kairos-chain 3.95.0 → 3.96.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3bce3f299f0bb91ecbb6199e464a2ea24602ede6e9d4e972c1a7b5905ec447c5
-  data.tar.gz: 4986b9e4f8c87ff233b67586791d8b3068aed4decaecb1319f5c0553b4a5445c
+  metadata.gz: d9378e59ddbeb6127f907b009d5c74f362932d3ded7669e75975d9e4e000285b
+  data.tar.gz: f5153b3a2034f5ad9f68d1ee5d31f4a7295e8b4e1cdf48cf90283744886d0355
 SHA512:
-  metadata.gz: a4af517774c9e5e90299d4877190d83659932acf7851bf04275d5c3066298411ca628084a490cfef6348b327d550c05d5cc4f96cab086e5c297e2a169e1f72b3
-  data.tar.gz: ba67dc90461e4350615a4ba9e232702efc27b241fa853a2934a80714bb5753c2aa1ebba06921ebe58e4db7145d8f3fb5d747be4ab37f8ad5da25150ab8c7ce8d
+  metadata.gz: 2a9ca012c529a7523e68bb0dde4fd08b20bda1e08a540d98714ae169efc1268946faeb6d16ad1a0926382a480177c60c736a383f8747b2dbcf0225bac5ad522a
+  data.tar.gz: 9e39c4801fef0169431db7c23e6f1e45099b11b0a482b12254fef0a90cf7de7787f6d3b6414824fddb86c0f04c246a2b488cda4741e450366841ee7d2f706b52

