feat(audit): replicate real-world agent harnesses — sdr-outreach, data-analyst, eval-loop

[LinuxDevil]

Summary

Surveyed what agent harnesses people actually build and ship (G2, Salesforce Agentic Index, OpenAI State of Enterprise AI, Google Cloud ROI study + reference implementations like Arvexi's SDR architecture, OpenAI's cookbook data-analyst, pi-sql-analytics, and the harness-centric generator↔evaluator literature — findings captured in audit/TRENDS.md), then replicated the three dominant production patterns as live OpenRouter harnesses:

• sdr-outreach/ — the "drafts-as-pull-requests" AI SDR: lead enrichment → personalized drafts → durable approval queue → reject-with-feedback → redraft → a separate sender principal (hard per-agent tool allowlist) → CRM activity log + audit trail. send_email simply doesn't exist in the drafting agent's registry.
• data-analyst/ — the "talk to your data" text-to-SQL pattern: sqlite SaaS warehouse, list_tables/describe_table/run_query with a deterministic guard outside the model (single-statement, SELECT/WITH only, auto LIMIT, describe-before-query gate), metric definitions, durable user corrections, queries.jsonl audit trail. No approval prompts — the guard IS the boundary.
• eval-loop/ — the generator↔evaluator harness pattern: builder + a hostile reviewer on a disjoint session, a contract of 5 testable predicates + a typed rubric, and a deterministic control loop (continue / stop / escalate after 4 rounds). Canary string proves context isolation.

Live results (OpenRouter, alpha.19 packed build)

Harness	Result
sdr-outreach	8/8 PASS on gpt-4o-mini — 27 durable approval pauses resolved; only approved drafts sent; rejection feedback visibly incorporated into the redraft
data-analyst	8/8 PASS on claude-haiku-4.5 — correct MRR/churn math, 9/9 hostile probes rejected, corrections recalled + applied
eval-loop	6/6 PASS on gpt-4o-mini — contract satisfied, converged round 2, evaluator typed rubric every round, canary leaked nowhere

Findings (documented in REPORT.md)

• Model tier matters for analytics too: gpt-4o-mini reported the top plan's MRR slice ($3,599) as the "total" ($4,673) and cited IDs instead of names; haiku-4.5 was correct with named accounts. Bounded flows pass on mini; multi-step SQL reasoning wants a stronger model — AUDIT_MODEL picks it.
• Guard > prompt: both models initially skipped describe_table before querying, so run_query now refuses statements against undescribed tables (advisory verdict, advised-aways=3 in the green run) — enforcing the pattern the way the reference implementations do.
• No SDK defects across ~40 tool calls and 27+ durable approval pauses.

Test plan

• npx tsx sdr-outreach/index.ts — 8/8 PASS
• npx tsx data-analyst/index.ts — 8/8 PASS (AUDIT_MODEL=claude-haiku-4.5)
• npx tsx eval-loop/index.ts — 6/6 PASS
• audit-only changes; no SDK source touched

Generated with Devin