Henry · The agent harness
Henry is the agent above your agents. A small Rust kernel decides every effect they take, signs a receipt for the work, holds the budget to the micro-dollar, keeps your keys where the model can’t reach them and stops everything on one command.
A mind proposes a step. Henry’s kernel decides it and issues a single-use ticket. A sandboxed computer carries it out, and an observer the agent cannot reach writes the record that becomes the receipt.
A mind proposes a step. Henry’s kernel decides it and issues a single-use ticket. A sandboxed computer carries it out, and an observer the agent cannot reach writes the record that becomes the receipt.
Every model and every loop, Henry’s own included, can only suggest the next step. A proposal is data, never an action.
A small Rust kernel decides each call against grants that only narrow, a purse and a forbid-only Cedar policy. An allowed call gets a ticket.
A sandboxed computer carries out the call, and only with its ticket. An observer the agent cannot reach writes down what happened.
Each step is written by an observer the agent cannot reach, into a hash chain nothing edits.
model_requestproxyThe loop asks for a turn. The proxy frames the request; the broker adds your key on the way out and drops it.
model_outputproxyThe model answers through the proxy, which records what it said as an observer the loop cannot reach.
call_proposedkernelThe loop proposes a call, citing the model output it came from. Proposing is all a mind can do.
call_decidedkernelA grant must cover the call and Cedar policy can only tighten it. An allowed call gets a signed ticket, single use, valid for at most five seconds.
call_claimedhxThe executor recomputes the binding from what it is about to run, refuses on any difference, then runs it in the sandbox.
call_observedhostThe host observes the call from outside the computer. The agent writes none of these records.
call_resultkernelThe result returns to the loop as data, and the next turn begins.
Seven guarantees that live in the kernel and its executor, never in a prompt.
Every mission ends in a receipt: what it spent, which hosts it reached, which credentials it used and every provider account its inputs touched. DSSE-signed with the tenant’s Ed25519 kernel key and checked offline against keys you pin.
$ henry receipt --verify mission.receipt \
--platform-key ed25519pk:…Nothing runs on the model’s say-so. Each allowed call gets an Ed25519 ticket that is valid once, for at most five seconds, and bound to the exact argv, directory, target, flows and policy. The executor recomputes the binding and refuses on any difference.
ticket single use · ≤ 5 s
binding H(action, cwd, target, argv, flows, policy)
policy Cedar, forbid-onlyTool lists are locked by digest and binaries run pinned. A tool that changes after review does not run until someone locks it again.
The tools/list of <ns> (<owner>) is not pinned. Lock again.Purses count integer micro-dollars, along with tokens, time, calls, egress and spawns. Spend is reserved before each model call and settled after. Running out is a wait, never an overspend: the agent parks and asks whoever funds it.
granted + overdraft ==
available + reserved + spent + carvedhenry hold opens its own line to the kernel, so it works while a window is frozen or gone. New tickets stop, egress is cut at the kernel, computers pause and state is kept. Only a person can resume.
$ henry hold all
hold everything
■ HELD by you · everything · 0.0 sYour key lives in the macOS login keychain. The broker leases it, injects it into the one outgoing request and drops it. The loop, the model and the sandbox never see it, and the sandbox refuses the places keys live: .ssh, .aws and the keychains.
key login keychain, henry.<tenant>.<provider>
never in the home, an argument or the environmentEvery home has its own tenant, owner and agent. Your owner key signs the agent’s charter: its computer, its model, a spend cap and an expiry. Authority only narrows as it passes down, and the record says which principal did what.
tenant · owner · agent
owner key signs the charter
charter computer · model · cap · expiryRamp’s Laminar post lists what a production harness takes on. Here is where each piece lives in Henry.
A hash chain per node that nothing edits, a signed Merkle root per commit and payloads encrypted per root.
BuiltThe kernel owns what the model sees: append-only context segments and strategy steps applied only at legal points.
BuiltAn MCP server for hosted runs and ACP over stdio for editors. MCP servers in the tool slot, from a reviewed copy, are in review.
BuiltEvery message is delivered steer, queue or interrupt, exactly.
BuiltA restart replays completed work with no new model call, charge or effect. A lost outcome stays Unknown and is never run twice.