data/CHANGELOG.md

@@ -6,6 +6,88 @@ This project follows [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [3.96.0] - 2026-10-21
+
+### Changed — multi_llm_review says what the roster was when a result is read (multi_llm_review 0.12.0, llm_client 0.4.0)
+
+A seat whose reviewer CLI was missing, logged out or refused by codex used to leave the count as `transport`, and
+an APPROVE carried no feedback at all, so a review decided by two Anthropic seats read like one decided by four
+seats from three makers. A Codex host's persona team was recorded as Claude's.
+
+- A failed seat's reason is the cause its CLI adapter established: `cli_missing` (the binary is not on the PATH the
+  server searched), `cli_unauthenticated` (the CLI, asked after the failure with its own status command, says it
+  holds no credential), `workspace_refused` (codex refused a working directory outside a git repository) or
+  `cli_timeout`. Anything else stays `transport`, which now means an error with no established cause. Nothing the
+  CLI printed is read for this: codex prints the prompt and the files it read.
+- `vote_tally.roster_health` states the seats, how many counted, each seat that did not count with its reason, and
+  each counted seat's maker with where it comes from (observed, configured, or declared by the caller). When a seat
+  did not count or maker diversity is not established, `feedback_text` starts with one line, on APPROVE too:
+  `Roster: 2 of 4 seats counted (1 caller-declared) — not counted: cli_missing: codex_gpt6-astra, cursor_composer2.5; maker diversity not established.`
+- INSUFFICIENT says how many seats counted and how many were needed, that a seat can be added in config, and the
+  action that restores each lost seat where one exists. The tool advises no strategy.
+- Every seat is dispatched with `no_fallback`: an API-key seat whose key is unset fails on its own provider instead
+  of being re-run on claude_code under its own name.
+- New optional argument `orchestrator_host` (`claude_code`, `codex_cli`, `cursor`, `other`). `claude_code` or none
+  keeps `claude_team_<model>`; `codex_cli` records the persona seat as `codex_team_<model>` with provider
+  `codex_cli_host`. Records carry `orchestrator_host` and the server's own `host_detected`.
+- `multi_llm_review_wait` reports answered and failed seats separately.
+- The verdict and the quorum are unchanged. VERDICT_SCHEMA_VERSION 3, feedback_text_schema_version 2;
+  multi_llm_review's min_core_version is 3.24.9.
+- config gains a commented second codex seat for a machine with only the codex CLI. Upgrades never rewrite an
+  instance's config; add it by hand.
+- llm_client 0.4.0: `ApiError` carries the `code`, and `CallRouter` and `llm_call` return it as `error['code']`.
+  After a failed CLI call one status command runs (never when the dispatcher ended the call; at most about 19 s).
+  The error message and its ErrorTaxonomy type are unchanged, so every other llm_client caller sees only the added
+  key and that pause.
+
+Design: `log/mlr_non_claude_host_design_v0.3.3_20261021.md`, frozen after four review rounds; implementation
+reviewed in two (records `log/mlr_non_claude_host_*`).
+
+### Changed — L1 `multi_llm_review_workflow` 3.17.0
+
+§ Auto Mode vs Manual Mode sent a missing CLI to a "Manual mode" the runbook never described. It is replaced by
+§ Execution Environment / Reduced rosters and non-Claude hosts: what each failure reason means and what restores
+the seat, the roster line, what a Claude-only, a non-Claude-host and a codex-only setup count under each strategy,
+and how a host's per-call time limit meets a long review call.
+
+### Fixed — `capability_status` reported installed reviewer CLIs as missing
+
+It searched PATH for files named `claude_cli`, `codex_cli` and `cursor_cli`. It now probes the binaries the
+adapters spawn (`claude`, `codex`, `agent`), runs `--version` without a shell, and names the binary it searched for.
+
+## [3.95.1] - 2026-10-21
+
+### Changed — the agent SkillSet ships a sample policy, `default_2026_10_20`, instead of `masa_2026_10_20` (agent 1.0.1)
+
+`masa_2026_10_20.rb` named its author and cited a record that exists only in the author's instance.
+`default_2026_10_20.rb` carries the same rules (the stand-in may answer from the operator's recorded words, from
+the instruction mode, and reversible questions no recorded word covers; review consent; no project exempt from the
+data check; 10 rounds per review; 300 stand-in calls), with comments that say what each rule does. The stand-in
+reads the policy file, comments included. Adopt it with `adopt policy default_2026_10_20 ac4ae89b`; adopting it
+consents to sending the run's artifacts to the reviewers configured in multi_llm_review.
+
+`masa_2026_10_20.rb` is no longer shipped and is not listed in `removed_files`, so upgrade leaves an installed copy
+and a forced reinstall keeps the installed copy: an instance that has it keeps it, and an adoption of it stays valid. It is another operator's sample with the same
+rules: an instance that never adopted it may delete it, and one that did may adopt `default_2026_10_20` instead. A
+shipped policy is never changed in place; a changed rule ships under a new policy name in a new file. Design:
+`log/agent_policy_default_and_proposal_design_v0.7.2_20261021.md`.
+
+### Changed — personal material out of the shipped agent tree
+
+Home paths, a person's project and course names, answers typed in a real course and a third party's name are
+replaced by synthetic ones in the agent SkillSet's tests and one code comment. The published 3.95.0 gem and the
+repository history keep them.
+
+### Added — `bin/agent_policy_report.rb`
+
+An operator-run script that reports, for each rule of the adopted policy, what the runs the chain records as ended
+hold against it: stand-in answers by class and their corrections, review rounds and cap hits, stand-in calls and
+grants, data checks, with counts, denominators and the operator's words. It moves no rule, evaluates no file
+from a run directory, and writes only its report, under `storage/agent/policy_reports/` (and
+`storage/agent/.gitignore` when absent; no report is written unless that file is a regular file holding exactly the line `*`). Every act it counts is recorded on the actor's reading of the
+operator's words, and the report says so. A policy changes only by the operator's own copy, edit and typed
+adoption.
+
 ## [3.95.0] - 2026-10-21
 
 ### Changed — the `agent` SkillSet is rebuilt (1.0): long runs in the host session, a stand-in instead of terminal approvals

data/lib/kairos_mcp/capability.rb

@@ -98,11 +98,25 @@ module KairosMcp
           declaration_errors: errors }
       end
 
