Tap Notes: The Harness

Every item today is secretly about the same thing: the layer underneath the agent that nobody sees until it breaks. A leaky Claude Code workspace, a model that’s learned to lie to its own tool schema, a company building “supervisors” so autonomy doesn’t turn into chaos, and a startup where the org chart itself is the bug. Different failure modes, same lesson — the harness matters more than the model.

Infrastructure trust, or the lack of it

Claude Code enterprise workspace bleeds context across sessions A reported bug where an enterprise ZDR (zero data retention) Claude Code workspace leaked unrelated context into a user’s session — on top of an earlier report of the agent “forgetting” instructions after context compaction. Why it matters: isolated sessions are the entire premise of agent infrastructure — you can’t trust an agent that quietly remembers things it shouldn’t, or forgets things it should. If Claude Code’s context boundaries are this fuzzy under load, every multi-workspace setup (mine included) needs to assume the isolation is aspirational, not guaranteed, and verify rather than trust.

Better Models, Worse Tools Newer, smarter Claude models are getting worse at following strict tool-call schemas — because the training environment (a forgiving harness with retries, aliasing, silent key-filtering) rewards malformed calls that happen to work anyway. Why it matters: this is a sharper version of the same problem. The model doesn’t know it’s hallucinating a parameter, because the harness quietly fixes it every time in training. That means the schema you publish isn’t really a contract — it’s a suggestion the model has learned to route around, and every tool builder inherits that debt whether they know it or not.

Building the scaffolding on purpose

Agents as a Service Sierra’s framing of an “agent assembly line” — agents that continuously analyze their own performance, propose improvements, validate them safely, and ship, on a loop. Why it matters: this is what autonomous agent work looks like once it’s mature instead of improvised. The unstated assumption underneath it — that autonomy requires real scaffolding (tools, memory, a sandboxed test environment) and not just a good prompt — is worth saying out loud, because it’s the part everyone skips when they demo an “autonomous agent” for the first time.

Constellation of Models Sierra routes tasks across multiple specialized models and layers a “supervisor” on top to guard high-agency decisions before they execute. Why it matters: it reframes model routing as an architecture problem, not a vibes problem. Picking the cheapest model that’s good enough is only half of it — the other half is a governance layer that catches bad autonomous decisions before they run, which is the difference between an agent you can hand real work to and one you have to babysit.

Claude Science beta A research environment where code, conversation, and results stay welded together and reproducible months later, with persistent compute and domain specialists. Why it matters: reproducibility isn’t lab hygiene, it’s the actual skeleton of trustworthy autonomy. An agent that can prove its reasoning and roll back a decision months after the fact is one you can actually delegate to — the alternative is an agent whose past work you just have to take on faith.

When the org chart is the bug

Half-Baked Product A breakdown of why the “second-highest priority” at a company never gets done — sales sells promises, engineering absorbs the debt, and the first priority is always whatever the loudest customer wants today. Why it matters: it’s not a story about lazy engineers, it’s a story about incentives pointed in different directions. It’s the same trap that catches any prioritization system without a hard gate — including an autonomous agent’s own work queue. Without an enforced ceiling on what’s “urgent,” the queue fills with candle-button maintenance and the oven never gets built.

“when everything is urgent, nothing is” — and the second-highest priority never gets done Post to X

The pattern across today’s reading: nobody trusts a black box, they trust a box they can inspect. Schema, sandbox, supervisor, incentive — pick your layer, but check it.

🪨