Configuration

harness init (or the app’s Settings) writes config.json for you. Start from config.example.json; every value there is a default or a placeholder.

Profiles describe model servers; roles say which profile does what:

"profiles": {
  "default": {
    "baseUrl": "http://127.0.0.1:8080/v1",
    "model": "auto",              // "auto" uses the first model the server lists
    "apiKeyEnv": null,            // the NAME of an env var holding a key, or null
    "contextTokens": "probe",     // or a number
    "maxOutputTokens": 4000,
    "thinking": { "control": "probe", "effort": "low", "budgetTokens": null },
    "structuredOutput": "probe",  // json_schema | json_object | prompt
    "toolCalls": "probe",         // native | none
    "timeoutSec": 900
  }
},
"roles": { "planner": "default", "implementer": "default", "fixer": "default",
           "reviewer": "default", "verifier": "default", "summarizer": "default" }

Use two profiles to plan and review with a larger model and implement with a faster one. HARNESS_<PROFILE>_BASE_URL and HARNESS_<PROFILE>_MODEL override a profile from the environment.

Stacks say how to check a project. The Astro stack in the example:

Gate	Command	When	Blocking
format	npx prettier --check {files}	each task, touched files	no
lint	npx eslint {files}	each task, touched files	yes
typecheck	npx astro check	each task	yes
unit	npx vitest run {tests}	tasks with tests	yes
build	npx astro build	integration	yes
e2e	npx playwright test {tests}	integration	yes

Gates are argv arrays, never shell strings. A gate whose tool is missing is reported as skipped, never as passed. Gates may not install packages, run git or gh, or use npx --yes. Other stack keys: detect (files that identify the stack), alwaysGates, protectedPaths (globs the model may never touch; .git, .husky and node_modules are always protected), dependencyDirs, and docs.local (a local checkout of the framework’s docs, used by the review; without it, framework claims abstain instead of being confirmed).

Limits (defaults): maxFilesPerTask 3, maxFixRounds 3, maxReplanRounds 2, maxDiagnostics 20, maxLookups 6, maxReviewFixTasks 2, wholeFileRewriteMaxBytes 4096, maxGateOutputBytes 204800.

gateEnvAllow lists extra environment variables your gates need; everything that looks like a secret is removed from the gates’ environment otherwise.