+      # The binary each declared external names: the one the llm_client
+      # adapter spawns for it (claude_code_adapter, codex_adapter,
+      # cursor_adapter). Probing the symbol itself searched PATH for a file
+      # called "codex_cli" and reported every installed CLI as missing.
+      EXTERNAL_BINARIES = {
+        claude_cli: 'claude',
+        codex_cli:  'codex',
+        cursor_cli: 'agent'
+      }.freeze
+
+      def binary_for(name)
+        EXTERNAL_BINARIES.fetch(name.to_s.to_sym, name.to_s)
+      end
+
       # which-style PATH check using only filesystem (no subprocess).
       # Returns true/false.
       def cli_in_path?(name)
         return false unless name.is_a?(Symbol) || name.is_a?(String)
-        bin = name.to_s
+        bin = binary_for(name)
         ENV.fetch('PATH', '').split(File::PATH_SEPARATOR).any? do |dir|
           full = File.join(dir, bin)
           File.executable?(full) && !File.directory?(full)
@@ -110,11 +124,13 @@ module KairosMcp
       end
 
       # Get version of a CLI by spawning subprocess (only when probe_versions: true).
-      # Returns nil on any failure (Honest unknown).
+      # Returns nil on any failure (Honest unknown). Spawned as an argv, not
+      # through a shell.
       def cli_version(name)
         return nil unless cli_in_path?(name)
-        out = `#{name} --version 2>&1`.strip
-        $?.success? ? out.lines.first&.strip : nil
+        require 'open3'
+        out, status = Open3.capture2e(binary_for(name), '--version')
+        status.success? ? out.strip.lines.first&.strip : nil
       rescue StandardError
         nil
       end

data/lib/kairos_mcp/tools/capability_status.rb

@@ -152,7 +152,9 @@ module KairosMcp
 
         externals.each do |ext|
           present = Capability.cli_in_path?(ext)
-          entry = { available: present }
+          # The binary searched for, so a reader can tell which file was
+          # missing (claude_cli is the `claude` binary, and so on).
+          entry = { available: present, binary: Capability.binary_for(ext) }
           entry[:reason] = 'not found in PATH' unless present
           if present && probe_versions
             ver = Capability.cli_version(ext)

data/lib/kairos_mcp/version.rb

@@ -1,4 +1,4 @@
 module KairosMcp
-  VERSION = "3.95.0"
+  VERSION = "3.96.0"
   CHANGELOG_URL = "https://github.com/masaomi/KairosChain_2026/blob/main/CHANGELOG.md"
 end

data/templates/knowledge/multi_llm_review_workflow/multi_llm_review_workflow.md

@@ -1,7 +1,7 @@
 ---
 name: multi_llm_review_workflow
 description: "Multi-LLM review methodology and execution — workflow pattern, CLI tooling, consensus analysis, Persona Assembly. Applicable to design, implementation, documentation, or any artifact."
-version: "3.16.0"
+version: "3.17.0"
 tags:
   - workflow
   - review
@@ -24,7 +24,7 @@ and integrated. The user (or primary LLM) acts as orchestrator.
 
 This skill covers:
 - **WHAT/WHEN**: When to use multi-LLM review, review types, convergence criteria
-- **HOW**: CLI commands, prompt generation, auto/manual execution, consensus analysis
+- **HOW**: CLI commands, prompt generation, Path A (manual) and Path B (MCP) execution, consensus analysis
 
 For **WHO** (which LLM is good at what), see: `multi_llm_reviewer_evaluation`
 For **development lifecycle** (design → implement → verify), see: `design_to_implementation_workflow`
@@ -861,20 +861,87 @@ Save to L2 context at these moments:
 
