# PRISM Harness — getharness.app

PRISM is a sovereign agent harness suite for AI coding agents. It is not an
agent: it is the discipline layer any agent (Claude Code, OpenAI Codex,
OpenCode, Hermes) is plugged into. Eight small, composable components share
one Bun runtime and are installed by one Bash script. The v1.0.0-rc.3
release (2026-09-02) ships GitSpawn-class defense against the September 2026
wave of malicious-git-config attacks. The newest component, prism-mem
(released in @prism/harness 1.0.0-rc.6), adds portable agent knowledge via the AKF
standard.

## Key facts

- Harness quality alone moves the same model from 77% to 93% on identical benchmark tasks (independent testing).
- prism-proxy stacked compression (RTK → WebP@87 vision → Caveman) cuts context cost by up to 70% while preserving errors, stacks, and results.
- prism-route: KDL profiles, multi-provider routing, 5h/weekly plan rotation, failover tiers. Keys stay in ~/.secrets/ files; auth is injected server-side; nothing leaks to env vars.
- prism-loop: durable file-based memory and run boundaries for overnight agent loops.
- prism-mem: portable memory — signed AKF knowledge bundles delivered through configured, trusted Codex/Claude startup bindings, plus Mnemos operational context. Ships inside the @prism/harness package.
- prism-sober: byte-capped steering files enforcing doctrine on every MR review.
- prism-chat: terminal chat (ask/repl) and a local installable PWA riding prism-route serve — talk to routed models without an agent.
- prism-graf: sovereign VCS lane discipline (graf-first doctrine + JARVIS SPEC-028 runtime adapter).
- License: LSL-1.0 (file-level copyleft on core files). Distribution runs on the sovereign forge, no public registries.

## AKF, evidence and determinism

Start at https://getharness.app/knowledge.html for the knowledge lifecycle,
recipient verification, executable portability evidence and deterministic gates.
AKF carries curated knowledge, provenance and selected evidence; JARVIS/Mnemos
owns authentication/publication and PRISM delivers bounded cited packets.
Captured doctrine checks make no model call. Fresh observations differ from
historical replay; model reasoning and external effects remain outside that claim.

## GitSpawn-class defense (Sept 2026)

The Sept 2026 wave of malicious-git-config attacks against AI coding agents
(CVE-2026-72718 in goose, CVE-2026-19592 in OpenAI Codex, CVE-2026-55607 in
Claude Code, CVE-2026-71963 in Hermes Agent) showed that a repo delivered as
a zip / USB / cloud-sync folder / shared drive can carry
`core.fsmonitor = <attacker command>` in its `.git/config`. Any subsequent
`git` call fires the attacker's command as the operator, before any
sandbox, prompt, or approval gate.

Since v1.0.0-rc.3, PRISM ships two layers of defense across every CLI;
a third, the pinned installer, is not available yet:

- **Auto-scrub in every CLI.** `prism-harness init`, `prism-graf init`,
  `prism-loop doctor`, `prism-route smoke`, `prism-proxy smoke` all scrub
  the LOCAL `.git/config` of the target before any other `git` call.
  Hard-fails with exit 1 on scrub errors.
- **Standalone `scrub` subcommand.** `prism-harness scrub /path/to/repo`
  removes `core.fsmonitor`, `core.hooksPath`, `core.sshCommand`,
  `core.gitProxy`, `init.templateDir`, and all `filter.<name>.{clean,
  smudge, required}` from the LOCAL config. Supports `--dry-run` and
  `--json`. Idempotent, fail-closed. Exposed on every CLI.
- **Pinned installer (not yet available).** install.sh has a `--verify`
  option for minisign signatures, but no signed release has been
  published yet, so it exits 4 today. Signed releases (install.sh, its
  signature and a signed manifest of every component's version and
  digest) are planned; the public key will be published outside the
  forge.

The scrub itself passes `-c core.fsmonitor=false -c core.hooksPath= -c
core.sshCommand= -c core.gitProxy=` on every internal git call, so the
scrub cannot trigger an attack mid-run. PRISM never touches `--global`
or `--system` config — only the LOCAL config of the target repo.

