@kal-elsam/kairo-runtime 0.5.1 → 0.7.0

package/README.md

@@ -261,7 +261,7 @@ node ./bin/kairo.js install --dry-run
 
 ## Supported adapters (agent-global)
 
-Kairo Runtime does **not** install Cursor, Codex, OpenCode, or Claude Code. It detects
+Kairo Runtime does **not** install Cursor, Codex, OpenCode, Claude Code, or Pi. It detects
 their home-directory roots and writes managed sections into their config files.
 
 | Adapter | Label | Root | Config file |
@@ -270,6 +270,7 @@ their home-directory roots and writes managed sections into their config files.
 | `codex` | Codex | `~/.codex` | `~/.codex/AGENTS.md` |
 | `opencode` | OpenCode | `~/.config/opencode` | `~/.config/opencode/AGENTS.md` |
 | `claude` | Claude Code | `~/.claude` | `~/.claude/CLAUDE.md` |
+| `pi` | Pi | `~/.pi/agent` | `~/.pi/agent/AGENTS.md` |
 
 Inspect detection and managed state:
 
@@ -281,14 +282,49 @@ kairo adapters --json
 Agent selection defaults:
 
 - If agent roots are detected → configure detected agents only.
-- If none are detected → safe fallback to all four supported adapters.
-- Force all four explicitly:
+- If none are detected → safe fallback to all five supported adapters.
+- Force all five explicitly:
 
 ```bash
 kairo setup --agents all
 kairo install --agents all
 ```
 
+### Pi runtime (auditable)
+
+```bash
+kairo run --agent pi --task "Review this repository" --permissions read-only --follow
+```
+
+Launches `pi --mode json --no-session` (optional `--model`). `read-only` maps to
+`--tools read,grep,find,ls`; other permission aliases are rejected (never translated
+to `--approve`). Custom `PI_CODING_AGENT_DIR` blocks config writes in 0.6.0 but does
+not block runtime. Kairo does not install Pi or assert subscription/entitlement.
+
+### Bounded review (Codex / Pi)
+
+Read-only native review against a Git snapshot. Never mutates the repo, never
+auto-fixes, and never persists prompts, diffs, or transcripts. Receipts land under
+`~/.harness/reviews/<reviewId>/receipt.json` (secret-free). Only Codex and Pi are
+`reviewCompatible` in 0.7.0; Cursor / Claude / OpenCode report `false` until audited.
+
+```bash
+kairo review --agent codex
+kairo review --agent pi --base main
+kairo review --agent codex --commit <sha>
+kairo review --agent codex --fail-on high --json
+kairo reviews list [--limit N] [--json]
+kairo reviews show <reviewId> [--json]
+```
+
+`--agent` is always required. Scope is working-tree by default; use `--base` or
+`--commit` (mutually exclusive). Private paths need `--include-private` plus TTY
+confirm or `--yes`/`--confirm`. Exit codes: `0` ok, `1` severity threshold,
+`2` operational/stale/invalid/cancel.
+
+Cockpit: **Runs → Reviews** lists receipts and opens a read-only detail view
+(no launch from Cockpit in v1).
+
 Primary governance flow:
 
 ```txt
@@ -518,9 +554,11 @@ kairo components rollback engram-memory --receipt <id> --dry-run
 
 Without `--agents`, Kairo uses the intersection of detected agents and
 Kairo-managed Engram agents (`cursor`, `codex`, `opencode`, `claude` → setup slug
-`claude-code`). After setup, status is `restart_required` — restart the agent to
+`claude-code`, `pi` → `pi`). After setup, status is `restart_required` — restart the agent to
 load MCP; configuration evidence is not runtime-active. Receipts live under
-`~/.harness/integrations/engram/`.
+`~/.harness/integrations/engram/`. For Pi, positive evidence requires
+`~/.pi/agent/settings.json` packages (`npm:gentle-engram`, `npm:pi-mcp-adapter`) and
+`~/.pi/agent/mcp.json` with `mcpServers.engram`.
