Better Model or Better Harness? Breaking Down the Six-Part Agent Harness

When an AI system fails on a multi-step engineering assignment, a cross-document financial audit, or a real-time 3D browser simulation, teams usually blame the model weights. The standard remedy is to upgrade to a larger frontier model, pay four times the inference cost, and hope the new checkpoint stops making structural mistakes. Across five controlled benchmarks where we held model weights fixed, we found the opposite result. Between 51.3 percentage points and 80.0 percentage points of task completion lift comes from the surrounding agent harness rather than the parameter count of the underlying language model.

An unpaginated frontier model operating in a single-pass chat window has to improvise perception, context selection, hypothesis testing, tool schema validation, state persistence, and self-verification inside one autoregressive token stream. When any one of those six steps drifts, the entire task fails. By contrast, a 9B to 31B open-weight model (such as Qwen2.5-7B-Instruct, qwen3-coder:30b, or gemma4:31b) running inside a verified Six-Part Agent Harness outperforms unassisted frontier baselines while keeping latency predictable and audit trails deterministic.

Why Unpaginated Frontier Prompts Collapse on Multi-Step Work

To isolate model capability from harness capability, we evaluated identical model checkpoints across five distinct task suites: 3D skeletal simulation in Foxglade (demos.baltor.ai/foxglade), 3D surface geometry and collision physics in the Comparison Studio (compare.baltor.ai), 14-constraint long-form engineering specifications, multi-hop labor contract screening in DueCare (evals.tayloramarel.com/duecare), and multi-objective secure code generation in Harmony (compare.baltor.ai/systems). In every suite, the raw model receives the complete problem statement and is permitted to generate code or decisions directly.

Inspecting the failure traces reveals that raw models rarely fail because they lack pretraining knowledge of inverse kinematics, SQL window functions, or statutory interest caps. When we probed Qwen2.5-7B-Instruct out of band on Google Colab and Kaggle T4 GPUs, the model correctly identified illegal recruitment fee-shifting and passport retention in 93.8% of cases. Yet when placed inside a direct drafting or tool-calling prompt without a pre-turn recognition gate, the exact same checkpoint complied with 81.3% to 91.7% of exploitative requests. Similarly, when asked to build a 3D woodland game in a single file, unassisted gemma4:31b knows what a quadruped gait is in prose, but emits five unarticulated orange boxes that slide through terrain hills because nothing in the prompt grounds heightfield normals or skeletal joint hierarchies before code emission.

Anatomy of the Six-Part Agent Harness

In Loop Engine, every executable graph vertex is a Loop. A discrete cognitive or act step Loop node executes a narrowly scoped assignment using selected context and resources, separately initialized harnesses, permitted harness changes, and explicit expectation checks. It iterates until declared completion conditions are met, can continue producing alternative outputs, and enforces protection against repeated external effects while keeping publication of an output separate from completion. Around that execution vertex, the harness divides responsibility into six distinct subsystems:

1. Part 1: Observation (Perceptual and Evidence Grounding). Before the language model sees a prompt, the Observation subsystem extracts immutable Layer-0 facts. For document forensics (evals.tayloramarel.com/divergence), it records SHA-256 source digests and runs deterministic SQL blocking canopies to link dispersed entities across filings. For 3D motion and worlds (Field Notes 01), it extracts 17-joint RTMPose keypoint trajectories from wildlife video and computes barycentric terrain heightfields so the model receives exact coordinate anchors rather than guessing geometry from text.
2. Part 2: Context (Factorized Working Memory: H_gen + H_env). Stuffing full repositories or 50-page statutory PDFs into the context window causes middle-context attention decay. In our 14-constraint specification benchmark, raw gemma4:31b satisfies the first four and last two rules in the prompt, dropping eight middle rules (42.9% pass rate). Even worse, dumping unfiltered statutory text into DueCare lowered precision because benign administrative clauses diluted the model's attention. Our Context subsystem factorizes memory into transferable invariants (H_gen) and compact environment contract cards (H_env, capped at 2,048 bytes in baltor_contract_card.json) paired with modular SKILL.md and RULES.md checklists.
3. Part 3: Control Loop (Recognition Gate and Competing Hypotheses). A single autoregressive pass locks the model into its first surface impression. Our Control Loop inserts a 120-token pre-turn statutory recognition gate before tool execution and spawns a two-branch competing-hypothesis tree (Protagonist vs. Antagonist). On Camouflaged Alpha (evals.tayloramarel.com/alpha), forcing the Protagonist branch to defend management's liquidity narrative while the Antagonist branch tests off-balance-sheet Footnote 14 guarantees cuts consensus echo from 78.0% down to 14.0%.
4. Part 4: Action (Typed Tool Envelopes and Verified Primitives). Unassisted agents improvise shell commands, HTTP fetches, and physics math inline. That improvisation introduces Server-Side Request Forgery (CWE-918), Confused Deputy data leaks, and Euler integration tunneling. The Action subsystem restricts effects to typed tools.json contracts with taint-tracked parameter scopes and binds qualified engine slots for 49-bone quadruped inverse kinematics, shell fur shaders, and swept-AABB collision response.
5. Part 5: State (Three-Layer Epistemic Separation and Multi-Turn Graphs). Stateless turn-by-turn guardrails suffer a 73.3% sycophancy breach rate by Turn 4 and Turn 5 when a user incrementally escalates authority. The State subsystem separates Evidence (immutable source bytes), Interpretation (extracted claims with provenance), and Exploration (tentative hypotheses) into separate stores, maintaining a cumulative obligation graph across turns that holds Turn 4 to Turn 5 breaches to 0.0%.
6. Part 6: Verification (Independent Gate: worker_id != verifier_id). A model cannot reliably grade its own output in the same context that generated it. Every candidate artifact must pass an independent verifier.py check, clear keyword-matched benign twins to prevent false-positive refusal inflation, and survive 5-axis Pareto selection before promotion.

