AI curriculum

Course outline for Harness Engineering

An agent that resumes a session can lose important context or attempt an action that was never approved. Prototype a small harness that separates model, provider, tools, policy, and durable state. Resume permitted work from an explicit checkpoint and verify that replanning cannot expand its authority.

Technology: AI-Assisted Software Engineering
Duration: 6 hours
Modules: 3 · 2 hours each
Level: Level 4

About Harness Engineering

Harness Engineering Course Objectives

Separate model, provider, harness, and tool responsibilities.
Load a selected skill with a typed tool contract and bounded context.
Enforce repository and action permissions outside generated instructions.
Persist versioned state and approval independently of conversation history.
Resume a fresh session from a checkpoint with verified action results.
Evaluate denied actions, context loss, and recovery against explicit acceptance rules.

Pre-requisites

Building Applications with LLMs and Agentic AI Foundations, or equivalent application-contract and agent-loop competence.
Programming and command-line experience.
Familiarity with agent tool calls and repository workflows.
Basic local persistence and test execution; a scaffold supplies these components.

Before this course

Complete the required courses or bring equivalent experience. Recommended courses add useful depth; they are not enrolment gates.

Required preparation

Recommended preparation

Understands application contracts and agent loops before implementing sessions, tools, checkpoints, and permission boundaries.

Find your place in the learning map

Lab Setup

Computer with Git, familiar programming runtime, test runner, and a disposable repository.
Supplied harness scaffold, mocked agent decisions, dummy policy identities, and checkpoint fixtures.
Prepared local sandbox or explicit simulated denial traces; no production credentials, unrestricted shell, or paid model access is required.

Detailed Course Outline

Module 1: Define harness contracts (2 hours)

Agent harness architecture: Model, provider, harness, and executor responsibilities; identify where step selection, capability enforcement, state persistence, and result verification occur.
Instructions and system prompts: Task guidance, precedence, and explicit constraints; distinguish instructional intent from externally enforced permissions and resource boundaries.
Skills: Discovery metadata, selected instructions, and deterministic scripts; load relevant procedural knowledge progressively without treating skill text as executable authority.
Tools: Typed inputs, capability scopes, and explicit results; separate read, recommendation, and mutation interfaces with independent policy checks.

Practical outcome: Separate stack responsibilities, progressively load only the relevant skill, and define typed read, recommendation, and mutation capabilities with a policy gate independent of model instructions.

Module 2: Bound session execution (2 hours)

Context management: Relevant inputs, session growth, and lossy compaction; record omitted facts and restore authoritative state from explicit artifacts.
File and repository access: Allowed paths, canonicalization, symlinks, and action checks; distinguish workspace conventions from enforced restrictions on actual file operations.
Sandboxed execution: Prepared isolation controls, resource limits, and denied actions; identify which protections are enforced and which remain simulator assumptions.
Sessions: Conversation-local state, interruptions, and fresh starts; distinguish retained messages from durable records needed to resume a task correctly.

Practical outcome: Restrict a disposable repository through enforced path/action checks and a prepared sandbox, record resource limits, and show how session compaction can lose context without changing permissions.

Module 3: Recover state and verify authority (2 hours)

Memory: Explicit persistent facts, record versions, and provenance; restore necessary state without relying on hidden chat history or generated recollection.
Checkpointing: Saved task state, completed effects, and resume preconditions; verify continuity after interruption without replaying an already recorded mutation.
Evaluation: Denied capabilities, interrupted runs, and final-state assertions; check effect counts independently of agent narration or revised plans.
Human approval: Exact action and version binding, invalidation after edits, and external permission gates; prevent replanning from silently increasing execution authority.

Practical outcome: Restore explicit versioned state in a fresh session, distinguish proposed actions from recorded effects, and test exact-version approval and bounded correction without granting new authority during replanning.

Practical exercise

Produce a small mock-agent harness with selected-skill loading, narrow tools, a checkpoint, and a policy-test report.
Resume a permitted read and draft; deny an out-of-scope path, an unapproved write, and an edit that invalidates previous approval.
Run at least eight fixtures across an interrupted session and a fresh session, verifying final state and effect counts independently of agent narration.
Record what compaction omitted, what durable state preserved, and which sandbox protections were actually enforced rather than assumed.

What you will produce

Prototype a single-agent harness that resumes checked state without bypassing repository scope or versioned approval.

How the work is checked

Harness, provider, model, policy, and tools have distinct responsibilities.
Out-of-scope and unapproved actions fail through enforced checks outside the model.
A fresh session resumes from explicit state and verifies actual effects.
The report distinguishes instruction guidance, sandbox enforcement, and residual risks.

Six hours extending a supplied single-agent harness: add a tool/policy gate and a checkpoint-resume test within module time. Path checks must account for canonical paths and symlink fixtures in the controlled workspace; they do not establish complete host isolation. Simulated denial traces demonstrate policy behavior, not a deployed sandbox guarantee. Cross-worker coordination is outside scope.

When another approach is better

Use a fixed script when the next steps and inputs are already known and do not need agent selection.
Do not rely on prompts, working directories, or sandbox labels as the sole permission boundary.

How we train

Ask about exercises, instructor feedback and the prior knowledge you need. Tool-specific courses marked provisional may become modules in a broader course.

Discuss your learning goals