Skip to content

docs(wiki): add agent-harness automated testing pipeline design - #295

Open
davida-ps wants to merge 1 commit into
mainfrom
docs/agent-harness-testing-design
Open

docs(wiki): add agent-harness automated testing pipeline design#295
davida-ps wants to merge 1 commit into
mainfrom
docs/agent-harness-testing-design

Conversation

@davida-ps

@davida-ps davida-ps commented Jul 12, 2026

Copy link
Copy Markdown
Collaborator

User description

Opener Type

  • Human
  • Agent (automated)

Summary

Adds a design/RFC wiki page for a two-phase automated agent-harness testing pipeline. When a skill changes, the supported agent runtimes (OpenClaw, NanoClaw, Hermes, Picoclaw) install the skill non-mutatively and verify it does what it claims (pre-merge); after a release, the install + verification pipeline itself is verified end-to-end against the published, signed artifacts (post-release).

This is a design document only — no pipeline code is written. It is the blueprint that assigned agents implement later, milestone by milestone.

Changes Made

  • wiki/agent-harness-testing.md — new Operations design doc (~500 lines): context, goals/non-goals, mandatory Picoclaw feasibility spike, architecture (harness/ layout + data-driven per-agent adapter generalizing the existing Picoclaw/Hermes sandbox regressions), credential/abuse model (keyless OIDC → scoped IAM role, tiered mock/Bedrock inference, two isolation models, threat-model table), the two phase workflows, reused-assets table, M0–M5 roadmap, open questions, and verification.
  • wiki/INDEX.md — registered the page under Operations + dated update note.

Key design decisions

  • Tiered inference: deterministic mock tier runs on every PR (incl. forks) with zero secrets; real-Bedrock tier is human-gated. One code path, two provider backends.
  • Keyless, scoped Bedrock: GitHub OIDC → IAM role, trust policy pinned by StringEquals to the protected environment + exact workflow ref; permission policy allows InvokeModel on one model and denies everything else.
  • Fork credentialing: since GitHub never mints an OIDC id-token for a fork's pull_request run, forks reach the Bedrock tier only via maintainer workflow_dispatch(pr_number, head_sha) (no pull_request_target).
  • Oracles over LLM-judging: exit-code contracts (42/43), SPEC.md finding schemas, and declared-vs-observed permissions.json subset checks; LLM-as-judge is last-resort, quorum-voted, fail-closed.
  • Feasibility first: Step 0 is a mandatory Picoclaw spike (the only agent whose source URL is known) before any framework is built.

Related Issues


Type of Change

  • Bug fix (non-breaking change that fixes an issue)
  • New feature (non-breaking change that adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Documentation update
  • Security incident (please open a Security Incident Report issue instead of a PR)

Testing

Ran the checks that CI runs on wiki/** changes — all pass:

  • node scripts/test-wiki-sync-export.mjs — 0 failures
  • node scripts/build-github-wiki-export.mjs --source wiki --output <tmp> — Home.md + _Sidebar.md present, no nested markdown, new page included
  • python3 scripts/i18n/qa_check.py — pass (new English-only page has no translation pairs to gate)
  • python3 scripts/i18n/link_check.py — no broken local markdown links

Checklist

  • My code follows the project's style guidelines
  • I have performed a self-review of my changes
  • I have added tests that prove my fix/feature works (N/A — documentation only)
  • New and existing tests pass locally

Generated description

Below is a concise technical summary of the changes proposed in this PR:
Document the proposed two-phase automated agent-harness testing pipeline in the Operations wiki, detailing the harness adapters, manifests, and workflows that agents will follow for pre-merge and post-release verification. Explain how the mock/Bedrock tiers, per-skill conformance specs, credentialing model, and governance/verification walksthroughs fit into the staged roadmap.

TopicDetails
Wiki Index Update Register the Operations design page in the wiki index and record the dated update note for the new pipeline documentation.
Modified files (1)
  • wiki/INDEX.md
Latest Contributors(2)
UserCommitDate
David.a@prompt.securitydocs(wiki): add agent-...July 12, 2026
david.a@prompt.securityfeat(traffic-guardian)...May 10, 2026
Harness Testing Design Document the automated agent-harness testing pipeline blueprint, including architecture, credentialing, oracles, workflows, and the mile-stoned roadmap for pre-merge and post-release verification phases.
Modified files (1)
  • wiki/agent-harness-testing.md
Latest Contributors(1)
UserCommitDate
David.a@prompt.securitydocs(wiki): add agent-...July 12, 2026
Review this PR on Baz | Customize your next review

- New wiki design doc: two-phase pipeline (pre-merge skill claims
  verification + post-release install/verify pipeline verification)
- Tiered inference: deterministic mock tier (no secrets, every PR) +
  gated real-Bedrock tier; keyless GitHub OIDC to a scoped IAM role
- Generalizes the existing Picoclaw/Hermes sandbox regressions into one
  data-driven per-agent adapter; deterministic oracles over LLM-judging
- Documents credential/abuse model, threat table, and an M0-M5 roadmap
  gated on a mandatory Picoclaw feasibility spike
- Design only; execution deferred. Registered under Operations in INDEX.md

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@baz-reviewer

baz-reviewer Bot commented Jul 12, 2026

Copy link
Copy Markdown
Contributor

Merger

Ready to Merge

MERGE: this is a docs-only wiki addition, and the diff matches the stated goal of adding the agent-harness pipeline design plus index entry. There are no review discussions or concrete blockers to resolve.

Commit 727eddc · Evaluated 2026-07-12 11:07 UTC

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant