> **Operator reference:** This page covers the internal multi-harness contract enforced by `starlight-agent-config` and `tools/pr-gate.mjs`. For public CLI usage across coding agents, see [Work from any harness](/starlight/harnesses).

## The four invariants every harness inherits [#the-four-invariants-every-harness-inherits]

1. **Isolated lane.** A harness works on its own branch (`agent/<harness>/<scope>` or `codex/<scope>`) and worktree, never committing into another agent's live checkout.
2. **Managed-block config.** Harness instructions (`~/.claude/CLAUDE.md`, `~/.codex/AGENTS.md`, `~/.gemini/GEMINI.md`, `~/.grok/AGENTS.md`) are compiled from `starlight-agent-config/core/doctrine/SYSTEM-SPINE.md` using marker-bounded blocks.
3. **Maker ≠ checker (`pr-gate.mjs`).** The harness that authored a branch cannot sign off on its own PR. A second harness (`claude`, `codex`, `antigravity`, `gemini`, `grok`, `hermes`) must verify the exact commit SHA (`starlight-signoff: harness=<H> verdict=pass sha=<SHA>`) before `pr-gate.mjs merge` will execute.
4. **Durable handover.** Completed slices record their session summary and next prompt in `frankxai/agentic-ops-hub` (`ops/sessions/YYYY-MM-DD.md` and `node scripts/handover.mjs index`).

## Human gates (fail closed) [#human-gates-fail-closed]

Per Doctrine 0 in `SYSTEM-SPINE.md`, agents build, test, verify, and stage autonomously, but **money, pricing, credentials, DNS records, repository visibility, and external customer sends always require explicit human execution**.