Crate av_harness 

The Agent Harness: the drop-in inline proxy wrapping agent → LLM traffic (brief §9 data flow).

Hot path (per request): validate identity → check token quota → sanitize → compress → dispatch a copy to the async workers (non-blocking try_send, bounded channels) → forward upstream → stream chunks back. Workers do the heavy work: embeddings, loop delta, OCSF emission, bridge publish, ATIF appends. Receipts are signed once, at session close, asynchronously (brief §2 signing rule).

Silent-error posture: every dropped worker message increments av_events_dropped_total; audited chat/tool work reserves worker capacity before quotas mutate, so ATIF-bearing jobs are admission-gated (fail closed), never dropped mid-flight; client aborts still finalize sessions; worker panics are supervised and counted.

Re-exports

pub use config::HarnessConfig;

pub use pipeline::AppState;

pub use routes::build_router;

Modules

config

Harness configuration (TOML surface, versioned).

dashboard

Read-only operator dashboard.

pipeline

Ordered hot-path middleware and upstream forwarding.

reconciler

Session finalization and periodic idle reconciliation.

routes

Axum HTTP routes for proxy, MCP interception, lifecycle, and operations.

session

Per-session state: sequence numbers, event chain, ATIF builder, loop state, lifecycle (open → active → closed/promoted), and finalization products.

worker

Bounded asynchronous worker for loop analysis, event emission, and capture.

Functions

control_key_from_signer

Derive the deployment-local HMAC key used for authenticated control files.