Profiles / temporal-community

Temporal Agent Harness

A workflow-engine vendor's agent harness that makes the human approval a durable object, shipped with an approvals server that listens on every interface and asks for no login.

Edited by Michael Ruescher / reviewed 2026-09-23

Operator Stance / as of 2026-09-21

Use it for
Teams already running Temporal who want an agent whose approvals, tool calls and turns survive a crash and replay exactly. The approval policy and event stream are readable in the repo rather than inferred.
Avoid it for
Anything reachable from a network you do not control while running the packaged server at 0.4.0 defaults. Production use of any kind: every release is flagged prerelease, and the hosting org disclaims support.
Watch next
A tag that binds loopback by default or adds authentication; #137 (first-class messages) reaching a tag; whether decision-model auto-approval lands in a release; whether Temporal Cloud history retention is documented for agent payloads.

The Temporal Agent Harness is on this watchlist because of what it makes durable. When the model asks for a tool the policy does not auto-approve, the call parks as a workflow wait. It survives a crash, can sit for days, and dispatches from where it stopped when a person decides. Every turn and decision lands in workflow history and can be replayed. It is the first entry built by a workflow-engine vendor rather than a model lab or an agent author.

Where it stands, 2026-09-21

Channel. Four GitHub releases in twelve days, 0.1.0 (4 September) through 0.4.0 (15 September), every one flagged prerelease. PyPI carries only 0.3.0 and 0.4.0. The 0.3.0 and 0.4.0 tags were re-pointed after their release pages went live, and the wheels came from a manual dispatch that skips the workflow’s tag-and-version check. Pin the wheel, and cite commit e4bde4be rather than the tag name.

The approvals server has no login. At 0.4.0 the packaged serve command defaults to 0.0.0.0, and the web app exposes session listing, approval, callback results and operator commands, including one that skips every approval, with no authentication. Run it with --host 127.0.0.1 or behind an authenticating proxy. Main adds wildcard CORS.

“Always” means the tool. In the coding example, OpenCode’s “always” answer posts remember=true, which allow-lists the tool by name. One “always” on bash approves every later bash command, whatever the dialog showed.

The policy is the caller’s. A caller’s AgentConfig.approval_policy overrides the agent author’s default, a skip-all layer exists, and relaxing the live policy releases calls already waiting.

Durability has an edge. “No double-run tool calls” holds for completed activities on replay. A tool interrupted mid-run runs again under Temporal’s default retry, and nothing in the harness enforces idempotency. Tool inputs, outputs and reply text all go into workflow history with no codec.

Main is ahead of the wheel. #137 on main replaces the operator-command channel with first-class messages, and the README on main documents it. The wheel does not have it.

Verification

open source commits / evidence floor: official docs / updated 2026-09-21

Featured in

Source policy: what Frontier watches and accepts as evidence

Edited and maintained by Bitter Frontier.

View source on GitHub