 # Execution
 
-## Auto Mode vs Manual Mode
+## Execution Environment
 
-### Mode Detection
+### Reduced rosters and non-Claude hosts
 
-```bash
-which codex 2>/dev/null && echo "codex: available" || echo "codex: NOT FOUND"
-which agent 2>/dev/null && echo "agent: available" || echo "agent: NOT FOUND"
-which claude 2>/dev/null && echo "claude: available" || echo "claude: NOT FOUND"
+The roster is whatever `config/multi_llm_review.yml` names (Path B), and the tool
+never drops a seat because its CLI is missing. Every seat runs only on its own
+provider (no fallback to another). A seat that cannot run fails, leaves the count,
+and is recorded with the cause its transport established — never with a cause read
+out of text the CLI printed, because codex prints the prompt and the files it read:
+
+| Reason | What happened | What restores the seat |
+|---|---|---|
+| `cli_missing` | the CLI's binary is not on the PATH the server searched | install it, or put its directory on that PATH (the result shows it) |
+| `cli_unauthenticated` | the CLI, asked after the failure, said it is not logged in | log in with that CLI (`codex login`, `agent login`, `claude` then `/login`); the seat reads the login under HOME |
+| `workspace_refused` | codex refused the server's working directory (no git repository, not trusted) | make that directory (named in the result) lie inside a git repository; how a host sets the server's directory is the host's |
+| `cli_timeout` | the CLI call's own timer (llm_client `timeout_seconds`) fired | raise llm_client's and multi_llm_review's `timeout_seconds` together |
+| `dispatch_timeout` | the dispatch window (multi_llm_review `timeout_seconds`) closed with the seat still running or still queued; with both at 600 s this fires first | as for `cli_timeout`; `collect_deadline_seconds` (1800 shipped) bounds how far that helps |
+| `transport` | anything else; the seat's error message says what was seen | read the seat's row (an API-key seat whose key is unset lands here) |
+
+Asking a failed CLI whether it is logged in costs one status command after the
+failure (its own 10 s timer; up to about 19 s with the kill grace and reader joins),
+and every other llm_client caller sees the same pause after a failed CLI call. It is
+never run when the dispatcher itself ended the call.
+
+Whenever a seat did not count, or the counted seats are not known to come from two
+different makers, the result carries one roster line, on APPROVE too:
+
+```
+Roster: 2 of 4 seats counted (1 caller-declared) — not counted: cli_missing: codex_gpt6-astra, cursor_composer2.5; maker diversity not established.
 ```
 
-- All three available → Auto mode (the configured roster, currently 5 reviewers)
-- Codex + Agent only → Auto mode (legacy, reduced roster — apply "Legacy 3-reviewer mode: 2/3 APPROVE" from Convergence Rules)
-- Any of codex/agent missing → Manual mode
-- User override: `mode: manual` or `mode: auto`
+A counted seat's maker is observed (the seat reported its model), configured (the
+roster pins the model and the seat ran on its own provider — this holds while the
+CLI's own configuration does not route that name to another maker), or
+caller-declared (a persona seat that was not observed). Only the first two
+establish diversity. Two kinds of round always carry the line: an `exclude` round
+whose caller names a slot (that slot does not count), and an agent SkillSet round
+(it submits no personas). None of this changes the verdict or the quorum
+(`min_quorum`, 2 shipped). An INSUFFICIENT result also says how many seats counted
+and how many were needed, that a seat can be added in config, and the restoring
+action for each reason in the table above.
+
+**Claude Code without codex or cursor.** Nothing to configure. The persona team and
+the Sonnet seat count, APPROVE is reachable, and every result says "2 of 4 seats
+counted … maker diversity not established".
+
+**A host other than Claude Code.** Pass `orchestrator_host` (`codex_cli`, `cursor`
+or `other`; `claude_code` or nothing keeps `claude_team_<model>`), and the persona
+seat is recorded as `codex_team_<model>` and so on, beside the server's own
+detection of its host. Run the personas as separate sub-agents of your host (Codex:
