feat(pitot): truthful, reproducible Kimi controlled action + README - #136
Merged
Conversation
Add a --template flag to `pitot init` (shell-policy, release-approval, blank-controller, blank-consumer). The shell-policy template registers its controller under the "shell" action kind so it actually governs Kimi's PreToolUse/Bash boundary, and denies only the PITOT_DENY_ME canary (a sample tripwire, not a shell-security control). Fix the next-step guidance to launch the agent (pitot dev --host HOST -- AGENT), not the controller. Extend `pitot doctor` with --host to check a host's binary, config, and hook wiring without editing host config.
… pitot) The bare "pitot" name is taken on PyPI; publish the distribution as operatorstack-pitot while keeping the importable package "pitot".
…n Kimi smoke Test A (deterministic, no model): build the generated shell-policy controller offline and drive canonical Kimi allow/deny payloads through the runtime, asserting exit 0/2, canary side effects, and that the deny reason reaches the caller. Add init-contract, dev e2e (decision timeline, PITOT_RUNTIME, argv, unique runtime paths, --exec vs -- semantics), multi-language build, and doctor --host tests. Test B: env-gated real-Kimi smoke that emits a bounded JSON evidence artifact. Add Kimi allow/deny conformance fixtures.
Lead with "Keep your coding agent. Add the behavior it is missing." and a See-it-work-with-Kimi walkthrough grounded in the allow/deny canary the tests exercise. Replace the false "pitot dev configures the host for you" claim with truthful one-time hook wiring plus `pitot doctor --host HOST`, drop the use-case gallery, and add a supported-hosts matrix keyed to what is verified in this repo.
Pitot coding-agent E2EIntelligence Flow is the verification source; Pitot's public README carries the latest
Runtime capabilities
Source commit: |
…e note The generated Rust shell-policy controller uses serde_json::from_value but the scaffolded Cargo.toml only declared pitot, so `cargo check` failed in CI (where cargo is present; it was skipped locally). Declare serde_json = "1" to match the SDK. Add the required append-only Pitot release note and re-sync the public projection.
TestKimiShellPolicyAllowAndDeny drives the canary via `sh -c`/`printf` with Unix path semantics; Git Bash on the Windows runner mangles the backslashed temp paths, so the allow canary never lands at the expected path. Skip on windows like the other POSIX shell-based tests; the control path is covered on the Linux and macOS runners.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Proves one truthful, locally reproducible Kimi control path and rewrites the Pitot README around that tested outcome.
Public promise: "Keep your coding agent. Add the behavior it is missing."
The tested path
clone → start one shell Controller → launch Kimi → allow one shell action → deny one shell action → prove the denied command never executed → prove the denial reason reached Kimi.
Changes
feat—shell-policyinit template,pitot doctor --host HOSThook diagnostics, and truthful agent-launch guidance (pitot dev --host kimi -- kimi -p ...).test— Two layers:PITOT_RUNTIME, argv, unique runtime paths,--execvs--), multi-language build, anddoctor --hosttests.PITOT_KIMI_SMOKE) real-Kimi smoke that emits a bounded JSON evidence artifact (identities/hashes/decisions only — never raw commands).docs— README rewrite: See-it-work-with-Kimi walkthrough grounded in the allow/deny canary, truthful one-time hook wiring, supported-hosts matrix keyed to what's verified in this repo. Removes the false "pitot devconfigures the host for you" claim.chore— Python SDK published asoperatorstack-pitot(import stayspitot); public projection (UPSTREAM.json) synced.Verification
gofmtclean,go vet ./...clean,go test ./cmd/pitotok,go test -race ./cmd/pitotok.build_pitot.py --checkPASS (114 files).Not in scope
No global Kimi host config auto-edit; no browser UI; no additional SDK languages; no hosted/cloud runtime; no LLM policy generation; no marketplace; no general shell-security claims. Test B is unverifiable in CI (needs an authenticated
kimi), by design.