 
 ### SDD Core skills
 
@@ -537,7 +575,7 @@ same `sdd-core` apply path. Lifecycle keeps persona frozen (`preservePersona`):
 it never auto-activates teaching. Explicit persona changes stay on
 `kairo components configure sdd-core`.
 
-**Destinations.** Cursor, Codex, and OpenCode share `~/.agents/skills/<id>/`.
+**Destinations.** Cursor, Codex, OpenCode, and Pi share `~/.agents/skills/<id>/`.
 Claude uses `~/.claude/skills/<id>/`. One physical tree per root; consumers are
 recorded per destination.
 

package/global-template/components/catalog.json

@@ -58,7 +58,8 @@
         "cursor": "- In repos with workspace harness: also read `.cursor/rules/` and `docs/specs/`.",
         "codex": "- In repos with workspace harness: also read `.codex/skills/sdd/` when present.",
         "claude": "- In repos with workspace harness: repo `AGENTS.md` wins over `CLAUDE.md` pointers.",
-        "opencode": "- In repos with workspace harness: also read `.opencode/` SDD assets when present."
+        "opencode": "- In repos with workspace harness: also read `.opencode/` SDD assets when present.",
+        "pi": "- Skills load from `~/.agents/skills` (shared Agent Skills root). Teaching persona activates only via the managed section of `~/.pi/agent/AGENTS.md`."
       }
     },
     {
@@ -80,7 +81,8 @@
         "cursor": "- Configure Engram via `kairo components configure engram-memory` (official `engram setup cursor`).",
         "codex": "- Configure Engram via `kairo components configure engram-memory` (official `engram setup codex`).",
         "claude": "- Configure Engram via `kairo components configure engram-memory` (official `engram setup claude-code`).",
-        "opencode": "- Configure Engram via `kairo components configure engram-memory` (official `engram setup opencode`)."
+        "opencode": "- Configure Engram via `kairo components configure engram-memory` (official `engram setup opencode`).",
+        "pi": "- Configure Engram via `kairo components configure engram-memory` (official `engram setup pi`). Evidence: `~/.pi/agent/settings.json` packages + `mcp.json` engram server. Restart Pi after setup; Kairo never runs `engram doctor`/`serve` or touches `engram.db`."
       }
     },
     {

package/global-template/components/orchestrator/orchestrator.md

@@ -5,7 +5,7 @@
 ## Role
 
 The Harness Orchestrator (conductor) coordinates work across local coding agents
-(Cursor, Codex, OpenCode, Claude). It does not replace any agent. It defines how
+(Cursor, Codex, OpenCode, Claude, Pi). It does not replace any agent. It defines how
 agents hand off work and which source of truth governs.
 
 ## Authority order

package/global-template/core/orchestrator.md

@@ -5,7 +5,7 @@
 ## Role
 
 The Harness Orchestrator (conductor) coordinates work across local coding agents
-(Cursor, Codex, OpenCode, Claude). It does not replace any agent. It defines how
+(Cursor, Codex, OpenCode, Claude, Pi). It does not replace any agent. It defines how
 agents hand off work and which source of truth governs.
