Top-level fields
Harness policy
managed_config contains model and harness-specific settings. mcp is additive. package_overrides may enable or disable an organization package and provide adapter settings; it cannot replace the source, version, or digest. minimum_client_version remains visible to operators, while required_capabilities is the enforcement mechanism for contract features.
Managed Codex launches default to approval_policy: on-request, preserving native approval prompts while the configured sandbox remains active. An explicit approval_policy remains authoritative. The provider-neutral auto_approve: true selects never only when no explicit Codex approval policy is present; auto_approve: false and an absent value both select on-request.
When upgrading, configurations that explicitly set approval_policy,
auto_approve, or required keep that choice. A deployment that previously
relied on Codex’s omitted approval setting must add approval_policy: never or
auto_approve: true if unattended execution is intentional. New production
baselines set required: true; use an explicit required: false only when
launching from stale cached governance during a control-plane outage is an
accepted risk.
The presence of top-level gateway enables gateway mode for every allowed coding agent and connects Blue to an upstream gateway operated by your organization. Blue does not bundle that gateway. litellm is the first and currently only supported type. The Control API injects proxy_url and the authenticated user’s session-bound inference token; each agent inherits its model from its own managed_config, or leaves model selection to the agent when none is managed. auth_style remains on the wire, but bearer is the only supported client-to-proxy value.
Managed packages
Harness policies may declare a semverversion_requirement. Blue parses the installed CLI’s native version output and fails before changing files or launching when the version is missing, unparsable, or outside that range. Package adapters may add ordered variants with inclusive introduced and optional exclusive before boundaries; the top-level adapter fields are the fallback layout. See Harness version compatibility for interval migration and lifecycle behavior.
Packages can contain skills, hooks, agent definitions, plugins, and helper executables. Every archive is pinned by SHA-256 and declares explicit archive-relative adapters rather than running an installer script.
Adapter availability describes whether the package supports a harness release;
variants describe how its archive layout changes across supported releases. A
variant-only adapter must cover its full availability range without gaps. When
fallback component fields exist, unmatched points inside availability use that
fallback. Governance publication rejects a package whose availability does not
cover the organization policy for an enabled harness.
Package-level
platform_sources maps exact os-architecture keys to alternate source, artifact ID, and digest triples. Package-level settings supplies defaults that per-harness overrides can replace.
Package paths must be relative, remain inside the verified archive, and exist on the selected platform. Links and special archive entries are rejected. Package settings are exposed to the governed child as HARNESS_PACKAGE_<ID>_SETTINGS JSON.
Each MCP server has a name and either a stdio command (plus optional args and env) or a remote url (plus optional transport). Set disabled: true to retain a definition without activating it.
Standalone skills can live anywhere in an archive and do not require a native plugin root. Blue generates harness-owned activation metadata for Codex and Claude. Codex and Claude agents or hooks still use the native package root named by plugin_dir. Kimi can load standalone agent directories and a TOML hook fragment. OpenCode hooks are plugin modules listed under plugins.
The dashboard can inspect github:owner/repository@ref for a public GitHub repository, a public HTTPS archive, or a deployment-managed GitHub/Bitbucket connection. Public GitHub refs resolve to immutable codeload URLs; clients download public sources directly and verify their exact digest. Managed repositories are resolved to an immutable commit and mirrored into organization-scoped object storage. Governance contains an artifact_id and exact digest; clients use their existing harness session to request a fresh short-lived download and never receive repository credentials.
Removing a package disables it for subsequent governed launches. Unmodified owned content is deleted; locally changed content is moved to quarantine and reported as drift.