The harness travelled better than the agent

N17Q could switch models and still could not move the run.

One implementation depended on provider conversation state. Another assumed a local shell and repository checkout. A hosted path offered an isolated container, persistent files, bounded shell output, controlled networking, reusable skills, and native context compaction. Each environment was capable. None represented the same workflow boundary.

I had built provider adapters around a system whose real interface was larger than a model request.

The portable unit was the harness: the product contract that connected intelligence to a governed world.

The model call was only one transition

A request supplied context and tools. A response proposed text or actions. Everything that made the proposal useful happened around it.

N17Q selected evidence, assembled instructions, offered capabilities, parsed output, normalized consequence, evaluated policy, invoked tools, observed state, checkpointed progress, reconciled effects, and verified claims.

Moving only the model call preserved syntax and lost behavior. Two providers could accept similar tool schemas while their surrounding systems made different promises about state, execution, networking, and continuation.

Portability had to name the whole loop.

A computer environment changed the centre of gravity

By 2026, hosted agent environments made filesystem, shell execution, structured local storage, restricted network access, skill bundles, and long-running compaction feel like platform primitives rather than bespoke infrastructure.

That shift was useful. Large resources could stay in files instead of prompts. The model could query a database, transform an artifact, and keep intermediate work in an isolated workspace. Output could be bounded while retaining enough context to continue.

It also raised the integration question. If the platform owned the container and loop, which product guarantees still belonged to N17Q?

Convenience did not erase the need for a harness contract. It made the boundary worth defining precisely.

The harness owned run state

N17Q defined one durable run model independent of provider sessions and container lifetimes. Goals, checkpoints, instruction manifests, evidence, workspace snapshots, candidates, approvals, effects, attempts, budgets, and final claims lived there.

A hosted platform could store conversation state or compact it efficiently. A local environment could keep files across turns. Those facilities were execution resources. The product state remained exportable and inspectable outside them.

If an environment disappeared, the run could resume from a sealed checkpoint with honest gaps. If a provider session survived, it could be reused as an optimization.

Ownership of state determined whether portability was real or ceremonial.

Providers exposed function calls, shell commands, computer actions, or remote protocol tools. N17Q exposed retrieve source, prepare patch, verify candidate, inspect effect, and deliver approved artifact.

Each product capability declared input semantics, effect class, data movement, required environment features, policy hooks, recovery, and evidence output. Adapters translated it into provider-native mechanisms.

The model saw the subset eligible for its current task and environment. A provider's newly available tool did not join the catalogue until mapped and reviewed.

Stable verbs let the workflow move without pretending every substrate behaved identically.

Environment features became declared requirements

A skill might need a POSIX shell, a writable workspace, SQLite, document rendering, or access to one approved domain. Hidden assumptions made migration fail late.

N17Q added an environment manifest. It described filesystem semantics, process model, runtimes, storage, network controls, secret handling, resource limits, snapshot support, and observation quality. Skills and tool contracts named their minimum requirements.

Planning could then select an eligible environment or explain why none fit. The model did not discover missing infrastructure after half the task had run.

Portability became compatibility between explicit contracts.

Shell access remained proposal-driven

Hosted shell tooling reinforced a useful fact: the model proposed commands; an orchestrator executed them. N17Q kept that separation visible.

A command candidate included executable, arguments, directory, intended purpose, and expected outputs. Product policy evaluated the proposal. The environment enforced mounts, process, network, secrets, and budgets. Resulting files and output became observations.

Even when a platform could orchestrate the loop automatically, the product decided which commands and consequences were eligible. Provider convenience did not convert model output into ambient process authority.

The same proposal boundary applied locally and remotely.

Files were context and state, not permission

Placing resources in a container let the model inspect them selectively rather than consuming a huge prompt. N17Q used that pattern for source material, manifests, and intermediate artifacts.

Every mounted resource carried origin, data class, mutability, and scope. The context compiler told the model where eligible files lived. Policy and the sandbox still controlled actual reads and writes.

A skill file could explain how to process a report. A data file could contain hostile instructions. Neither gained authority from sharing a filesystem.

The harness preserved provenance even when context became a directory tree.

For large tables and trace indexes, querying SQLite was more reliable than pasting rows into context. N17Q staged normalized, bounded datasets with schema descriptions and provenance tables.

The database was a derived artifact tied to source digests. Queries entered the trace as observations. Mutating analytical state did not mutate the source or external system.

Moving between environments required the database file, schema contract, runtime compatibility, and snapshot identity—not a replay of every query.

Local structure reduced prompt pressure while remaining inside the portable workspace.

