Harness and Adapters - r5e

What an Adapter Does

The adapter is a governance-to-native-config compiler. It takes r5e’s governed session spec and projects it into whatever format the provider expects:

r5e Input	Claude Code Output	Codex Output	API Output
Policy grants	`.claude/settings.json`	`--sandbox` flags	tool definitions
Context layers	`CLAUDE.md`	system prompt	system message
Tool refs	`.claude/skills/*.md`	tool flags	tools array
Gateway config	MCP server config	N/A	base URL
Credential leases	env vars (v1alpha)	env vars	auth headers
Workspace claims	git worktree	`-C workdir`	N/A

Same governance. Different projections. Writing a new adapter = writing a new governance projector.

Adapter Classes

Not all adapters have the same fidelity:

Class	Enforcement	Event Fidelity	Example
opaque-cli	Pre-flight + observe-and-terminate	Partial (post-hoc observation)	Claude Code, Codex, Gemini CLI
governed-api	Synchronous per-call enforcement	Full	Direct API adapters
governed-mcp	MCP protocol-native enforcement	Full	MCP gateway adapters

Downstream governance is aware of the adapter class. An opaque-cli session’s audit trail has lower fidelity — this is an accepted tradeoff, not a hidden gap.

The Adapter Contract

defmodule R5e.Adapter do
  @callback materialize(session_spec) :: {:ok, handle} | {:error, term}
  @callback execute(handle, event_handler) :: :ok | {:error, term}
  @callback interrupt(handle, :graceful | :hard) :: :ok | {:error, term}
  @callback report(handle) :: {:ok, result} | {:error, term}
  @callback adapter_class() :: :opaque_cli | :governed_api | :governed_mcp
end

Adapters are Capability resources — certified through the trust registry, governed by the same admission pipeline as everything else.