@kal-elsam/kairo-runtime 0.1.0

package/repo-template/.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"

package/repo-template/.github/instructions/harness.instructions.md

@@ -0,0 +1,11 @@
+# Harness Instructions
+
+Follow `AGENTS.md` as the universal source of truth.
+
+For non-trivial changes:
+
+1. Create/update spec.
+2. Create tests/evals first.
+3. Implement minimum scope.
+4. Validate.
+5. Report risks.

package/repo-template/.github/workflows/harness-quality-gate.yml

@@ -0,0 +1,67 @@
+name: Harness Quality Gate
+
+on:
+  pull_request:
+  push:
+    branches: [main, master]
+
+jobs:
+  quality:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Detect package manager
+        id: pm
+        shell: bash
+        run: |
+          if [ -f pnpm-lock.yaml ]; then echo "pm=pnpm" >> "$GITHUB_OUTPUT";
+          elif [ -f yarn.lock ]; then echo "pm=yarn" >> "$GITHUB_OUTPUT";
+          else echo "pm=npm" >> "$GITHUB_OUTPUT"; fi
+
+      - name: Setup Node
+        if: hashFiles('package.json') != ''
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: ${{ steps.pm.outputs.pm }}
+
+      - name: Enable pnpm
+        if: steps.pm.outputs.pm == 'pnpm'
+        run: corepack enable
+
+      - name: Install dependencies
+        if: hashFiles('package.json') != ''
+        run: |
+          if [ "${{ steps.pm.outputs.pm }}" = "pnpm" ]; then pnpm install --frozen-lockfile; fi
+          if [ "${{ steps.pm.outputs.pm }}" = "yarn" ]; then yarn install --immutable || yarn install --frozen-lockfile; fi
+          if [ "${{ steps.pm.outputs.pm }}" = "npm" ]; then npm ci; fi
+
+      - name: Format check
+        if: hashFiles('package.json') != ''
+        run: npm run format:check --if-present
+
+      - name: Lint
+        if: hashFiles('package.json') != ''
+        run: npm run lint --if-present
+
+      - name: Typecheck
+        if: hashFiles('package.json') != ''
+        run: npm run typecheck --if-present
+
+      - name: Unit tests
+        if: hashFiles('package.json') != ''
+        run: npm test --if-present -- --runInBand
+
+      - name: Build
+        if: hashFiles('package.json') != ''
+        run: npm run build --if-present
+
+      - name: Harness doctor
+        run: |
+          if [ -f scripts/harness/doctor.mjs ]; then node scripts/harness/doctor.mjs; fi
+
+      - name: Harness evals
+        run: |
+          if [ -f scripts/harness/run-evals.mjs ]; then node scripts/harness/run-evals.mjs; fi

package/repo-template/.github/workflows/harness-security-gate.yml

@@ -0,0 +1,32 @@
+name: Harness Security Gate
+
+on:
+  pull_request:
+  push:
+    branches: [main, master]
+
+permissions:
+  contents: read
+  security-events: write
+  pull-requests: read
+
+jobs:
+  dependency-review:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Dependency Review
+        uses: actions/dependency-review-action@v4
+        with:
+          fail-on-severity: moderate
+          deny-licenses: GPL-3.0, AGPL-3.0
+
+  secret-scan-basic:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Detect obvious secrets
+        shell: bash
+        run: |
+          ! grep -RInE "(sk-[A-Za-z0-9_-]{20,}|api[_-]?key\s*=|secret\s*=|password\s*=)"             --exclude-dir=.git --exclude-dir=node_modules --exclude-dir=.next --exclude-dir=dist .             || (echo "Potential secret detected" && exit 1)

package/repo-template/.harness/spec-sizing.json

@@ -0,0 +1,33 @@
+{
+  "levels": {
+    "basic": {
+      "score": "0-3",
+      "description": "Low-risk localized work"
+    },
+    "standard": {
+      "score": "4-9",
+      "description": "Normal feature/change"
+    },
+    "complex": {
+      "score": "10+",
+      "description": "High-risk, architectural, cross-system or critical work"
+    }
+  },
+  "hardTriggers": [
+    "auth",
+    "authorization",
+    "payments",
+    "billing",
+    "secrets",
+    "production database migration",
+    "destructive data changes",
+    "infrastructure",
+    "CI/CD release gates",
+    "production AI behavior",
+    "MCP/tool permissions",
+    "cross-service contracts",
+    "architecture boundaries",
+    "compliance/legal/privacy",
+    "hard rollback"
+  ]
+}

