docs: lead with independent trust harness

CHANGELOG.md

@@ -6,6 +6,10 @@ This project follows SemVer.
 
 ## [Unreleased]
 
+### Docs
+
+- **Trust harness positioning.** Lead with independent merge evidence rather than a cheaper or smarter model loop. New thesis page: [docs/14-trust-harness-thesis/README.md](docs/14-trust-harness-thesis/README.md).
+
 ## [1.6.2] - 2026-08-15
 
 ### Changed

README.md

@@ -1,6 +1,6 @@
 # Òtítọ́
 
-**Local-first context and merge evidence for coding agents: turn AI-generated changes into trusted commits.**
+**Models generate the change. Otito proves whether it is safe to merge.**
 
 [![CI](https://img.shields.io/github/actions/workflow/status/BASHBOP/otito/otito-ci.yml?style=flat-square&label=CI)](https://github.com/BASHBOP/otito/actions/workflows/otito-ci.yml) [![npm](https://img.shields.io/npm/v/@bashbop/otito?style=flat-square)](https://www.npmjs.com/package/@bashbop/otito) [![license: MIT](https://img.shields.io/badge/license-MIT-blue?style=flat-square)](LICENSE) [![node](https://img.shields.io/badge/node-%E2%89%A518.18-339933?style=flat-square)](https://nodejs.org/)
 
