Run the Local Agent Harness

Availability: preview — runnable from source, without a supported release package

The Local composition executes one bounded JSON event through the shared Harness and retains calls, artifacts, budgets, state, and completion reason in an inspectable run directory. It requires no PostgreSQL, Redis, incident-application login identity, or project configuration.

The CLI and examples are source-evaluation interfaces. They are covered by focused and race tests and an offline fixture smoke path, but Mendry does not yet publish a supported Local binary, installer, or compatibility guarantee.

Build and run

From backend/, build the local runner and example MCP workspace server:

make build-agentcore-local build-mcp-workspace

Run the deterministic report fixture without provider credentials or network access:

./bin/agentcore-local run \
  --config examples/agentcore-local/fixture-report.config.json \
  --event examples/agentcore-local/report.event.json \
  --state-dir .agentcore/runs

The output includes the 32-character run ID. Use it to read the validated durable snapshot:

./bin/agentcore-local inspect \
  --state-dir .agentcore/runs \
  --run-id RUN_ID

Run with the same effective configuration and event plus --resume to require and continue an existing run:

./bin/agentcore-local run --resume \
  --config examples/agentcore-local/fixture-report.config.json \
  --event examples/agentcore-local/report.event.json \
  --state-dir .agentcore/runs

Configuration boundary

The trusted configuration selects a versioned Profile and completion contract, provider mode, policy, finite budgets, and MCP bindings. The event contains bounded goal, payload, and context data only. In JSON, maxElapsed is a Go duration encoded in nanoseconds. Equivalent configurations and events are normalized before identity hashing.

Trust boundary

• Trusted startup configuration selects Profile, completion contract, finite budgets, policy, provider binding, and MCP bindings.
• Event data supplies goal and context; it does not select commands, endpoints, credentials, effects, or policy.
• Credentials come from explicitly named environment variables at composition time.
• Stdio MCP receives only configured environment entries, not the complete parent environment.
• Effectful calls are not automatically retried after timeout, disconnect, or an unknown result.

Policy and recovery examples

restrictive-refusal.config.json records a rejected write without dispatching it. allow-all-workspace.config.json uses the real example filesystem boundary; allow-all still retains trusted registration, intent persistence, and budgets. The workspace server’s configured root owns traversal, symlink, size, and atomic write checks. Those restrictions belong to the example tool, not to every Harness tool.

An effectful invocation whose result cannot be known durably moves the run to waiting with unknown_write_outcome; it is never replayed automatically. After confirming the external result, record only succeeded or failed, then resume the run:

./bin/agentcore-local resolve \
  --state-dir .agentcore/runs \
  --run-id RUN_ID \
  --invocation-id INVOCATION_ID \
  --state succeeded \
  --code operator_confirmed \
  --output-json '{"status":"confirmed"}'

See Extend the Agent Harness for the internal Go extension contracts. Use the incident application journey for the database-backed web application instead.