killchain 0.1.0__tar.gz

killchain-0.1.0/.gitignore

@@ -0,0 +1,9 @@
+__pycache__/
+*.py[cod]
+*.egg-info/
+build/
+dist/
+.venv/
+.ruff_cache/
+.pytest_cache/
+workspace/

killchain-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Josh Simmons
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

killchain-0.1.0/PKG-INFO

@@ -0,0 +1,268 @@
+Metadata-Version: 2.5
+Name: killchain
+Version: 0.1.0
+Summary: Split a build so a frontier coding agent never sees the risky half.
+Project-URL: Homepage, https://github.com/jcpsimmons/killchain
+Project-URL: Repository, https://github.com/jcpsimmons/killchain
+Project-URL: Issues, https://github.com/jcpsimmons/killchain/issues
+Project-URL: YouTube, https://youtube.com/@drjoshcsimmons
+Author: Josh Simmons
+License-Expression: MIT
+License-File: LICENSE
+Keywords: agents,claude-code,codegen,codex,partitioning
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Software Development :: Code Generators
+Requires-Python: >=3.11
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == 'dev'
+Requires-Dist: ruff>=0.6; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# killchain: refusal-first split build
+
+An abliterated orchestrator model (refuseless by default, settings mirrored
+from `~/.hermes/config.yaml`) is the front door. It is the only model that
+sees the full prompt. It splits the job into a **public half** (built by a
+frontier coding agent: Claude Code or Codex, which may fan out to its own
+subagents) and a **private half** (implemented by the orchestrator itself),
+joined by a contract.
+
+The partition rule is **refusal risk, nothing else**. Claude and Codex are good
+and fast, but they hedge, caveat, simplify, or refuse when a task looks
+reverse-engineered, unlicensed, regulated, exploitative, or oversized. Those
+parts go to the uncensored model. The frontier gets the rest of the app and
+never learns how the interesting bits work, so it has no position to take.
+
+It is not a cost trick and not only a quality trick: a brief that says "match
+the behaviour of X" gets you `from memory` disclaimers and invented constants.
+A brief that says "given these fields return a float in [0, 1], monotonic in
+both" gets you working code.
+
+## Install
+
+Python 3.11+, no dependencies. Pick one:
+
+```bash
+uv tool install killchain          # installs the `killchain` command
+pipx install killchain             # same, if you use pipx
+pip install killchain              # into the current environment
+uvx killchain "your task"          # zero-install trial, no venv needed
+```
+
+From a checkout, before it is on an index:
+
+```bash
+uv tool install git+https://github.com/jcpsimmons/killchain
+# or, for development:
+uv venv && uv pip install -e ".[dev]"
+python harness.py --version
+```
+
+Then find out what is missing before you waste a run:
+
+```bash
+killchain --doctor
+```
+
+`doctor` checks your config, the `claude`/`codex` binary, both API keys, the
+private directory mode, the denylist, and does one live round-trip to each
+endpoint. It exits non-zero only if something fatal to a run is wrong.
+
+## First run
+
+Nothing is written into the directory you installed to. On first use killchain
+creates:
+
+| Path | What |
+| --- | --- |
+| `~/.config/killchain/config.toml` | your config, seeded from the shipped default |
+| `~/.config/killchain/denylist.txt` | literal terms and `re:` patterns the gate rejects |
+| `~/.local/share/killchain/workspace/` | public halves, one directory per run |
+| `~/killchain-private/` | mode 0700: raw prompt, contract, `private_impl/`, risk report |
+
+Override with `$XDG_CONFIG_HOME`, `$XDG_DATA_HOME`, `$KILLCHAIN_CONFIG`,
+`$KILLCHAIN_PRIVATE_ROOT`, or per run with `--private-root` / `--workspace`.
+
+## How it works
+
+```
+prompt ─► orchestrator ─► contract.json  (brief + interfaces + decoy fixtures + private fixtures + notes)
+                │
+                ├─ risk score (8 dimensions, per span)  ┐ on the PUBLIC VIEW, plus
+                ├─ whole-view pass (is the task itself scary?) ┘ flagged spans go back to orchestrator
+                ├─ regex gate + framing hints
+                │
+                ├─► public/   contracts/ stubs + tests/test_contracts.py  ─► frontier agent builds app + tests