 
 ## Authority order

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@kal-elsam/kairo-runtime",
-  "version": "0.5.1",
-  "description": "Kairo Runtime — local agent operating system for Codex, Cursor, Claude, Gemini, Copilot, Engram, and Graphify.",
+  "version": "0.7.0",
+  "description": "Kairo Runtime — local agent operating system for Codex, Cursor, Claude, Pi, Engram, and Graphify.",
   "type": "module",
   "homepage": "https://github.com/Kal-elSam/harness#readme",
   "repository": {
@@ -45,6 +45,7 @@
     "agents",
     "codex",
     "cursor",
+    "pi",
     "kairo",
     "kairo-runtime",
     "harness",

package/scripts/cockpit-smoke.mjs

@@ -26,7 +26,7 @@ const root = join(dirname(fileURLToPath(import.meta.url)), "..");
 const require = createRequire(import.meta.url);
 const pkg = require(join(root, "package.json"));
 
-assert.equal(pkg.version, "0.5.0");
+assert.equal(pkg.version, "0.7.0");
 assert.ok(pkg.dependencies["ansi-escapes"]);
 
 assert.equal(resolveLayoutMode({ columns: 120, rows: 40 }), LAYOUT_MODES.WIDE);

package/scripts/install.sh

@@ -4,7 +4,7 @@
 # Safe by design:
 #   - no sudo
 #   - no shell profile changes
-#   - does not install Cursor/Codex/OpenCode/Claude
+#   - does not install Cursor/Codex/OpenCode/Claude/Pi
 #   - default ends with setup --dry-run (no writes)
 #   - explicit apply: pass --yes to run setup --yes
 #

package/scripts/installer-smoke-test.sh

@@ -88,9 +88,9 @@ if (!payload.ok || payload.overall !== 'ok') {
   process.exit(1);
 }
 const managed = payload.agents.filter((agent) => agent.managed).map((agent) => agent.id).sort();
-const expected = ['claude', 'codex', 'cursor', 'opencode'];
+const expected = ['claude', 'codex', 'cursor', 'opencode', 'pi'];
 if (JSON.stringify(managed) !== JSON.stringify(expected)) {
-  console.error('Expected all four agents managed');
+  console.error('Expected all five agents managed');
   process.exit(1);
 }
 " "$status_json"
@@ -105,7 +105,8 @@ const targets = [
   '.cursor/AGENTS.md',
   '.codex/AGENTS.md',
   '.config/opencode/AGENTS.md',
-  '.claude/CLAUDE.md'
+  '.claude/CLAUDE.md',
+  '.pi/agent/AGENTS.md'
 ];
 
 for (const relativePath of targets) {
@@ -143,7 +144,8 @@ mkdir -p \
   "$FAKE_HOME/.cursor" \
   "$FAKE_HOME/.codex" \
   "$FAKE_HOME/.config/opencode" \
-  "$FAKE_HOME/.claude"
+  "$FAKE_HOME/.claude" \
+  "$FAKE_HOME/.pi/agent"
 
 echo
 echo "== curl install.sh | sh --version ${VERSION} --yes --agents all =="

package/src/cli.js

@@ -38,6 +38,7 @@ import { runWorkspaceDetect, runWorkspaceDoctor, runWorkspaceInit, runWorkspaceU
 import { runOrchestratorDiagnostics, runOrchestratorShell } from "./global/orchestrator.js";
 import { runIntelligenceCli } from "./global/intelligence-cli.js";
 import { runGlobalRun, runGlobalRuns } from "./global/runtime/run-cli.js";
+import { runGlobalReview, runGlobalReviews } from "./global/runtime/review/review-cli.js";
 import {
   LEGACY_PACKAGE_NAME,
   PACKAGE_NAME,
@@ -111,6 +112,12 @@ export async function runCli(argv) {
     case "runs":
       await runGlobalRuns(optionsWithPolicy, packageManifest);
       return;
+    case "review":
+      await runGlobalReview(optionsWithPolicy, packageManifest);
+      return;
+    case "reviews":
+      await runGlobalReviews(optionsWithPolicy, packageManifest);
+      return;
     case "intelligence":
       await runIntelligenceCli(optionsWithPolicy, packageManifest);
       return;
@@ -371,6 +378,11 @@ export function parseArgs(argv) {
     intelligencePaths: [],
     runsAction: null,
     runId: null,
+    reviewId: null,
+    reviewsAction: null,
+    base: null,
+    commit: null,
+    failOn: null,
     agent: null,
     task: null,
     model: null,
@@ -401,6 +413,10 @@ export function parseArgs(argv) {
     parseRunsAction(args, options);
   }
 
+  if (command === "reviews") {
+    parseReviewsAction(args, options);
+  }
+
   if (command === "intelligence") {
     parseIntelligenceAction(args, options);
   }
@@ -495,6 +511,15 @@ export function parseArgs(argv) {
     else if (arg.startsWith("--timeout=")) options.timeoutMs = parsePositiveInt(arg.slice("--timeout=".length), "timeout") * 1000;