@@ -16,9 +16,11 @@
  \___/ |_| |___| |_| \___/
 ```
 
-An agent's output is bounded by two things: the **model** and the **harness** around it. The harness includes the prompts, the context it's given, the codebase it works in, and the gates it must pass before code merges. You don't control the model. You control the harness, and a tighter harness lets a cheaper model do the same work with fewer wasted tokens.
+The generic agent loop (prompting, retries, tool routing, file editing) is becoming infrastructure. Frontier models already plan, search repositories, use tools, and recover from mistakes. Model vendors are packaging native harnesses with file tools and sandbox execution. Competing there is a losing bet.
 
-**Òtítọ́** is that harness layer. It is local-first, deterministic, and model-agnostic: it discovers repositories, builds local indexes, generates task-aware context before an agent edits, scores how much a change actually touches, and gates merge readiness. It works the same way every time, with no server, no account, and no code leaving the machine. Because it depends on software fundamentals rather than any one model, the harness you build today keeps working as models change underneath it.
+What remains strategically important is the **trust harness**: accurate repository context, permission and sandbox boundaries, exact validation against the changed code, risk-sensitive policies, CODEOWNERS and human approval, reproducible receipts, and independent evidence the model cannot award itself. Stronger models increase that need, because teams will let them change more code with less supervision.
+
+**Òtítọ́** is that independent trust layer. It is local-first, deterministic, and model-agnostic: it discovers repositories, builds local indexes, generates task-aware context before an agent edits, scores how much a change actually touches, and gates merge readiness. It works the same way every time, with no server, no account, and no code leaving the machine. It does not compete with Codex, Claude Code, Gemini, Cursor, or future native harnesses. It integrates with them, and keeps working as models change underneath it.
 
 ## Trusted agent workflow
 
@@ -30,7 +32,7 @@ Request -> context -> scoped change -> exact validation -> review evidence -> hu
 
 Otito helps the agent understand and bound a task before editing, then gives the maintainer evidence to decide whether to trust the result. A passing local gate is never an automatic merge approval: hosted CI, GitHub review, CODEOWNERS, and the human release decision remain separate authorities.
 
-It does not try to replace `opensrc`, `code-structure`, Daytona, or Harnss. It gives developers and coding agents a single CLI that can:
+It does not try to replace native agent harnesses, `opensrc`, `code-structure`, Daytona, or Harnss. It gives developers and coding agents a single CLI that can:
 
 Deterministic merge gates are the differentiated core. This is the human-in-the-loop checkpoint that a model cannot grade for itself:
 
@@ -76,6 +78,7 @@ The published MkDocs site is a practical discovery and delivery guide:
 - [Determinism Thesis & Harness Boundary](docs/11-determinism-thesis/README.md)
 - [Dual-Mode Thesis & Complementary Stack](docs/12-dual-mode-thesis/README.md)
 - [Prompt Determinism Thesis & Settings Trap](docs/13-prompt-determinism-thesis/README.md)
+- [Trust Harness Thesis & Commodity Loop](docs/14-trust-harness-thesis/README.md)
 - [Glossary](docs/GLOSSARY.md)
 
 Read it at:

docs/06-builder-founder-operating-loop/README.md

@@ -22,7 +22,7 @@ durable evidence
 
 ## Tool Boundaries
 
-Òtítọ́ is the product surface. Its context, impact, and gate commands provide repository context, PR review context, workspace reports, agent-facing evidence, and merge readiness.
+Òtítọ́ is the independent trust-harness surface. Its context, impact, and gate commands provide repository context, PR review context, workspace reports, agent-facing evidence, and merge readiness without competing with the coding agent's own loop.
 
 `otito impact` is the canonical change-impact analyzer. Use it when scope is unclear, when import-neighbor evidence matters, or when a diff needs validation against the original change request. The standalone `impact-map` work has been absorbed into otito for normal product and agent workflows.
 
@@ -34,7 +34,7 @@ The rule is simple:
 | Is this PR ready to merge under the repo's governance rules? | Òtítọ́ gate |
 | What files, import neighbors, tests, or missed diff areas might this change affect? | `otito impact` |
 
-This keeps the public story clear: one product, with context and impact analysis before its final merge-safety gate.
+This keeps the public story clear: model-native agents generate changes; one model-agnostic product provides context and impact analysis before its final merge-safety evidence.
 
 ---
 
@@ -151,7 +151,7 @@ The ledger can live in a PR description, merge note, release note, company pilot
 
 | Track | Question | Artifact |
 | --- | --- | --- |
-| Product | Is otito still the context foundation? | README, docs, CLI/MCP behavior, tests |
+| Product | Is otito still the independent context and merge-evidence layer? | README, docs, CLI/MCP behavior, tests |
 | Gate | Is Òtítọ́ still the merge-safety signal? | Òtítọ́ workflow, local report, PR check, policy mode |
 | Release | Can another maintainer understand what shipped? | SemVer impact, changelog, tag, GitHub release |
 | Governance | Can a company see who was accountable? | CODEOWNERS, review policy, branch protection, decision record |

docs/07-harness-thesis/README.md

@@ -1,6 +1,6 @@
 # Harness Thesis & Agent Experience
 
-> _Why otito bets on the harness, not the model — and the roadmap that follows from it._
+> _Why otito still bets on a harness, which harness is durable, and the AX roadmap that follows._
 
 This document maps a widely-shared argument about agentic engineering onto otito's
 existing surface, then turns it into a concrete, prioritised roadmap. The source is a
@@ -11,21 +11,26 @@ matters most, and naming it sharpens the product.
 
 ## The thesis in one line
 
-> Everyone obsesses over the model — the engine of the F1 car. The rest of the car is the
-> **harness**: prompts, skills, the codebase, the gates. You control the harness far more
-> than you control the model, and a tighter harness lets a cheaper model do the same work.
+> Everyone obsesses over the model. You still control a harness, but the generic
+> agent loop is becoming vendor infrastructure. Otito owns the **trust harness**:
+> context, gates, receipts, and independent merge evidence. A tighter repo still
+> lets a cheaper model do more; that is now the AX score, not the lead claim.
 
-otito **is** a harness tool. It is deterministic, local-first, and model-agnostic — the
-part of an AI stack that keeps working as models churn underneath it.
+otito **is** that trust layer. It is deterministic, local-first, and model-agnostic.
+The generic loop belongs to Codex, Claude Code, Gemini, Cursor, and future native
+harnesses. See [the trust harness thesis](../14-trust-harness-thesis/README.md).
 
 ## Eight lessons, mapped to otito
 
 ### 1. Own the word "harness" (positioning)
 
 The video reframes "code context tool" as something bigger: the environment an agent runs
 in. otito already generates harnesses (`otito harness`, `repo_harness`) and gates
-(`otito gate`, `review_gate`). The README now leads with this. The strategic claim —
-*the harness survives model churn* — is both true of otito and currently going viral.
+(`otito gate`, `review_gate`). Keep that vocabulary, then split it. The generic loop
+(prompts, retries, file tools) is becoming infrastructure. The **trust harness**
+(context, validation, owners, receipts) is the durable product. The README now leads
+with merge evidence, not cheaper models. See
+[the trust harness thesis](../14-trust-harness-thesis/README.md).
 
 ### 2. "A cheaper model works if the codebase is easy to change" → make it measurable
 
@@ -112,7 +117,8 @@ model cannot do for itself**, framed as the durable half of the stack.
 
 - Matt Pocock & David Ondrej, _Agentic Engineering Workflow_ — <https://www.youtube.com/watch?v=nQwJVHCtDDY>
 - otito source referenced above: `src/lib/tokens.js`, `src/lib/impact.js`, `src/lib/review.js`, `src/lib/risk-paths.js`, `src/lib/harness.js`
-- Companion: [Determinism Thesis](../11-determinism-thesis/README.md) (why the harness must be non-model),
+- Companion: [Trust Harness Thesis](../14-trust-harness-thesis/README.md) (which harness is durable),
+  [Determinism Thesis](../11-determinism-thesis/README.md) (why the harness must be non-model),
   [Dual-Mode Thesis](../12-dual-mode-thesis/README.md) (probabilistic generation + deterministic verification),
   [Prompt Determinism Thesis](../13-prompt-determinism-thesis/README.md) (prompt settings are not a gate),
   [Convergence Thesis](../09-convergence-thesis/README.md)

docs/07-harness-thesis/ax-score-spec.md

@@ -23,7 +23,9 @@ _"how cheap and safe is it for an agent to make a change here?"_ for a given tas
 
 It is the measurable form of the harness thesis (see
 [README.md](./README.md), lesson 2): a better codebase needs **fewer tokens** and has
-**better guardrails**, so a cheaper model can do the same work. The AX score rises as the
+**better guardrails**, so a cheaper model can do the same work. That remains a cost
+property. The product lead is independent merge evidence (see
+[the trust harness thesis](../14-trust-harness-thesis/README.md)). The AX score rises as the
 harness improves and falls when the codebase is hard to change. No competing tool ships this.
 
 Two framings, same engine:

docs/08-tutorials-integration/README.md

@@ -83,3 +83,5 @@ merge-ready — the same trust-layer discipline otito uses on itself.
   agents plus deterministic merge evidence.
 - [Prompt Determinism Thesis & Settings Trap](../13-prompt-determinism-thesis/README.md) — why
   "tell it not to randomize" is not a merge gate.
+- [Trust Harness Thesis & Commodity Loop](../14-trust-harness-thesis/README.md) — why independent
+  merge evidence outlasts generic agent orchestration.

docs/09-convergence-thesis/README.md

@@ -136,7 +136,8 @@ execution — the half of verification a model structurally cannot do for itself
 - otito source referenced above: `src/lib/impact.js` (`generateImpact`,
   `validateAgainstDiff`), `src/lib/review.js`, `src/lib/risk-paths.js`,
   `src/lib/codeowners.js`, `src/lib/ax.js`
-- Companions: [Dual-Mode Thesis](../12-dual-mode-thesis/README.md) (probabilistic vs deterministic 101),
+- Companions: [Trust Harness Thesis](../14-trust-harness-thesis/README.md) (which harness is durable),
+  [Dual-Mode Thesis](../12-dual-mode-thesis/README.md) (probabilistic vs deterministic 101),
   [Prompt Determinism Thesis](../13-prompt-determinism-thesis/README.md) (prompt settings are not a gate),
   [Determinism Thesis](../11-determinism-thesis/README.md) (why model output varies),
   [Harness Thesis](../07-harness-thesis/README.md)

docs/11-determinism-thesis/README.md

@@ -133,11 +133,12 @@ variance with prompt settings, read
 this doc for why LLM variance is structural, not a settings bug.
 