package/repo-template/.opencode/README.md

@@ -0,0 +1,71 @@
+# OpenCode Adapter
+
+OpenCode es el runtime principal recomendado para este harness cuando se usa Gentle AI + DeepSeek.
+
+## Rol
+
+```txt
+OpenCode executes.
+Gentle AI structures SDD/TDD.
+DeepSeek iterates cheaply.
+Harness governs.
+Loops repair with boundaries.
+```
+
+## Uso
+
+Desde la raíz del proyecto:
+
+```bash
+opencode
+```
+
+Inicialización recomendada:
+
+```txt
+/init
+```
+
+Si `AGENTS.md` ya existe, no dejes que OpenCode lo sobrescriba sin revisar. El core universal del repo gana.
+
+## Fuente de verdad
+
+- `AGENTS.md`
+- `docs/ai/`
+- `docs/skills/`
+- `docs/specs/`
+- `evals/`
+
+## Agentes
+
+Agentes por proyecto viven en:
+
+```txt
+.opencode/agents/
+```
+
+Usa `@agent-name` para invocarlos manualmente cuando aplique.
+
+## Loops
+
+Loop definitions viven en:
+
+```txt
+.opencode/loops/
+.gentle-ai/loops/
+```
+
+## Governance clarification
+
+OpenCode is workflow-primary for this user's current setup.
+
+OpenCode is not governance-primary.
+
+```txt
+AGENTS.md governs.
+OpenCode executes.
+Gentle AI structures.
+DeepSeek iterates cheaply.
+```
+
+If `.opencode/` conflicts with `AGENTS.md`, update `.opencode/`.

package/repo-template/.opencode/agents/adapter-parity-reviewer.md

@@ -0,0 +1,23 @@
+---
+description: Reviews whether OpenCode remains an adapter and does not override the universal core.
+mode: subagent
+temperature: 0.1
+permission:
+  edit: deny
+  bash: deny
+---
+
+# adapter-parity-reviewer
+
+## Source of truth
+
+- `AGENTS.md`
+- `docs/ai/adapter-parity.md`
+- `docs/ai/governance.md`
+- `docs/ai/tool-adapters.md`
+
+## Rules
+
+- OpenCode is workflow-primary, not governance-primary.
+- Do not modify files.
+- Report conflicts and missing parity.

package/repo-template/.opencode/agents/architect.md

@@ -0,0 +1,38 @@
+---
+description: Reviews architecture, boundaries, ADRs and high-impact design.
+mode: subagent
+temperature: 0.1
+permission:
+  edit: deny
+  bash: deny
+---
+
+# architect
+
+## Source of truth
+
+- `AGENTS.md`
+- `docs/ai/harness.md`
+- `docs/ai/loops.md`
+- `docs/ai/loop-policy.md`
+- `docs/ai/provider-routing.md`
+
+## Rules
+
+- Respect context budget.
+- Do not exceed loop boundaries.
+- Do not approve critical impact.
+- Escalate after repeated failures.
+- Report files, tests, evals, risks and next action.
+
+## Output
+
+```txt
+Agent:
+Context:
+Decision:
+Validation:
+Risks:
+Escalation:
+Next action:
+```

package/repo-template/.opencode/agents/checkpoint-reviewer.md

@@ -0,0 +1,38 @@
+---
+description: Runs final review/checkpoint without applying changes.
+mode: subagent
+temperature: 0.1
+permission:
+  edit: deny
+  bash: deny
+---
+
+# checkpoint-reviewer
+
+## Source of truth
+
+- `AGENTS.md`
+- `docs/ai/harness.md`
+- `docs/ai/loops.md`
+- `docs/ai/loop-policy.md`
+- `docs/ai/provider-routing.md`
+
+## Rules
+
+- Respect context budget.
+- Do not exceed loop boundaries.
+- Do not approve critical impact.
+- Escalate after repeated failures.
+- Report files, tests, evals, risks and next action.
+
+## Output
+
+```txt
+Agent:
+Context:
+Decision:
+Validation:
+Risks:
+Escalation:
+Next action:
+```

