Two Decision Programs for Army SBIR ARM26BX06-NV012, each with its evidence, the recorded run
(kai-1.3, 2026-10-15, `kai serve` on CPU with no network) and run.py, which asks every Kai
question of the program on api.hanzo.ai and prints it beside the recorded answer.
Co-authored-by: Hanzo Dev <[email protected]>
hanzo.sh installs the hanzo CLI (checksum-verified native binaries), and
hanzo code runs claude, codex, cursor, agy or dev with the MCP toolset, model
calls metered through api.hanzo.ai and the session streamed to the
dashboard. Each flag and URL named here was run against the installed CLI
and the live installer. No speed or cost claim: a wrapped session's savings
are measured from recorded usage, not stated.
examples/claude-code holds a Stop hook, a PreToolUse hook and the kai
skill. .claude-plugin/marketplace.json makes this repo the marketplace
"kai" (not "hanzo", a name another Hanzo marketplace already holds), so
/plugin install kai@kai installs it.
Kai does not yet read agent work reliably: its zero-shot answers to
"done", "verified" and "risky" are near chance. So rules in code decide
first, Kai can only tighten (send a turn back, or ask before an action;
never allow), both hooks fail open on any error or timeout, and the
default mode, shadow, logs Kai's answers and changes nothing. The log
holds probabilities and verdicts only, 0600 in a 0700 directory. A state
sent to Kai is redacted and at most 3,000 characters of JSON; only https,
or http on loopback, is called, and no redirect is followed.
Against the first draft: plugin options are read as
CLAUDE_PLUGIN_OPTION_<KEY> uppercased, as Claude Code exports them (the
draft read lowercase names and never saw the plugin's key or mode). The
floor is checked before the read-only shortcut, which let "env rm -rf"
and awk's system() through, and now catches "git checkout -- .",
"rm -Rf" and split rm flags. A background-task notice no longer starts a
new turn. Stop answers with decision "block" as JSON. Only the last
8 MiB of a transcript is read: a 745 MB one made the hook throw.
test/kai.test.mjs runs both hooks offline against a stand-in for Kai on
127.0.0.1, 25 tests; test.sh runs it with the rest. In a live Claude
Code 2.1.296 session against the stand-in, the Stop block came back as
"Stop hook feedback", the PreToolUse ask denied an allowed command
under -p, and shadow showed a notice and let it run.
The README said CI runs test.sh; the gate is declared but stops at reading
its key until KMS grants that read to the identity the run logs in as.
Co-authored-by: Hanzo Dev <[email protected]>
Removed what nothing measured: 30-120 ms per decision, up to 90% cheaper,
0% hallucination, "0.80 means correct 80% of the time", the policy-join
section (no recipe implements one), action.act_probability, and the model
ids hanzoai/kai-1, kai-1-agent, kai-1-multilingual and jev, which the API
refuses.
Stated what was measured against production on 2026-10-09: the price
($0.021 per million input tokens, output free; Jev $0.042), the answer
shape of each question type and how confidence relates to the top
probability, the 100-question limit, the 1,024-token trained length and how
an answer degrades past it, observed latency, and the SDK calls that work.
README gains a table of each recipe's use cases, primitives and live result.
Co-authored-by: Hanzo Dev <[email protected]>
zeekay