 ```text
-Dual-mode (docs/12)           →  two modes, complementary roles
-Prompt determinism (docs/13)  →  you cannot collapse modes via prompting
-Determinism (this doc)        →  why the model cannot be the trust layer
-Harness (docs/07)             →  what you control instead of the model
-Convergence (docs/09)         →  how you measure intent vs. execution deterministically
+Trust harness (docs/14)       ->  which harness is durable; integrate with native loops
+Dual-mode (docs/12)           ->  two modes, complementary roles
+Prompt determinism (docs/13)  ->  you cannot collapse modes via prompting
+Determinism (this doc)        ->  why the model cannot be the trust layer
+Harness (docs/07)             ->  what you still control; AX as a cost property
+Convergence (docs/09)         ->  how you measure intent vs. execution deterministically
 ```
 
 ## Priorities
@@ -164,7 +165,8 @@ variance, ship deterministic verification, and keep the merge decision human.**
 - otito source referenced above: `src/lib/context-engine.js`, `src/lib/converge.js`,
   `src/lib/review.js`, `src/lib/pass-local.js`, `src/lib/impact.js`,
   `tests/telemetry.test.js`, `tests/context-engine.test.js`
-- Companions: [Harness Thesis](../07-harness-thesis/README.md),
+- Companions: [Trust Harness Thesis](../14-trust-harness-thesis/README.md),
+  [Harness Thesis](../07-harness-thesis/README.md),
   [Convergence Thesis](../09-convergence-thesis/README.md),
   [Dual-Mode Thesis](../12-dual-mode-thesis/README.md),
   [Prompt Determinism Thesis](../13-prompt-determinism-thesis/README.md)

docs/12-dual-mode-thesis/README.md

@@ -22,13 +22,15 @@ the onboarding explainer for why otito sits beside an LLM instead of replacing o
 
 ## The thesis in one line
 
-> Coding agents are **probabilistic** — they interpret, generate, and adapt. Merge
-> readiness is **deterministic** — same repo state, same rules, same verdict. A
+> Coding agents are **probabilistic**: they interpret, generate, and adapt. Merge
+> readiness is **deterministic**: same repo state, same rules, same verdict. A
 > trustworthy agent stack uses **both modes on purpose**, with a bright line between
-> generation and verification.
+> generation and verification. Native model harnesses own generation. Otito owns
+> verification.
 
 otito **is** the deterministic mode for repository work: rules, gates, receipts, and
-git facts — not token sampling.
+git facts, not token sampling. It integrates with Codex, Claude Code, Gemini, and
+Cursor rather than competing with their agent loops.
 
 ## What lines up — otito is already the deterministic mode
 
@@ -53,10 +55,14 @@ LLM outputs vary at scale. This doc explains *what to do about it architecturall
 
 The determinism doc owns "models vary; harnesses don't." This doc owns the **split
 itself**: *probabilistic generation, deterministic verification.*
+[The trust harness thesis](../14-trust-harness-thesis/README.md) then names **which
+harness** sits on the deterministic side: independent merge evidence, not the generic
+agent loop.
 
 That reframes otito from "anti-AI" to "complementary." Teams already accept that
 chatbots are probabilistic. otito makes the same acceptance explicit for coding agents:
-let the model judge and draft; let the harness rule and measure.
+let the model judge and draft; let the harness rule and measure. Native hosts generate.
+Otito attests.
 
 ### 2. Place deterministic work at guarantees
 
@@ -129,14 +135,17 @@ agents** — the if-this-then-that layer for repository trust.
 ## How the thesis docs fit together
 