     else if (arg === "--include-private") options.includePrivate = true;
     else if (arg === "--cloud-consent") options.cloudConsent = true;
+    else if (arg === "--base") options.base = requireFlagValue("--base", args[++index]);
+    else if (arg.startsWith("--base=")) options.base = requireFlagValue("--base", arg.slice("--base=".length));
+    else if (arg === "--commit") options.commit = requireFlagValue("--commit", args[++index]);
+    else if (arg.startsWith("--commit=")) {
+      options.commit = requireFlagValue("--commit", arg.slice("--commit=".length));
+    } else if (arg === "--fail-on") options.failOn = requireFlagValue("--fail-on", args[++index]);
+    else if (arg.startsWith("--fail-on=")) {
+      options.failOn = requireFlagValue("--fail-on", arg.slice("--fail-on=".length));
+    }
     else if (arg === "--help" || arg === "-h") options.help = true;
     else if (arg === "--version" || arg === "-v") options.version = true;
     else throw new Error(`Unknown option "${arg}".`);
@@ -624,6 +649,26 @@ function parseRunsAction(args, options) {
   }
 }
 
+function parseReviewsAction(args, options) {
+  const action = args[0];
+  if (!action || action.startsWith("-")) {
+    options.reviewsAction = "list";
+    return;
+  }
+  if (!new Set(["list", "show"]).has(action)) {
+    throw new Error(`Unknown reviews action "${action}". Use list or show.`);
+  }
+  args.shift();
+  options.reviewsAction = action;
+  if (action === "show") {
+    const reviewId = args[0];
+    if (!reviewId || reviewId.startsWith("-")) {
+      throw new Error(`Missing review id. Use: ${formatCliCommand("reviews show <reviewId>")}`);
+    }
+    options.reviewId = args.shift();
+  }
+}
+
 function parseIntelligenceAction(args, options) {
   const action = args[0];
   if (!action || action.startsWith("-")) {
@@ -657,6 +702,13 @@ function parsePositiveInt(value, label) {
   return parsed;
 }
 
+function requireFlagValue(flag, value) {
+  if (value == null || value === "" || String(value).startsWith("-")) {
+    throw new Error(`Missing value for ${flag}.`);
+  }
+  return value;
+}
+
 function parseScope(value) {
   if (!SCOPES.has(value)) {
     throw new Error(`Invalid scope "${value}". Use agent-global or workspace.`);
@@ -673,6 +725,8 @@ function normalizeCommand(command) {
   if (command === "orchestrator") return "orchestrator";
   if (command === "run") return "run";
   if (command === "runs") return "runs";
+  if (command === "review") return "review";
+  if (command === "reviews") return "reviews";
   if (command === "intelligence" || command === "intel") return "intelligence";
   if (command === "setup") return "setup";
   if (command === "status") return "status";
@@ -732,7 +786,7 @@ function printHelp() {
   console.log(`${BRAND.displayName} (${PACKAGE_NAME})
 
 ${BRAND.tagline}. ${BRAND.displayName} does not install AI apps — it powers and
-coordinates agents you already have (Cursor, Codex, OpenCode, Claude) with managed
+coordinates agents you already have (Cursor, Codex, OpenCode, Claude, Pi) with managed
 sections, components, backups, and drift repair under ~/.harness.
 
 Bootstrap: see README.md (curl install.sh or npx ${PACKAGE_NAME}).
@@ -747,6 +801,9 @@ Usage:
   ${cli} runs list [--json] [--limit <n>] [--active-only]
   ${cli} runs show <runId> [--json] [--limit <n>] [--follow]
   ${cli} runs stop <runId> [--json]
+  ${cli} review --agent codex|pi [--base <ref>|--commit <sha>] [--model <name>] [--include-private] [--yes|--confirm] [--fail-on high|medium|low] [--json]
+  ${cli} reviews list [--limit <n>] [--json]
+  ${cli} reviews show <reviewId> [--json]
   ${cli} orchestrator [--json]          Read-only agent capability diagnostics
   ${cli} intelligence [status|models|context|route|ask] [--json]
   ${cli} intelligence models --backend opencode-go|opencode-zen|opencode
@@ -795,6 +852,8 @@ Commands:
              Tab switches region only when content is interactive (runs/launch).
   run        Launch a managed agent run with local audit trail.
   runs       List, inspect, or cancel agent runs under ~/.harness/runs/.
