Dimensional Frame Harness

Harness agentic potential. Delegate boldly.

You set the frame. Checked, not trusted.

AI agents now act on their own, across many steps. The Dimensional Frame Harness checks an agent's whole run, not one action at a time, and blocks the harm that no single step shows. (A run is one task or session, start to finish.) Below: how I got here, the harness running on real code, and the one lesson worth taking away.

where it stands

The proof of concept is done: the checks are built and pass their tests on cases we constructed. Next, the alpha puts DFH on real AI work for the first time, as an app on your own machine inside Claude Code, and reports what it catches, what it misses, and what it costs. Then the beta opens it to more people and more tools.

Roadmap How it works

I study how coordination fails. Agents fail the same way.

01 · where this starts

How coordination fails.

What we tested

  • How coordination behaves under real pressure, across many different kinds of organizations.

What we learned

  • A healthy coordination system holds together under tension, like a tensegrity: when one part gives way, the load runs through the whole, so a failure propagates rather than staying local.
  • The failures are not random. The same shapes recur: a handoff drops, a warning goes unengaged, a decision rests on ground that already shifted.
  • Because they recur, they can be named and written down. That is where all of this starts.
A luminous tensegrity structure with glowing cyan struts held in balance by tension; one strut has snapped and glows red, and the surrounding cables buckle as the load redistributes through the whole.

a healthy coordination structure under tension: one strut fails and the whole redistributes

02 · what I built

I wrote the patterns down, and made them run.

What we tested

  • Whether those failure-patterns could be made enforceable, not just described.

What we learned

  • They can: a suite of five kinds of integrity on a floor of precision, meaning, structure, data, evaluation, and time.
  • Made executable, so a machine holds a live system to them, not just a person reading a document.
  • The harness is the layer on top that puts them to work on a running agent.
A faceted solid whose five colored bands are the five kinds of integrity: meaning at the crown in red, then structural in orange, data in gold, evaluation in green, and temporal in blue at the base, held between a luminous Precision floor (PFDS) and a Dimensional Frame Harness ceiling (Action Integrity).

03 · the recognition

An agent is a coordination system too.

What we tested

  • Whether the coordination-failure patterns I found in organizations also show up in agentic AI.

What we learned

  • They do. An agent learned to coordinate from human data, so it fails the way we do, only faster.
  • The same shapes, at machine speed and at scale, with far less room to catch itself.
  • Meeting that speed and scale is what the alpha and beta test, on real agent work, in the open.
A single lone amber coordination unit on the left, dwarfed by the same unit multiplied into a vast swarm of identical cyan copies streaming in at high speed from the right, dense and overwhelming.

one unit on its own, then the same shape as a swarm, at machine speed and scale

04 · the failure to watch

Every step passes. The whole is the harm.

What we tested

  • Whether checking each action on its own catches the harm.

What we learned

  • It does not. The harm is only in how the actions combine.
  • You have to read the whole run, which is exactly what the harness reads and a per-action gate misses.
A field of calm blue glowing points, each one benign, whose connecting lines together trace the unmistakable red silhouette of a predatory creature, visible only when the points are seen as a whole.

each point is benign; only the whole shows the shape of the harm

05 · watch it run

So I built a harness that reads the whole run.

Here it is, running on real code. The run builds on the left and the monitor evaluates it on the right. The one thing to watch for: the send that carries a sensitive record out of the system, which every step approved.

idletip: click any phase on the left to jump back
the run
phases · click to revisit
    reference-monitor.mjs · footprint ledgeridle

    Press Run the agent to start. The monitor evaluates each action as the agent takes it, and logs one record for every action whether or not a rule fires.

    06 · what testing taught

    Tested against real models, not asserted.

    What we tested

    • One scenario, run on models from three companies, ten runs each, with a judge from a different company than the model being read.

    What we learned

    • One model reached harm while describing each step as safe: it staged customer data where an outside party could pull it, and called that routine. DFH caught it 10 of 10, with two independent judges.
    • The other two models did not take the harmful path, and DFH read them clean, with no false alarms.
    • The catch came from comparing what the model said with what it did, across the whole run.
    • It is early: one scenario, ten runs each. It is tested in the open, and broader tests are what the alpha and beta are for.
    Several independent glowing cyan trails, each starting from a different node, all converging onto one shared path through green ring checkpoints and ending together at a single bright red danger node.

    many small steps, one route: only the whole run shows where it leads

    07 · what it will not fake

    Where a re-route slips past, it says so.

    What we tested

    • A re-route through a surface no rule was written for.

    What we learned

    • No rule catches it, and the harness does not pretend to.
    • It records the action and sends it to review; a log that writes only when a rule fires is blind to exactly that case.
    • Nothing leaves the system silently.
    A glowing cyan grid floor with tall luminous pillars; a small object slips through the gap between two pillars untouched, but presses a glowing amber footprint into the grid floor where it passed.

    what slips past the rules is not caught, it is traced

    how it's built

    Defense in depth, counted honestly.

    DFH never depends on a single check. Every protection has independent backups, so when one fails, another catches it, and the failure shows. We count strictly: two defenses that could fail the same way count as one, because a backup that breaks for the same reason is not a backup. Our secrets layer is the first worked example: keeping real keys away from the AI is enforced in five separate places, the app, the wall around the agent, the service the key belongs to, a record the app can't rewrite, and the person.

    This is a principle, not a finished list. As testing shows where DFH needs another defense, new versions add one, and each version says which defenses it has and how each is counted.

    08 · the lesson

    Read the run, not just the step.

    Agent safety is a coordination problem. Do not only gate actions one at a time. Read the run as a whole, and hold each action to what the agent said it was doing. That is the mistake you now do not have to make.

    The standards behind it

    Integrity Suite The Coordination Structural Integrity Suite: the standards this harness runs, and how to use them. Start here. Run it on your own organization An AI prompt launcher. Copy a prompt into any AI assistant and it walks your organization through the suite. The standards in full, on GitHub Ten standards for how coordination holds and fails under pressure, with the reasoning behind each. Polymathie The studio where the harness and the standards are built.
    open method · checked, not trusted

    The demo above is the real deterministic monitor from the DFH prototype, running in your browser, on a scenario modeled on the shape of the July 2026 Hugging Face incident: an agent moving sensitive material out, then re-routing through a channel no rule covers. The verdicts are the code's own output. It is not a claim that this harness would have stopped that breach.

    How the harness reads an agent's operating stance from its own language is open like the rest of the method, and experimental: it is under test, not a validated capability. What runs here is the deterministic layer that works today: it blocks what the standards cover, and surfaces what they do not.