LongHorizon-Harness runs a long agent task as a sequence of rounds. A manager keeps the task state outside the agent's context. A fresh-context executor performs one subtask per round. A read-only auditor inspects the environment before any state record can change. With the same model and the same Claude Code backend, this raises the WeaveBench pass rate from 51.8% to 80.7%.
Agents now work on tasks that take hours and span hundreds of steps. Harnesses such as Claude Code and Codex CLI run these tasks in one session. That session holds three different things in one growing context: the execution history, the task state (what is required, what is done, what was discovered), and the judgment of whether each step succeeded. The authors argue that this coupling causes the familiar long-horizon failures. Errors compound: a wrong early decision distorts every later decision. The context decays: as the history grows, the model retrieves the relevant facts less reliably. And the task state gets lost: the agent no longer knows which requirements remain open.
There is a fourth problem, and it is the one this paper targets most directly. The agent grades its own work. When the executor claims a subtask is complete and the claim is wrong, that wrong claim enters the context and becomes a premise for every following decision.
The authors reframe long-horizon execution as a state-management problem. The task state lives outside the execution context, as a structured set of records: requirements (objectives and constraints from the original task), artifacts (outputs produced so far), and facts (information discovered in the environment). Each record carries a status — completed, pending, blocked, or untrusted — and references to the evidence that supports it.
Three roles operate on this state in a Manage-Execute-Audit (MEA) loop:
The manager owns the state and never touches the environment. It cannot run commands, read files, or see the screen. Each round it selects one open requirement and writes a subtask contract: the goal, the acceptance criteria, the boundary constraints, and pointers to the prior evidence the subtask needs. It can also stop the loop: done, blocked, or ask-the-user.
The executor is the only role that may modify the environment. It is an unmodified existing agent — Claude Code, Codex CLI, or OpenClaw — launched through a thin adapter with a time budget. It starts each round in a fresh context that contains only the contract and the referenced evidence, not the transcripts of earlier rounds. When the round ends, its transcript is discarded. Its completion report is kept, but treated as an unverified claim.
The auditor also starts fresh, with read-only tools. It ignores the executor's claim and inspects the environment directly: files, logs, processes, test results, or the screen. It reports a completion status (complete, incomplete, blocked) and an integrity status (clean, suspect, violation). The harness watches the workspace during the audit; if the auditor changes anything relevant to the task, the audit cannot support a completion.
Only audit evidence updates the persistent state. Audit reports are the only memory that crosses rounds. If you build infrastructure, the shape is familiar: it is the reconciliation pattern. The manager holds the desired state, the auditor observes the actual state, and each round closes part of the gap between them.
The matched comparison uses the same model (Qwen 3.7-Plus) and the same execution backend (Claude Code), with and without the MEA layer. On WeaveBench (114 tasks that mix GUI and CLI work), the pass rate rises from 51.8% to 80.7%. On Terminal-Bench 2.1 (command-line tasks), the success rate rises from 69.7% to 77.2%. On OSWorld 2.0 (desktop workflows with a median human completion time of 1.6 hours), full completions rise from 2.8% to 8.3%. The gain is not only for weaker models: on a 34-task OSWorld subset, Claude Opus 4.7 rises from 20.6% to 35.3% full completions. On the WeaveBench games subset, Qwen inside this harness (mean score 0.733) beats Opus inside plain Claude Code (0.680).
The caveats matter. The WeaveBench runs used root privileges inside the task VM; the official leaderboard rows used a regular user account, so only the authors' own baseline is a fair comparison. On OSWorld, the official baselines act through the GUI only, while this harness also gets a shell — part of that gain is the extra tool, not the loop. The cost is real: on OSWorld, Qwen's output tokens grew from 29K to 104K per task, and the auditor consumes 19–38% of all tokens. The cost is not a fixed multiplier, though — with the stronger Opus model, total tokens fell from 16.5M to 11.1M per games task, because a stronger executor needs fewer repair rounds; on Terminal-Bench the harness used 24% fewer tokens than the baseline. The gains are largest where the weak point is execution reliability; on tasks limited by a single capability (visual perception, algorithm design), the loop helps little and sometimes lowers the score — a few tasks that the baseline solved fully dropped to zero under the extra verification rounds. All numbers are the authors' own, and WeaveBench is scored by an LLM judge.
The code is open (github.com/AMAP-ML/LongHorizon-Harness), and the adapter wraps agent CLIs you already run. But the pattern is more portable than the code, and you can apply it with off-the-shelf tools today. Keep the task state in a file outside the agent session, as explicit requirements with statuses and evidence links. Run the agent per-subtask in fresh sessions, and give it a contract with acceptance criteria, not the full history. Verify with a separate read-only pass before you mark a requirement done, and never let the worker's own "done" update the plan. The paper's case studies show why: a baseline agent retried one unresponsive Wireshark dialog for 400 steps because the failure report was lost in its own long history; the harness recorded the failure as a fact, and the next fresh executor simply worked around it. The broader lesson repeats across recent work: agent capability is a property of the model and the harness, and the harness is the part you control.