Workspace Agent Harness now has one authoritative product path: the Human-usable TypeScript/Pi General Agent Working Stack. The Python evented runtime remains runnable as a reference implementation, while prior ReAct, protocol, campaign, proof-pack, and benchmark work remains retained experimental material rather than a product dependency.
Verification boundary: WorkOrder #24 changes product authority and navigation; it creates no new benchmark, model-quality, security, project-fact, Wiki, or resume claim. Historical Evidence remains governed by its original identity and review status. Start at
AGENTS.md; the bounded assignment lives indocs/agents/current-assignment.md.
Use Node.js 22.19.0 or newer, choose an existing workspace plus a disjoint memory path, install the locked TypeScript dependencies, enter the Provider credential without putting it in command history, then launch the authoritative TUI:
npm --prefix typescript ci --ignore-scripts
read -s DEEPSEEK_API_KEY
export DEEPSEEK_API_KEY
npm --prefix typescript run agent -- \
--workspace /absolute/path/to/workspace \
--memory-root /absolute/path/to/memory \
--model deepseek-v4-flash \
--thinking highThe TUI displays the resolved Provider/model/workspace/memory identities and requires confirmation before the first task; submitting that task makes the first Provider call. The selected workspace is the default cwd, not containment. The trusted-local tools run with the current host user's authority. See the TypeScript operator guide, runbook, and design before using a real Provider.
| Lane | Classification |
|---|---|
| TypeScript/Pi working stack | authoritative product |
| Python evented TUI/runtime | reference-only |
| ReAct mechanism | experiment/reference |
| Protocol reliability | experiment/reference |
| DeepSeek campaigns | experiment/reference |
| Proof packs and evaluators | experiment/reference |
| Benchmark machinery | experiment/reference |
Language-neutral conformance fixtures under conformance/ preserve only cross-implementation semantics: the retained read/write/edit/bash tool meanings, attributable terminal kinds, active-tool cancellation, and cross-task Context behavior. The TypeScript runner consumes them through the public GeneralAgentSession Interface without importing or executing the Python package.
The project maintains a source-grounded Learning Wiki recording what building this system teaches: harness engineering, agent tool design, evaluation methodology, and verification practice. Every substantive page is either a Verified Learning Fact (with an explicit verification level — source-located, triangulated, or experiment-reproduced — and stated boundaries) or an Open Learning Question (with a verification path). The log is append-only. The Wiki claims no product, benchmark, or resume authority; it is the project's public learning trail.
The TypeScript package and Human command are backed by the working-stack design. One deep GeneralAgentSession Module owns Pi's stateful Context and Agent loop, translates through a real DeepSeek Adapter, exposes typed read/write/edit/bash tools, returns control for successive tasks, renders usage and attributable terminals, and supports cancellation. Its test Adapter is Pi's deterministic Faux Provider; WorkOrder #24 makes no paid Provider call.
The shell is explicitly trusted-local: it runs as the host user, and the selected workspace is only the default cwd. It claims neither path containment nor an OS/network sandbox. The Python shell/PTY implementation remains available for comparison, but it is not the default product route.
The architecture is Human-accepted. The code and tests below remain a candidate, but their ordinary operator-trusted implementation boundary has passed a separate same-model Regulator review; high-risk security, public benchmark, fact, and resume gates remain closed:
docs/design/general-vertical-system.md: Runtime and Domain Pack Interface alternatives, selection, invariants, ordering, errors, configuration, and migration;docs/design/deerflow-mechanism-map.md: pinned DeerFlow mechanism sources, local decisions, and intentional omissions;docs/design/proof-domains.md: boundeddata-analysisandworkspace-codingtasks and deterministic evaluators;docs/design/benchmark-strategy.md: a pinned PinchBench compatibility lane plus a 15+15 local vertical evidence campaign;docs/adr/0009-general-runtime-and-vertical-domain-packs.md: accepted Runtime/Pack seam decision;docs/adr/0010-external-and-vertical-evaluation-lanes.md: accepted benchmark/campaign placement;docs/design/react-to-swe-mvp.md: Phase 0 Act-only/ReAct mechanism comparison, dual-channel observations, Docker/gold gates, and the later SWE-style ACI transition;docs/adr/0011-react-mvp-before-swe-aci.md: accepted decision to isolate ReAct loop grammar before adding coding-interface treatments;docs/design/protocol-reliability-v1.md: frozen 24-context JSON/Strict protocol replay, repair, measurement, identity, and stop contract;docs/design/protocol-reliability-v1.1-max-token-sensitivity.mdanddocs/design/protocol-reliability-v1.2-max-token-16k-extension.md: the complete 2K/4K/8K sensitivity design and transparently post-v1.1 16K extension;docs/adr/0012-freeze-protocol-reliability-v1.md: accepted decision to calibrate the Translation Layer before coding ACI treatments;docs/design/translation-adapter.mdand acceptedADR-0013: WorkOrder #4's independently accepted offline candidate seam for typed canonical