + /ping (incl. the undocumented time_of_last_update field), AG-UI / A2A, the three
  deploy paths, and the corrected codeConfiguration source-deploy guidance (deps must be vendored as
  arm64 wheels, or use agentcore deploy — the platform does not pip install for you).
• Gateway build side (references/gateway.md) — create a Gateway and turn Lambda / OpenAPI / Smithy /
  MCP-server / API-Gateway / Runtime backends into MCP tools: CreateGateway / Target / Rule, inbound
  authorizerType, outbound credential providers, then wire into a harness.
• Code Interpreter deep dive (references/code-interpreter.md) — session lifecycle, all nine tools
  with verified arguments shapes, cross-tool file+command workflows, custom interpreters
  (PUBLIC/SANDBOX/VPC + certificates), and the arguments-is-a-dict gotcha.
• Executable boto3 examples added to references/identity.md (Workload Identity, API-key + OAuth2
  providers), references/policy.md (Policy engine + Cedar), references/registry.md (registry + records).
  references/payments.md is documentation-only with an explicit never-e2e caution.
• Console Playground (references/playground.md) — what it is, how to reach it, and the repeatable
  programmatic equivalent.

Verified live (e2e on real AWS, committed under tests/e2e-results/)

• Batch-1 13/14, Gateway 6/6, Identity/Policy/Registry 4/4, Code Interpreter 7/7 —
  30/31 total. The single non-pass is a documented platform finding (source-deploy + a misleading
  init-timeout error, see upstream aws/bedrock-agentcore-sdk-python#519).
• ~10 verified findings folded into the docs, including: agentRuntimeName / policy names reject hyphens;
  CreateApiKeyCredentialProvider needs secretsmanager:CreateSecret; CreateRegistry returns only
  registryArn; invoke_code_interpreter arguments is a dict; Cedar rejects wildcard resources;
  routeToTarget rules require HTTP-protocol targets.

Quality gates (on merged main)

reference-code validator (every boto3 call resolves on live SDK) ✅ · test_offline.py 41/0 ✅ ·
py_compile clean ✅ · sanitization clean ✅

Install

Download agentcore-harness-builder.skill below and place it in your skills directory (Kiro / Claude Code).

Full changelog: v0.1.0...v0.2.0

v0.1.0 — agentcore-harness-builder

agentcore-harness-builder v0.1.0 — initial release

A battle-tested Kiro skill that builds production-ready AWS Bedrock AgentCore Harness agents end to end.

Lives in this repo at skills/skills/agentcore-harness-builder/.

What's in v0.1.0

• Phased workflow — preflight → design → author config → create → wire memory → observability → invoke → assess.
• 14 reference files — harness-config, model-and-prompt, tools, skills, memory, advanced-config, observability, evaluations, optimizations, identity, policy, payments, registry, browser-auth (human-in-the-loop SSO via Live View), plus gotchas (consolidated hard-learned facts) and decision-guide (Harness vs Runtime vs Bedrock Agents).
• 8 helper scripts (all --dry-run capable) — preflight.py (version check + live shape introspection), validate_config.py, create_harness.py, update_harness.py (introspection-driven optionalValue per-field wrapping), wire_memory.py (3-step incl. IAM grant + namespace→glob conversion), setup_observability.py, invoke_harness.py, test_offline.py (41-test self-check).
• Assets — verified harness.json.template, iam_execution_role.json, skill.md.template, requirements.txt.
• Evals — evals/evals.json with realistic prompts the skill should trigger on.

Battle-tested

Used to build a real Amazon Quick POC web-UI test agent and run it end-to-end against a real Amazon Quick Suite (workshop) console:

• Result: PARTIAL — 12 PASS / 1 FAIL / 8 PARTIAL across 21 steps.
• 11 cookbook corrections captured (real UI labels/URLs/dialogs/permission options that diverged from the test plan).
• 21 screenshots, schema-valid JSON report.
• Surfaced a managed-harness Browser limitation: Live View "Take control" → Release tears down the automation context. Mitigation (interact in Live View without clicking Take control + agent must reconnect after the human's login) is documented in references/browser-auth.md. Filed upstream as aws/bedrock-agentcore-sdk-python#518.

Quality gates (all green)

• quick_validate → "Skill is valid!"
• scripts/test_offline.py → 41 passed / 0 failed
• python3 -m py_compile scripts/*.py → clean
• All field shapes verified against live boto3 1.43.29 service_model introspection (the SDK's bundled control-plane model is the source of truth where the public docs lag in this preview API).

Install

# Option A — install the source folder into your local skills dir
git clone https://github.com/timwukp/agent-skills-best-practice.git
cp -r agent-skills-best-practice/skills/skills/agentcore-harness-builder \
      ~/.kiro/skills/

# Option B — download the .skill bundle from this release and unpack
#   (the .skill is a zip; unpack into ~/.kiro/skills/)
unzip agentcore-harness-builder.skill -d ~/.kiro/skills/

Coverage scope (be honest)

This v0.1.0 is A+ for Harness as the chassis. v0.2.0 will broaden coverage to fully earn an agentcore-builder reading. See PR #14 for the audit + roadmap.

Planned in v0.2.0

• Track A — Runtime build path: BedrockAgentCoreApp, @app.entrypoint, /ping contract (incl. the time_of_last_update caveat), serve_ag_ui/serve_a2a, agentcore deploy.
• Track B — Gateway creation: CreateGateway / CreateGatewayTarget / CreateGatewayRule, inbound + outbound auth, plus a create_gateway.py script.
• Track C — Console Harness Playground reference.
• Track D — Executable boto3 examples added to identity.md / policy.md / payments.md / registry.md.
• Track E — Deeper Code Interpreter coverage.
• Re-run quality gates; refresh .skill asset.

Acknowledgments

• Battle-test target: Amazon Quick Suite workshop environment.
• Companion artifact: the validated Quick POC support agent built using this skill — timwukp/amazon-quick-poc-support-agent.
• Authoritative sources: AWS Bedrock AgentCore Developer Guide + live boto3 1.43.29 service_model (the source of truth when public docs and reality diverge).