+                │                                                            (HARNESS_MODE=stub: fixtures answer)
+                └─► private/  prompt, contract, private_impl/              ◄─ orchestrator implements to contract
+                                                                              (HARNESS_MODE=real: tests prove the fit)
+```
+
+## Where to edit the routing
+
+**[killchain/routing.py](https://github.com/jcpsimmons/killchain/blob/main/killchain/routing.py)** is the one file that decides what the frontier is
+allowed to see. Everything else is plumbing that imports from it:
+
+| In routing.py      | What it controls                                                      |
+|-------------------|-----------------------------------------------------------------------|
+| `DIMENSIONS`      | the refusal dimensions, and the argument for each. Their `question` text is what Jev is actually asked |
+| `SAFE`            | what a frontier agent builds without comment; the "false" criteria    |
+| `HARD_RULES`      | regexes that block a send outright, no model involved                 |
+| `FRAMING_HINTS`   | non-blocking warnings for clone/hedge/licence wording                 |
+| `THRESHOLDS`      | risk probability needed to pull a span, per dimension and span kind    |
+| `classify()`      | the final per-span decision; any dimension over its bar routes private |
+| `pick_frontier()` | which coding agent builds the public half, by content if you like      |
+| `split_prompt()`  | how the raw prompt is cut into spans for the risk map                  |
+
+The denylist (`~/.config/killchain/denylist.txt`) adds literal and regex rules
+without touching any code. It carries two things: secrets that must never
+leave, and terms that tip the frontier off (product names, licence names,
+codenames).
+
+The shipped dimensions are a starting taxonomy, not a law: attribution and
+clone framing, reverse engineering, offensive security, extraction and ToS,
+regulated domains, another vendor's model or SDK internals, hedge wording, and
+scope an agent will negotiate away. Add a dimension when you find a refusal
+that none of them predict.
+
+## Trust boundaries
+
+To the **orchestrator (refuseless)**: the full prompt, the contract, and the
+private implementation loop. This is the half that is supposed to know
+everything.
+
+To the **frontier agent**: only `contract.public.json`, the public brief,
+interface signatures and descriptions, and decoy fixtures. It is told the
+private functions are a black box it should not infer, reimplement, or ask
+about.
+
+To **OpenRouter/TypeSafe (Jev)**: the public view span by span, plus, when
+`probe_raw_prompt = true` (default), raw prompt spans. The denylist terms ride
+along in every criteria block either way. Turn scoring off entirely with
+`--no-risk` if OpenRouter is out of bounds.
+
+The raw prompt, `private_notes`, `private_plan`, and `private_impl/` live under
+`paths.private_root` (default `~/killchain-private/`), never the frontier's cwd or
+on its PYTHONPATH, and the frontier subprocess gets an environment scrubbed of
+anything pointing there. The frontier runs with permissions skipped, so treat
+that boundary as a convention, not a jail.
+
+## Layers of protection on the outbound view
+
+1. **Orchestrator partition** (semantic): told the rule is refusal risk, shown
+   the dimensions, told to rewrite the framing rather than only move content.
+2. **Regex gate** (deterministic): denylist literals and regexes plus built-in
+   secret patterns. Any hit blocks the send.
+3. **Risk scorer** (probabilistic): `typesafe/jev-1.14` via the OpenRouter
+   Decisions API, one `noul` question per dimension per span, criteria from
+   routing.py. Then a whole-view pass, because a refusal is triggered by the
+   shape of a task and every individual span can be innocent.
+4. **Human review**: the outbound view, the decoy fixtures, and the span
+   scores are printed and you confirm, unless `--yes`.
+
+Rejections from 2 and 3 are fed back to the orchestrator with the exact spans,
+so it re-partitions and re-frames.
+
+**Probes.** Before it partitions, the harness scores the raw prompt span by