package/repo-template/.opencode/agents/eval-engineer.md

@@ -0,0 +1,38 @@
+---
+description: Creates and reviews AI evals for prompts, agents, tool calling and RAG.
+mode: subagent
+temperature: 0.1
+permission:
+  edit: ask
+  bash: ask
+---
+
+# eval-engineer
+
+## Source of truth
+
+- `AGENTS.md`
+- `docs/ai/harness.md`
+- `docs/ai/loops.md`
+- `docs/ai/loop-policy.md`
+- `docs/ai/provider-routing.md`
+
+## Rules
+
+- Respect context budget.
+- Do not exceed loop boundaries.
+- Do not approve critical impact.
+- Escalate after repeated failures.
+- Report files, tests, evals, risks and next action.
+
+## Output
+
+```txt
+Agent:
+Context:
+Decision:
+Validation:
+Risks:
+Escalation:
+Next action:
+```

package/repo-template/.opencode/agents/loop-controller.md

@@ -0,0 +1,38 @@
+---
+description: Controls bounded repair/validation loops and escalates when limits are reached.
+mode: subagent
+temperature: 0.1
+permission:
+  edit: ask
+  bash: ask
+---
+
+# loop-controller
+
+## Source of truth
+
+- `AGENTS.md`
+- `docs/ai/harness.md`
+- `docs/ai/loops.md`
+- `docs/ai/loop-policy.md`
+- `docs/ai/provider-routing.md`
+
+## Rules
+
+- Respect context budget.
+- Do not exceed loop boundaries.
+- Do not approve critical impact.
+- Escalate after repeated failures.
+- Report files, tests, evals, risks and next action.
+
+## Output
+
+```txt
+Agent:
+Context:
+Decision:
+Validation:
+Risks:
+Escalation:
+Next action:
+```

package/repo-template/.opencode/agents/loop-debugger.md

@@ -0,0 +1,38 @@
+---
+description: Diagnoses loops that fail, repeat or do not converge.
+mode: subagent
+temperature: 0.1
+permission:
+  edit: ask
+  bash: ask
+---
+
+# loop-debugger
+
+## Source of truth
+
+- `AGENTS.md`
+- `docs/ai/harness.md`
+- `docs/ai/loops.md`
+- `docs/ai/loop-policy.md`
+- `docs/ai/provider-routing.md`
+
+## Rules
+
+- Respect context budget.
+- Do not exceed loop boundaries.
+- Do not approve critical impact.
+- Escalate after repeated failures.
+- Report files, tests, evals, risks and next action.
+
+## Output
+
+```txt
+Agent:
+Context:
+Decision:
+Validation:
+Risks:
+Escalation:
+Next action:
+```

package/repo-template/.opencode/agents/model-router.md

@@ -0,0 +1,38 @@
+---
+description: Selects economic vs strong model according to provider routing.
+mode: subagent
+temperature: 0.1
+permission:
+  edit: deny
+  bash: deny
+---
+
+# model-router
+
+## Source of truth
+
+- `AGENTS.md`
+- `docs/ai/harness.md`
+- `docs/ai/loops.md`
+- `docs/ai/loop-policy.md`
+- `docs/ai/provider-routing.md`
+
+## Rules
+
+- Respect context budget.
+- Do not exceed loop boundaries.
+- Do not approve critical impact.
+- Escalate after repeated failures.
+- Report files, tests, evals, risks and next action.
+
+## Output
+
+```txt
+Agent:
+Context:
+Decision:
+Validation:
+Risks:
+Escalation:
+Next action:
+```

package/repo-template/.opencode/agents/sdd-orchestrator.md

@@ -0,0 +1,38 @@
+---
+description: Coordinates SDD flow with bounded loops.
+mode: subagent
+temperature: 0.1
+permission:
+  edit: ask
+  bash: ask
+---
+
+# sdd-orchestrator
+
+## Source of truth
+
+- `AGENTS.md`
+- `docs/ai/harness.md`
+- `docs/ai/loops.md`
+- `docs/ai/loop-policy.md`
+- `docs/ai/provider-routing.md`
+
+## Rules
+
+- Respect context budget.
+- Do not exceed loop boundaries.
+- Do not approve critical impact.
+- Escalate after repeated failures.
+- Report files, tests, evals, risks and next action.
+
+## Output
+
+```txt
+Agent:
+Context:
+Decision:
+Validation:
+Risks:
+Escalation:
+Next action:
+```

