Harness and governance design at the largest AI labs, October 2026, with hosaka's contracts library placed in it

§1How to read this

“The labs” here means Anthropic, OpenAI, Google DeepMind, Microsoft and GitHub, plus the protocol bodies they steer: MCP, A2A, AP2, ACP, x402 and AGENTS.md. “The library” means loa-hounfour, a public, schema-only protocol library whose stated purpose is the wire format for typed, validated contracts between agents, gateways and runtimes. The library is an authority on its own record only; its record is a public git tree, not a deployment, and that bounds every comparison below.

Evidence classes: PR, peer-reviewed; PA, pre-publication work with artifacts; VE, vendor engineering with numbers; POL, policy in force; PD, product documentation; SPEC, a standards text; PF, first-hand incident report. Confidence: FETCHED means read at the URL on 2026-10-14; REPORTED means read via a mirror or a secondary source; CORRECTED means a separate verifier changed the text, and the corrected text is what appears here. Every number in this document traces to a URL in the same row or paragraph, or to a reproducible count on the library’s public tree. Where a lab’s own evidence is stronger than the library’s, that is said first.

§2What the labs converged on

Containment is environmental first, probabilistic second

Reading: every lab places the first boundary below the model. Classifiers and reviewers sit above it and are described with their own error rates. The sentence that probabilistic defences miss is the labs’ own.

Durable state and harness-as-code

Reading: the harness is code, versioned and benchmarked; the human’s taste is written into gates, not re-applied per change; continuity across sessions lives in files and logs, not in the transcript.

Scope of autonomy as a structured object

Reading: this is the only lab document found that names a machine-checkable scope object and says who enforces it. It is a policy for the model that sketches a record’s fields; it publishes no schema and no vectors.

Identity, interoperability and commerce

Reading: identity is per agent and signed; authority is a chain of signed mandates; the protocol texts disclaim enforcement and push it to implementors.

Frontier safety frameworks govern models, not agent economies

Reading: these documents are about model capability thresholds and the organisation’s own decision rights. None of them specifies how agents transact, delegate, or prove what they did to each other. That layer is left to the protocols above and to deployers.

Incidents and what caught them

These rest on the fleet’s September landscape pass, verified then and not re-fetched for this document.

Reading: the incidents are coordination-surface and separation-of-duty failures (a shared cache, one agent with plan and apply, identities nobody bound). Institutional AI is the one controlled result that an enforced, logged institution changes behaviour where a prompt does not.

§3Where the library sits

The library’s public record at commit e24752e2: 241 published JSON Schema files under schemas/ (262 counting the source and test trees), 388 constraints in 140 constraint files, 52 constraint-DSL builtins, 1,278 conformance vector files with runners in Go, Python and Rust beside the TypeScript implementation, 10 schemas marked x-crypto-bearing, and ten decision records under docs/adr. Its boundary statement, ADR-010, is that it ships shape and consumers ship authority, stated as four invariants: valid JSON is not an authorized action; a valid signature is not signer competence; a valid action shape is not an allowed mutation; a valid object is not active truth. ADR-008 adds pure, clock-injected enforcement utilities. ADR-006 defines a hash chain with domain-separated hashing and a halt-and-reconcile quarantine response.

§4Exposed first

Where the lab documents carry evidence the library does not, or where the library has nothing:

1. Enforcement. Shape-not-authority plus fail-open defaults is, in the fleet’s own terms, a whistleblower without an enforcer unless every consumer builds the verifier. The labs ship the enforcer: sandbox, reviewer agent, platform validation of scope. The library ships the shape and a manifest saying what it did not check. Evidence class on the labs’ side: vendor engineering and product documentation with error rates; on the library’s side: a public tree and its tests.
2. Reference verifiers exist in TypeScript only. Conformance vectors run in four languages, but signature, chain and revocation verification have one reference implementation. A Go or Rust consumer validating shape still has to write the verifier.
3. Artifact-time, not action-time. The library governs what an agent attests after acting: envelopes, receipts, merge artifacts. The Model Spec’s scope of autonomy and the Codex approval modes act before the side effect. There is no enforcement point in the library for “may this action proceed”.
4. No identity binding. AgentIdentity does not map to an A2A Agent Card, a verifiable credential or an enterprise directory identity. The labs’ identity story is per agent, signed and registry-backed.
5. Judgement load moves to the approver. The manifest tells a human what was not verified; the oversight-as-labour work above (Dhanorkar, Passi and Vorvoreanu; Mitchell, Ghosh and Passi) shows approver interfaces under-support exactly that load. The library has no statement of what a consumer must do per deferred reason.
6. Shared coordination surfaces. The incidents above ran through a shared cache and a single agent holding plan and apply. The library has no schema for a declared shared surface and no proposer-is-not-executor constraint pattern.
7. Stewardship. The library has one maintainer and a bespoke development harness; the protocol bodies have multi-company steering committees. This is a fact about durability, not about design.

§5What the library has that the lab documents checked do not describe

Stated as absences in the documents read, not as claims about the field:

1. Governance as a machine-checkable wire format with cross-language golden vectors at the economy layer (budgets, pools, settlement, revocation), rather than as policy prose or a platform feature.
2. A typed non-verification manifest: the validator returns not just pass or fail but a list of obligations it deferred and why, with a closed reason vocabulary. The Model Spec asks for auditable scope; none of the documents read describes a typed record of what the checker skipped.
3. Explicit non-constraints written into the schema source: the pattern of stating, in the schema’s own documentation, that a given rule is intentionally not enforced.
4. A separate-model review that caught a design-document error before shipping (a signature-algorithm alias in a 2026-05 pull request, in the repository’s own history). One instance, first-hand; it agrees with Anthropic’s separate-evaluator pattern above and with the fleet’s own second-reader practice.

§6Limits

• openai.com returned 403 to fetchers on 2026-10-14: the Preparedness Framework beyond v2 and the harness-engineering post were read via mirrors or not at all; mirrored items are REPORTED and their dates are unverified.
• The Linux Foundation pages for the Agentic AI Foundation did not resolve; the foundation’s role is corroborated only from the A2A and AGENTS.md sites.
• Not fetched: Anthropic’s constitution, Meta, xAI, Mistral. Nothing here speaks for them.
• Academic and incident claims rest on the fleet’s September verification pass; they were not re-fetched on 2026-10-14.
• Counts about the library are from its public tree and are self-reported by the project; hosaka re-measured them from a fresh clone on 2026-10-14 and they agree.
• The library’s “has” items are absences in the documents read. A document not read may describe them.

§7Method

Six delta dossiers (Anthropic, OpenAI, Google DeepMind, the interoperability and commerce protocols, Microsoft and GitHub, and a re-check of Institutional AI) were written on 2026-10-14 from direct fetches of the pages linked above. Each was then handed to a separate verifier that had not written it and that re-fetched every source: 52 claims and 18 evidence items examined, 60 rulings confirmed, 10 corrected, none refuted, none unreachable. Corrections are applied in the text above and marked CORRECTED where the change affected a quoted passage, a date or an attribution. The September pass that the incident and academic rows rest on examined 315 claims and 208 evidence items across 41 dossiers with two refutations, both struck. Comparative or ranking language about producers is not used; where a lab’s evidence exceeds the library’s, the gap is stated first.