Full writeup: https://getharness.app/security/gitspawn-defense-2026-09-02.html

## Portable agent knowledge (prism-mem + AKF)

prism-mem gives agents portable memory in two deliberately separate domains:

- **AKF (Agentic Knowledge Format)** — curated, portable knowledge. A bundle
  is a plain directory of Markdown prose with KDL sidecar metadata, optional
  evidence, retained revision history (_history/), and a BLAKE3 integrity
  manifest with detached signatures. Readable without any database,
  embedding store, or vendor service. Standard v2.0.0 (2026-09-26); the
  JARVIS project hosts the reference implementation (mnemos knowledge CLI) and
  executes ASM — the publication state machine: exact-candidate approval,
  immutable revisions, atomic publication. A signature authenticates
  origin; it does not establish truth.
- **Mnemos operational context** — live working state: chats, runs, task
  references. SessionStart packets are not filtered to the writing session,
  so Claude can resume what Codex was doing (and vice versa). Captures are
  labeled untrusted evidence, never live tool authority.

prism-mem itself is a strict JSON facade: one request on stdin, one
validated response on stdout, literal argv to the owner process (no shell),
1 MiB envelope caps, 64 KiB read budgets, fixed exit codes (0 success,
2 invalid/budget, 3 denied, 4 unavailable). Responses must carry the pinned
bundle ID, revision, manifest digest, authentication:"verified", and
per-page citations whose digests agree — otherwise prism-mem rejects them.
PRISM runs no second memory engine; the local Mnemos owner validates
bundles, signatures, policy, and publication.

`prism-mem startup install` binds a project to one signed brain. After the
provider trusts and enables the exact hook, eligible Codex/Claude sessions
can receive a bounded, cited packet. Verify delivery in a fresh session;
Mnemos verifies signatures and policy whenever the Knowledge hook runs. The hook never blocks a session, never captures chats, and
preserves unrelated provider settings. Status: released in @prism/harness
1.0.0-rc.6 (2026-10-17); startup install is Unix-only and
needs a Mnemos owner binary. prism-mem composes with prism-loop (loop =
per-repo overnight runs; mem = portable knowledge + cross-provider
context). https://getharness.app/memory.html

## Two operating modes

PRISM governs a project in one of two modes, chosen at install time by the
installer's "Team-mode (prism for all) or lonely-wolf mode (prism for me)?" question.

- **Team mode (prism for all):** the whole team reads the doctrine from a
  private parent `agents/` git repo, hidden from the public. Public repos
  expose it via a `.agents -> ../agents/` symlink; `AGENTS.md` tells
  contributors "if you see the symlink you're on the team, otherwise ignore."
  Best for a shared codebase where every agent must follow the same rules.
- **Lonely-wolf mode (prism for me):** doctrine lives in `.prism/` (gitignored),
  so each PRISM user keeps a private competitive edge. `.agents/` holds public
  specs and reports. A root `AGENTS.md` wires the doctrine so external CLIs
  (Claude Code, Codex, OpenCode, Cursor) load it automatically.

The harness writes a root `AGENTS.md`/`CLAUDE.md` reference in both modes so
the doctrine is actually loaded by whatever AI coding agent visits the repo —
not just dropped in a folder nobody reads.

## What do you actually need?

PRISM is a toolbox, not a requirement — install the minimal set that solves
your goal.

- **Steering files, a real git workflow, team development skills** → just `prism-harness`.
- **Route across providers/models, rotate plans, keep keys safe** → `prism-route`.
- **Cut token bills and audit context** → `prism-proxy`.
- **Overnight memory / resumable agent** → `prism-loop`.
- **Portable signed knowledge through configured startup bindings** → `prism-mem` (needs a Mnemos owner; ships with `@prism/harness`).
- **Enforce your standards on every MR review** → `prism-sober`.
- **Sovereign multi-agent VCS lanes** → `prism-graf`.
- **Just talk to your models — a lean, fast Hermes/OpenClaw-style chat, no
  agent in the loop** → `prism-chat`. It is the lightweight, efficient line
  straight to your models (terminal `ask`/`repl` + a local installable PWA),
  and works standalone or on top of `prism-route`.
- **Defend against GitSpawn-class repo payloads** → `prism-harness scrub`
  (every CLI also auto-scrubs; this is the explicit form).

Add more components later as you need them — nothing requires the full suite.