Controlled Ablation Across Five Benchmark Suites

To measure how much each subsystem contributes, we ran step-by-step ablations starting from the unassisted model (Arm B0) and enabling one harness subsystem at a time through the full Six-Part Agent Harness (Arm B6). The table below reports observed task pass rates across all five suites:

Concrete Implementation: The Six-Part Harness Contract Card

Instead of writing ad-hoc Python wrappers for every task, we declare the six harness bindings inside a versioned baltor_contract_card.json file that stays under 2,048 bytes. During discovery, the runtime reads only this compact contract card and loads heavy implementation files or engine containers only after selection:

{
  "schema_version": "1.0.0",
  "component_id": "loop.harness.six_part_investigative_v1",
  "role": "Solution",
  "mode": "hybrid",
  "six_part_bindings": {
    "observation": {
      "layer0_hash": "sha256_strict",
      "blocking_canopies": ["exact_tax_id", "phonetic_director", "address_geohash_6"]
    },
    "context": {
      "h_gen_card": "invariants/normative_hierarchy_v2.md",
      "h_env_card": "domains/hk_manila_corridor_v1.json",
      "max_card_bytes": 2048
    },
    "control_loop": {
      "pre_turn_recognition_gate": true,
      "gate_max_tokens": 120,
      "hypothesis_tree": ["protagonist_lawful_twin", "antagonist_disguised_usury"]
    },
    "action": {
      "tool_manifest": "tools.json",
      "taint_tracking": "deny_untrusted_egress_cwe918"
    },
    "state": {
      "epistemic_layers": ["evidence", "interpretation", "exploration"],
      "multi_turn_obligation_ledger": true
    },
    "verification": {
      "require_independent_verifier": true,
      "verifier_entrypoint": "checks/verifier.py",
      "benign_twin_false_positive_ceiling": 0.05
    }
  }
}

When a 9B Model Inside a Harness Beats an Unassisted Frontier Model

A critical question for deployment economics is whether a small local or open-weight model inside the Six-Part Agent Harness can beat a much larger frontier model running unassisted. On the 500-pair Evaluation-Execution Divergence suite (evals.tayloramarel.com/divergence) and the 48-pair DueCare statutory hierarchy benchmark (evals.tayloramarel.com/duecare), unassisted frontier models achieve 54.2% to 62.5% joint accuracy because they get captured by surface contractual authority ("zero placement fee" clauses paired with off-contract training loans) or suffer false-positive spikes on legitimate employer-paid relocation packages.

When we wrap a 9B to 27B open-weight model in the Six-Part Agent Harness, joint accuracy rises to 91.7%–95.8% at less than one-tenth the per-task token cost. The small model does not need to hold the entire statutory truth table in its attention heads simultaneously. Part 1 (Observation) surfaces the exact cross-document links; Part 2 (Context) supplies the 48% APR cap under Hong Kong Cap. 163 s.24 and the zero-fee rule under Philippine RA 10022; Part 3 (Control Loop) forces explicit testing of the benign twin hypothesis; and Part 6 (Verification) blocks any output that fails deterministic arithmetic or statutory checks.

Takeaways for Systems Engineers

Before upgrading your model tier or fine-tuning weights on domain traces, instrument which of the six harness subsystems is actually failing. If the model misses cross-document facts, fix Observation blocking keys. If it drops middle constraints in long prompts, factorize Context into compact contract cards. If it knows a rule in Q&A but violates it during tool execution, add a 120-token Control Loop recognition gate and an independent Part 6 verifier. You can inspect all five interactive comparisons live at compare.baltor.ai/harness and compare.baltor.ai, or download the full monograph PDF at papers.tayloramarel.com.