package/repo-template/.opencode/agents/sdd-spec-reviewer.md

@@ -0,0 +1,38 @@
+---
+description: Reviews SDD specs for ambiguity, contradictions and scope creep.
+mode: subagent
+temperature: 0.1
+permission:
+  edit: deny
+  bash: deny
+---
+
+# sdd-spec-reviewer
+
+## Source of truth
+
+- `AGENTS.md`
+- `docs/ai/harness.md`
+- `docs/ai/loops.md`
+- `docs/ai/loop-policy.md`
+- `docs/ai/provider-routing.md`
+
+## Rules
+
+- Respect context budget.
+- Do not exceed loop boundaries.
+- Do not approve critical impact.
+- Escalate after repeated failures.
+- Report files, tests, evals, risks and next action.
+
+## Output
+
+```txt
+Agent:
+Context:
+Decision:
+Validation:
+Risks:
+Escalation:
+Next action:
+```

package/repo-template/.opencode/agents/spec-intake-analyst.md

@@ -0,0 +1,19 @@
+---
+description: Classifies task complexity and chooses basic, standard or complex spec.
+mode: subagent
+temperature: 0.1
+permission:
+  edit: ask
+  bash: deny
+---
+
+# spec-intake-analyst
+
+Read:
+
+- `docs/ai/spec-sizing.md`
+- `docs/ai/spec-intake.md`
+- `docs/skills/spec-complexity-classifier.md`
+
+Create or recommend the right spec template.
+Do not implement application code.

package/repo-template/.opencode/agents/tdd-engineer.md

@@ -0,0 +1,38 @@
+---
+description: Creates failing tests first and validates behavior.
+mode: subagent
+temperature: 0.1
+permission:
+  edit: ask
+  bash: ask
+---
+
+# tdd-engineer
+
+## Source of truth
+
+- `AGENTS.md`
+- `docs/ai/harness.md`
+- `docs/ai/loops.md`
+- `docs/ai/loop-policy.md`
+- `docs/ai/provider-routing.md`
+
+## Rules
+
+- Respect context budget.
+- Do not exceed loop boundaries.
+- Do not approve critical impact.
+- Escalate after repeated failures.
+- Report files, tests, evals, risks and next action.
+
+## Output
+
+```txt
+Agent:
+Context:
+Decision:
+Validation:
+Risks:
+Escalation:
+Next action:
+```

package/repo-template/.opencode/commands/checkpoint.md

@@ -0,0 +1,3 @@
+# checkpoint
+
+Read AGENTS.md and the relevant docs/ai enforcement documents. Execute this workflow without overriding the universal core.

package/repo-template/.opencode/commands/eval-design.md

@@ -0,0 +1,3 @@
+# eval-design
+
+Read AGENTS.md and the relevant docs/ai enforcement documents. Execute this workflow without overriding the universal core.

package/repo-template/.opencode/commands/maintainability-review.md

@@ -0,0 +1,3 @@
+# maintainability-review
+
+Read AGENTS.md and the relevant docs/ai enforcement documents. Execute this workflow without overriding the universal core.

package/repo-template/.opencode/commands/quality-gate.md

@@ -0,0 +1,3 @@
+# quality-gate
+
+Read AGENTS.md and the relevant docs/ai enforcement documents. Execute this workflow without overriding the universal core.

package/repo-template/.opencode/commands/spec-escalate.md

@@ -0,0 +1,9 @@
+# spec-escalate
+
+Review whether the current spec must be upgraded.
+
+Read:
+
+- `docs/skills/spec-escalation-review.md`
+
+Stop implementation if risk exceeds the current spec level.

package/repo-template/.opencode/commands/spec-intake.md

@@ -0,0 +1,10 @@
+# spec-intake
+
+Run spec intake and create the right spec template.
+
+Read:
+
+- `docs/skills/spec-intake.md`
+- `docs/skills/spec-complexity-classifier.md`
+
+Do not implement yet.

package/repo-template/.opencode/commands/spec-size.md

@@ -0,0 +1,21 @@
+# spec-size
+
+Classify the requested task as basic, standard or complex.
+
+Read:
+
+- `docs/ai/spec-sizing.md`
+- `docs/ai/spec-intake.md`
+- `docs/ai/spec-escalation.md`
+
+Return:
+
+```txt
+Spec level:
+Score:
+Hard triggers:
+Reason:
+Template:
+Validation:
+Approval:
+```

package/repo-template/.opencode/commands/trust-review.md

@@ -0,0 +1,3 @@
+# trust-review
+
+Read AGENTS.md and the relevant docs/ai enforcement documents. Execute this workflow without overriding the universal core.