+multi-agent). Nothing in the system can observe that, so the persona seat is always
+recorded as your declaration. A Codex session can still run the `claude` seats:
+Codex's sandbox does not confine kairos-chain's MCP server.
+
+**A machine with only the codex CLI.** One seat can answer, below the quorum, so
+every review is INSUFFICIENT until a second codex seat is added on another model —
+the commented recipe in `config/multi_llm_review.yml`. Upgrades never rewrite an
+instance's config, so an existing instance adds it by hand: a slot naming
+`provider`, `model` and `role_label`, on a model the roster does not already name.
+With orchestrator_model `gpt-6-astra` and a `gpt-6-sol` seat:
+
+| Strategy | Counted seats | What it costs |
+|---|---|---|
+| `delegate` (default) | 2: `gpt-6-sol` and your persona team | the persona seat rests on your declaration |
+| `subprocess`, no `persona_model` | 2: `gpt-6-astra` and `gpt-6-sol`, both fresh processes | one call that returns only when every seat has finished; your own slot runs only if your model names one |
+| `exclude` | 1: your slot leaves (`exclude_orchestrator_model: true`, shipped) | below the quorum |
+
+**A host with a per-call time limit** (Codex: `tool_timeout_sec` per MCP server;
+documented default 60 s, not verified here). A `subprocess` review is one call that
+lasts as long as the slowest seat, so first raise the limit for kairos-chain above
+both configured `timeout_seconds`, with a margin. A cut single-phase call leaves its
+record only in the run's `completed.json`. On the delegate path the first call
+returns at once, but waiting in short calls is no substitute: three consecutive
+`still_pending` replies from `multi_llm_review_wait` end in `crashed` /
+`wait_exhausted` while the worker is still healthy. Raise the host's limit instead.
+`multi_llm_review_collect` waits at most `collect_max_wait_seconds` (420 shipped)
+before reaping a live worker, so call collect after wait has said `ready`.
+
+**Path A (manual Bash).** Run `which codex`, `which agent`, `which claude`; leave
+out the line of a CLI that is not found, and read the result by the same rules: the
+quorum stays 2, and the report says which seats did not count and why.
 
 ### CLI Tool Matrix (tested 2026-03-28; model flags made mandatory 2026-07-27)
 
@@ -1069,7 +1136,7 @@ multi_llm_review(
   `orchestrator_strategy: "subprocess"`.
 - If `orchestrator_model` is `null` or unmatched, full roster runs (back-compat).
 
-**Manual-mode equivalent**: When orchestrating by hand, do not assign yourself
+**Path A equivalent**: When orchestrating by hand, do not assign yourself
 as a subprocess reviewer. Run the Claude CLI subprocess reviewers (Sonnet 5.5, plus
 any frontier roster slot you are not); if your own model matches one of them,
 skip that entry and use the after-exclusion convergence rule.
@@ -1094,19 +1161,21 @@ cross-model subprocess reviewers give epistemic diversity. The two are complemen
 
 **Call 1**: `multi_llm_review(orchestrator_strategy: "delegate", orchestrator_model: "...")`
 - SkillSet drops the orchestrator-matching reviewer from dispatch
-- Subprocess reviewers run synchronously (no background threads)
-- Subprocess results persisted to `.kairos/multi_llm_review/pending/<uuid>.json`
+- Subprocess reviewers run in a detached worker (default `parallel: true`), or
+  synchronously with `parallel: false`
+- Subprocess results persisted under `.kairos/multi_llm_review/pending/<token>/`
 - Returns `status: "delegation_pending"`, `collect_token`, `persona_count_min/max`
 
 **Orchestrator's obligation** (between calls):
 - Recognize the `delegation_pending` status
-- Spawn 2-4 parallel `Agent` tool calls with self-chosen personas appropriate to
+- Run 2-4 personas as separate sub-agents of your host (Claude Code: parallel
+  `Agent` tool calls; Codex: multi-agent), self-chosen and appropriate to
   the artifact (e.g. design → architect/security/operability; code → correctness/
   performance/api-design; doc → ontologist/skeptic/integration)
 - Collect persona results: each as `{persona, verdict (APPROVE|REVISE|REJECT),
   reasoning, findings: [{severity, issue}, ...]}`
-- Bind each persona to its subagent: add `agent_id` — the id the Agent tool
