STEWARD HARNESSTHE WORKSHOP UNDERNEATH 1PUNI
The model proposes. The harness disposes.
Steward is a small deterministic harness around autonomous intelligence. The model gets somewhere durable to think, work, remember and propose changes. The harness keeps the keys: what may change, what must hold, and what counts as done.
It is not another agent framework. The reasoning is done by native agent CLIs — Claude Code, Codex, GLM, DeepSeek — with their own loops, tools and subagents. Steward owns only the authority those loops cannot grant themselves.
MIT licensed · pre-1.0 · built and shipped through itself. Both links in this paragraph are true.
01 / THE THESIS
FOUR COMMITMENTSTasks, decisions, findings and knowledge are files and commits, not rows in someone's session database. A branch is a possible future; a merge is acceptance; the default branch is accepted desired state. A model from a provider that does not exist yet can wake up, read the files and the history, and understand what we believe and how we got there.
A proposal is a branch. Only the harness turns an exact, tested revision into reality. Nothing is true because someone said it happened — only because the retained branch, the test evidence, the remote refs and the live release say so.
The commit that was tested is the commit that is pushed. Work, base and candidate are retained before publication; the push carries an exact-base lease; recovery observes the remote instead of guessing. What got tested is what lands.
Everything the model runs — providers, gates, builds — executes as an untrusted OS account through an execution broker. Push, transport and deployment credentials never enter a model-controlled process. The boundary is OS permissions, or it isn't there.
INTENT→WORK→CHECK→PUBLISHED.
02 / SCOPE
SAID PLAINLY| Steward is | Steward is not |
|---|---|
| A controller around native agent CLIs that bring their own reasoning loops, tools and subagents | An agent framework: no agent graph, role system or tool catalogue of its own |
| Git as the durable world: tasks and knowledge are files and commits | A memory service, vector store or proprietary session format |
| One daemon with one worker budget, first asked, first served | A workflow engine, scheduler or message bus |
| Exact-revision gates: the commit that was tested is the commit that is pushed | A CI system: the gates are your repository's own test and build commands |
| Target drivers that observe what a destination actually serves | A deployment platform: your release system still deploys; Steward checks that it did |
| A separate Unix identity for everything the model runs | A sandbox product: the boundary is OS permissions, or it isn't there |
| Operated from Telegram and the host CLI | A dashboard: the task board browses and changes nothing |
03 / ENGINEERING DOCTRINE
TWELVE PRINCIPLES, OPERATIONALThe doctrine is how the harness is built and how anything working on it is expected to think. Each principle earns its place as a test you can actually run. The method that applies them under pressure — stormbeslå — has its own section below.
Name the fundamental entities in one sentence each. If the problem has five ideas and the code exposes fifty, the abstraction is wrong until proven otherwise.
For every branch handler, ask: can this physically occur, given the invariants? If not, delete the state instead of handling it.
When code gets hard to reason about, don't ask how to organise it. Ask whether it should exist. Can a deletion replace a subsystem?
Real concurrency, protocols and trust boundaries stay. Translation between two shapes of the same data goes.
Permissions over warnings; schemas over prose. A rule that must be remembered is weaker than a system that cannot break it.
If the model can argue its way past a boundary, move the boundary outside the model. Intelligence works inside strong boundaries; it does not replace them.
Describe the component in one precise sentence. A paragraph of "and also" is several components wearing one coat.
Several symptoms, one suspect: find the smallest upstream cause that explains the most downstream observations.
If logic exists only to repair the representation, the representation is wrong. Derived information stays derived.
Generalise on the second real instance. Never on the first imagined one.
Existing behaviour may be required; existing structure is not. Sunk effort is not an argument, and neither is a passing test.
Judge every decision at repository scale: does it add a concept, a source of truth, another place state can diverge?
04 / STORMBESLÅ
DEMOLISH, THEN FILLStormbeslå — Swedish for "storm-fasten", boarding up before the weather hits — is the one method in the doctrine defended against anyone. Small edits have no constraint on their own size: each is locally defensible while the total grows, which is exactly how a well-behaved session leaves every commit green and the source seven hundred lines larger than it started.
So invert it. Pick a whole concept, not a convenient file. Delete it everywhere — the store, the module, its callers, its synchronisation, its recovery path, the tests that only protect that machinery. Leave a hole with the replacement primitive written on the rim. Do that everywhere in the concept before filling anything. Now the holes are visible, the line count has already fallen, and no fill can quietly cost more than what it replaced, because what it replaced is a number you can read. A hole is filled by a primitive, or it is not filled; a fill that recreates the removed subsystem means the representation is still wrong.
"A withdrawn task must stop its running gate" reads like correctness. It isn't. The requirement is that withdrawn work must not land. Whether the gate finishes first is a question about wasted CPU, and wasted CPU is not an invariant.
