We keep securing the model and trusting the scaffolding around it.
That assumption breaks the moment the agent can edit the scaffolding.
Most agent architectures rest on a quiet division: the model is the untrusted part, and the harness — the prompts, the tools, the memory, the subagent definitions — is the infrastructure that constrains it. Every control we put on an agent lives in that layer.
The newer self-improving harnesses dissolve the division. When an agent can rewrite its own context assembly, register new tools, spawn subagents, and persist state that survives the session, it is no longer just producing answers. It is modifying the machinery that produces every later answer.
So a harness edit is not a runtime detail. It is a privileged production change, and it deserves what production changes get: a version, an author, a diff, a review path, an evaluation gate, and a rollback that actually restores the previous behaviour.
The alternative is not to freeze the harness — that forfeits the improvement. It is to let the agent propose changes in a sandboxed branch, and require the same evidence a human would need to merge one.
If the agent can change the thing that governs it, that thing is not a control any more.