+span and puts the resulting risk map in the partition prompt. The orchestrator
+can also reply `{"probes": ["exact text", ...]}` up to `max_probe_rounds`
+times to score any phrasing it is unsure about before committing.
+
+## Run
+
+```bash
+killchain "build X using our proprietary Y"
+```
+
+```bash
+killchain -f prompt.md --frontier codex --yes
+```
+
+Flags: `--frontier claude|codex|fake`, `--orch-url`, `--risk-url` (alias
+`--detector-url`), `--no-risk`/`--no-detector`, `--run-id`, `--skip-frontier`
+(public already built, redo private), `--skip-private` (stop after frontier),
+`--private-root`, `--workspace`.
+
+Offline end-to-end with canned backends (exercises both feedback loops and the
+whole-view pass):
+
+```bash
+killchain "rank leads" --orch-url fake --frontier fake --detector-url fake --yes
+```
+
+Then run the result with both halves together:
+
+```bash
+cd <workspace>/<run>/public && HARNESS_MODE=real PYTHONPATH=~/killchain-private/<run> python -m app.<entry>
+```
+
+## Config
+
+Edit `~/.config/killchain/config.toml` (or pass `-c FILE`). `[orchestrator]` is
+any OpenAI-compatible chat endpoint; default
+is refuseless with the key read from `$REFUSELESS_API_KEY` or from
+`~/.hermes/.env` at runtime (never stored in the repo). `[frontier]` picks
+`claude` or `codex` and their flags (overridable per run by
+`routing.pick_frontier`). `[risk]` holds the Jev endpoint and model and needs
+`OPENROUTER_API_KEY`; dimensions and thresholds are in routing.py. `[paths]`
+sets the workspace, the private root and an optional denylist location.
+
+## Contract shape
+
+Each interface is one Python function in `contracts/<module>.py`, generated
+from the contract and never edited by either side. In stub mode it answers from
+`_fixtures.json` (exact input match, else first fixture). In real mode it
+delegates to `private_impl.<module>.<function>`.
+
+Two fixture sets per interface. **Public fixtures** are decoys: right shape,
+wrong values, never computed with the real logic, because a few correct
+input/output points would let the frontier vendor fit the rule. They drive stub
+mode. **Private fixtures** are computed with the real logic, live only in the
+private run dir (`private_fixtures.json`), and drive `tests/test_contracts.py`
+in real mode via `HARNESS_FIXTURES`. Passing there is the integration proof.
+The harness rejects a public fixture that equals a private one.
+
+## Limits
+
+Jev predicts refusal; it does not measure it. Refusals are stochastic and
+version-dependent, and a model can still balk at something no dimension
+predicted. Two things mitigate that: the framing rules in `prompts/partition.md`
+(describe behaviour, not lineage) and `NOTES.md` from the frontier, which
+tells the private side the edge cases it expects. Re-run a partition when the
+frontier ships a new model.
+
+v1 limits: Python interfaces only; the orchestrator writes files by returning
+JSON (no tool use needed on its side); one contract round, no renegotiation
+mid-build.
+
+## Why this exists
+
+I keep handing the good model work it will not do. The build comes back with a
+polite paragraph about what it cannot help with and a function that returns a
+placeholder. So I drop to something weaker and looser, which writes the hard
+part badly and the easy part badly too, and now I am debugging two models
+instead of one.
+
+The thing I actually wanted was to hand the boring 90% to the model that is
+good at boring, and hand the part it flinches at to one that does not flinch.
+That is all this does. No jailbreak, no prompt poem, no arguing with anything.
+You know which half of your own project is the risky half. Say so once, and
+each model gets the half it is best suited to.
+
+Frame a task by what it does and Claude Code will build it. Frame it by what it
+resembles and you get disclaimers and made-up numbers. That difference is not a
+bug in the model. It is a difference in how you asked.
+
+I write about building with these things, and about the parts of the industry
+that deserve a harder look, over at
+**[youtube.com/@drjoshcsimmons](https://youtube.com/@drjoshcsimmons)**. Issues
+and war stories are welcome in the
+[repo](https://github.com/jcpsimmons/killchain).
+
+MIT licensed.
+
+- Dr. J

