Executable, inspectable, stateful, governed — and gated.

A field survey just mapped "code as agent harness" — code no longer as the generated artifact, but as the medium agents act through ("Code as Agent Harness", arXiv 2605.18747; listed affiliations Meta, Stanford, UIUC). Let's say it upfront: a survey describes a landscape, it does not validate a product. What it does do is name the ground. And it closes on a sentence we could have written: the systems that matter will combine four properties — executable, inspectable, stateful, governed.

Four properties, on the delivery side

The harnesses the paper studies are runtimes: they plan, execute, observe, and repair while the agent runs. runward is not a runtime and never will be. It is the delivery layer above: it records decisions and judges evidence at rest; it executes none of the agent's work. The four properties are embodied there all the same — one command and one ADR each:

• Executable. The verdict runs: runward check --json, fixed exit codes — same repository, same verdict, replayable in CI. Conformance to declared rules is enforced at the gate, not in prose (ADR-0001).
• Inspectable. The rule set is a machine surface: runward rules --json lists the effective rules, runward explain prints each rule's contract and its rationale, inline (ADR-0024).
• Stateful. runward status reports the real lifecycle position, reopenings included: mission state is an artifact on disk, not a session memory (ADR-0033).
• Governed. Handover is a gated phase — crossed only on verified evidence — and the decision → ADR → manifest chain lands in a citable OSCAL mapping via runward compliance (ADR-0026).

Same grammar as the paper, different floor. The survey recommends "deterministic sensors and human-review gates" to govern the runtime's state transitions; runward applies the same discipline to the one transition no runtime ever sees: the one that decides whether the system may ship.

The empty box

The word "gate" appears some fifty times in the paper. Human gates genuinely exist there: runtime HITL gates, permission tiers, approvals as auditable state transitions. So let's be precise about what the corpus does not have: none of the surveyed systems describes a deterministic human delivery gate. A byte-replayable verdict, zero LLM in the verdict path, crossed by a human on evidence rather than confidence. It is a narrow box; it is ours, and the field survey records no one else in it.

Where we diverge — and why that's good news

A confrontation that found only convergences would prove nothing. Here it is: the paper reports that LLM-simulated execution reaches "98%+ precision and recall" and recommends a mature harness using "linguistic reasoning as the fast path", with execution as the verification oracle only for the failure modes that require it (§3.4). On its own ground — the economics of the runtime repair loop — we have no quarrel with it. In the verdict path, runward refuses it by dated decision: LLM verification is advisory, never the gate (ADR-0007). The same paper elsewhere demands signals "that cannot hallucinate"; it carries that tension within itself. We picked a side and locked it.

Four properties the field converges on naming, one box no one else occupies, one divergence owned in writing. That is our reading of the paper; the paper, for its part, has no opinion about us — and that is exactly as it should be.

---

Install: npx runward init

The paper on arXiv · The repository on GitHub · All news

← All news