# Building an agentic harness that outlasts the model

DevFeed: [Building an agentic harness that outlasts the model](<https://devfeed.tech/articles/building-an-agentic-harness-that-outlasts-the-model-1319.md>)

Original publisher: [Read original article](<https://shopify.engineering/building-an-agentic-harness-that-outlasts-the-model>)

Author: Zack Deveau

Published: 2026-07-29T15:30:00Z

Content type: article

Language: en

Sources: [Shopify Engineering](<https://devfeed.tech/sources/shopify-engineering.md>), [Shopify Engineering - Shopify Engineering](<https://devfeed.tech/sources/shopify-engineering-shopify-engineering.md>)

Topics: [Application Security](<https://devfeed.tech/topics/application-security.md>), [Shopify](<https://devfeed.tech/topics/shopify.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Code review](<https://devfeed.tech/topics/code-review.md>), [Orchestration](<https://devfeed.tech/topics/orchestration.md>), [pull-requests](<https://devfeed.tech/topics/pull-requests.md>), [Rails](<https://devfeed.tech/topics/rails.md>), [Ruby](<https://devfeed.tech/topics/ruby.md>), [web applications](<https://devfeed.tech/topics/web-applications.md>), [Back end](<https://devfeed.tech/topics/backend.md>)

Tags: [agentic](<https://devfeed.tech/tags/agentic.md>), [application-security](<https://devfeed.tech/tags/application-security.md>), [backend](<https://devfeed.tech/tags/backend.md>), [building](<https://devfeed.tech/tags/building.md>), [code](<https://devfeed.tech/tags/code.md>), [orchestration](<https://devfeed.tech/tags/orchestration.md>), [pull-requests](<https://devfeed.tech/tags/pull-requests.md>), [review](<https://devfeed.tech/tags/review.md>), [ruby](<https://devfeed.tech/tags/ruby.md>), [shopify](<https://devfeed.tech/tags/shopify.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>), [web-applications](<https://devfeed.tech/tags/web-applications.md>), [workflow](<https://devfeed.tech/tags/workflow.md>)

## AI overview

Shopify describes an agentic code review and test-oracle harness for application security. The harness scans software for vulnerabilities, validates findings with real tests, generates Shopify-specific fixes, and opens relevant pull requests. The article also explains its Dispatch orchestrator, parallel scanning workflow, reusable application context, and diff-based follow-up scans.

## Source excerpt

We built an agentic code review and test oracle harness that discovers vulnerabilities, proves them with real tests, and provides Shopify-tuned fixes.