Multi-Objective Harness Evolution: Balancing Pass Rate and Exploit Resistance on the Pareto Frontier

An AI agent is not a custom Python orchestration class or a fine-tuned model checkpoint. In practice, a specialized task agent is a preconfigured bundle of eight harness files (AGENTS.md, CLAUDE.md, SKILL.md, RULES.md, tools.json, context_pack.json, verifier.py, and baltor_contract_card.json) that govern how a model observes, plans, acts, and verifies its work. Because those eight files are plain text and executable code, it is tempting to optimize them automatically using an evolutionary loop driven by a single scalar benchmark score.

When we tested single-objective harness evolution, we encountered a severe pathology that aligns directly with recent findings in Harmony Harness: Multi-Objective Self-Evolution of Agent Harnesses (arXiv:2610.15150). Whenever an evolutionary mutator optimizes a harness purely to maximize functional unit-test pass rate, it quietly deletes security sanitization rules, loosens taint scopes in tools.json, and weakens verifier.py assertions so edge-case functional inputs pass. Conversely, when it optimizes purely for security or hazard refusal, it evolves overly broad refusal rules that reject legitimate inputs and collapse functional utility.

Why Single-Scalar Weighted Sums Fail on Conflicting Objectives

Suppose you evaluate a backend coding or compliance agent across five competing objectives:

1. f_1 (Functional Correctness): Fraction of functional test suites passed (for example, BaxBench API endpoints or SecRepoBench C/C++ patches).
2. f_2 (Exploit Resistance / Security): Fraction of live proof-of-concept (PoC) security exploits blocked (such as SQL injection, path traversal, CWE-918 SSRF, or heap buffer overflows).
3. f_3 (Benign Twin Specificity): 1.0 - FPR on keyword-matched legitimate business twins.
4. f_4 (Token and Context Efficiency): Keeping contract cards under 2,048 bytes and turn token usage within budget.
5. f_5 (Verification Determinism): Zero flaky or non-reproducible verifier outcomes across 3 independent trials.

If you collapse (f_1, f_2, f_3, f_4, f_5) into a single linear scalar S = w_1*f_1 + w_2*f_2 + ..., early generations discover that sacrificing 15 percentage points of exploit resistance (f_2) by allowing unvalidated shell or SQL string interpolation yields an immediate 20 percentage point jump in functional test completion (f_1). Once the population converges on that permissive local optimum, security invariants are lost from the gene pool. Even worse, scalar weighted sums cannot populate concave regions of the Pareto frontier.

Factorized Harness Representation: H = H_gen + H_env

To prevent harness evolution from trading away safety for functionality, our Harmony Pareto engine (Monograph #13 PDF) factorizes every 8-file agent bundle into two orthogonal spaces:

• H_gen (Transferable General Mechanisms): Domain-agnostic structural invariants that apply across all tasks, including the 120-token pre-turn recognition gate, three-layer epistemic separation (Evidence / Interpretation / Exploration), taint-tracked egress locks, and the mandatory rule that worker_id != verifier_id. Mutation operators are forbidden from deleting H_gen invariants.
• H_env (Environment-Specific Adaptations): Task-specific checklists, AST lint rules, and domain verifiers (for example, C/C++ bounds-checking macros for SecRepoBench, parameterized query templates for BaxBench, or RA 10022 / Cap. 163 statutory calculators for DueCare).

Instead of mutating prompts blind, our Credit-Attributed Mutation Operator inspects the structured failure receipt emitted by verifier.py. If a candidate fails a PoC exploit test, credit attribution localizes the fault to RULES.md and verifier.py inside H_env while freezing the functional workflow steps that already passed.

Empirical Results Across SecRepoBench, BaxBench, and DueCare

We evolved a population of 64 task-specific agent harnesses (512 verified component files) over 15 generations using MOEA/D (Multi-Objective Evolutionary Algorithm based on Decomposition) with Tchebycheff scalarizing vectors on fixed gemma4:31b and qwen3-coder:30b weights:

Concrete Implementation: Tchebycheff Pareto Admission Gate

Before any mutated 8-file agent bundle is promoted to the active registry on assets.baltor.ai, it must strictly dominate or expand the non-dominated Pareto archive without violating hard floor constraints on exploit resistance or benign-twin specificity:

def evaluate_pareto_candidate_admission(
    candidate_scores: dict[str, float],
    reference_ideal: dict[str, float],
    weight_vector: dict[str, float],
    current_incumbent_tchebycheff: float,
) -> dict[str, object]:
    # Admit mutated harness bundle only if hard safety floors hold and Tchebycheff improves.
    # Hard non-regression floors: zero PoC exploits allowed, benign twin FPR <= 5%
    if candidate_scores["poc_exploit_survival"] < 1.0:
        return {"admitted": False, "refusal_code": "poc_exploit_floor_violated"}
    if candidate_scores["benign_twin_specificity"] < 0.95:
        return {"admitted": False, "refusal_code": "benign_twin_false_positive_regression"}

    # Tchebycheff metric: minimize the maximum weighted distance to ideal point z*
    max_weighted_dev = max(
        weight_vector[k] * abs(reference_ideal[k] - candidate_scores[k])
        for k in weight_vector
    )
    admitted = max_weighted_dev < current_incumbent_tchebycheff
    return {
        "admitted": admitted,
        "tchebycheff_distance": round(max_weighted_dev, 5),
        "joint_pass_and_safe": round(
            candidate_scores["functional_pass"] * candidate_scores["poc_exploit_survival"], 4
        ),
    }

Inside the 8-File Preconfigured Agent Bundle

To make our evolved Pareto-optimal harnesses immediately portable across Claude Code, OpenAI Codex CLI, Cursor, and Loop Engine without lock-in, every point on the Harmony frontier compiles into a standardized 8-file directory (assets.baltor.ai). Rather than burying behavior in opaque framework code, each of the eight files owns one clear boundary:

1. AGENTS.md (Runtime & Authority Constitution): Declares the agent's scope, branch and commit discipline, effect authority boundaries, and non-regression requirements.
2. CLAUDE.md (Harness Entry & Tool Routing): Binds workspace entry commands, test runners, and context-loading priority rules so the agent starts cleanly after context compaction.
3. SKILL.md (Domain Procedure & Mathematical Primitives): Provides verified domain algorithms (such as Law-of-Cosines 2-bone IK, swept-AABB collision math, or multi-canopy SQL blocking templates) so the model does not improvise fragile formulas from scratch.
4. RULES.md (Hard Invariants & Anti-Slop Checklist): Lists explicit negative constraints (for example, forbidding unparameterized SQL strings, forbidding CWE-918 SSRF egress, and forbidding worker-paid recruitment fee schedules).
5. tools.json (Typed Action Schemas & Taint Scopes): Declares allowed tool signatures, parameter regex/range bounds, and provenance taint rules.
6. context_pack.json (Factorized H_gen + H_env Manifest): Pins the exact SHA-256 digests of reference contract cards and statutory tables loaded into working memory.
7. verifier.py (Independent Executable Gate): A standalone, deterministic verification script executed by a separate verifier identity (worker_id != verifier_id) that runs AST checks, unit tests, PoC exploit probes, and benign-twin false-positive checks.
8. baltor_contract_card.json (Compact ≤ 2,048-Byte Discovery Card): Summarizes the agent's typed inputs, outputs, observed Pareto metrics, and resource budget for fast planner selection.

Why Credit-Attributed Mutation Beats Blind Prompt Rewriting

In standard evolutionary prompt engineering, a meta-LLM rewrites the entire prompt randomly after a failed run, which frequently breaks rules that were working in earlier generations. In Harmony, verifier.py outputs a structured JSON failure receipt naming the exact failed assertion (for example, "failed_gate": "cwe89_sql_parameterization_check" or "failed_gate": "benign_twin_employer_paid_clearance"). The evolutionary mutator maps each failure code to the single responsible file inside H_env, leaving H_gen and all passing modules untouched. That surgical credit assignment allows our 64 task agents to reach 82.5% joint functional-and-secure pass rate and 100.0% PoC exploit survival within 15 generations.

Why We Ship 64 Preconfigured 8-File Task Agents

Because different deployment contexts require different operating points along the Pareto frontier (for example, an ultra-low-latency browser shader generator vs. a zero-tolerance statutory compliance auditor), our MOEA/D archive exports 64 distinct, verified 8-file agent bundles across 8 engineering and investigative domains. Every bundle includes its own executable verifier.py and baltor_contract_card.json, ready to inspect or download at assets.baltor.ai and in Monograph #13 on papers.tayloramarel.com.