Task toolset

Your task agent gets four tools. All four are reads. Every operation returns a JSON envelope with an "ok" key — failures never raise into the agent loop; they come back as {"ok": false, "error": "..."}.

Through v0.8 this page described ten operations, including mailbox reads, trace inspection, and rule writes. Those moved to the package-owned repair agent in v0.9. The reason is measured, not aesthetic: handed the larger surface, an agent spent its turns operating the harness, and most of the rules it wrote were about its own diagnostic protocol.

Operations

Operation	Purpose
`harness_rules_read`	Read the learned rules in one scope. Defaults to `global`. The `scope` argument takes an identifier listed under References in `rules.md` — never a path.
`harness_rules_search`	Search live learned rules (active + provisional) by lexical relevance and return bounded references and snippets. Takes `query`, optional `limit` (clamped to 1–50).
`harness_rules_list`	Load the canonical `rules.md` guide plus its compact live-scope index: one entry per scope with a bounded description and active/provisional counts. No rule bodies.
`harness_rule_status`	One rule’s lifecycle and validation state — status, baseline vs. trial breach rate, sessions observed, replay attempts, verdict. How the agent tells a validated rule from a provisional one.

That is the entire surface. There is no fifth tool, no admin mode, and no escape hatch.

Example: a task agent consulting its rules

# Start from the guide: which scopes exist, and how much is in each.
index = await harness.task_tools.call("harness_rules_list", {})
# index["path"] == "rules.md"
# index["scopes"] == [{"scope": "global", "path": "rules/global.md",
#                      "description": "...", "active": 2, "provisional": 1}, ...]

# Read a scope the index actually listed.
rules = await harness.task_tools.call("harness_rules_read", {"scope": "payments"})

# Or search when the right scope isn't obvious.
hits = await harness.task_tools.call(
    "harness_rules_search", {"query": "duplicate charge", "limit": 5}
)

# Distinguish a validated rule from one still under evaluation.
status = await harness.task_tools.call(
    "harness_rule_status", {"rule_id": hits["rules"][0]["id"]}
)
# status["rule"]["status"] == "active" | "candidate"

In practice your agent makes these calls when it judges prior rules relevant. Nothing obliges it to: the harness performs no rule lookup on its behalf and makes no tool call before a turn.

Reads include provisional candidates — rules under evaluation, clearly labeled as such. That is deliberate: a rule must be in force to be measurable. Prefer an active rule when a candidate conflicts with it, and use harness_rule_status when you need to be sure which is which.

What the task agent deliberately cannot do

Everything in this table is rejected at dispatch with unsupported capability, including hallucinated calls. None of it has a side effect.

Not exposed to the task agent	Where it lives instead
Read a diagnostic notice or its dump	The repair agent’s `harness_notice_read`, scoped to its assigned episode.
Inspect a flagged trace	The repair agent’s `harness_trace_inspect`, restricted to traces the assigned notice names.
Write a rule	The repair agent’s `harness_rule_add` — at most one candidate per episode.
Acknowledge or resolve a notice	The repair agent’s `harness_notice_ack` / `harness_notice_resolve`.
Promote or retire a rule	Neither agent. Only validation transitions a candidate.
Trigger validation or a regression run	Operator surfaces: `harness.validate_candidates()`, `harness.run_regression()`, `pandaprobe-harness-eval`.
Score history	The notice and the trajectory gate already carry the series. Operators read `state/score_history.json`.
The journal	An operator surface: `harness.journal.recent(...)`.
Eval-set listing and curation	An operator concern: `harness.evalset`, or the turn payload’s `end_state`.

Why the surface shrank

In a measured AppWorld run of the larger design — the whole rule corpus in context, ten tools, and a check-your-mailbox-every-turn mandate — the agent spent its turns operating the harness instead of doing the task. Nine of the thirteen rules it wrote were about gaming its own diagnostic protocol rather than about the work. Two lessons are baked into the current shape. Every tool an agent can call is a turn it might spend not doing the task, so the task surface is four reads. And diagnosis is a different job from execution, so it belongs to a different agent with a different prompt — one whose only output is a candidate rule.

Delivery

harness.task_tools implements the ToolDispatcher protocol, so the simplest wiring is direct:

tools = my_tools + list(harness.task_tools.specs())

Or convert to your framework’s native format in one call:

Anthropic
LangChain
OpenAI Agents

from pandaprobe_harness.agent_tools.native import as_anthropic_tools

specs, dispatch = as_anthropic_tools(harness.task_tools)
# specs -> tool definitions for the Messages API
# dispatch(name, args) -> awaitable result envelope

from pandaprobe_harness.agent_tools.native import as_langchain_tools

tools = as_langchain_tools(harness.task_tools)   # list of StructuredTool

from pandaprobe_harness.agent_tools.native import as_openai_function_tools

tools = as_openai_function_tools(harness.task_tools)  # list of FunctionTool

Attaching the toolset is optional. A task agent with no harness tools still benefits from the loop: evaluation, notices, repair, and validation all run regardless. The tools only decide whether the agent can consult what was learned. The schema is exported as TASK_OP_SCHEMAS if you need to inspect it; repair schemas and dispatch stay package-internal.

Route every harness_* name to this dispatcher rather than filtering names yourself. Enforcement lives in TaskToolset.call, so a hallucinated administrative call is rejected safely instead of reaching your domain executor — see the security model.

Get Started

The Self-Heal Loop

Closing the Loop

Integrations

Reference

Operations

Example: a task agent consulting its rules

What the task agent deliberately cannot do

Why the surface shrank

Delivery

​Operations

​Example: a task agent consulting its rules

​What the task agent deliberately cannot do

​Why the surface shrank

​Delivery

Operations

Example: a task agent consulting its rules

What the task agent deliberately cannot do

Why the surface shrank

Delivery