history, provider-native call/result replay, separate reasoning, fail-closed correlation, and ModelProfile-owned output limits;docs/design/agent-loop-behavioral-eval-v0.mdand acceptedADR-0014: WorkOrder #3's independently accepted evented AgentLoop, deep ModelGateway, consumer-only TUI, Context, and Behavioral Eval design freeze;docs/design/evented-tui-tracer.md: WorkOrder #6's credential-free, manually testable Python TUI tracer candidate and replay/cancellation entry points; pending independent Regulator review and explicitly excluding #7–#10;docs/design/provider-context-overflow-recovery.md: WorkOrder #8's one classified Provider Context-overflow recovery candidate, #7 semantic-compaction reuse, one retry ceiling, separate attempt accounting, explicit exhaustion, and deterministic TUI/replay paths; pending independent Regulator review;docs/design/behavioral-eval-runtime-v0.md: WorkOrder #9's exact 12-case deterministic Behavioral Eval campaign, protected oracles, attributable report, and zero-call replay candidate; pending independent Regulator review;docs/design/tui-three-view-projections.md: WorkOrder #10's compact/expanded/trace event projections, visibility filtering, candidate/admission distinction, bounded long-output rendering, and repeatable Python TUI view selection candidate; pending independent Regulator review;docs/design/deepseek-live-behavioral-eval-stage-a.md: WorkOrder #11 Stage A's DeepSeek native-tool Translation/Gateway, balance and call/token/cost controls, content-hashed paired 120-slot lock, and zero-call inventory candidate; pending independent Regulator review and containing no live result;docs/design/deepseek-live-budgeted-serial-runner.mdandStage B terminal Evidence: WorkOrder #11's independently accepted runner later retained one frozen HTTP 400 Provider exchange, mandatory balance settlement,model_usage_missingstop, and the complete1 failed / 119 skipped / 0 missingdenominator; v2 is terminal, with no task result or arm comparison, and any v3 requires a new lock and fresh Human budget authorization;docs/design/deepseek-live-v3-adapter-stage-a.mdandcandidate Evidence: WorkOrder #19's independently accepted zero-call v3 repair retains Thinking/tools/stable endpoint, omits request-leveltool_choice, accepts one typed tool call or non-empty ordinary final content, versions the lock/runner/entry identity chain, and preserves the 120-slot controls; accepted on 2026-08-29 and authorizing no live call;docs/design/deepseek-live-tui.md,historical #21 smoke observation, and#22 smoke candidate Evidence: the accepted Python entry plus WorkOrder #22's candidate trusted-local extension. Default no-shell behavior remains;--trusted-localadds a typed non-interactive shell and a separate exact-command/cwd Human PTY confirmation, process-group cancellation, lossless artifacts, lifecycle events, and replay. The trusted-local profile also treats absent/empty Provider reasoning as optional metadata (the default-off profile remains reasoning-required) while retaining executable action validation. The authorized realdeepseek-v4-flashsnake smoke completed on exact candidate bytes with a Human-operated PTY handoff; it makes no sandbox, benchmark, model-quality, or TypeScript migration claim and remains pending independent high-risk review;tests/test_general_runtime_contract.py: Runtime/Pack seam, authority, admission, and evaluator-limit contracts;tests/test_benchmark_campaign_contract.py: suite selection, eligibility, aggregation, and append-only attempt contracts.workspace_agent_harness/proof_packs.py: concrete seed Pack implementation candidate; the Runtime Module does not import it;tests/test_proof_packs.py: same-Runtime/same-model concrete Generality Proof integration contract.
The complete local suite is expected green for this implementation candidate. Passing tests are Evidence, not automatic acceptance. The reviewed foundation includes one concrete seed for each proof Pack, a two-case vertical-development-smoke, PinchBench core/full P0 catalog locks, and a 30-case vertical configuration in which only the two seeds are eligible. The newer Phase 0 candidate adds a real-provider Adapter and completed frozen five-case SWE-bench development smoke. Each treatment produced one resolved planned slot, but response-contract failures dominated and one Act-only slot had an infrastructure/artifact failure. It does not include PinchBench task translation, the other 28 fixtures/evaluators, a SWE-bench Lite score, or any accepted project/resume fact.
The ReAct MVP executable lock lives at workspace_agent_harness/benchmark_configs/react-mvp-5-v1.json. scripts/swebench_gold_gate.sh reproduces one selected case's pinned official gold gate, scripts/run_react_mvp_case.py runs one pre-gated attempt, and scripts/summarize_react_mvp.py deterministically enumerates and hashes all expected slots. The candidate result and limitations are in docs/evidence/react-mvp-30-slot-candidate-2026-08-23.md.
The protocol locks are protocol-reliability-v1.json, its 24-context corpus, the 2K/4K/8K sensitivity, and the separately versioned 16K extension. scripts/freeze_protocol_reliability_contexts.py verifies Trace reconstruction; the protocol and sensitivity runners retain deterministic append-only raw calls; their summarizers report layered reliability, repair/cap cost, confidence intervals, marker diagnostics, and provider identity. Generated state stays under ignored .scratch/, .runs/, and logs/ paths.
