Agent Harness

A capability-gated workflow and executable action graph for agents that discover, quote, prepare, externally sign, and submit Strata operations.

This is the canonical first-run workflow for any agent entering Strata. Live capabilities remain the authority: this harness explains how to work, but never grants permission.

Automatic entry

• MCP: connect to the hosted Strata MCP server. Initialization points agents to the versioned harness resource and prompt.
• Terminal: use the official TypeScript terminal client when MCP is unavailable.
• Manifest: discover the machine-readable harness at the Strata agent manifest.
• Action graph: fetch the live executable graph to see available operations and their transition conditions.

Authority model

The external agent owner decides what the agent may do and configures its signer. Strata does not receive private keys or impose an additional human-approval policy. It exposes reviewed operations, verifies signatures and immutable quote bindings, and returns durable receipts.

The graph entry node is discover_capabilities. Follow live edges only when their conditions and required capabilities are satisfied.

Required workflow

1. discover capabilities — Read the live capability catalog before every objective. Never infer permission from documentation, package support, or an earlier session.
2. establish mode — Read the action graph and identify which prepare and submit nodes are live. The external agent owner configures its permissions and signer authority; static documentation never enables a Strata operation.
3. understand objective — Resolve the user's market, side, amount, and tolerance. Ask before proceeding when any economically meaningful input is ambiguous.
4. discover market — List markets, select one marked ready, and use its discovered base and quote decimals. Do not guess market identifiers or token decimals.
5. preserve atoms — Represent token amounts as unsigned base-10 atomic strings. Never pass settlement amounts through floating-point arithmetic.
6. request quote — Request a fresh Sonar quote with an explicit side, exact input atoms, and execution tolerance supplied by the external agent.
7. validate quote — Verify the quote binds to the selected market, side, and input. Check labelled fees, minimum output, price impact, server time, and expiry.
8. report result — Report consumed input, expected output, minimum output, fees by asset side, price impact, and remaining validity without inventing private route composition.
9. authorize writes — When prepare and submit are exposed, keep signing external to Strata: request canonical authorization bytes, sign them with the owner-configured signer, verify the prepared transaction preserves the quote, then submit the externally signed transaction with idempotency.
10. monitor outcome — After an authorized submission, report the durable receipt or explicit failure. Never claim completion from preparation, signing, or an unconfirmed request.

MCP sequence

strata_capabilities → strata_action_graph → strata_markets → strata_quote → strata_execution_challenge → strata_execution_prepare → strata_execution_submit

Terminal sequence

npx -y @stratabook/sdk capabilities --json
npx -y @stratabook/sdk action-graph --json
npx -y @stratabook/sdk markets --json
npx -y @stratabook/sdk quote --market SOL/USDC --side sell --amount-atoms 10000000 --json

Stop conditions

• The required live capability is disabled or absent.
• The market is paused, unavailable, or has no reviewed operation path.
• Market, side, amount, decimals, tolerance, or signer authority is unavailable or ambiguous.
• The contract version is unsupported or a response contains unknown fields.
• A quote is expired or its market, side, amount, fee, minimum-output, or time binding is inconsistent.
• A requested operation exceeds the exposed tool, account, or policy scope.
• A user asks the agent to receive or expose wallet secrets, private keys, seed phrases, session keys, or production credentials.

Safety rules

• Never request or accept wallet secrets, private keys, seed phrases, session keys, or production credentials in a prompt.
• Never call undocumented endpoints or reconstruct private Sonar behavior.
• Never silently widen slippage, refresh changed economics, substitute a market, or retry a non-retryable failure.
• Treat capability removal, revocation, expiry, and emergency disable as immediate stop signals.
• Capability and action-graph availability are authoritative for Strata operations; permission and signer policy remain controlled by the external agent owner.

Capability discovery is mandatory. Documentation, installed packages, cached tools, and prior sessions are never authorization.