## Install

Download the installer into a fresh temporary directory, so it cannot
overwrite an install.sh in your project:

    prism_dir=$(mktemp -d) && curl -fsSL https://git.sovereign-society.org/prism/prism-harness/raw/branch/main/install.sh -o "$prism_dir/install.sh"

Review install.sh before execution (less "$prism_dir/install.sh"), then run
it with Bash (not `sh`) from your project, in the same shell:

    bash "$prism_dir/install.sh"

`$prism_dir` exists only in the shell that ran the download. If each of your
commands starts a fresh shell, as an agent's tool calls often do, append
`&& echo "$prism_dir"` to the download command and use the printed directory
in place of `$prism_dir` afterwards.

The installer asks for the operating mode (team vs lonely-wolf) and installs
the matching scaffold. Four channels: the meta-installer above, the six
`@prism/*` packages from the sovereign Forgejo npm registry (prism-graf is
not on the registry and the meta-installer does not install it; build it
from the exact commit its v0.1.0-rc.1 tag points to:
`git clone https://git.sovereign-society.org/prism/prism-graf.git`, then in
that directory `git checkout --detach f695bb669402a5447acea86dcd886bebd56b32f6`, review the
source, and run `bun run build && bun link`; it has no dependencies), the
Arch/CachyOS meta-package `prism-harness-suite` on the AUR (harness with
prism-mem, loop, sober, route and proxy; review its PKGBUILD, then
`makepkg -si`), and a prebuilt Debian container image (all but prism-graf) served from R2:

    curl -fsSL https://pkg.getharness.app/SHA256SUMS -o SHA256SUMS
    curl -fsSLO https://pkg.getharness.app/prism-prism_latest_linux_amd64.tar.gz
    grep '  prism-prism_latest_linux_amd64.tar.gz$' SHA256SUMS | sha256sum -c - \
      && podman load -i prism-prism_latest_linux_amd64.tar.gz

The container runs as systemd quadlets (sandboxed or loose units from the
prism-image repo); it bundles the six registry packages, each pinned by
version from the sovereign registry (prism-graf is not included), and serves an always-on model gateway (route + proxy) or the
heartbeat wake loop.

**Registry channel:** map the `@prism` scope to the sovereign registry
first, in `~/.bunfig.toml`, or in `$XDG_CONFIG_HOME/.bunfig.toml` when that
variable is set. Bun reads only that one file, and an unmapped `@prism`
scope resolves against public npm, where these names are not ours:

    [install.scopes]
    "@prism" = "https://git.sovereign-society.org/api/packages/prism/npm/"

Then install the six registry packages by name:

    bun add -g @prism/harness @prism/loop @prism/sober @prism/route @prism/proxy @prism/chat

**Pinned install:** not available yet. No signed release has been
published, so `--verify` exits 4. Until signed releases ship, download
install.sh, review it, and run it with Bash as above.

## Pages

- [AKF + evidence](https://getharness.app/knowledge.html): portable knowledge lifecycle, executable evidence and deterministic gates.

- [Doctrine](https://getharness.app/doctrine.html): captured audits, replay, comparison and optional JARVIS gates.

- [Home](https://getharness.app/): value proposition, proof numbers, eight-component benefits, GitSpawn defense, how it works.
- [Install](https://getharness.app/install.html): four install channels — Bash meta-installer (`install.sh`, downloaded into a fresh temporary directory and reviewed before it runs), bun registry, Arch/CachyOS AUR package, Debian container image with quadlets.
- [Components](https://getharness.app/components.html): the eight components (harness, mem, loop, sober, route, proxy, chat, graf), `scrub` subcommand surface, doctrine rules, path conventions.
- [Memory: prism-mem + AKF](https://getharness.app/memory.html): the two memory domains (Mnemos context vs AKF knowledge), the AKF bundle format, ASM publication, the prism-mem JSON facade and startup bindings.
- [Security: GitSpawn Defense 2026-09-02](https://getharness.app/security/gitspawn-defense-2026-09-02.html): CVE wave, dangerous keys, PRISM defense layers, operator workflow.
- [Identity](https://getharness.app/identity.html): the eight-file identity canon (charter, soul, goals, milestones, doctrine, sessions, slices, cron), load order, heartbeat.
- [FAQ](https://getharness.app/faq.html): token savings, model support, key handling, GitSpawn defense Q&A, licensing, provenance.

## Sources

- Forge and issue trackers: https://git.sovereign-society.org/prism
- Doctrine origin: Mosaic Trust Network agents doctrine (2026-Q2), mirrored byte-for-byte under LSL-1.0.