+  review     Bounded read-only review via Codex or Pi; receipts under ~/.harness/reviews/.
+  reviews    List or show prior review receipts (secret-free).
   orchestrator  Read-only capability registry diagnostics (--json supported).
   intelligence  Harness Engineering layer: backends, context packs, routing, budgets.
              Local-first (Ollama). Cloud only with --cloud-consent.

package/src/global/adapters/pi.js

@@ -0,0 +1,53 @@
+import { resolve } from "node:path";
+import { createManagedConfigAdapter } from "../managed-config-adapter.js";
+
+export const PI_DEFAULT_ROOT_DIR = ".pi/agent";
+export const PI_DEFAULT_CONFIG_FILE = ".pi/agent/AGENTS.md";
+export const PI_CODING_AGENT_DIR_ENV = "PI_CODING_AGENT_DIR";
+
+const CUSTOM_DIR_MESSAGE =
+  `Pi config writes are unsupported when ${PI_CODING_AGENT_DIR_ENV} points away from `
+  + `~/${PI_DEFAULT_ROOT_DIR} (out of scope for Kairo 0.6.0). `
+  + `Unset ${PI_CODING_AGENT_DIR_ENV} to manage the default directory; runtime launches remain available.`;
+
+/** True when PI_CODING_AGENT_DIR is set to a non-default absolute/relative path. */
+export function isCustomPiCodingAgentDir(env = process.env, homeDir) {
+  const raw = env?.[PI_CODING_AGENT_DIR_ENV];
+  if (raw == null || String(raw).trim() === "") return false;
+  if (homeDir == null) return true;
+  return resolve(String(raw).trim()) !== resolve(homeDir, PI_DEFAULT_ROOT_DIR);
+}
+
+export function assertDefaultPiConfigDir(context = {}) {
+  const env = context.env ?? process.env;
+  if (isCustomPiCodingAgentDir(env, context.homeDir)) {
+    throw new Error(CUSTOM_DIR_MESSAGE);
+  }
+}
+
+const managed = createManagedConfigAdapter({
+  id: "pi",
+  label: "Pi",
+  rootDir: PI_DEFAULT_ROOT_DIR,
+  configFile: PI_DEFAULT_CONFIG_FILE
+});
+
+/** Managed adapter for ~/.pi/agent/AGENTS.md; custom PI_CODING_AGENT_DIR fails before writes. */
+export default {
+  ...managed,
+
+  plan(context) {
+    assertDefaultPiConfigDir(context);
+    return managed.plan(context);
+  },
+
+  async apply(context, plan) {
+    assertDefaultPiConfigDir(context);
+    return managed.apply(context, plan);
+  },
+
+  async uninstall(context, stateEntry) {
+    assertDefaultPiConfigDir(context);
+    return managed.uninstall(context, stateEntry);
+  }
+};

package/src/global/agent-capabilities/index.js

@@ -2,6 +2,7 @@ import cursorManaged from "../adapters/cursor.js";
 import codexManaged from "../adapters/codex.js";
 import opencodeManaged from "../adapters/opencode.js";
 import claudeManaged from "../adapters/claude.js";
+import piManaged from "../adapters/pi.js";
 import { createAgentCapabilityAdapter } from "./create-capability-adapter.js";
 
 const cursor = createAgentCapabilityAdapter({
@@ -37,7 +38,16 @@ const claude = createAgentCapabilityAdapter({
   runExecutable: "claude"
 });
 
-const CAPABILITY_ADAPTERS = [cursor, codex, opencode, claude];
+const pi = createAgentCapabilityAdapter({
+  id: "pi",
+  label: "Pi",
+  managedAdapter: piManaged,
+  executable: "pi",
+  opaqueAuth: true,
+  runExecutable: "pi"
+});
+
