The Model Was Right. The Harness Failed. — Vinoth Govindarajan, OpenAI

AI Engineer · 18 min · 273 sentences · from YouTube's caption track

Each timecode opens YouTube at the start of that sentence. Line anchors (#s42) are the cue ids in the WebVTT, and every line carries its start and end seconds. All transcripts has every talk, and the whole corpus as one file.

00:01[music]
00:13Thank you for choosing to spend this session with me.
00:16My goal today is simple.
00:19I want to convince you all that most of the production failures are not most of most of the agent failures are not model failures.
00:27Those are harness failures.
00:29So let's start with one production incident.
00:32The user saw the reply.
00:34The system forgot it happened.
00:36This is a failure shape I want to start with.
00:39Not a hallucination, not a crash, not a bad answer.
00:43The user visible edge looked healthy while the durable record had a hole.
00:50In this example, the user asked the customer the agent to remember a refund for a customer.
00:58The assistant said it recorded the fact for the next turn.
01:02The interface looked normal.
01:03No red screen, no obvious failures.
01:06But the next turn cannot reconcept the fact.
01:09The user experienced success.
01:11The system inherited incomplete reality.
01:16Why this matters?
01:18The crash is annoying, but at at least it gives you a boundary.
01:22You know some you know something stopped.
01:24You usually see an error.
01:26You can often start from last known good point.
01:30Silent success gives you a lie.
01:32Delivery can succeed while the persistent fails.
01:36The user has no reason to doubt the reply.
01:40The operator has no obvious alarm.
01:43The next turn can still sound confident because the model is coherent but it is coherent over a broken history.
01:53That is why agent reliability matters.
01:56and agent relity cannot stop at model quality.
02:01Hi, I'm Ben.
02:03I work on core data and AI infrastructure at OpenAI.
02:07Before that, I worked on distributed systems at Apple and Uber.
02:12Outside of the work, I write the agent stack where I try to explain how the production AI and data systems work under the hood.
02:20I'm daughter of OpenClaw and this is not a openclaw product pitch.
02:25This is a pure system design talk.
02:27I'm using open claw as a public case study because its issues code docs makes the harness around the agent unusually visible.
02:38Here's a production contract for the talk.
02:41A model proposes the harness commits and the receipts proves it.
02:46The model can may suggest a message, a tool, a edit or an command.
02:51But model is not the production boundary.
02:54The harness owns the state transition, the authority check, the ordered commit and the receipt is the evidence that survives the term.
03:02Open clause is the case study and the contract is the takeaway.
03:07If you remember only three things from this talk, make it these.
03:10Own the state, order the mutation and prove the action.
03:16A fact needs only one owner and one replay path.
03:19Shared mutable state needs one ordered commit path and transcript is not the proof.
03:25A transcript tells you what the agent said.
03:27A receipt tells you what the system allowed, attempted, executed and what the user visible edge confirmed.
03:36To create a simple mental model, I created this car analogy of the harness.
03:42The model is the engine.
03:44It matters a lot.
03:46But nobody buys a production car by just looking at the horsepower alone.
03:52You also care about steering, brakes, road rules, dashboard, and a black box.
03:58The model gives you capability, but the harness gives you control.
04:03A powerful engine with no brakes is not autonomy.
04:06It is a liability with good acceleration.
04:09Here is the harness blueprint I wanted to uh discuss today.
04:15Every agent we know of like personal agents such as open claw or Hermes, coding agents such as codeex, cursor, open code or cloud code uses the same underlying architecture.
04:28Events enter from many surfaces a chat, web hook, timer or heartbeat or another external system.
04:36The control plane maps the events to a session key and the session key determines the state boundary.
04:43The session lane gives you one active writer for that mutable state.
04:47The runtime calls the models and tools.
04:50Tools act through approvals and policies and audit rail becomes the run receipt.
04:55This is the blueprint event session key throttle tools audit.
05:00The blueprint is a talk and the incident of the proof that each boundary matters.
05:08context is assembled uh in agent runtime does not usually remember in human sense.
05:16It is stateless.
05:18The harness rebuilds the working state for the each turn.
05:21The working set may include the transcript, session state, memory, policy, tool definitions.
05:28[clears throat] The model only sees what the harness supplies.
05:32If one input is missing or stale, the answer may still sound coherent.
05:37Coherence does not proves the working set was complete.
05:43These failures are not new.
05:44We already know about timeouts, retries, item potency, locks, ordering, and state ownership.
05:52What change is the agent setting?
05:55Now these failures sit around a probabilistic planner with dynamic plans.
05:59It's rebuilding the context for every turn.
