TrueForge — the harness as a switchboard

The system prompt is assembled as a tree of XML sections — <agent-identity>, then a section per enabled capability (sandbox, sub-agents, deferred tools, generative UI), then <user-instructions> wrapped in CDATA so the operator's text is delivered as data rather than markup. The docs are firm about what belongs there: the agent's role and audience, not tool documentation (injected) and not procedures (those are skills). An agent can also carry seed messages, injected at the top of every new session before the user speaks.

There is no grep, no read, no retrieval index in the core — material arrives through whatever MCP servers the agent is attached to, or through a shell in the sandbox. What the harness owns is the shape of what arrives: get_tool_output_schema fetches a tool's output schema before the model writes code against it, and Code Mode lets a Python script call MCP tools through an in-sandbox client and print only the fields it wanted. Delivery is bring-your-own; the filter on it is built in.

Four layered mechanisms, each with a number. Deferred loading: preload is false by default, so a server contributes its name and description and four meta tools — list_tools, get_tool_info, get_tool_output_schema, call_tool — until a schema is asked for. Large-response offloading: over 6,000 tokens for one result, or 10,000 combined across parallel calls, the payload is written to a sandbox file and replaced by its first and last hundred characters plus the path. Sub-agents return only a final message. Compaction: when prompt plus completion tokens cross 50,000, a 931-token prompt turns the whole history into one assistant summary followed by a fixed continuation note — the working context is overwritten; the session's event record is not.

Every external tool is MCP, remote, over HTTP — with header auth or OAuth including dynamic client registration, and an in-chat Connect button when a server needs authorising mid-run. Per server, selectors resolve against the annotations the server publishes: enable @all or @read-only, require approval for @write and @destructive by default, or name tools literally. The harness's own tools are few and local: the sandbox, ask_user_question, create_sub_agent, and the OpenUI block for generative UI.

The stated position is sandbox as a tool, against agent in a sandbox: the loop and every credential stay on the server, and an isolated environment is provisioned only when a turn needs code, files, or a skill — then reused across the session and stopped after idle time. The boundary holds even for Code Mode: a script's MCP calls are bridged back to the harness, which applies the stored credentials, so the container never holds a token. Approval is the second gate — write and destructive tools pause the turn until a human allows or denies. Providers are bring-your-own; the docs name Daytona as the only supported one today.

The session is an event log, and the runtime README states the ordering rule as law: yield the event, let the consumer persist it and possibly throw, and only then mutate memory. Sessions, turns, threads, and events go to SQLite in local mode or Postgres in hosted mode, with a Redis Stream fanning events out across replicas; a conversation survives a reconnect, a restart, and a sandbox crash. Compaction overwrites the model's working context and leaves the record whole, so the full history stays queryable through the events API after the model has forgotten it.

One thread loop with three processor phases — pre-send, pre-LLM, post-tool-call — that compaction and offloading plug into, streamed step by step over SSE. The loop pauses in two named states, approval required and response required, and will not accept a new user message while either is open. A safety stop caps iterations per turn at 100, adjustable to 1,024; a response format can demand JSON against a schema. The same loop is driven from the chat UI, the HTTP API, or an embedded React client.

A single create_sub_agent tool, on by default. A child gets the same tools and the same sandbox but a fresh context — the tool description warns the model that the child has no access to the conversation and must be given a self-contained brief — and returns only its final message. Children run in parallel and the root waits for all of them; they cannot ask the user anything, though their approval-gated calls still pause for the human; and delegation is one level deep by rule. With a model set configured, the root picks a model per child from a described list.

Skills are git repositories. A SKILL.md with name and description in frontmatter, registered once by URL, path, and ref — pin a tag for production — and attached to an agent by name. Only the name and description ride in the prompt; when the model chooses one, a sparse clone lands at /opt/tfy/skills/{name} in the sandbox and the model reads the body and runs the bundled scripts there. Skills therefore require the sandbox, which makes the progressive disclosure literal: the second stage is a filesystem.

Observability is the event log itself — every model message, tool call, approval, and context overwrite is an event you can subscribe to live or page through afterwards — plus a tracing interface with OpenTelemetry spans around MCP operations and the sandbox. Verification of the answer is thinner: a JSON schema on the response format is the only check in the loop. The judge lives outside it, in a benchmark harness the repo ships — a blind LLM grader over DevRev's Enterprise-Bench that scored the harness at 10.7 of 14, level with Claude Managed Agents. The roadmap names an evaluation pipeline in CI as the next step.

Nothing compounds on its own. An agent is a spec in the database and evolution is editing it — a new model name, a tighter tool list, a skill attached, a threshold moved; skills evolve where they live, in git. The roadmap is candid about what is missing: automatic model selection per task, agent instructions auto-composed from a chat that went well, and approve-once so a decision outlives one call. Each of those is a place a lesson could persist; today each is a human's edit.