-  returned for that persona's subagent — to its entry. With the model_provenance
+- Bind each persona to its subagent (Claude Code): add `agent_id` — the id the
+  Agent tool returned for that persona's subagent — to its entry. With the model_provenance
   SkillSet installed, the seat then records the model the harness observed
   answering, not only the declared one: a safety-classifier fallback inside a
   persona (Opus 5.5 → Opus 5 on biology, → Opus 4.8 on cyber) otherwise leaves
@@ -1120,7 +1189,8 @@ cross-model subprocess reviewers give epistemic diversity. The two are complemen
 
 **Call 2**: `multi_llm_review_collect(collect_token, orchestrator_reviews: [...])`
 - Persona Assembly: any REJECT → REJECT; else any REVISE → REVISE; else APPROVE
-- Assembled into one synthetic reviewer entry `claude_team_<orchestrator_model>`
+- Assembled into one synthetic reviewer entry `<host>_team_<model>`
+  (`claude_team_` for `orchestrator_host` claude_code or none; § Reduced rosters)
 - Combined with persisted subprocess results, run Consensus, return final verdict
 - Idempotent: repeated calls with the same token return the cached result
 
@@ -1128,9 +1198,12 @@ cross-model subprocess reviewers give epistemic diversity. The two are complemen
 - `expired_or_unknown_token`: orchestrator missed `must_collect_by` deadline
   (default 1800s since v3.23.2; was 600s), or token never existed. The pending
   review is gone; call `multi_llm_review` again from scratch.
-- `error: invalid orchestrator_reviews`: persona count outside 2-4 or missing
-  required fields. Fix and retry collect with the same token.
-- All-subprocess-failed at Call 1: returns error immediately; no token issued.
+- `error: invalid orchestrator_reviews`: more than 4 personas, or missing
+  required fields. Fix and retry collect with the same token. 0–4 are accepted;
+  fewer than convened is recorded as a shortfall.
+- All subprocess seats failed at Call 1: with `parallel: false` it returns an
+  error at once and issues no token; on the default parallel path the failures
+  surface at collect, as INSUFFICIENT with each seat's reason.
 
 **Default**: `orchestrator_strategy` defaults to `"delegate"` (config key
 `default_orchestrator_strategy`). `"exclude"` remains available as the legacy
@@ -1554,7 +1627,8 @@ Step 3: Execute the configured roster in parallel (currently 4 slots, one of
 Step 4: Collect and validate
   - Wait for all to complete (background task notifications)
   - Verify each output file exists and contains structured review
-  - Failed tool → offer manual fallback
+  - Failed tool → record it as not counted, with its cause (§ Reduced rosters
+    and non-Claude hosts)
 
 Step 5: Consensus analysis
   - Read all review files
@@ -1571,10 +1645,11 @@ Step 6: Report to user
 
 | Error | Detection | Recovery |
 |-------|-----------|----------|
-| CLI not found | `which` non-zero | Manual mode fallback |
-| Auth expired | Non-zero exit, auth error | Prompt re-login |
-| Timeout (>5 min) | Background task timeout | Kill, report partial, retry |
-| Empty output | Missing verdict | Report failure, manual retry |
+| CLI not found | `cli_missing` (Path A: `which` non-zero) | Install, or fix the server's PATH |
+| Not logged in | `cli_unauthenticated` | Log in with that CLI |
+| codex refuses the directory | `workspace_refused` | Run from inside a git repository |
+| Timeout | `cli_timeout` / `dispatch_timeout` | Raise both `timeout_seconds`; mind `collect_deadline_seconds` |
+| Empty output | `no_verdict` / `insubstantial` | Report failure, retry |
 | Trust prompt | Agent hangs | `--trust` flag |
 | Usage limit | "usage limit" in output | Alternate tool fallback |
 
@@ -2028,6 +2103,20 @@ Compression ratio: parallel agent raw → Assembly ≈ 2:1
   Step 0.25 guard-track sentence and § Convergence Rules. Source: design
   `log/agent_skillset_rebuild_design_v0.5.1_20261020.md` §2 and its delta v0.6.6.
 
+- Reduced rosters and non-Claude hosts (v3.17.0, 2026-10-21, operator request:
+  「MLRのdefaultがclaude codeでない場合の処理について…修正しようと思います」,
+  rulings 1–9 in L2 `decision_mlr_non_claude_host_four_rulings_20261021`).
+  § Auto Mode vs Manual Mode, which sent a missing CLI to a "Manual mode" it never