Network policy stayed product-visible

A hosted environment could route outbound traffic through a controlled proxy, apply allowlists, and inject destination-scoped secrets without exposing raw values to the model. Those were strong lower-level capabilities.

N17Q still compiled product policy from task, requester, data, destination, and effect. The environment adapter translated an allowed connection into platform controls and returned evidence of the active network policy.

If an environment could only promise coarse unrestricted network, sensitive workflows were ineligible. If it offered stronger controls, the product could use them without assuming they covered semantic authorization.

Portability preserved layered responsibility rather than searching for one universal sandbox.

Secret references crossed the boundary, not secrets

Tool contracts named connection handles and destination scope. Environment adapters resolved those handles through approved secret mechanisms at execution.

Raw credentials never entered model context, portable run exports, skill bundles, or workspace snapshots. A hosted egress injector and a local broker could implement the same product promise differently.

Receipts identified connection and policy revision without exposing reusable material. replay environments contained only fixture connections.

The harness could move because its durable state depended on identities and evidence, not copied credentials.

Skills were packages, not magic prompts

Reusable skills fit naturally inside a filesystem-based agent environment: metadata could enter context, instructions could be opened progressively, and scripts or assets could run through the shell.

N17Q treated each skill as a versioned package with purpose, requirements, provenance, allowed dependencies, and output contract. The harness decided when to load it and which capabilities accompanied it. Package instructions shaped planning but did not grant authority.

An environment adapter staged the bundle and reported its digest and path. Another could expose the same logical package through a different mechanism.

The portable object was the reviewed skill contract plus contents, not one provider's upload ID.

Native context compaction made long agent loops practical. A model-aware summary could retain important conversation state more effectively than blunt truncation.

N17Q used compaction as a context optimization and retained durable checkpoint fields separately. Approvals, effects, budgets, workspace revisions, denials, and verification eligibility could never depend on what a compacted item remembered.

The harness recorded compaction boundaries and the context package that followed. Switching to an environment without the same facility triggered product-side recompilation from state.

Long context helped the model continue. Portable state let the system continue safely.

Streaming was normalized into events

Platforms differed in how they streamed text, reasoning summaries, shell output, tool deltas, and lifecycle status. Building the UI directly on one stream format locked product behavior to that provider.

N17Q adapters converted transport events into product states: model item drafting or complete, tool candidate incomplete or ready, execution attempt phase, bounded output observation, and checkpoint transition.

Raw safe events remained available for diagnosis. User-facing state and policy never inferred consequence from token arrival alone.

The harness could preserve responsive streaming without making transport syntax its domain model.

Output bounds were part of the tool contract

Shell commands could produce logs far larger than a model context. Some platforms supported per-command caps and returned preserved beginning and end with truncation evidence.

N17Q declared output budgets, selection rules, artifact spill paths, and truncation markers. The model received a bounded projection. Full eligible output could remain as a workspace artifact under retention policy.

Adapters used native bounding where available and enforced an additional product boundary. A truncated result never masqueraded as complete evidence.

This behavior travelled because the contract specified meaning, not one streaming parameter.

A platform could execute several shell sessions concurrently and multiplex output. That improved latency for independent searches and checks.

The harness represented tasks and tool intents separately from transport concurrency. Safe reads could run in parallel when their snapshots and budgets allowed it. Consequential effects followed ordering and idempotency constraints. Shared workspace writes required isolation or serialization.

Adapters declared what concurrency they could enforce and observe. The scheduler selected a compatible plan rather than assuming parallel tool calls were independent.

Performance features entered through the same consequence model as everything else.

Snapshots made workspaces portable

A persistent container was useful while it lived. Portability required a sealed representation of its relevant state.

N17Q captured base and candidate manifests, content-addressed artifacts, environment identity, running-process settlement, and verification links. Export excluded credentials and disposable caches while recording their contracts.

Another eligible environment could materialize the snapshot, verify digests, and resume from a child checkpoint. Platform-specific special files or unsupported semantics blocked migration explicitly.

The workspace moved as an accountable artifact, not as an opaque container promise.

Effects stayed outside environment migration

Copying a workspace could not copy or reset external consequences. An unknown delivery remained unknown when the run moved from hosted to local execution.

The effect ledger was durable product state. The new environment received only the capabilities allowed by each active intent. It could query or reconcile using approved connection mappings, and it could not create a replacement effect merely because its adapter instance was fresh.

Replay mappings stayed in fixture namespaces. Live connection identity never followed a snapshot by accident.

Portability moved computation while keeping the world history anchored.

Evidence quality varied by substrate

One environment exposed strong process boundaries and network logs. Another offered only command exit status. One could snapshot efficiently; another required archive export. Treating their traces as equal would overstate the weaker environment.

