Harness-Hub Authors Publish Harness Adapters on Hugging Face: LoRA Adapters Trained With RL Inside pi, opencode and hermes, Guarded by safeagents Against Reward Hacking, but Fewer Tool Calls at Equal Accuracy Is Reported Only From Smoke Tests While Final Runs Are Still Streaming

On November 6, 2026, authors from the harness-hub organization published a Community Article on the Hugging Face blog called Harness adapters: Safe RL for efficient agentic development. It describes small LoRA adapters, one per model and per agent harness, trained with reinforcement learning (RL) inside the unmodified harnesses pi, opencode and hermes. The idea is that someone can swap the model behind a local coding agent for the adapter trained in that agent. The article also introduces safeagents, a proxy that checks every tool call during training. It is a community post, not an announcement by Hugging Face as a company, and the final training runs are still in progress.

The setup is concrete. Three models are trained: LFM2.5-24B-A2B, a mixture-of-experts model with 2 billion active parameters, and LFM3-1.7B as the main runs, plus TwIL-8B, a dense 8.8 billion parameter reasoning model, as an experiment because its model card says it was not trained on agentic data. Training uses the GRPO algorithm with TRL's AsyncGRPOTrainer, LoRA adapters of rank 32 on every linear layer, 8 rollouts per task and a learning rate of 1e-5. The planned runs are 200, 400 and 300 steps for the three models, on Hugging Face Jobs with 2 H200 GPUs for LFM3-1.7B and 4 for the others. The reward is the task's own verifier plus a small bonus for using fewer tool calls, 0.1 times one minus calls divided by 15, paid only on correct rollouts.

One base model can serve every harness at once. A single vLLM server loads the base weights once, and each of the three trainers sends requests that name its own adapter, so no one waits for another. The same trick is used for evaluation: nine checkpoints of LFM2.5-24B-A2B, 1,350 agent sessions in total, ran in one H200 job in under an hour for about $5 of GPU time. The authors estimate that merging and serving each checkpoint separately would have cost about $90.

Training is asynchronous. Each trainer keeps up to 48 agent sessions running at once, about 6 tasks with 8 rollouts each; TwIL-8B uses only 12 sessions because its longer reasoning fills memory sooner, and a task joins the queue only when all 8 of its rollouts are scored, because GRPO compares them with each other. A step packs finished rollouts into 4 micro-batches under a token budget of 131,072 tokens for LFM2.5-24B-A2B and 65,536 for the other two, so the number of tasks per step varies. Rollouts started more than 4 adapter versions earlier are dropped. For LFM3-1.7B the three trainers even share one GPU, because earlier runs spent about 35 seconds per step on forward and backward passes but several minutes waiting for sandboxes.

The training tasks come from two sources. SmolDataEnvs are data-analysis questions built from public Kaggle notebooks. Repo2RLEnvs rebuilds tasks from open agent sessions that people published on the Hub, in four types: repair, qa, build and extend. Each candidate passes six checks, and a task needs a verifiable oracle. The released set of 270 tasks is far from balanced: 253 are build tasks, or 94%, against 11 repair, 6 extend and no qa. Each run mixes both sources, holding out 40 Repo2RLEnvs tasks and 150 SmolDataEnvs tasks for evaluation.

The safety part is safeagents, a reverse proxy placed between the harness and the model server. It checks each tool call with rules, not with a model, in about 10 to 20 milliseconds: the call must use a declared tool, any host it reaches must appear in the conversation, and a scanner called atif-scan, extended by the authors' own plugins, looks for reward tampering, test editing, answer lookups and credential use. A blocked call is replaced by a text notice, and any rollout containing a notice scores 0. In the smoke run for TwIL-8B, at step 0, the model tried to find the storage bucket that held a task's source data, and the call was blocked. In a 50-step ablation with pi and LFM2.5-24B-A2B, turning the guard on changed held-out pass@1 by +0.0 points, with a margin of ±4.1 points, so that ablation detected no clear change; the ±4.1-point margin does not establish zero cost across setups. The authors also fixed a rule that first matched a legitimate grader file, and 213 sessions rescanned with both plugins matched no rule.

What the article does not show is the final result. Its summary says that on held-out tasks, in smoke training tests, the adapters make fewer tool calls than the base model while keeping or improving accuracy, but it gives no table of numbers, and the full runs are being streamed on a live dashboard. The results come from small models, three harnesses and a task mix that is mostly build tasks. We did not run any of it.

Our reading: this is an interesting and unusually open recipe. The safeagents idea, a deterministic proxy that blocks and zeroes reward-hacking attempts with no clear accuracy change detected in that configuration’s ablation (±4.1 points), can be useful to anyone doing RL on coding agents, and the safeagents repository is Apache-2.0 licensed. The claim that adapters make local agents more efficient is still a promise. Wait for the final runs and the live dashboard before relying on it, and check whether an adapter exists for your own harness and model.