+const CAPABILITY_ADAPTERS = [cursor, codex, opencode, claude, pi];
 
 export const AGENT_CAPABILITY_IDS = CAPABILITY_ADAPTERS.map((adapter) => adapter.id);
 

package/src/global/brand/index.js

@@ -30,14 +30,16 @@ export const AGENT_LABELS = {
   cursor: "Cursor",
   codex: "Codex",
   opencode: "OpenCode",
-  claude: "Claude Code"
+  claude: "Claude Code",
+  pi: "Pi"
 };
 
 export const AGENT_SYMBOLS = {
   cursor: "◆",
   codex: "◆",
   opencode: "◆",
-  claude: "◆"
+  claude: "◆",
+  pi: "◆"
 };
 
 export const TOKENS = {

package/src/global/dashboard-guidance.js

@@ -150,7 +150,7 @@ export function resolveDashboardRecommendation({
       kind: NEXT_STEP_KINDS.LAUNCH,
       title: "Create a new run",
       message: "Create a new run",
-      detail: "Delegate a task to Cursor, Codex or Claude.",
+      detail: "Delegate a task to Cursor, Codex, Claude, or Pi.",
       targetView: RECOMMENDATION_TARGETS.LAUNCH,
       targetAction: "launch"
     };

package/src/global/global-cli.js

@@ -734,7 +734,7 @@ function printAdapterMatrixReport(report) {
   console.log(commandHeader("adapters — supported agent integrations"));
   console.log(`Home: ${report.homeDir}`);
   console.log("");
-  console.log(`${BRAND.displayName} does not install Cursor, Codex, OpenCode, or Claude Code.`);
+  console.log(`${BRAND.displayName} does not install Cursor, Codex, OpenCode, Claude Code, or Pi.`);
   console.log("It configures managed sections in each agent's config files.");
   console.log("");
   console.log(`Supported: ${report.supportedCount}  Detected: ${report.detectedCount}  Managed: ${report.managedCount}`);

package/src/global/ink/cockpit-controller.js

@@ -144,6 +144,16 @@ export function reduceCockpitUi(state, action) {
           returnView: null
         };
       }
+      if (state.view === ORCHESTRATOR_VIEWS.REVIEW_DETAIL) {
+        const back = ORCHESTRATOR_VIEWS.REVIEWS;
+        return {
+          ...state,
+          view: back,
+          listIndex: 0,
+          region: defaultRegionForView(back, state.layoutMode),
+          returnView: null
+        };
+      }
       if (isRunsChildView(state.view)) {
         return goRunsHub(state);
       }

package/src/global/ink/cockpit-focus.js

@@ -18,6 +18,8 @@ const CONTENT_INTERACTIVE_VIEWS = new Set([
   ORCHESTRATOR_VIEWS.ACTIVE_RUNS,
   ORCHESTRATOR_VIEWS.RECENT_RUNS,
   ORCHESTRATOR_VIEWS.RUN_DETAIL,
+  ORCHESTRATOR_VIEWS.REVIEWS,
+  ORCHESTRATOR_VIEWS.REVIEW_DETAIL,
   ORCHESTRATOR_VIEWS.LAUNCH,
   ORCHESTRATOR_VIEWS.ACTIVITY
 ]);
@@ -41,7 +43,11 @@ export function defaultRegionForView(view, layoutMode = LAYOUT_MODES.COMPACT) {
 
 export function interactiveRegionsFor(state) {
   const regions = regionsForLayout(state.layoutMode);
-  if (!isContentInteractiveView(state.view) || state.view === ORCHESTRATOR_VIEWS.RUN_DETAIL) {
+  if (
+    !isContentInteractiveView(state.view)
+    || state.view === ORCHESTRATOR_VIEWS.RUN_DETAIL
+    || state.view === ORCHESTRATOR_VIEWS.REVIEW_DETAIL
+  ) {
     return regions.filter((region) => region === COCKPIT_REGIONS.NAV);
   }
   return regions.filter(
