Every decision record lives under /v1/research now (hanzo-inc/cloud
0ce6cf3d5e): evidence is POST /v1/research/evidence and /evidence/sysml,
and what read a uri is GET /v1/research/evidence/dependents.
Co-authored-by: Hanzo Dev <[email protected]>
army/README.md gains "File it": `example apu file https://api.hanzo.ai
changes/bulletin.json` from the decision runtime, and the records it files
(evidence, the DDT decision with its charter, the evaluation, Action
drafts, the bulletin's next version, and what read it). jltv files its
SysML model as elements with satisfy and verify links. army/apu/charter.json
is the decision's charter. run.py is unchanged.
Co-authored-by: Hanzo Dev <[email protected]>
Two Decision Programs for Army SBIR ARM26BX06-NV012, each with its evidence, the recorded run
(kai-1.3, 2026-10-15, `kai serve` on CPU with no network) and run.py, which asks every Kai
question of the program on api.hanzo.ai and prints it beside the recorded answer.
Co-authored-by: Hanzo Dev <[email protected]>
hanzo.sh installs the hanzo CLI (checksum-verified native binaries), and
hanzo code runs claude, codex, cursor, agy or dev with the MCP toolset, model
calls metered through api.hanzo.ai and the session streamed to the
dashboard. Each flag and URL named here was run against the installed CLI
and the live installer. No speed or cost claim: a wrapped session's savings
are measured from recorded usage, not stated.
examples/claude-code holds a Stop hook, a PreToolUse hook and the kai
skill. .claude-plugin/marketplace.json makes this repo the marketplace
"kai" (not "hanzo", a name another Hanzo marketplace already holds), so
/plugin install kai@kai installs it.
Kai does not yet read agent work reliably: its zero-shot answers to
"done", "verified" and "risky" are near chance. So rules in code decide
first, Kai can only tighten (send a turn back, or ask before an action;
never allow), both hooks fail open on any error or timeout, and the
default mode, shadow, logs Kai's answers and changes nothing. The log
holds probabilities and verdicts only, 0600 in a 0700 directory. A state
sent to Kai is redacted and at most 3,000 characters of JSON; only https,
or http on loopback, is called, and no redirect is followed.
Against the first draft: plugin options are read as
CLAUDE_PLUGIN_OPTION_<KEY> uppercased, as Claude Code exports them (the
draft read lowercase names and never saw the plugin's key or mode). The
floor is checked before the read-only shortcut, which let "env rm -rf"
and awk's system() through, and now catches "git checkout -- .",
"rm -Rf" and split rm flags. A background-task notice no longer starts a
new turn. Stop answers with decision "block" as JSON. Only the last
8 MiB of a transcript is read: a 745 MB one made the hook throw.
test/kai.test.mjs runs both hooks offline against a stand-in for Kai on
127.0.0.1, 25 tests; test.sh runs it with the rest. In a live Claude
Code 2.1.296 session against the stand-in, the Stop block came back as
"Stop hook feedback", the PreToolUse ask denied an allowed command
under -p, and shadow showed a notice and let it run.
zeekay
