Shadow Harness Architecture

Components

Component	Responsibility	Boundary
Capture adapter	Convert live traces into a stable envelope	Redacts before persistence
Case registry	Store immutable task and dataset versions	Content-addressed identity
Replay planner	Select cases and candidate configurations	No execution privileges
Executor	Run bounded candidate workloads	Isolated credentials and quotas
Grader	Produce versioned outcomes and rationales	Cannot mutate task records
Comparator	Pair baseline and candidate results	Operates on immutable runs
Review surface	Slice results and inspect examples	Read-only release evidence

Data contracts

A case describes the task and expected evaluation method. A configuration fingerprints every behavior-affecting setting. A run binds cases to one configuration. A result contains trace references, output, operational measures, and grader outcomes.

Safety model

Replay is deny-by-default for side effects. Credentials are scoped by executor and environment. Sensitive fields are classified at capture. Retention applies independently to payloads and metadata. All access to raw content is auditable.

Release gate

A candidate is eligible only when required slices meet quality and reliability thresholds, no critical safety regression appears, cost remains inside budget, and failure examples have been reviewed. The gate creates evidence; it does not replace engineering judgment.