@@ -51,7 +57,12 @@ export function interactiveRegionsFor(state) {
 
 export function canTabBetweenRegions(state) {
   if (!isContentInteractiveView(state.view)) return false;
-  if (state.view === ORCHESTRATOR_VIEWS.RUN_DETAIL) return false;
+  if (
+    state.view === ORCHESTRATOR_VIEWS.RUN_DETAIL
+    || state.view === ORCHESTRATOR_VIEWS.REVIEW_DETAIL
+  ) {
+    return false;
+  }
   return interactiveRegionsFor(state).length >= 2;
 }
 
@@ -70,7 +81,11 @@ export function routeCockpitKey(state, keyAction) {
         return { type: "arrow", direction: keyAction.direction };
       }
       if (state.region === COCKPIT_REGIONS.CONTENT && isContentInteractiveView(state.view)) {
-        if (state.view === ORCHESTRATOR_VIEWS.RUN_DETAIL || state.view === ORCHESTRATOR_VIEWS.LAUNCH) {
+        if (
+          state.view === ORCHESTRATOR_VIEWS.RUN_DETAIL
+          || state.view === ORCHESTRATOR_VIEWS.REVIEW_DETAIL
+          || state.view === ORCHESTRATOR_VIEWS.LAUNCH
+        ) {
           return null;
         }
         return {

package/src/global/ink/cockpit-models.js

@@ -250,6 +250,11 @@ export function buildFooterModel({
     return { text: parts.join(` ${glyphs.bullet} `) };
   }
 
+  if (view === ORCHESTRATOR_VIEWS.REVIEW_DETAIL) {
+    parts.push("Esc Back");
+    return { text: parts.join(` ${glyphs.bullet} `) };
+  }
+
   if (view === ORCHESTRATOR_VIEWS.CHANGES) {
     return { text: buildChangesFooterParts(changesPhase).join(` ${glyphs.bullet} `) };
   }
@@ -263,6 +268,7 @@ export function buildFooterModel({
   const showTab = view === ORCHESTRATOR_VIEWS.RUNS
     || view === ORCHESTRATOR_VIEWS.ACTIVE_RUNS
     || view === ORCHESTRATOR_VIEWS.RECENT_RUNS
+    || view === ORCHESTRATOR_VIEWS.REVIEWS
     || view === ORCHESTRATOR_VIEWS.LAUNCH
     || view === ORCHESTRATOR_VIEWS.ACTIVITY;
   if (showTab) {
@@ -280,7 +286,8 @@ export function buildFooterModel({
     || region === COCKPIT_REGIONS.NAV
     || view === ORCHESTRATOR_VIEWS.RUNS
     || view === ORCHESTRATOR_VIEWS.ACTIVE_RUNS
-    || view === ORCHESTRATOR_VIEWS.RECENT_RUNS) {
+    || view === ORCHESTRATOR_VIEWS.RECENT_RUNS
+    || view === ORCHESTRATOR_VIEWS.REVIEWS) {
     parts.push("Enter Open");
   }
   if (view !== ORCHESTRATOR_VIEWS.LAUNCH) {

package/src/global/ink/cockpit-reviews.js

@@ -0,0 +1,62 @@
+/** Read-only Cockpit helpers for review receipts under ~/.harness/reviews/. */
+
+export function countFindingsBySeverity(findings = []) {
+  const counts = { high: 0, medium: 0, low: 0 };
+  for (const finding of findings) {
+    const severity = String(finding?.severity ?? "").toLowerCase();
+    if (counts[severity] != null) counts[severity] += 1;
+  }
+  return counts;
+}
+
+export function selectReviewFromList(receipts = [], listIndex = 0) {
+  if (!Array.isArray(receipts) || receipts.length === 0) return null;
+  const index = Math.min(Math.max(0, listIndex), receipts.length - 1);
+  return receipts[index] ?? null;
+}
+
+export function formatReviewListLines(receipts = []) {
+  if (!Array.isArray(receipts) || receipts.length === 0) {
+    return ["No review receipts yet. Run kairo review --agent codex|pi."];
