Enforce your org’s quality, security and compliance gates inside every agent session.
Hold every agent and engineer to the same quality standard. Every session runs in its own consistent, reproducible worktree, with deterministic validation, verifiable proof and full observability.
npm install -g @osfactory/harhar onboard
The quality governance layer for your agentic development lifecycle.
- Governance
Consistent standards across every agent
Every agent, in every repo, inherits your standards by default. Your engineering policies, regulatory requirements and security controls are enforced on every change and stay consistent as you scale.
- Velocity
Faster time to merge
Agents run your verification gates on every change, before they open a pull request. Work reaches reviewers already verified, so review is faster and changes merge sooner.
- Enablement
A team that works like your best
See how your most effective engineers work with agents, then make those patterns the default for everyone.
- Economics
A clear return on your AI spend
Kerno Run ties every ticket to the AI spend behind it. You can show what a budget delivered and forecast the next one.
Every change is verified before the PR opens.
Define the verification gates every agent must pass before it opens a pull request. Work reaches reviewers already verified, so review is faster and changes merge sooner.
Every agent runs your full pipeline of real checks on each change, before opening a pull request.
A per-session matrix records the exact gate that ran and the tree it validated, yours to verify.
Every worktree keeps a verify history, logs and a replayable agent trajectory to show exactly why.
Know exactly what your AI spend delivered.
Every dollar of AI spend is tied to the work that produced it, so you can prove the return and plan the next budget.
Broken down by model, repository and teammate, exportable to CSV.
Set a weekly limit and alert admins the moment spend crosses it.
Every ticket and task carries the exact cost and validation of the run behind it.
Turn your power users’ habits into the team default.
See how your most effective engineers work with agents, then make those patterns the default for everyone.
See how your top engineers work with agents, then make it the team default.
Adoption, pass rate and cost for everyone in the workspace.
Drill into one engineer’s repos, runs and pass rate to coach them directly.
Ask anything about your ADLC.
Ask why a pass rate dropped, where spend is going, which repos are failing, or how your team works with agents. Kerno answers in plain English, from your live data.
Why did gate pass rate drop on acme/auth this week?
Pass rate on acme/auth fell from 96% to 88% starting Tuesday. 9 of 11 failures are the policy gate, triggered by a new dependency added in SEC-118. Cost on the branch is up $340 from the retries.
- Pass rate
- 88%
- Failed gate
- policy
- Ticket
- SEC-118
- Extra spend
- $340
Three steps from local harness to org-wide control.
- Step 01
Keep the harness you have
Kerno Run reads the same .har/ contract in your repo, so your agents keep running the way they do today.
npm install -g @osfactory/har - Step 02
Connect your workspace
Point the harness at your org workspace. Runs, gates, proof and cost start syncing as they happen.
har hq connect - Step 03
Set your standards
Define required gates, budgets, roles and alert thresholds once. Every repository and every agent inherits them by default.
In your workspace settings
Profiles and plugins for the way your team ships.
Built on open standards, with zero lock-in and complete control.
Kerno Run is built on HAR, the open-source agent harness. Its .har/ contract is an open standard that lives in your repo, and it plugs into the agents, tools, tests and CI you already use.
- .har/
- ├─ harness.envconfiguration
- ├─ stages.jsonthe verify pipeline
- ├─ stages/your own checks
- ├─ hooks/lifecycle steps
- └─ plugins/Playwright, Semgrep, Kerno Validate
- 01
An open standard
One machine-readable contract in .har/ that Claude Code, Cursor, Codex or any MCP agent reads the same way.
- 02
Fits your existing flow
Your own checks become the verify stages, and HAR runs as a CLI and an MCP server inside the agents and CI you already use.
- 03
Zero lock-in
The contract lives in your repo and moves with you to whichever agent or tool you adopt next.
- 04
Complete control
Apache-2.0 and fully auditable. Add your own stages, hooks and plugins, and self-host Kerno Run in your own cloud.
The open harness your engineers already run, on their own machines and CI.
In the open core- Isolated slots and worktrees
- Deterministic validation gates
- Evidence trail per run
- Local Mission Control
- Plugins and custom stages
Everything in the open core, plus the layer an organization needs to govern it.
Everything in HAR, plus- Shared org workspaces and roles
- RoAI attribution down to the ticket
- Proof and funnel analytics at scale
- Budget and failure alerts
- SSO, SAML and audit trail
- Self-hosted or VPC deployment
Kerno Run meets enterprise security, compliance and procurement requirements.
Deploy in your own cloud or VPC, connect your identity provider, and keep an audit trail on every run.
- Apache-2.0 open core, fully auditable
- SSO / SAML / SCIM
- Self-hosted or VPC
- Keep code in your environment
Agents run on your own machines, CI or cloud, so only run metadata reaches Kerno Run.
- Run it in your own cloud
Deploy Kerno Run in your own cloud account or VPC, so your data lives where your policies require.
- SSO and SAML
Connect your identity provider so your team signs in with accounts you already manage.
- Role-based access control
Owner, Admin and Member roles, so people see only what they should.
- Audit trail on every run
Every run records who triggered it, what it checked and the exact tree it validated.
- Encryption in transit and at rest
Every connection is encrypted, and your run metadata is encrypted at rest.
Set up Kerno Run.
npm install -g @osfactory/harhar onboardKerno Run FAQs
Got any extra questions? Reach out on our community channel and we'll be happy to help.
01Does our source code leave our environment?
That is your choice. Run agents on your own machines and CI and your source stays there. Or run them in Kerno Run Cloud sandboxes, which are isolated per run, encrypted, ephemeral, and never retained or used for training. Either way, Kerno Run stores only run metadata long-term, including stages, durations, cost and tree hashes.
02How is Kerno Run different from the open-source HAR?
Kerno Run is the team edition built on the same Apache-2.0 core. The harness, gates and contract are identical. Kerno Run adds org workspaces, cost attribution, analytics, roles, alerts and SSO.
03Can we self-host?
Yes. Enterprise deployments run in your own cloud account or VPC, so your data lives where your policies require.
04Which coding agents are supported?
Any agent that reads the .har/ contract, including Claude Code, Cursor, Codex and any MCP agent. One profile covers them all.
05What do we need before we start a trial?
A repository with a .har/ profile. Runs happen on your own machines and CI, or in Kerno Run Cloud sandboxes, so most teams connect their first workspace the same day.
06How is Kerno Run priced?
Pay as you go on credits, at $1.00 a credit. Each verification run uses 0.2 credits, and data ingestion uses 0.6 credits per million events, kept for 12 months. Kerno Pro starts with a 14-day free trial with 100 credits, and Enterprise is billed by contract.
07Where are you on compliance?
Encryption in transit and at rest, RBAC and per-run audit trails are available today, and the open core is fully auditable.
08What is RoAI, and how do you attribute it?
RoAI is the return on your AI spend. Kerno Run ties every ticket to the runs and models behind it, so you can report what a budget delivered and forecast the next one.
09How does Kerno Run lower time to merge?
Agents run your verification gates on every change, before they open a pull request, so work reaches reviewers already verified and review is faster.