 ```text
-Dual-mode (this doc)            →  two modes, complementary roles
-Prompt determinism (docs/13)    →  you cannot collapse modes via prompting
-Determinism (docs/11)           →  why the probabilistic mode cannot self-verify
-Harness (docs/07)               →  what you control instead of the model
-Convergence (docs/09)           →  how you measure intent vs. execution deterministically
+Trust harness (docs/14)         ->  which harness is durable; integrate with native loops
+Dual-mode (this doc)            ->  two modes, complementary roles
+Prompt determinism (docs/13)    ->  you cannot collapse modes via prompting
+Determinism (docs/11)           ->  why the probabilistic mode cannot self-verify
+Harness (docs/07)               ->  what you still control; AX as a cost property
+Convergence (docs/09)           ->  how you measure intent vs. execution deterministically
 ```
 
 Read this doc first for onboarding. Read
+[the trust harness thesis](../14-trust-harness-thesis/README.md) when the question is
+whether generic agent loops still matter. Read
 [the prompt determinism thesis](../13-prompt-determinism-thesis/README.md) when someone
 proposes "just tell it not to randomize." Read determinism next for the engineering depth on
 LLM variance. Read harness and convergence when designing workflows and gates.
@@ -165,7 +174,8 @@ in a stack that still needs probabilistic generation.
 - otito source referenced above: `src/lib/pass-local.js`, `src/lib/risk-paths.js`,
   `src/lib/converge.js`, `src/lib/review.js`, `src/lib/context-engine.js`,
   `codex/skills/otito-context/`, `codex/skills/otito-review/`
-- Companions: [Determinism Thesis](../11-determinism-thesis/README.md),
+- Companions: [Trust Harness Thesis](../14-trust-harness-thesis/README.md),
+  [Determinism Thesis](../11-determinism-thesis/README.md),
   [Harness Thesis](../07-harness-thesis/README.md),
   [Convergence Thesis](../09-convergence-thesis/README.md),
   [Prompt Determinism Thesis](../13-prompt-determinism-thesis/README.md)

docs/13-prompt-determinism-thesis/README.md

@@ -123,11 +123,12 @@ merge evidence** — because the chat is not the artifact that ships.
 ## How the thesis docs fit together
 