+  }
+  return receipts.map((receipt) => {
+    const counts = countFindingsBySeverity(receipt.findings);
+    const findingTotal = (receipt.findings ?? []).length;
+    const created = String(receipt.createdAt ?? "").slice(0, 19).replace("T", " ");
+    return `${receipt.reviewId}  ${String(receipt.state).padEnd(10)}  ${String(receipt.agentId).padEnd(6)}  ${findingTotal}f (h${counts.high}/m${counts.medium}/l${counts.low})  ${created}`;
+  });
+}
+
+export function formatReviewDetailLines(receipt) {
+  if (!receipt) return ["Review receipt not found."];
+  const counts = countFindingsBySeverity(receipt.findings);
+  const snapshot = receipt.snapshot ?? {};
+  const totals = snapshot.totals ?? {};
+  const lines = [
+    `Id: ${receipt.reviewId}`,
+    `Agent: ${receipt.agentId}${receipt.model ? ` · model ${receipt.model}` : ""}`,
+    `State: ${receipt.state}`,
+    `Created: ${receipt.createdAt ?? "n/a"}`,
+    `Findings: ${(receipt.findings ?? []).length} (high ${counts.high}, medium ${counts.medium}, low ${counts.low})`,
+    `Snapshot: ${snapshot.mode ?? "n/a"} · files ${totals.fileCount ?? 0} · fingerprint ${String(snapshot.fingerprint ?? "").slice(0, 12) || "n/a"}`
+  ];
+  if ((receipt.warnings ?? []).length > 0) {
+    lines.push(`Warnings: ${receipt.warnings.length}`);
+  }
+  const findings = receipt.findings ?? [];
+  if (findings.length === 0) {
+    lines.push("", "No findings recorded.");
+    return lines;
+  }
+  lines.push("", "Findings (read-only):");
+  for (const finding of findings.slice(0, 20)) {
+    const loc = finding.line != null ? `:${finding.line}` : "";
+    lines.push(
+      `  [${String(finding.severity).toUpperCase()}] ${finding.path ?? "?"}${loc} — ${finding.title ?? "untitled"}`
+    );
+  }
+  if (findings.length > 20) {
+    lines.push(`  … ${findings.length - 20} more (use kairo reviews show ${receipt.reviewId})`);
+  }
+  return lines;
+}

package/src/global/ink/cockpit-runs.js

@@ -13,6 +13,12 @@ export const RUNS_HUB_ITEMS = [
     view: ORCHESTRATOR_VIEWS.RECENT_RUNS,
     description: "Review completed and failed run outcomes."
   },
+  {
+    id: "reviews",
+    label: "Reviews",
+    view: ORCHESTRATOR_VIEWS.REVIEWS,
+    description: "Browse secret-free bounded-review receipts (read-only)."
+  },
   {
     id: "launch",
     label: "New run",
@@ -27,13 +33,16 @@ export function isRunsBranchView(view) {
     || view === ORCHESTRATOR_VIEWS.ACTIVE_RUNS
     || view === ORCHESTRATOR_VIEWS.RECENT_RUNS
     || view === ORCHESTRATOR_VIEWS.LAUNCH
-    || view === ORCHESTRATOR_VIEWS.RUN_DETAIL;
+    || view === ORCHESTRATOR_VIEWS.RUN_DETAIL
+    || view === ORCHESTRATOR_VIEWS.REVIEWS
+    || view === ORCHESTRATOR_VIEWS.REVIEW_DETAIL;
 }
 
 export function isRunsChildView(view) {
   return view === ORCHESTRATOR_VIEWS.ACTIVE_RUNS
     || view === ORCHESTRATOR_VIEWS.RECENT_RUNS
-    || view === ORCHESTRATOR_VIEWS.LAUNCH;
+    || view === ORCHESTRATOR_VIEWS.LAUNCH
+    || view === ORCHESTRATOR_VIEWS.REVIEWS;
 }
 
 export function resolveRunsHubItem(listIndex = 0, items = RUNS_HUB_ITEMS) {