killchain-0.1.0/README.md

@@ -0,0 +1,244 @@
+# killchain: refusal-first split build
+
+An abliterated orchestrator model (refuseless by default, settings mirrored
+from `~/.hermes/config.yaml`) is the front door. It is the only model that
+sees the full prompt. It splits the job into a **public half** (built by a
+frontier coding agent: Claude Code or Codex, which may fan out to its own
+subagents) and a **private half** (implemented by the orchestrator itself),
+joined by a contract.
+
+The partition rule is **refusal risk, nothing else**. Claude and Codex are good
+and fast, but they hedge, caveat, simplify, or refuse when a task looks
+reverse-engineered, unlicensed, regulated, exploitative, or oversized. Those
+parts go to the uncensored model. The frontier gets the rest of the app and
+never learns how the interesting bits work, so it has no position to take.
+
+It is not a cost trick and not only a quality trick: a brief that says "match
+the behaviour of X" gets you `from memory` disclaimers and invented constants.
+A brief that says "given these fields return a float in [0, 1], monotonic in
+both" gets you working code.
+
+## Install
+
+Python 3.11+, no dependencies. Pick one:
+
+```bash
+uv tool install killchain          # installs the `killchain` command
+pipx install killchain             # same, if you use pipx
+pip install killchain              # into the current environment
+uvx killchain "your task"          # zero-install trial, no venv needed
+```
+
+From a checkout, before it is on an index:
+
+```bash
+uv tool install git+https://github.com/jcpsimmons/killchain
+# or, for development:
+uv venv && uv pip install -e ".[dev]"
+python harness.py --version
+```
+
+Then find out what is missing before you waste a run:
+
+```bash
+killchain --doctor
+```
+
+`doctor` checks your config, the `claude`/`codex` binary, both API keys, the
+private directory mode, the denylist, and does one live round-trip to each
+endpoint. It exits non-zero only if something fatal to a run is wrong.
+
+## First run
+
+Nothing is written into the directory you installed to. On first use killchain
+creates:
+
+| Path | What |
+| --- | --- |
+| `~/.config/killchain/config.toml` | your config, seeded from the shipped default |
+| `~/.config/killchain/denylist.txt` | literal terms and `re:` patterns the gate rejects |
+| `~/.local/share/killchain/workspace/` | public halves, one directory per run |
+| `~/killchain-private/` | mode 0700: raw prompt, contract, `private_impl/`, risk report |
+
+Override with `$XDG_CONFIG_HOME`, `$XDG_DATA_HOME`, `$KILLCHAIN_CONFIG`,
+`$KILLCHAIN_PRIVATE_ROOT`, or per run with `--private-root` / `--workspace`.
+
+## How it works
+
+```
+prompt ─► orchestrator ─► contract.json  (brief + interfaces + decoy fixtures + private fixtures + notes)
+                │
+                ├─ risk score (8 dimensions, per span)  ┐ on the PUBLIC VIEW, plus
+                ├─ whole-view pass (is the task itself scary?) ┘ flagged spans go back to orchestrator
+                ├─ regex gate + framing hints
+                │
+                ├─► public/   contracts/ stubs + tests/test_contracts.py  ─► frontier agent builds app + tests
+                │                                                            (HARNESS_MODE=stub: fixtures answer)
+                └─► private/  prompt, contract, private_impl/              ◄─ orchestrator implements to contract
+                                                                              (HARNESS_MODE=real: tests prove the fit)
+```
+
+## Where to edit the routing
+
+**[killchain/routing.py](https://github.com/jcpsimmons/killchain/blob/main/killchain/routing.py)** is the one file that decides what the frontier is
+allowed to see. Everything else is plumbing that imports from it:
+
+| In routing.py      | What it controls                                                      |