The travelling excerpt: a CPU wish dressed in the grammar of a rule — caught by the two questions to ask before deleting an invariant. Is it an invariant at all? Does the representation already hold it? One that fails the first was never real; one that fails the second lives in the wrong place. And the argument is not just written — it shipped:
Cancelling does not interrupt a running gate. A withdrawn task can wait for a gate to finish before the publisher observes the withdrawal.
The shipped behaviour, from the working notes (opens in a new tab): withdrawal is checked by the one writer that can push, so nothing else has to check it.
During a structural refactor, every few commits the diff goes to a separate read-only reviewer — a model is fine — which must answer from the diff, not the implementer's summary: which concept disappeared, which primitive now owns the behaviour, and how the number of independent representations changed. scripts/converging.sh prints the arithmetic.
It is called drifting when source rises, a new module names no primitive, a responsibility merely moved, one subsystem replaced another, or a green suite is the only evidence offered. Two of those at once means stop, and name the first change to reconsider. The current arithmetic, measured against the doctrine's own target, is in the honest numbers.
05 / A NOD TO THE ANCESTORS
TWO THINGS ARE OURSThe doctrine was written without citations, then cited anyway, so nobody mistakes the lineage for novelty: Fred Brooks on essential versus accidental complexity; C. A. R. Hoare on robustness by reduction; the Unix tradition of composing primitives the OS already solved; Rich Hickey on simplicity as uncomplecting; Minsky and King on making illegal states unrepresentable; Casey Muratori on semantic compression; David Parnas on decomposition by meaning; the capability tradition's least authority, from which "the model proposes; the harness disposes" descends.
Exactly two things in the stack are claimed as ours: stormbeslå, the demolish-then-fill method above, and the pseudocode ratio: write the machine as pseudocode without borrowing a single implementation name, and divide. The full acknowledgment (opens in a new tab).
06 / HONEST NUMBERS
MEASURED 25 OCTOBER 2026The doctrine's own pseudocode test invites arithmetic, so here it is — read from the public repository, not from a brochure.
The public history starts on September 24, 2026, with a clean snapshot at 16,132 source lines; today it is 21,899. That is growth, not convergence, and the months of private history that would show the longer arc are not part of the public repository. No trend line is invented here. What the last month does show is concepts dying in the open: the read-only desk and its Codex read scope, superseded provider homes retired once Git held their records, the rhythm conversation kind, the container execution mode the boundary no longer had. Recent windows are small: the last four commits net +118 lines. Source size is a signal, never the goal; the audit that matters counts concepts, and that ledger is marked pending rather than fabricated.
07 / TEN MINUTES
INTENT → WORK → CHECK → PUBLISHEDsteward task add from the host CLI, or a message from Telegram. One admitted intention gets one retained Git ref and one task document. Every later decision is a commit.
A native agent wakes in its own checkout of that world: thinks, edits, commits, changes its mind, asks a question and waits if it must. Its files and commits retain what happened. It cannot push.
When the work looks finished, the candidate is fixed before the gates run, and the gates are the repository's own test and build commands. Conflicts and red gates go back to the task's session with their exact inputs — an unchanged failure is reported as no progress, not retried forever.
One integrated commit, pushed with an exact-base lease. A target driver then applies that revision and must see it running and healthy before anything is called done. A successful apply is not readiness.
The scripted acceptance test drives this exact journey — message in, reply out, world edited, a task asks a question, the gate goes green, the commit lands — against a fake Telegram and a scripted model, in Docker, on a laptop:
git clone https://github.com/1puni/steward.git steward-harness
cd steward-harness && uv sync --extra dev
ACCEPT_PROJECT=my-first-steward SELFTEST_PROJECT=my-first-steward-selftest \
FAKE_PORT=8099 sh scripts/follow-through-acceptance.shThe first sanity command, uv run steward check config/steward.example.yaml, will refuse on a laptop with "untrusted execution: unavailable". Good. A harness that said yes there would be lying to you. The afternoon version — a real Linux host, a real execution user, a real task — is the getting-started guide (opens in a new tab).
08 / PLAIN SIGHT
THE UNFINISHED BUSINESS09 / PROVENANCE
WRITTEN BY ITS OWN PATIENTMuch of Steward's code was written by models working through Steward: filed as tasks, reasoned in private checkouts, gated on exact revisions, accepted and published by the harness it was extending. That is not a confession to be owned quietly — it is the experiment running.
The credential is that the research and the artifact agree. When the working paper asks what evidence establishes that an agent achieved the required outcome, the harness answering it is this one, and the page you are reading was accepted and published through the same boundary. The work has to survive its own doctrine.
The harness has no voice of its own. Back to the workshop at 1puni ↗