veritas-kanban

Harness Compatibility

Veritas publishes one reviewed compatibility record for Buzz, Grok Build, OpenAI Codex app-server, Claude Code, and GitHub Copilot CLI. The canonical machine-readable form is:

GET /api/config/harness-compatibility

Settings -> Agents and vk doctor --json consume that record. Run telemetry stores the same profile capability digest beside the existing support tier, provider version/build, runtime-manifest digest, and failure class.

Reviewed matrix

Harness Profile Tested build Transport Source availability Important limitation
Buzz buzz-agent Buzz v0.4.24, commit 710ed9fff57878a1d69f809b80a6ee0416c53fc4; buzz-agent 0.1.0 ACP v1 stdio Open source Task execution uses buzz-agent; relay, identity, community, and workflow checks remain separate.
Grok Build grok-build v0.2.111, build 94172f2aa4e5 ACP v1 stdio Partial source lineage The released artifact self-reports alpha and is not fully traceable to the public source tree.
OpenAI Codex openai-codex-app-server codex-cli 0.145.0 app-server JSON-RPC v2 Open source Experimental methods remain excluded until pinned schemas and behavior are reviewed.
Claude Code claude-code 2.1.218 (Claude Code) stream-json process Partial source The complete CLI implementation is not public; some host enforcement remains provider-dependent.
GitHub Copilot CLI github-copilot-cli v1.0.74, commit 2b809c84e87dbcc88f897cb4f3fb97c43b77af95 ACP v1 stdio Partial source ACP is public preview and provider-managed authentication has no non-consuming status probe.

The API is authoritative for the full capability list, reviewed evidence URLs, fixture paths, platform coverage, limitations, live readiness, and matrix digest. This table is an operator summary, not a substitute for current probe evidence.

Support tiers

Tier Definition
certified Installed build, configuration, runtime manifest, probe revision, and deterministic fixtures match passing evidence.
configured The executable adapter can dispatch, but current deterministic certification evidence is absent.
detected The executable is installed, but the profile is disabled.
degraded A readiness, compatibility, policy, or certification check failed.
unsupported The platform or configured provider has no safe executable adapter for the profile.

These definitions are emitted in the matrix response. CLI, API, web, and telemetry must not maintain provider-specific alternatives.

Certification and invalidation

Each reviewed profile includes a deterministic fixture set, fixture revision, capability digest, evidence paths, and current status. Certification is invalidated by any change to:

Credential-gated smoke evidence is supplemental only. It can add exact-build runtime evidence, but it cannot replace or overwrite a deterministic failure. Raw observations retain launch-manifest, runtime-manifest, task, attempt, and event references through harness-conformance-result/v1.

Buzz additionally has a composed credential-free gate:

pnpm test:buzz:compatibility

Its matrix record names the relay compatibility, communication/replay, ACP, run-scoped MCP, persona/team import, and workflow-trigger fixtures. Live Buzz smoke is supplemental and never replaces a deterministic failure. See the Buzz integration guide.

Operating each harness

Detailed installation, authentication, configuration, permissions, MCP, worktree, upgrade, degraded-state, and troubleshooting guidance is maintained with each provider:

The common operating contract is:

  1. Install the exact tested build.
  2. Authenticate through the provider’s login or an allowlisted boot credential.
  3. Enable the built-in profile without adding provider-owned launch bypasses.
  4. Assign a Veritas sandbox, permission, and approval policy.
  5. Run vk doctor --json; fix any degraded or unsupported evidence.
  6. Re-run deterministic certification after an upgrade or evidence revision.

Veritas launches all five harnesses in the assigned task worktree. MCP access is limited to the immutable task catalog plus the system-owned veritas-run bridge. Unsafe launch flags, unexpected versions, stale certification, and adapter/profile mismatches fail closed before an attempt is created.