+|-------------------|-----------------------------------------------------------------------|
+| `DIMENSIONS`      | the refusal dimensions, and the argument for each. Their `question` text is what Jev is actually asked |
+| `SAFE`            | what a frontier agent builds without comment; the "false" criteria    |
+| `HARD_RULES`      | regexes that block a send outright, no model involved                 |
+| `FRAMING_HINTS`   | non-blocking warnings for clone/hedge/licence wording                 |
+| `THRESHOLDS`      | risk probability needed to pull a span, per dimension and span kind    |
+| `classify()`      | the final per-span decision; any dimension over its bar routes private |
+| `pick_frontier()` | which coding agent builds the public half, by content if you like      |
+| `split_prompt()`  | how the raw prompt is cut into spans for the risk map                  |
+
+The denylist (`~/.config/killchain/denylist.txt`) adds literal and regex rules
+without touching any code. It carries two things: secrets that must never
+leave, and terms that tip the frontier off (product names, licence names,
+codenames).
+
+The shipped dimensions are a starting taxonomy, not a law: attribution and
+clone framing, reverse engineering, offensive security, extraction and ToS,
+regulated domains, another vendor's model or SDK internals, hedge wording, and
+scope an agent will negotiate away. Add a dimension when you find a refusal
+that none of them predict.
+
+## Trust boundaries
+
+To the **orchestrator (refuseless)**: the full prompt, the contract, and the
+private implementation loop. This is the half that is supposed to know
+everything.
+
+To the **frontier agent**: only `contract.public.json`, the public brief,
+interface signatures and descriptions, and decoy fixtures. It is told the
+private functions are a black box it should not infer, reimplement, or ask
+about.
+
+To **OpenRouter/TypeSafe (Jev)**: the public view span by span, plus, when
+`probe_raw_prompt = true` (default), raw prompt spans. The denylist terms ride
+along in every criteria block either way. Turn scoring off entirely with
+`--no-risk` if OpenRouter is out of bounds.
+
+The raw prompt, `private_notes`, `private_plan`, and `private_impl/` live under
+`paths.private_root` (default `~/killchain-private/`), never the frontier's cwd or
+on its PYTHONPATH, and the frontier subprocess gets an environment scrubbed of
+anything pointing there. The frontier runs with permissions skipped, so treat
+that boundary as a convention, not a jail.
+
+## Layers of protection on the outbound view
+
+1. **Orchestrator partition** (semantic): told the rule is refusal risk, shown
+   the dimensions, told to rewrite the framing rather than only move content.
+2. **Regex gate** (deterministic): denylist literals and regexes plus built-in
+   secret patterns. Any hit blocks the send.
+3. **Risk scorer** (probabilistic): `typesafe/jev-1.14` via the OpenRouter
+   Decisions API, one `noul` question per dimension per span, criteria from
+   routing.py. Then a whole-view pass, because a refusal is triggered by the
+   shape of a task and every individual span can be innocent.
+4. **Human review**: the outbound view, the decoy fixtures, and the span
+   scores are printed and you confirm, unless `--yes`.
+
+Rejections from 2 and 3 are fed back to the orchestrator with the exact spans,
+so it re-partitions and re-frames.
+
+**Probes.** Before it partitions, the harness scores the raw prompt span by
+span and puts the resulting risk map in the partition prompt. The orchestrator
+can also reply `{"probes": ["exact text", ...]}` up to `max_probe_rounds`
+times to score any phrasing it is unsure about before committing.
+
+## Run
+
+```bash
+killchain "build X using our proprietary Y"
+```
+
+```bash
+killchain -f prompt.md --frontier codex --yes
+```
+
