The missing primitive in every agent harness is a protected region
I wrote a post about why agentic coding falls off a cliff after a few weeks. Coding agents have no equivalent of the source/assembly boundary a compiler gives us. Prompt, code, tests, and previous agent output are all editable and all treated as input. A week-three "simplify this" prompt can quietly drop a GDPR consent check or weaken a fraud cap with tests still passing. I call it logic drift: a locally valid edit preserves the shape of the code but weakens an earlier constraint. It already hit the Linux kernel, where an AI patch dropped a __read_mostly annotation that looked like trivial cleanup.
The piece walks through why discipline, traditional process (tests, types, CODEOWNERS), and current harness features (AGENTS.md, Cursor rules, Claude Code hooks, Copilot instructions) don't fix it. They're advisory, the agent can ignore them silently. My argument is that the missing primitive is harness-enforced protected regions at statement granularity, something like a # lock: comment that the harness rejects patches against unless the user explicitly unlocks. Until a harness ships that, the only boundary that holds is one the agent can't see, which today mostly means micro repos, sparse checkouts, sandboxes, write allowlists.