lzt-harness

The challenge

A single-agent Claude Code session loses context faster than I can ship useful work, and the failure modes of unattended agentic execution (silent git operations, accidental file deletion, runaway tool calls) need belt-and-suspenders enforcement rather than a hopeful prompt.

My role

I built a multi-agent harness on top of Claude Code with planner, implementer, and reviewer routing, hooks that block destructive operations by default, and an MCP broker that surfaces intent in response metadata.

What I did

1. 01

   Multi-agent routing tier

   Why: Specialization beats raw context. A focused implementer does not drift the way a single agent juggling planning and execution does, and a reviewer catches what the implementer misses.

   Trade-off: Higher coordination overhead per task and longer time-to-first-output for trivial work. The discipline is worth the overhead for any task that crosses a single session.

2. 02

   Hooks that block destructive operations by default

   Why: Belt-and-suspenders enforcement: the agent should never be one keystroke away from wiping a working tree or force-pushing a branch. The hooks block by default and require explicit operator approval to bypass.

   Trade-off: About 50 milliseconds of latency per tool call. Bypass requires a literal approval phrase in the same turn, which slows me down too — by design.

3. 03

   Intent-filtered MCP broker

   Why: Only allow-listed tools fire telemetry, and the broker surfaces what an agent asked for versus what it actually got back. The audit chain stays readable even when a session runs for hours across multiple sub-agents.

   Trade-off: New MCP integrations require an explicit allow-list entry. The friction is intentional — the broker is the chokepoint that keeps unexpected tools from running silent.

What changed

• Effective session length

  Before: About 30 minutes per single-agent session

  After: 4–6 hours across multi-agent sessions

  Evidence: Internal session logs, 2026-Q3

• Silent work-loss incidents

  Before: About 2 per month

  After: 0 in 2026-Q3 (remaining cases caught by the teleport safety net as advisories)

• Audit chain readability

  Before: Opaque — single agent, no per-tool trace

  After: Per-tool intent log, browsable after the session

Trade-offs

The harness is private because the rules and hooks are tuned to my own failure modes. The patterns (multi-agent routing, destructive-command hooks, intent-filtered broker) generalize, but the specific rule files do not.

What I learned

The failure mode of agentic work is not the agent — it is the missing guardrails around it. A disciplined harness turns the agent from a liability into a tool I trust at 3am.

Stack

• Go
• Rust
• Python
• Shell
• MCP