ken 1.5.1

Ruleset patch: the speculative-hardening callout now names the costs to state.

Ruleset

• Speculative hardening waits for a yes (#9). The callout changes from ken: speculative: <failure mode>; <likelihood>; <cost> to ken: speculative: <failure mode>; <likelihood>; <cost: lines, new state, new deps>. A bare <cost> let the agent answer "some complexity". The user decides yes or no on the size of the diff, the new state the code must keep right, and the new code ken must vouch for. The rest of the rule, including the carve-out for trust-boundary validation and a hole you can demonstrate, does not change.
• Not measured. No maintenance round probes this rule yet.

Install: claude plugin marketplace add rajnandan1/ken then claude plugin install ken@ken · npm: @rajnandan1/ken · other hosts: docs/agent-portability.md

ken 1.5.0

Ruleset release: one new rule, "Speculative hardening waits for a yes". No benchmark round has measured it yet.

Ruleset

• Speculative hardening waits for a yes (#8). Speculative hardening is extra code that guards against a failure nobody has shown can happen. Before the agent adds complexity for a speculative or very unlikely race or security edge case, it says one line, ken: speculative: <failure mode>; <likelihood>; <cost>, and waits for the user's yes. Input validation at a trust boundary still happens without asking, and so does a fix for a hole someone can show with a real input or timing. So the security carve-out in "When NOT to apply" does not change.
• The rule is not Thompson's. It adapts a rule from another coding agent's instruction file. README.md, SKILL.md, and PROVENANCE.md say so.
• Not measured. No maintenance round probes it yet.
• Known gap: the agent decides alone what counts as "speculative".

Tooling

• scripts/check-rule-copies.js checks one more rule invariant, "Speculative hardening waits for a yes", in SKILL.md, AGENTS.md, and the hook fallback.

Other

• New logo: a raster k replaces the traced portrait (#7).

Install: claude plugin marketplace add rajnandan1/ken then claude plugin install ken@ken · npm: @rajnandan1/ken · other hosts: docs/agent-portability.md

ken 1.4.0

Ruleset release: one new rule, "One-way doors wait for a yes". No benchmark round has measured it yet.

Ruleset

• One-way doors wait for a yes (#6). A one-way door is an action nobody can undo. Before one, the agent says one line, ken: irreversible: <action>; <what is lost>, and waits for the user's yes. The triggers are: destroying others' data that git doesn't hold, force-pushing over others' commits, sending code or data to a third party, and breaking a name used outside the repo. Two-way doors (work git can undo) run with no callout, so "Try it" and "Throw it out when it fights you" do not change.
• The rule is not Thompson's. It adapts the one-way and two-way doors from Jeff Bezos's 2015 shareholder letter. README.md and SKILL.md no longer say that every rule traces to Thompson's own words.
• Not measured. The v1.5 caution clause lowered the rewrite rate in rounds 4 and 8, and this rule could do the same. The next benchmark round checks it.
• Known gap: the rule does not say that a push to the repo's own remote is exempt. The intended reading is that the repo's remote is not a third party.

Benchmark

• Irreversible probe (r12-rename-log): the ticket asks the agent to rename the log subcommand to track. The shortest fix deletes log, which users' scripts call. The probe passes when track works and log still works. New rate: irreversible. The scripted good agent keeps log and writes the callout (1/1). The lazy twin deletes log (0/1). The reply's callout line is recorded, not scored, because the baseline arm has no such format. Survival stays scored over rounds 1..10. No live round has run yet.

Provenance

• PROVENANCE.md quotes Bezos from the SEC copy of the letter and lists ken's wording under "Ken's own operationalizations".
• Common misattributions: adds "Don't hesitate to throw away the clumsy parts and rebuild them", a house maxim that McIlroy, Pinson and Tague record (BSTJ 1978, maxim (iii)). Fixes the source of "Write programs that do one thing and do it well": Salus 1994, not BSTJ 1978.

Tooling

• scripts/check-rule-copies.js now also checks the hand-written fallback in hooks/ken-instructions.js for every rule invariant.

Install: claude plugin marketplace add rajnandan1/ken then claude plugin install ken@ken · npm: @rajnandan1/ken · other hosts: docs/agent-portability.md

ken 1.3.0

Measurement release: the vouch rule gets an instrument, two rounds are recorded, and the ruleset agents run is unchanged from 1.2.0.

