A black box for AI coding agents

Install (Claude Code)

claude plugin marketplace add yuta9999zn/kiai-plugin
claude plugin install kiai@kiai

Hooks are active in every session from then on. A .kiai/ folder appears in a repository the first time a hook fires there. KIAI itself makes no network calls: no account, no server, the flight record stays in your repository. (Your coding agent still talks to its model provider as before.)

What you get

• Flight record. Every session start, tool call, tool result and stop is appended to .kiai/flight/ inside your repo, hash-chained: one changed byte, one deleted or reordered record in the middle, and kiai verify fails and names the record. On the machine that wrote the chain, a truncated tail is caught too.
• References, not contents. A file write is stored as path + sha256. Shell commands are stored with common key, token and password shapes redacted. No file contents, no reasoning.
• Never blocks the agent. If recording fails, the failure is logged and the agent keeps working.
• Evidence report. kiai report turns a session or a unit of work into Markdown: sessions, tools, files with hashes, shell commands, git state.
• Acceptance packet. kiai accept builds the document you actually sign: every file the agent wrote and whether the file on disk still matches it, the test commands that ran, your acceptance criteria, and the decision — sealed back into the flight record with the packet's hash, so the packet and the chain vouch for each other. English, Vietnamese or both.
• Humans decide. accept --decision is refused from inside an agent session. This is an environment check, not a cryptographic signature; that is planned.

What a packet says

Verbatim lines from a real bilingual packet (--lang both) produced on 2026-09-05 against a live Claude Code 2.1.261 session. Sections between the lines are omitted; nothing is edited. The writer id is the recording machine's hostname slug.

# Hồ sơ nghiệm thu / Acceptance packet — UOW-120

- **Trạng thái / Status:** **CHẤP NHẬN / APPROVED** — Người quyết định / Decided by: **tech lead (probe)** · Lúc / At: 2026-09-05T23:24:26.266Z · Ghi qua / Recorded via: người, ngoài phiên agent / human, outside any agent session
- **Chuỗi flight record / Flight record chain:** ✅ nguyên vẹn / intact — 7 bản ghi / records; đầu chuỗi / heads: `hideki-f5284e` 7 → `39a3fa40fd5cffcd…`

## Tiêu chí nghiệm thu / Acceptance criteria

> - [ ] hello.txt exists and contains the word kiai

| `hello.txt` | write | `920bc4834ade2e83…` | ✅ khớp / matches |

Hash: bcb15d087aefeb7ce12ae62ddbd2f845420b5ec845fbcba2f5895fc9c985e0d2

The full file is committed in the KIAI repository as probe-UOW-120b-acceptance-approve.md. kiai accept --check recomputes that footer and, inside the repository, prints the decision record that sealed the file, or NOT SEALED.

What it does not do yet

• Cursor and Codex hooks are not verified against real clients. The record command accepts any hook JSON, but only Claude Code has been probed.
• No model name or token cost: Claude Code does not expose them to hooks.
• An unanchored hash chain proves consistency, not completeness. Commit the .jsonl files and paste the head into the PR; anchoring the head into git is planned.
• A test command shows "completed", never "passed". Redaction is regex based and cannot be complete.

How it was built

Both releases so far went through an independent adversarial review before they shipped, and the reports are in the repository. The review of v0.1 found a truncated chain tail that verify did not catch, secrets slipping past redaction and two clones breaking one chain through git. The review of v0.2 found absolute paths that made packets useless on a clone, a lock race that could leave an approved packet without its record, and an agent able to "approve" its own work. All of it is fixed, with tests (42, offline, Node 18+), and documented in the repository.