BuiltOne model slot: Anthropic today, Foundry’s catalog when hosted, and OpenAI and Gemini codecs in review.
BuiltA deny-by-default Seatbelt computer on every Mac, over an APFS clone. Vercel Sandbox and E2B computers are in review.
BuiltA supervision tree in the kernel: each mind gets a carved purse and grants that only narrow, and a hold reaches the whole tree.
BuiltEvents as server-sent events or NDJSON, resumable from the last sequence, and ACP session updates.
BuiltAsks only a person can answer, and approvals for every proposed read in hosted runs.
BuiltRecords from observers the agent cannot reach, henry recap, a live terminal view and receipts a third party can verify.
BuiltLifecycle and tool events as signed webhooks, and pre-call rules that can only narrow.
In reviewReviewed tool declarations pinned by BLAKE3, loaded on demand through the provider’s search tool.
In reviewHenry sits above the agents you already use. It starts every mind, pays for it from a purse it carves and can stop the whole tree at once.
Henry is the top agent of every home. For each mission it starts a mind, carves that mind’s purse from its own and derives grants no wider than its own. A hold reaches the whole tree.
The agent slot has adapters for Claude Code over its stream-json control protocol, Codex over its app-server and any ACP agent. Each permission an agent asks for is answered once, by Henry, never as a standing grant.
Henry speaks the Agent Client Protocol over stdio, so any ACP editor drives it like any other agent.
henry acp --home ~/.henry
adapters/agent/claude can_use_tool → one answer, allow or deny
adapters/agent/codex approvalPolicy on-request, Henry reviews
adapters/agent/acp any ACP agent, v1 and v2
A small Ring 0 holds the trust. Around it, every adapter binds to one Rust contract. Swap the part; the kernel stays the same.
rings.toml keeps Ring 0 to an allowlist and walls off every adapter.
Anthropic, and Foundry’s catalog when hosted. OpenAI and Gemini codecs are in review.
A deny-by-default Seatbelt computer on every Mac. Vercel Sandbox and E2B computers are in review.
Native tools pinned by digest. MCP servers from a reviewed copy are in review.
A Minds memory adapter is in review.
The keychain broker on macOS. Linux custody is in review.
Claude Code, Codex and ACP agents under Henry.
Asks only a person can answer.
The terminal, ACP and the hosted API.
Strategy steps the kernel applies only at legal points.
Both are opt-in, owner-only files in the Henry home. Neither can widen what an agent is allowed to do.
Session, turn, approval, park, completion and tool events, projected from committed records and delivered as signed Standard Webhooks with retries. Delivery never blocks the agent.
Deny or require approval before a tool runs. Rules can only narrow: every call still needs its kernel ticket.
A catalog of reviewed tool declarations, each pinned by BLAKE3. Tools load on demand through the provider’s search tool, and a stale pin refuses boot.
Hosted Henry runs behind the Genesis API gateway. Every call is scoped to an organization and a grant, and every run is metered.
Start runs, stream their events and steer, queue or interrupt them. Fork and replay a run. Approvals for every proposed read.
HenryClient, a dependency-free JavaScript client for Node.js 24 or later.
henry-cloud runs the same calls from a terminal or a script.
An MCP server, so any MCP client can start and follow Henry runs.
Henry needs one thing: a model API key. There is no account to create and no hosted service in the loop.
henry init --local asks for an Anthropic key, stores it in the login keychain and signs a charter: one sandboxed computer, one model, $5 for 30 days.In reviewhenry -p runs it. henry hold all stops everything.henry init --local
Henry home ready: ~/.henry
model anthropic / claude-sonnet-5
computer ~/.henry/computers/ten_755c…/ (Seatbelt, read and write; no network, no exec)
budget $5 for 30 days
key login keychain, henry.ten_755c….anthropic
Next: henry -p "<your task>"
henry -p 'Write hello.md in your workspace with a three-line poem about rivers, then read it back and report what it says.'
I wrote `hello.md` to the workspace and read it back. It contains this three-line poem about rivers:
> Silver water winds through stone,
> Carrying secrets far from home,
> Rivers flow, never alone.
henry hold all
hold everything
■ HELD by you · everything · 0.0 s
The agent above your agents: every effect decided, proven, paid for and stoppable.