 ```text
-Dual-mode (docs/12)           →  two modes, complementary roles
-Prompt determinism (this doc) →  you cannot collapse modes via prompting
-Determinism (docs/11)         →  why generation settings still fail at scale
-Harness (docs/07)             →  what you control instead of the model
-Convergence (docs/09)         →  how you measure intent vs. execution deterministically
+Trust harness (docs/14)       ->  which harness is durable; integrate with native loops
+Dual-mode (docs/12)           ->  two modes, complementary roles
+Prompt determinism (this doc) ->  you cannot collapse modes via prompting
+Determinism (docs/11)         ->  why generation settings still fail at scale
+Harness (docs/07)             ->  what you still control; AX as a cost property
+Convergence (docs/09)         ->  how you measure intent vs. execution deterministically
 ```
 
 Read dual-mode first, then this doc when someone proposes "just tell it not to
@@ -156,7 +157,8 @@ scope probabilistic work; otito verifies deterministic facts about what actually
   <https://www.youtube.com/shorts/YRf_-mNEnvQ>
 - otito source referenced above: `src/lib/context-engine.js`, `src/lib/converge.js`,
   `src/lib/pass-local.js`, `src/lib/code-map/generate.js`, `src/lib/review.js`
-- Companions: [Dual-Mode Thesis](../12-dual-mode-thesis/README.md),
+- Companions: [Trust Harness Thesis](../14-trust-harness-thesis/README.md),
+  [Dual-Mode Thesis](../12-dual-mode-thesis/README.md),
   [Determinism Thesis](../11-determinism-thesis/README.md),
   [Harness Thesis](../07-harness-thesis/README.md),
   [Convergence Thesis](../09-convergence-thesis/README.md)