Model harnesses

Reasoning runs on an authorized hosted or bring-your-own rail. Exact external actions do not go through a model at all — they are fixed server operations. Those two sentences are the whole security posture of the model layer, and everything else follows from them.

Each bot identity carries its own provider and model. An expensive lane and a cheap lane can run side by side in the same swarm on the same work, and be compared on measured output rather than on preference. Swapping a provider becomes a decision with evidence behind it.

• Unattended local CLI execution fails closed. The CLI harness family remains a typed configuration interface, but running one unattended is refused at the guard rather than sandboxed and hoped for.
• Re-enabling it is audited work, not a flag. It would require a brokered sandbox with immutable handler generations and exact operation scopes, keeping authentication and connector credentials outside the model-visible process and workspace.
• A caller-supplied connection is ephemeral — used for that request, then gone. It does not quietly become the bot's new default.