x0ne Harness · Preview (0.2.0)

A hardened harness for AI coding agents.

Every action is checked before it runs. Files are snapshotted before they change.

x0ne Harness puts a safety layer between an AI agent and your machine. Use it as its own terminal agent, or plug it into Claude Code, Codex and other MCP clients.

Source code Install

Preview (0.2.0): usable today; defaults and interfaces may change before 1.0. Apache-2.0.

An agent that writes your code also runs commands on your machine. x0ne Harness checks every action before it runs, confines the agent's commands in a sandbox, and snapshots files before they change.

01 / 06
Every action meets the policy.
The agent asks for typed actions: x0ne-runtime has 101. Each one is checked against your policy before it runs: allowed, refused, or held until you answer.
docs/policy.md
02 / 06
Commands run in a closed box.
On Linux, agent commands run under bubblewrap with Landlock inside: system read-only, writes only where you allow, secrets hidden, loopback only. If that sandbox cannot start, the command is refused.
docs/security.md
03 / 06
A snapshot before every write.
Before each file write, the agent loop snapshots the files it targets: copy-on-write on btrfs (APFS: not measured), a copy elsewhere. When a change goes wrong, /undo restores them, file by file.
README
04 / 06
Simulate before you run.
Dry-run one action, or a whole plan, through the policy engine. You get each step's verdict and everything it would read, write, run or contact. Nothing is executed, nothing is written.
docs/primitives.md
05 / 06
Parallel Worlds.
With an Incus remote, the agent forks several containers from one copy-on-write snapshot. Each tries a different approach, all at once: one round-trip instead of one try after another.
Requires an Incus remote · docs/primitives.md
06 / 06
Keep the winner.
The results come back together. The agent picks the winner and copies its files back to your workspace. Each container is deleted when its task ends, whatever the outcome.
docs/architecture.md

Coding agent

x0ne terminal agent: illustrative, written scenario

❯ fix the expiry check in src/auth.rs

→ ReadFile {"path": "src/auth.rs"}

✓ allow

→ ReadFile {"path": ".env"}

✗ deny · refused by the policy

→ RunCommand {"command": "cargo", "args": ["test"]}

? confirm · [y]es [n]o [a]lways

❯ y

# under bubblewrap, with Landlock inside

# writes: the workspace · network: loopback

→ EditFile {"path": "src/auth.rs", …}

# snapshot of src/auth.rs first, then the write

→ RunCommand {"command": "cargo", "args": ["check"]}

✗ failed

❯ /undo

✓ src/auth.rs restored

→ Simulate {"target": {"type": "Pipeline", …}}

[0] ReadFile read_only allow

[1] WriteFile fs_write require_confirmation

[2] RunCommand process_spawn require_confirmation

# executed: nothing · written: nothing

→ CreateSnapshot {"name": "base", …}

→ RunIncusGroup {"tasks": [a, b, c], …}

# a, b, c: clones of one snapshot, run at once

← {"total": 3, "succeeded": 1, "failed": 2, …}

# winner: b

→ WriteFile {"path": "src/auth.rs", …}

✓ allow · the files of b, in the workspace

Or Claude Code, Codex and other MCP clients

x0ne-runtime

Policy

101 typed actions

allow
confirm
deny

dry run

Your machine: illustrative, written scenario

sandbox

workspace

src/auth.rs
src/lib.rs
tests/auth.rs
.env

cargo test

/the system
~/.ssh ~/.awscredentials
networkthe Internet

Before it runsyour answer

RunCommand · cargo test[y]es[n]o[a]lways

bubblewrap · LandlockLinux

If the sandbox cannot start, the command is refused, not run unconfined.

Snapshot, before the writecopy-on-write on btrfs

src/auth.rs/undo · file by file

Side effects, projecteddry run

would readsrc/auth.rs
would writesrc/auth.rs
would runcargo test

Executed: nothing. Written: nothing.

Incus remoterequired

snapshotbase

Each container is deleted when its task ends.

Worlds, from the prompt.Each with its own runtime and its own directory.

In the terminal agent, /spawn N starts N worlds on the same task, each through the session's policy and confirmation gate. Each one opens its own x0ne-runtime and works in its own directory: a git worktree, or a copy.

❯ /spawn 3 "make the auth tests pass"
# a diffstat per world
❯ /worlds diff
# applies world 2's diff, checked first with git apply --check
❯ /worlds pick 2
# removes the directories of finished worlds
❯ /worlds drop

Parallel Worlds, in the docs

Try it.From the source.

$ git clone https://github.com/x0ne-labs/x0ne-Harness
$ cd x0ne-Harness
# builds and installs x0ne, x0ne-runtime and x0ne-orchestrator
$ make install
# the first run opens the setup wizard: model and provider
$ x0ne

From Claude Code, make claude-add registers the runtime and the gateway as MCP servers; Codex and other MCP clients connect the same way. Its own agent runs with any OpenAI-compatible provider, Ollama, or x0ne Engine for confidential inference. The undo demo needs no model: make demo-undo-fast.

On Linux, agent commands need bubblewrap, unprivileged user namespaces and Landlock (Linux 5.13 or later); without them, they are refused. macOS has neither: there, the default isolation refuses every agent command. Building needs Rust 1.98 or later, a C compiler, make and git.

The install guide

What it does not do.

It does not prevent prompt injection. An instruction planted in a file, a web page or a command's output can steer the model. What bounds it: the policy is evaluated on every action before it runs, whoever asked for it.

Plugged into Claude Code or Codex, their native tools only go through the policy with the PreToolUse hook: docs/agent-hooks.md.

It is built for a single developer, on a local machine, in an interactive session; not for production servers, multi-tenant environments or untrusted input.

Preview (0.2.0): defaults and interfaces may change before 1.0. Known limits and fixed issues are listed in SECURITY.md.

The threat model and its limits

Open source, Apache-2.0.

The code, the documentation and the security policy are on GitHub.

x0ne-labs/x0ne-Harness Documentation

A hardened harness for AI coding agents.

Every action meets the policy.

Commands run in a closed box.

A snapshot before every write.

Simulate before you run.

Parallel Worlds.

Keep the winner.

Worlds, from the prompt.Each with its own runtime and its own directory.

Try it.From the source.

What it does not do.

Open source, Apache-2.0.