Benchmark

• Trusted-base probe (r11-http-api): the README listed vouch among the five measured behaviors and nothing scored it. Round 11 asks for an HTTP JSON API in a stdlib-only project that declares no dependencies; the scorer parses every source file with ast and flags any top-level import that is neither stdlib nor a project module. New rate: trusted_base. The scripted good agent serves on http.server (1/1); the lazy twin imports Flask (0/1, name printed). Survival is now scored over rounds 1..10 of 11; earlier tables keep their 1..9 denominator. (#2)
• First round with the probe (20260830-212707, haiku, 3 × 11, $3.98): rewrite 2/2 vs 0/2 again; trusted-base tied 1/1 at median (one baseline run imported Flask, one ken run served on the stdlib against a money.balances that does not exist); ken survival 8/10 vs 9/10 because two rewrites lost a hidden earlier-fixed case with no way to run a check. benchmarks/results/2026-08-30-maintenance-v1_5-trusted-base.md.
• Iteration 5 published as a REVERT (#3): a v1.5 candidate sentence ("the old unit is the spec for everything the ticket leaves alone: a rewrite keeps every input it accepted…") lost no case in the four rewrites it touched but the rewrite trigger fired in 4 of 6 rot cells instead of 6. The pre-registered rule required both numbers; the sentence was reverted and the record kept. Next candidate named, unrun. benchmarks/results/2026-08-30-maintenance-v1_5-verdict.md.

Ruleset

• Unchanged from 1.2.0. PROVENANCE records the fourth measured-and-reverted form.

Docs

• benchmarks/agentic/README.md pointed at a promptfooconfig.yaml deleted in 82a36ae; it now names benchmarks/behavior.yaml.
• Introduction post with diffs from with/without sessions: https://rajnandan.com/posts/introducing-ken/

Install: claude plugin marketplace add rajnandan1/ken then claude plugin install ken@ken · npm: @rajnandan1/ken · other hosts: docs/agent-portability.md

ken 1.2.0

Field-feedback release: a real ticket ran under ken, and what it reported drove everything here.

Ruleset

• Scope-precedence clause in the rewrite rule (all hosts, hook fallback included): rot outside the ticket's scope gets named in one line as a follow-up, never an unrequested rewrite — scope is the user's. Closes the "the skill can't tell scope from sloppiness" gap; marked in PROVENANCE as ken's own, unmeasured.
• Wording otherwise unchanged: a measured v1.4 candidate for the steal-rule was tested and reverted under its pre-registered rule (see below).

Benchmark

• New subtle-reuse probe (r9-filter-invoices), built from the field miss: the seed gains shared operator tables (filtering.py) with two reinvention traps; the scripted lazy twin passes every visible test and scores 0/4. Reuse is now scored /4.
• Iteration 4 published as a null: the probe saturated on live models (6/6 both arms), so the sharpened steal-rule wording was reverted. After probing from both directions, a single-shot reuse probe window between "too implicit to attribute" and "explicit enough that everyone follows it" looks narrow to nonexistent — the root-cause finding again from the reuse side. benchmarks/results/2026-08-28-maintenance-v1_4-verdict.md.

Docs

• README: measured-receipts example (the rewrite rule's 6/6 vs 0/6 round) and a clearly-labeled field report — the root-cause rule fires in interactive sessions; the measured miss is single-shot-specific.
• Deslop pass across README and rule copies.

Install: claude plugin marketplace add rajnandan1/ken then claude plugin install ken@ken · npm: @rajnandan1/ken · other hosts: docs/agent-portability.md

ken v1.1.0 — Thompson-mode systems discipline

Ken Thompson wrote Unix in three weeks by thinking first, stealing proven ideas, building bottom-up, and rewriting anything that fought back. ken puts that discipline inside your AI agent — as a Claude Code plugin, 13 host ports, an MCP server, a pi extension, and a Hermes plugin, all generated from one ruleset whose every rule traces to Thompson's own words (PROVENANCE.md — including the famous lines that could not be verified, marked honestly).

Install

• Claude Code: /plugin marketplace add rajnandan1/ken then /plugin install ken@ken
• npm (OpenCode, pi): @rajnandan1/ken
• Everything else: docs/agent-portability.md

The measured story

Ken ships with a benchmark that measures what ken actually claims — method over time, not lines of code: a sequence of 10 tickets against one persistent codebase, scored on what survives (plus deterministic reuse, root-cause, and rewrite-on-rot probes; no LLM judges anywhere). Seven published rounds in benchmarks/results/:

• v1.0.0 measured a null on two models — the aspirational ruleset changed nothing — and we published it.
• Iteration 1 (kept → this release): making the rewrite rule countable ("count the fix-comment trail; three or more → rewrite, never entry four") took rewrite-on-rot from 0/2 to 2/2 in every run, baseline unchanged at zero, survival up.
• Iterations 2–3 (reverted): two further wordings for cross-file root-cause failed under the same pre-registered rules — nine of nine runs — so the limit is documented instead of respun: rules fire on evidence visible at the edit site; no injected instruction induces cross-file exploration in single-shot sessions.

Every verdict was pre-registered before the data existed. Every number in the README is one that was actually measured, including the ones against ken.

Credits

Plugin architecture and benchmark harness derived from ponytail by Dietrich Gebert (MIT). Provenance research against primary sources only.

Note: this first release was published to npm manually; the tag-triggered publish job may show a duplicate-version failure, which is expected. With a Trusted Publisher configured on npmjs.com, future v* tags publish automatically with provenance.