Most agent work runs in someone else's data center. Hospitals, defense suppliers and banks can't send it there. We rebuilt the harness and the compute so it runs inside the network that already holds the data.
Six hours in, an agent has opened files nobody listed, reached hosts that were never in the plan, and spent real money doing it. The person who asked went home at five.
The usual answer is to run it in someone else's data center, under someone else's jurisdiction. For most teams that is the right answer.
The organizations with the most to gain from a six-hour agent are the ones whose lawyers will never let the data leave the building.
We build for the second group.
Three products, stacked the way a ship is stacked. You work in Harbor. Bridge and the Engine Room sit underneath it, and they are what make Harbor's guarantees checkable.
A quiet room. Ask for something and leave; come back when it's done. Harbor picks up on whatever device you open next.
Each result takes one line where it happened. The thing itself goes in a berth you can open later, so a hundred results don't become a hundred walls of text.
Everything below this line runs on hardware you can walk up to.
Every tool and every permission is written down before the work starts, by a person, in the open. Nothing gets added while the agent is running.
The allowlist is written while you are watching. The model never edits it, and has no way to ask.
The part you never see. Weights, scheduler and GPUs, all inside racks you own. Traffic leaves only when you send it.
We measure this rather than promise it. The counter that reads zero would read the bytes if something got out.
The dashed line under each is the part we haven't solved.
Context windows got bigger. Memory did not. Four hours in, an agent is mostly reading a summary it wrote of itself, and we have no way to tell which parts of that summary it got wrong.
What should an agent refuse to compress?
Benchmarks measure the model. Deployments fail on the things around it: tool schemas, retries, timeouts, the interrupt that lands mid-write.
Which failures belong to the model, and which belong to the harness?
Running a serious model on hardware you already own is a scheduling problem first. Weights that don't fit. Batches that never fill. Eight people, one GPU, and a Tuesday afternoon.
How much iron does a building actually need before this stops being a compromise?
Prompt injection is the famous one. We worry more about the agent that was allowed to do every single step it did, and should never have been allowed to do them in that order.
How do you prove what an agent did not do?
We would rather show four empty boxes than four numbers we can't reproduce. Nothing goes in these until the same run gives the same answer twice.
Frontier columns fill from public citations when an Officer publishes. Shipwright cells stay empty until A and B agree.
Run 0417, plotted from its own event log: six hours on sealed hardware, compressed to forty-five seconds, including the parts where it sits and waits.
We take on a few partners at a time. We pick by whether the constraint is real, so tell us what yours is.
Request a berthNotes from the yard when there is something worth reading. No cadence, no newsletter.