Enterprise Production Deployment

# .harness/config.toml — Complete Enterprise Configuration

# === Provider Selection ===
# Provider and model are set via CLI flags (-p, -m),
# environment variables, or the router configuration below.
# Default provider: anthropic
# Default model: determined by provider

# === Router & Budget ===
[router]
strategy = "cost_optimized"
fallback_chain = ["anthropic", "openai", "google"]
max_cost_per_session = 5.00
max_tokens_per_session = 1000000
simple_task_model = "claude-haiku-4-5-20251001"

# === Permissions ===
[permissions]
mode = "accept_edits"

# === Policy ===
[policy]
policy_paths = [".harness/policy.yml", "~/.harness/policy.yml"]
simulation_mode = false

# === Audit ===
[audit]
enabled = true
scan_pii = true
retention_days = 365
retention_max_size_mb = 1000
log_tool_args = true

# === Sandbox ===
[sandbox]
enabled = true
mode = "docker"
max_memory_mb = 1024
max_cpu_seconds = 60
network_access = false
docker_image = "python:3.12-slim"
allowed_paths = ["/workspace"]
blocked_commands = ["rm -rf /", "curl", "wget", "nc"]

# === OpenTelemetry ===
# OpenTelemetry is configured via environment variables:
# export OTEL_SERVICE_NAME="harness-agent"
# export OTEL_EXPORTER_OTLP_ENDPOINT="http://localhost:4317"
# export OTEL_TRACES_EXPORTER="otlp"
# export OTEL_METRICS_EXPORTER="otlp"

# OpenTelemetry is configured via environment variables:
export OTEL_SERVICE_NAME="harness-agent"
export OTEL_EXPORTER_OTLP_ENDPOINT="http://localhost:4317"
export OTEL_TRACES_EXPORTER="otlp"
export OTEL_METRICS_EXPORTER="otlp"

version: "3.8"
services:
  jaeger:
    image: jaegertracing/all-in-one:1.52
    ports:
      - "16686:16686"  # Jaeger UI
      - "4317:4317"    # OTLP gRPC
    environment:
      - COLLECTOR_OTLP_ENABLED=true

  prometheus:
    image: prom/prometheus:v2.48.0
    ports:
      - "9090:9090"
    volumes:
      - ./prometheus.yml:/etc/prometheus/prometheus.yml

  grafana:
    image: grafana/grafana:10.2.0
    ports:
      - "3000:3000"
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=admin
    depends_on:
      - prometheus
      - jaeger

docker compose -f docker-compose.monitoring.yml up -d

global:
  scrape_interval: 15s

scrape_configs:
  - job_name: "harness"
    static_configs:
      - targets: ["host.docker.internal:9464"]

version: 1
defaults:
  decision: ask
rules:
  - tool: Bash
    decision: deny
    conditions:
      - type: command_matches
        pattern: "rm -rf /.*"
    description: "Org: Never delete root paths"
  - tool: Write
    decision: deny
    conditions:
      - type: path_matches
        pattern: "\\.(env|pem|key)$"
    description: "Org: Protect secrets"

version: 1
inherit_from: "~/.harness/policy.yml"
rules:
  - tool: Bash
    decision: deny
    conditions:
      - type: command_matches
        pattern: "docker push.*"
    description: "Team: No manual docker pushes"

version: 1
inherit_from: "../team-policy.yml"
rules:
  - tool: Read
    decision: allow
    description: "Project: Allow all reads"
  - tool: Edit
    decision: allow
    conditions:
      - type: path_matches
        pattern: "src/.*\\.py$"
    description: "Project: Allow editing Python source"

groups:
  - name: harness
    rules:
      - alert: HighCostSession
        expr: harness_cost > 5
        for: 1m
        labels:
          severity: warning
        annotations:
          summary: "Harness session cost exceeds $5"

      - alert: HighErrorRate
        expr: rate(harness_tool_calls{status="error"}[5m]) > 0.1
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "Harness tool error rate above 10%"

      - alert: HighLatency
        expr: harness_provider_latency > 30000
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "Harness provider latency above 30s"

      - alert: AuditChainBroken
        expr: harness_audit_chain_valid == 0
        for: 0m
        labels:
          severity: critical
        annotations:
          summary: "Audit log chain integrity check failed"

# production_agent.py — Enterprise-grade Harness deployment
import asyncio
import logging
import sys
from pathlib import Path

import harness
from harness.audit.logger import AuditLogger
from harness.providers.budget import TokenBudgetTracker, BudgetExhaustedError

logging.basicConfig(level=logging.INFO, format="%(asctime)s %(levelname)s %(message)s")
logger = logging.getLogger("harness-prod")

async def run_production_task(prompt: str) -> dict:
    """Run a task with full enterprise controls."""

    # Budget guard
    # Note: This budget tracker monitors cost AFTER each run completes.
    # To enforce budgets mid-run, configure the [router] section in
    # .harness/config.toml with max_cost_per_session — the engine
    # checks the budget internally between turns.
    budget = TokenBudgetTracker(max_tokens=500_000, max_cost=5.00)

    result_data = {
        "success": False,
        "output": "",
        "tokens": 0,
        "cost": 0.0,
        "error": None,
    }

    try:
        async for msg in harness.run(
            prompt,
            provider="anthropic",
            model="claude-sonnet-4-20250514",
            permission_mode="accept_edits",
            sandbox_mode="docker",
            max_turns=50,
        ):
            match msg:
                case harness.TextMessage(text=t, is_partial=False):
                    logger.info(f"Agent: {t[:100]}...")

                case harness.ToolUse(name=name, args=args):
                    logger.info(f"Tool: {name}")

                case harness.Result() as r:
                    # Record final usage
                    budget.record_usage(
                        # Approximation: total_tokens doesn't split input/output
                        input_tokens=r.total_tokens // 2,
                        output_tokens=r.total_tokens // 2,
                        cost=r.total_cost,
                    )
                    # Check if we should stop future runs
                    budget.check_budget()

                    result_data.update({
                        "success": True,
                        "output": r.text,
                        "tokens": r.total_tokens,
                        "cost": r.total_cost,
                    })

                    snap = budget.snapshot()
                    logger.info(
                        f"Complete: {r.turns} turns, {r.tool_calls} tools, "
                        f"${r.total_cost:.4f}, {r.total_tokens:,} tokens"
                    )
                    logger.info(
                        f"Budget: ${snap.cost_remaining:.2f} remaining, "
                        f"{snap.tokens_remaining:,} tokens remaining"
                    )

    except BudgetExhaustedError as e:
        logger.error(f"Budget exhausted: {e}")
        result_data["error"] = str(e)
    except Exception as e:
        logger.error(f"Unexpected error: {e}")
        result_data["error"] = str(e)

    return result_data

async def main():
    if len(sys.argv) < 2:
        print("Usage: python production_agent.py 'Your task here'")
        sys.exit(1)

    prompt = sys.argv[1]
    logger.info(f"Starting production task: {prompt[:50]}...")

    result = await run_production_task(prompt)

    if result["success"]:
        logger.info(f"Task completed successfully. Cost: ${result['cost']:.4f}")
    else:
        logger.error(f"Task failed: {result['error']}")
        sys.exit(1)

if __name__ == "__main__":
    asyncio.run(main())

uv run python production_agent.py "Audit all TODO comments and open GitHub issues for each"

[router]
max_cost_per_session = 10.00       # Individual session cap
# Monthly budget tracked externally via audit logs + Prometheus