N17Q's environment manifest declared observation guarantees. Invariants named the evidence strength they required. A high-impact workflow could refuse a substrate that could execute the command but could not prove containment or capture the resulting state.

Reports named these differences when comparing runs.

The harness was portable because it could say no to an incompatible execution surface.

The conformance suite tested promises

I built fixture scenarios for path escape, background writes, oversized output, denied network, domain-scoped credentials, process timeout, concurrent sessions, snapshot restoration, compaction resume, lost transport, and missing tool support.

Each adapter had to produce the expected product states and world invariants. Platform-specific diagnostics could differ. The meaning of denial, interruption, sealed workspace, and fixture replay could not.

A capability matrix alone said what an environment claimed. Conformance fixtures showed what the harness could rely on.

Portable architecture became executable evidence.

No abstraction covered every provider feature. N17Q allowed environment-specific extensions for experimental or low-level workflows, but tagged them as non-portable dependencies.

The run manifest named the extension, data boundary, effect semantics, and fallback. A task using it could not migrate silently. Product review decided whether the benefit justified coupling.

This was healthier than pretending a lowest-common-denominator interface or leaking provider concepts everywhere.

Portability became a deliberate property with known exceptions.

Local and hosted execution shared one receipt model

A local command could return an exit code and changed tree. A hosted action could return platform events, artifact handles, and container status. Neither transport response alone established the product postcondition.

N17Q adapters emitted normalized attempt evidence, then product observers verified workspace or world state. Receipts named environment, tool contract, input digest, execution boundary, and observed result. The final account rendered a stable vocabulary while technical views retained native details.

This let the same invariant ask whether a candidate was verified without assuming how the command had run.

Portability improved when evidence crossed the boundary in a shared shape.

Environment selection became part of planning

Routing originally chose the cheapest available runtime before the model saw the task. That could strand work after discovering a rendering dependency, network restriction, or data residency requirement.

N17Q performed a bounded capability analysis from task type, active skills, artifact formats, data class, and expected effects. It selected an eligible environment and recorded alternatives. New requirements could trigger a sealed handoff rather than an improvised install or permission expansion.

The model could recommend a need, but policy and the environment registry decided placement. Cost and latency optimized among eligible choices.

Where the work happened became an explainable product decision.

Version drift was a migration input

Even compatible environments carried different operating systems, runtimes, utilities, fonts, and certificate stores. A task that produced the same source patch could render a different document or resolve dependencies differently.

The harness recorded execution image, runtime versions, relevant toolchain, locale, and renderer identity. Skills could pin or constrain requirements. Verification results stayed attached to that environment manifest.

Migration compared manifests and marked affected checks stale. It did not assume that “shell available” meant equivalent behavior. Fixture suites covered the semantic promise while artifact-specific tests covered exact output.

Portable did not mean identical; it meant differences were declared, bounded, and reevaluated.

If the interface rendered provider messages and container sessions directly, switching environments would change the product's shape. N17Q instead showed task, plan, artifacts, approvals, effects, checks, and final account.

Technical detail views exposed model requests, platform tool events, container IDs, and adapter diagnostics. They remained evidence beneath stable product concepts.

Users could understand a run that moved environments without learning two orchestration vocabularies.

The harness's domain model became the interface's information architecture.

The migration stopped being a rewrite

In the original experiment, I moved an N17Q document task from a local loop into a hosted computer environment. The first attempt duplicated state in provider conversation items, mounted files, and local records. Resume paths disagreed, and one live connection escaped the fixture replay.

After defining the harness, the environment adapter implemented workspace staging, shell attempts, output bounds, network evidence, skill loading, checkpoint export, and snapshot sealing. The run continued to use product capabilities, policy, effect identity, and evaluation.

The hosted path could take advantage of persistent files, structured local data, controlled egress, concurrent sessions, and native compaction. None of those features became the sole owner of the workflow.

That division also kept experimentation cheap. I could adopt a stronger platform primitive behind one adapter, compare evidence and performance against the conformance suite, and roll it back without migrating the meaning of every historical run. Useful infrastructure innovation stopped demanding a product rewrite each time the execution surface improved.

Moving again would still require engineering. It would no longer require redefining what a run meant.

The industry was converging on computer environments because useful agents need somewhere to work. The more capable those environments became, the more important it was to keep application semantics above them.

Models generated proposals. Platforms supplied execution primitives. The harness connected them to product state, authority, evidence, recovery, and a user-visible account.

That harness—not the prompt, model, container, or provider session—became the unit N17Q could carry forward.

It was the architecture that made every underlying improvement safely composable.