Documentation — Harness

Build and run

Rust 1.87+ is required. The daemon and the CLI are two processes; Ollama covers a local model.

cargo build

# terminal 1: the daemon
cargo run -p harness-daemon

# terminal 2: one prompt
cargo run -p harness-cli -- -p "hello"

# interactive
cargo run -p harness-cli

Desktop app

Tauri 2, a universal arm64 + x86_64 bundle. The local daemon starts from the app; tokens live in Keychain.

cd apps/desktop
cargo build --release

# bundle at dist/Harness.app
./scripts/package-desktop.sh --universal

Server

Static musl archives need no Rust on the machine. The installer creates a systemd unit and two tokens: admin and read-only.

cargo zigbuild --release --workspace \
  --target x86_64-unknown-linux-musl
TARGET=x86_64-unknown-linux-musl ./scripts/package-server.sh

scp dist/harness-*-linux-x86_64-musl.tar.gz server:
ssh server ./install-server.sh --from-tarball \
  harness-*-linux-x86_64-musl.tar.gz

Config

YAML next to the data. Secrets are never written to the file: only the environment variable name is stored.

provider: ollama
model: qwen3-coder:30b
base_url: http://localhost:11434/v1

limits:
  max_steps: 12
  max_tool_calls: 40
  turn_timeout_secs: 300

embeddings:
  model: nomic-embed-text
  base_url: http://localhost:11434/v1

schedules:
  - name: Morning digest
    cron: "0 8 * * *"
    prompt: Summarise the last day across projects
    agent: scout
    delivery:
      kind: file
      path: /srv/harness/digest.md

Access

Without a token the daemon trusts loopback only. A remote server requires a token; TLS is terminated by Caddy or a tunnel.

admin token: full access, including turns and settings
read-only: sees sessions and knowledge, cannot write
secrets in .env or Keychain, config keeps only names
sensitive RPCs are audited in ~/.harness/audit.log

What to read next

The documentation lives in the repository next to the code.