The completed Working Agent result and its explicit limits are indexed at docs/evidence/protocol-reliability-v1-candidate-2026-08-23.md. It is a dated provider-protocol measurement, not task quality, a persistent benchmark, VPF, or resume fact.
The follow-up maximum-token sensitivity candidate Evidence qualifies that result: higher ceilings extended many malformed Strict/ReAct outputs to 16K without a monotonic L3 gain. It supports bounded validation/repair rather than using 16K as the default protocol fix and remains pending independent review.
The WorkOrder #4 implementation candidate adds translation.py, the provider-specific deepseek_translation.py, and an offline four-cell dry-run. Its offline candidate passed an independent Regulator Gate on 2026-08-25, while its secret-free fixture contracts prove local mapping and rejection behavior only; no live call, causal result, Verified Project Fact, Wiki entry, or resume claim was produced.
This retained reference entry defaults to #21's bounded no-shell tool profile. Choose an existing workspace and a new artifact path outside it; add --trusted-local only when you deliberately grant host-user shell and Human PTY authority:
read -s DEEPSEEK_API_KEY
export DEEPSEEK_API_KEY
PYTHONPATH=. python3 -m workspace_agent_harness.tui \
--live-deepseek \
--trusted-local \
--workspace /absolute/path/to/workspace \
--session-root /absolute/new/path/to/live-sessionThe command displays and asks you to confirm the Provider, model, resolved workspace, and selected authority before accepting Task>. Each task gets a new Run and model Context while the workspace persists. Use :help, :view compact|expanded|trace, :runs, :replay RUN_ID, or :exit. Starting, cancelling before confirmation, using help/views, or replaying makes no Provider call. Run artifacts contain the append-only Event Log, secret-free Provider exchanges, Context artifacts, trusted-local stream/PTY identities when enabled, public metadata, reported usage, and changed workspace paths.
The TypeScript/Pi entry is the default route documented at the top of this file. Every admitted run is durably archived under --memory-root (created if missing; it must be disjoint from the workspace) and bound to the current typescript/RUNBOOK.md revision; :runs and :replay RUN_ID inspect sealed archives with zero Provider calls or tool effects.
PinchBench is pinned as an external compatibility source, not vendored as the Runtime contract. workspace_agent_harness/benchmark_configs/ holds content locks; workspace_agent_harness.benchmarks.load_pinchbench_suite(...) audits a caller-supplied clean checkout without executing embedded graders. All 21/147 upstream cases are currently ineligible because no local translation is frozen. Any later translated local run must be labelled pinchbench-compatible; official compatibility requires the unmodified upstream runner. The Composio thread contributes campaign shape and efficiency metrics only, not reusable tasks or results.
- Task surface: Markdown knowledge maintenance, CSV retrieval/cleaning/aggregation, and code modification/test repair.
- Agent surface: an online model adapter, CLI, allowlisted file/command tools, composable Skills and Workflow, explicit budgets, structured Trace, checkpoint/resume, and policy results.
- Acceptance suite: 30 version-frozen local tasks, exactly 10 per task family. Every task uses an isolated fixture workspace and a deterministic grader; tasks and graders freeze before the formal run, and failed cases are retained.
- Baseline: the same model, tools, prompt budget, and task suite run through a minimal ReAct loop. The full system adds only Skills/Workflow, Trace, recovery, and reliability controls.
- Metrics: task success rate is primary; Token use, cost, and latency are secondary; fault-injection recovery rate, unauthorized-operation block rate, and Trace completeness are reliability metrics.
Coze is a Product Reference for how task entry, Skills, Workflow, tool execution, observation, debugging, evaluation, and release can be organized. It is not a benchmark and this project does not claim superiority to Coze. The 30-task Evaluation Suite is the v1 acceptance mechanism. Only after v1 passes may a v1.1 experiment attempt a clearly named Terminal-Bench subset; BFCL is an on-demand component diagnosis for tool-selection or argument errors. GAIA is outside the current roadmap.
v1 does not include open-web browsing, GUI/Computer Use, multimodal input/output, autonomous research, cloud multi-tenancy, a complete Coze clone, model training, or a precommitted paper. Research may be reconsidered only after the product exposes a repeated, falsifiable failure mode and additional work cannot delay the job-search deliverable.
docs/evidence/verified-project-facts.md is the only project-level fact register. It records each accepted atomic Claim, Evidence, Criterion, independent acceptance, date, and limitation. README prose, specs, Wiki pages, and passing structure checks are not implementation Evidence by themselves.
Run the authoritative TypeScript candidate suite with:
npm --prefix typescript run checkThe retained reference and experiment regression suite remains available with:
python3 -m unittest discover -s tests -p 'test_*.py' -vThe historical Local Workspace v1 specification remains GitHub Issue #1 and docs/spec/v1.md. Domain language lives in CONTEXT.md; ADR-0008 is the accepted historical product decision, while Human-accepted ADR-0009 and ADR-0010 define the current target. Their bounded ordinary implementation has passed a same-model Regulator Gate; this does not release high-risk security, benchmark, project-fact, or resume claims.