06:01there are more event sources and it can act through more action surfaces.
06:06So these failures are familiar agents makes them easier to trigger and harder to explain.
06:13That's why agent harness matters.
06:18Let's talk about the first failure mode.
06:27This is the same failure mode I started this talk with.
06:31The user sees a success.
06:33The source of truth cannot replay it.
06:35Delivered is not remembered.
06:38In this stateole open claw issue, a telegram reply could succeed while the router turn was not written to the active context or transcript.
06:48The user saw the response.
06:49The log looked healthy.
06:52But the next turn had no durable record of the next change.
06:55A successful send proves transcript.
06:57It does not prove the future context.
07:00That distinction matters because the model can answer fluently over an incomplete record.
07:06The missing boundary was not intelligence.
07:08It was the state ownership.
07:12By owner, I do not mean a person.
07:15I mean the system of record whose persistent state becomes the truth.
07:20A calendar event belongs to the calendar system.
07:22A support status belong to the ticketing system.
07:25While a code change belongs to a workspace or repository on a conversation turn belongs to a session transcript and a user preference belongs to a memory store.
07:35Storage tells you where the bytes live.
07:37Ownership tells you who can reconstruct the reality.
07:43A replay is not a reliable memory until until a named owner can replay it.
07:47A system has to persist the turn.
07:50It has to name the owner or system of record and it has to make the replay possible.
07:55The question is simple.
07:57For every fact the agent might use later, who owns it and how would you replay it?
08:04If no owner can replay the fact, this the system did not reliably remember it.
08:11Once we know who owns the state, the next question is who's allowed to change it and in what order?
08:18Two correct rights can still produce one wrong outcome.
08:22and last writer wins is not a consistency model.
08:28In this overlapping writer open claw issue describes a load modify save race.
08:34Two callers loads the same old state.
08:37Each changes a different record.
08:39The sil the second save silently erases the first.
08:43The user may see a dismissed commitment return or receive a duplicate follow-up.
08:48Neither writer is malformed.
08:50Both operations are locally correct.
08:52The missing boundary is civilization around the commit.
08:58The invariant is not no concurrency.
09:00That would be too slow and it would miss the point.
09:03You can fan out sub agents.
09:05Parallel reads are fine.
09:06Independent retrieval is fine.
09:08Many sessions can also run at once.
09:11The rule is narrower and simple.
09:13One ordered commit path for one mutable state boundary.
09:17This mechanism may be a Q, a mutx, a transaction or a lock.
09:22You can use locks or mutx across the sessions and cues or transactions within a session.
09:27Be conservative of the commit time and not across the whole system.
09:34Users do not see cues or locks.
09:37They see behavior.
09:39A last correction feels forgetful.
09:41A stuck lane feels dead.
09:44And completion before delivery feels confused.
09:47Ordering is a product feature because users experience ordering books as personalities.
09:55Now let's talk about time in production.
09:58Silence cannot be neutral.
10:00Let's review.
10:01Uh the next uh failure mode is life cycle failure mode.
10:05The run waits for an event that cannot arrive.
10:08Silence is not a terminal state.
10:12In this dangling tool call issue, the session contains a tool call but no matching tool result.
10:18A process may have died.
10:20The connection may have dropped.
10:22A timeout might have happened before the results were recorded.
10:26The exact cause uh matters for debugging.
10:29The production failure is much simpler.
10:32The run is waiting for a event that will never arrive.
10:36New messages cue behind that silence.
10:39To the user, the agent simply looks stuck.
10:45Runs needs deadlines and cancellation.
10:47A deadline bounds the weight.
10:49Watchdog makes the stuck work visible.
10:52Tools needs time modes and error results.
10:54Channels needs recovery commands that do not wait behind the stuck work they are trying to fix.
11:00Every external boundary needs an ending.
11:02Success, failure, timeout, cancel, or max attempts.
11:08Most importantly, the receipt records the terminal outcome.
11:11So the next step does not have to guess.
11:14Bound the work before the work bounds you.
11:19Now let's uh we can move on from state to authority because a chat becomes risky when it becomes an action.
11:26Capability is not execution.
11:28The model can request an action.
11:30Requestability is not authority.
11:32Approval needs a shape.
11:35In this approval drift issue, expired approved call back was stated as retraable.
11:41The state call back state durable served restarts and blocked later channel work.
11:46The battle click existed.
11:48The valid authority did not.
11:50This is the mistake.
11:51Treating approval as a vague memory that the human was near the system or clicked yes.
11:57Approval as a scoped execution state, it must stay bound to the action it authorized.
12:02An expiration must terminate rather than loop.