+Flags: `--frontier claude|codex|fake`, `--orch-url`, `--risk-url` (alias
+`--detector-url`), `--no-risk`/`--no-detector`, `--run-id`, `--skip-frontier`
+(public already built, redo private), `--skip-private` (stop after frontier),
+`--private-root`, `--workspace`.
+
+Offline end-to-end with canned backends (exercises both feedback loops and the
+whole-view pass):
+
+```bash
+killchain "rank leads" --orch-url fake --frontier fake --detector-url fake --yes
+```
+
+Then run the result with both halves together:
+
+```bash
+cd <workspace>/<run>/public && HARNESS_MODE=real PYTHONPATH=~/killchain-private/<run> python -m app.<entry>
+```
+
+## Config
+
+Edit `~/.config/killchain/config.toml` (or pass `-c FILE`). `[orchestrator]` is
+any OpenAI-compatible chat endpoint; default
+is refuseless with the key read from `$REFUSELESS_API_KEY` or from
+`~/.hermes/.env` at runtime (never stored in the repo). `[frontier]` picks
+`claude` or `codex` and their flags (overridable per run by
+`routing.pick_frontier`). `[risk]` holds the Jev endpoint and model and needs
+`OPENROUTER_API_KEY`; dimensions and thresholds are in routing.py. `[paths]`
+sets the workspace, the private root and an optional denylist location.
+
+## Contract shape
+
+Each interface is one Python function in `contracts/<module>.py`, generated
+from the contract and never edited by either side. In stub mode it answers from
+`_fixtures.json` (exact input match, else first fixture). In real mode it
+delegates to `private_impl.<module>.<function>`.
+
+Two fixture sets per interface. **Public fixtures** are decoys: right shape,
+wrong values, never computed with the real logic, because a few correct
+input/output points would let the frontier vendor fit the rule. They drive stub
+mode. **Private fixtures** are computed with the real logic, live only in the
+private run dir (`private_fixtures.json`), and drive `tests/test_contracts.py`
+in real mode via `HARNESS_FIXTURES`. Passing there is the integration proof.
+The harness rejects a public fixture that equals a private one.
+
+## Limits
+
+Jev predicts refusal; it does not measure it. Refusals are stochastic and
+version-dependent, and a model can still balk at something no dimension
+predicted. Two things mitigate that: the framing rules in `prompts/partition.md`
+(describe behaviour, not lineage) and `NOTES.md` from the frontier, which
+tells the private side the edge cases it expects. Re-run a partition when the
+frontier ships a new model.
+
+v1 limits: Python interfaces only; the orchestrator writes files by returning
+JSON (no tool use needed on its side); one contract round, no renegotiation
+mid-build.
+
+## Why this exists
+
+I keep handing the good model work it will not do. The build comes back with a
+polite paragraph about what it cannot help with and a function that returns a
+placeholder. So I drop to something weaker and looser, which writes the hard
+part badly and the easy part badly too, and now I am debugging two models
+instead of one.
+
+The thing I actually wanted was to hand the boring 90% to the model that is
+good at boring, and hand the part it flinches at to one that does not flinch.
+That is all this does. No jailbreak, no prompt poem, no arguing with anything.
+You know which half of your own project is the risky half. Say so once, and
+each model gets the half it is best suited to.
+
+Frame a task by what it does and Claude Code will build it. Frame it by what it
+resembles and you get disclaimers and made-up numbers. That difference is not a
+bug in the model. It is a difference in how you asked.
+
+I write about building with these things, and about the parts of the industry
+that deserve a harder look, over at
+**[youtube.com/@drjoshcsimmons](https://youtube.com/@drjoshcsimmons)**. Issues
+and war stories are welcome in the
+[repo](https://github.com/jcpsimmons/killchain).
+
+MIT licensed.
+
+- Dr. J