+  described and counted 5 reviewers, is replaced by § Execution Environment /
+  Reduced rosters and non-Claude hosts: what each failure cause means and what
+  restores the seat, the roster line results now carry, what a Claude-only,
+  non-Claude-host or codex-only setup counts under each strategy, and a host's
+  per-call limit. The delegation protocol now names sub-agents of any host,
+  `<host>_team_<model>`, the 0–4 persona range and where an all-failed Call 1
+  surfaces; the Error Handling table maps the new reason tokens. Ships with
+  multi_llm_review 0.12.0 and llm_client 0.4.0. Design
+  `log/mlr_non_claude_host_design_v0.3.3_20261021.md`, frozen after four rounds.
+
 **Key insight**: Design reviews and implementation reviews find
 **categorically different bugs**. Both phases are necessary. The corollary that
 cost eight rounds to learn: **which of the two you are in is readable from the

data/templates/skillsets/agent/bin/agent_policy_report.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+# The policy report (design v0.7.2 INV-8): for each rule of the adopted
+# policy, what the runs the chain records as ended hold against it — counts
+# with their denominators and the operator's words of each act. The operator
+# runs it outside runs. It reads the data directory, calls no model,
+# evaluates no file from a run directory, writes one file under
+# storage/agent/policy_reports (and storage/agent/.gitignore when absent), and
+# changes no policy.
+#
+#   ruby .kairos/skillsets/agent/bin/agent_policy_report.rb [--data-dir DIR]
+
+require_relative '../lib/agent/policy_report'
+
+def arg(name)
+  i = ARGV.index(name)
+  i && ARGV[i + 1]
+end
+
+data_dir = arg('--data-dir') || ENV['KAIROS_DATA_DIR'] || File.join(ENV['CLAUDE_PROJECT_DIR'] || Dir.pwd, '.kairos')
+paths = KairosMcp::SkillSets::Agent::Paths.new(data_dir)
+begin
+  puts KairosMcp::SkillSets::Agent::PolicyReport.new(paths).write
+rescue ArgumentError, IOError, SystemCallError => e
+  abort e.message
+end

data/templates/skillsets/agent/config/policies/default_2026_10_20.rb

@@ -0,0 +1,34 @@
+# A sample policy for agent runs: an operator's mandate, shipped with the agent
+# SkillSet. It binds no one until an operator adopts it by typing
+# "adopt policy default_2026_10_20 <first 8 hex digits of its digest>"; any
+# edit changes the digest and needs a new adoption. A changed policy takes a
+# new name in its policy line. The stand-in reads this whole file, comments
+# included, as part of its instructions.
+#
+# stand_in may: the decision points the stand-in answers instead of the
+#   operator (questions, plan approval and parameters, pinned-test changes).
+#   :precedent answers from the operator's own recorded words;
+#   :instruction_mode answers from the active instruction mode;
+#   :novel_reversible answers a reversible question no recorded word covers,
+#   by the model's own judgment (with an empty precedent store, that is most
+#   questions). Leaving out :precedent or :instruction_mode while keeping
+#   :novel_reversible answers the same questions, labelled novel; leaving out
+#   all three sends those decision points to the operator. These classes do
+#   not govern the stand-in's readings: it still checks review bundles for
+#   personal data, labels review findings and rules on hazards.
+# consent review: a run may send its artifacts to the reviewers configured in
+#   multi_llm_review. The value and scope are recorded, not enforced.
+# free_of_personal_data: projects whose review bundles skip the stand-in's
+#   check for personal or third-party data, unless a bundle carries findings
+#   from an earlier round. None here.
+# spend: review_rounds caps each review, counted apart; at the cap the review
+#   waits for the operator. stand_in_calls caps the stand-in's model calls in a
+#   run; past it decision points and readings go to the operator, and a hazard
+#   cannot be ruled, which ends the run.
+
+policy "default_2026_10_20" do
+  stand_in may: [:precedent, :instruction_mode, :novel_reversible]
+  consent review: :configured_providers, of: :project_artifacts
+  free_of_personal_data projects: []
+  spend default: { review_rounds: 10, stand_in_calls: 300 }
+end