Architecting Agentic Harnesses with Codex

Agentic Architecture and Protocols

The Codex harness separates communication into two distinct protocols: the App Server protocol for UI-to-harness interaction and the Responses API for harness-to-inference communication. The Responses API is designed as an open standard, allowing developers to plug in compatible model providers like Olama or LM Studio. To optimize context management, the harness employs deferred tool loading, where tools are excluded from the initial context and only surfaced via tool search, and caps available skills at 2% of the total context window to prevent token bloat and model confusion.

Execution and Security

For long-running tasks, the harness utilizes a sandbox layer (using seatbelt on macOS, bubble wrap on Linux, and a custom open-source sandbox on Windows) to isolate file system and network interactions. To mitigate approval fatigue, the system implements an auto-approval mode. When an agent attempts a sensitive action, it spawns a read-only sub-agent that evaluates the request against a risk taxonomy and the user's original authorization before granting permission. For browser-based tasks, the agent uses a persistent Node REPL to write and execute Playwright scripts, allowing it to maintain state across multiple pages and tabs.

Performance and State Management

To overcome network bottlenecks during high-frequency tool calls, Codex shifted from server-sent events to persistent websocket connections. This enables stateful communication where only incremental data changes are transmitted rather than the full context. For long-duration tasks, the system uses automated context compaction, which summarizes previous turns into a single compaction item. Goal-oriented loops are managed by injecting a continuation prompt that persists the objective until the model invokes an update_goal tool, emphasizing the need for concrete, verifiable user prompts.