killchain-0.1.0/killchain/__init__.py

@@ -0,0 +1,10 @@
+"""killchain: split a build so a frontier agent never sees the risky half.
+
+The prompt is partitioned by *refusal risk*, not confidentiality. Anything a
+commercial coding agent would refuse, hedge, simplify, or guess at is routed to
+an abliterated orchestrator model, which then implements it locally. A frontier
+agent (Claude Code, Codex) builds the rest against stubs.
+"""
+
+__version__ = "0.1.0"
+__all__ = ["__version__"]

killchain-0.1.0/killchain/__main__.py

@@ -0,0 +1,5 @@
+"""Allow `python -m killchain`."""
+from killchain.harness import main
+
+if __name__ == "__main__":
+    main()

killchain-0.1.0/killchain/config.toml

@@ -0,0 +1,78 @@
+# killchain configuration. Paths may use ~.
+#
+# This file is the shipped default. On first run it is copied to
+# ~/.config/killchain/config.toml, which is what you should edit.
+
+[orchestrator]
+# The abliterated orchestrator model: the only model that sees the full prompt.
+# Any OpenAI-compatible chat endpoint. Default: refuseless, settings mirrored
+# from ~/.hermes/config.yaml. The key is read from $REFUSELESS_API_KEY, or
+# from env_file if that is unset. It is never written to disk by killchain.
+base_url = "https://api.refuseless.com/v1"
+model = "deepseek-v4.1-flash-abliterated"   # also: glm-5.3-abliterated, glm-5.3-flash-abliterated
+api_key_env = "REFUSELESS_API_KEY"
+env_file = "~/.hermes/.env"
+timeout = 900
+max_partition_tries = 4
+max_impl_tries = 4
+
+[frontier]
+backend = "claude"            # claude | codex | fake
+claude_model = ""             # blank = CLI default
+claude_extra_args = ["--dangerously-skip-permissions"]  # it runs confined to the public dir
+codex_model = ""
+codex_extra_args = ["--full-auto"]
+timeout = 3600
+
+[risk]
+# Jev (TypeSafe) via the OpenRouter Decisions API. Scores each span of the
+# candidate public view on every refusal dimension in routing.py. Everything
+# scored is sent to OpenRouter, so scoring happens on the public view and, if
+# score_raw_prompt is on, on spans of the raw prompt.
+enabled = true
+base_url = "https://openrouter.ai/api/alpha/decisions"
+model = "typesafe/jev-1.14"
+api_key_env = "OPENROUTER_API_KEY"
+# Dimensions, thresholds and the per-span decision live in routing.py.
+timeout = 60
+# Pre-score the RAW PROMPT span by span to build the risk map, and let the
+# orchestrator ask for extra probes on subsets. Refusal risk is carried by the
+# original phrasing, so this is the useful mode. All of it goes to
+# OpenRouter/TypeSafe; turn off to score only the assembled public view.
+probe_raw_prompt = true
+max_probe_rounds = 3
+
+[routing]
+# Shipped defaults live in killchain/routing.py; anything set here wins. Read
+# routing.py first - these change what the frontier model is allowed to build.
+# Nothing here is required; the section exists so retuning needs no code edit.
+
+# Drop a dimension entirely (it stops being asked and stops routing spans).
+# disabled_dimensions = ["hedge_framing"]
+
+# Per-dimension bar, 0..1: the risk probability needed to pull a span out of
+# the public view. Lower = more paranoid (more goes private).
+# Valid keys: attribution, reverse_engineering, offensive_security, extraction,
+#             regulated, proprietary_model, hedge_framing, scale_or_scope,
+#             overall, default
+# [routing.thresholds]
+# hedge_framing = 0.75
+# attribution = 0.40
+
+# Adjustment per span kind, added to the bar. Fixtures are bare JSON numbers
+# and score near 0.5 whatever they contain, so they get a higher bar.
+# [routing.kind_slack]
+# fixture = 0.15
+
+# Extra regexes that block an outbound view outright, no model involved.
+# Prefix with re: for a regex, otherwise it is a literal. Prefer the denylist
+# file for terms; use this for patterns that should ship with your team's config.
+# hard_rules = ["TICKER-[A-Z]{4}", { pattern = "re:\\bsk-[a-z0-9]{20,}", why = "looks like an API key" }]
+
+[paths]
+# Defaults are user directories so an installed command never writes into
+# site-packages. Override with env vars (KILLCHAIN_PRIVATE_ROOT) or per run
+# with --workspace / --private-root. Relative paths resolve against the cwd.
+workspace = ""                    # blank = <project>/.killchain/workspace, else ~/.local/share/killchain/workspace
+private_root = "~/killchain-private"   # mode 0700: prompts, contracts, private impls
+denylist = ""                     # blank = ~/.config/killchain/denylist.txt