12:07A useful approval object answers who approved in what session and run for which tool and for which arguments and for how long and with what outcome.
12:20It also point to the receipt.
12:22If those fields fall off during a retry replay or a channel call back the harness can no longer prove the action was being executed is the action being approved.
12:34The general lesson is simple.
12:35Capability is not execution.
12:38Least privileges narrows the tool surface.
12:41Scoped credentials ensures the right identity is used for the action.
12:45Approval and audit decides what happens before and after the execution.
12:49The model can reason about the boundary but it should not be the boundary.
12:53The model can request but the still the system decides.
13:00Finally, even if the tool says success, the user visible B may disagree.
13:05Internal component reports success.
13:07The user visible surface shows nothing.
13:09This is the inverse of the opening incident.
13:11We saw in this missing edging edge proof issue.
13:15The message tool reported success for a web chat or TUI run, but the message did not render.
13:21Normal assistant reply still appeared.
13:23The tool proved that the internal path accepted the request.
13:27It does not prove the user saw the result.
13:29That difference change the conversation.
13:31The agent may later say, "I already sent it."
13:34And the user may truthfully say, "I never saw it."
13:37Internal success is not external proof.
13:41Proof is a chain, not a claim.
13:43Model proposed something.
13:45Policy allowed or denied it.
13:47Execution attempted it.
13:49User visible edge confirmed or failed to confirm the outcome.
13:54The receipt preserves the chain.
13:56A transcript records what the agent said.
13:58The tool results records what one component claimed.
14:02A receipt records what the agent can verify at the boundary that matters.
14:08Let me recap all the incidents.
14:10Here are the file failure shapes you you to look for.
14:13A state hole, overlapping writers, dangling tool call, approval drift, and missing edge proof.
14:19For each one, let's ask the same question.
14:22What did the user see?
14:24Which boundary it broke?
14:25And what would the receipt have caught?
14:29Here is the audit I want you to run when you get back to your team.
14:32Pick one agent system, not all of them.
14:35One trace one production, one real production path and ask for the receipt.
14:42The audit has five questions.
14:44What woke it up?
14:46What state did it inherit?
14:48Which authority did it use?
14:50What executed?
14:51And what evidence survived?
14:53These questions expose squashalty.
14:57They turn a fluent conversation into an inspectable production run.
15:02First, what woke it up?
15:04A user message, web hook, timer, tool result, sub agent, or a replay.
15:10Name the trigger and its identity.
15:12Without that, you cannot reason about dduplication, order, or authorization.
15:17Second, which state did it inherit?
15:20transcript, session state, memory snapshot, policy version, and tool surface.
15:25The model only reasons over the working set the harness assembled.
15:30Third, which authority did it use?
15:33Record the actor, session, tool, run, arguments, scope, and lifetime.
15:39A model request is not permission.
15:41Authority should bind to a one pending action.
15:46Fourth, what executed?
15:48Record the tool or API call, arguments, attempt number, item potency key, and external results.
15:54This is a side effect boundary, not the poor summary of what the agent intended.
16:00Fifth, what evidence survived?
16:03Did the ticket get updated?
16:04Did the message got rendered?
16:06Did the file got changed?
16:09Did the calendar event exist?
16:11The receipt should end at the boundary the usual the user usually cares about.
16:18Now let's apply the opening incident.
16:20The same order to the opening incident.
16:22What woke it up a user message?
16:25What state it owned?
16:27That was the broken boundary.
16:28What executed the channel send?
16:31What evidence survived delivery?
16:33What did not survive the durable turn?
16:38Delivery survived while the state did not.
16:41That gap is the harness failure.
16:44The agent uh do did not need a better model.
16:47The model did not need a better prompt.
16:50The system needed a better harness with complete receipt.
16:55Let me recap the same three things I asked you to remember from the start of my talk.
16:59Own the state, order the mutation and prove the action.
17:05A better model helps inside the turn.
17:07Ownership, ordering, life cycle, authority and proof keep the system sane across turns.
17:16A model proposes the harness commits and the receipts receipt proves it.
17:21Once text can become an action, the useful question changes.
17:25Do not only ask whether the model can reason.
17:27Ask whether the system can own the state, order the mutation, bound the work, constraint authority, and preserve evidence.
17:36A loop can answer a turn and harness can serve up production.
17:41If you want to go deeper, scan the QR codes.
17:44The first points to the agent open AI agents SDK where all these um harness are already built in so that you can use to build your own agents and second points to the agent stack where I write about the production agents
17:58systems in more detail.
18:00I'll be at the open booth after this talk if you want to talk about your harness design.
18:05Thank you.
18:07[applause]
18:21[music]