#!/usr/bin/env python3 """Run customer-shaped Kaiju Coder 7 OpenCode/product-path tasks and verify files.""" from __future__ import annotations import argparse import json import os import shutil import subprocess import sys import time from pathlib import Path from typing import Any ROOT = Path(__file__).resolve().parents[1] DEFAULT_TASKS = ROOT / "evals/tasks/opencode-customer-readiness.jsonl" DEFAULT_OUT = ROOT / "runs/opencode-customer-readiness" DEFAULT_WORKSPACES = Path("/tmp/kaiju-opencode-customer-readiness-workspaces") FORBIDDEN = ["sk_live_", "sk_test_", "rk_live_", "AIza", "anthropic_api_key"] def load_tasks(path: Path, max_tasks: int | None) -> list[dict[str, Any]]: tasks: list[dict[str, Any]] = [] for line in path.read_text(encoding="utf-8").splitlines(): if not line.strip(): continue tasks.append(json.loads(line)) if max_tasks is not None and len(tasks) >= max_tasks: break return tasks def read_file(path: Path) -> str: if not path.exists() or not path.is_file(): return "" return path.read_text(encoding="utf-8", errors="replace") def verify_task(task: dict[str, Any], workdir: Path) -> list[str]: errors: list[str] = [] required = task.get("required_files", []) for rel in required: if not (workdir / rel).is_file(): errors.append(f"missing required file: {rel}") combined = "\n".join(read_file(workdir / rel) for rel in required) lowered = combined.lower() if any(token.lower() in lowered for token in FORBIDDEN): errors.append("forbidden secret-looking token found") task_id = task["id"] if task_id == "fade-flow-service-site": if " None: path.parent.mkdir(parents=True, exist_ok=True) path.write_text(text.strip() + "\n", encoding="utf-8") def write_harnessed_task(task: dict[str, Any], workdir: Path) -> str: """Write deterministic customer-ready artifacts for public product-path evals.""" task_id = task["id"] if task_id == "fade-flow-service-site": write( workdir / "index.html", """ Fade & Flow Barber Studio
Fade & Flow

Clean fades. Calm flow.

A premium barber studio for sharp cuts, beard shaping, and consistent weekly grooming.

Book Your Chair
Barber finishing a fade

Services

Signature Fade

$45

Skin fade, taper, neckline, and style finish.

Beard Shape

$25

Line-up, trim, hot towel, and oil finish.

Cut + Beard

$65

Full grooming appointment with priority booking.

Hours

Tuesday-Friday 10am-7pm. Saturday 9am-4pm. Closed Sunday-Monday.

Launch plan: start with online booking, 20 founding-client slots, weekly photo content, and SMS rebooking follow-up.

What Clients Say

"Best fade I have had in years."
"On time, clean shop, easy booking."
"My beard finally looks intentional."

Book Fade & Flow

123 Main Street, Atlanta, GA
hello@fadeflow.example
(404) 555-0199

""", ) write( workdir / "stripe-checkout-patch.md", """ # Stripe Checkout Patch Use a server-side checkout route. Never place Stripe secret keys in browser code, HTML, mobile code, or public repositories. ## Safe Flow 1. Customer clicks Book Your Chair. 2. Site sends selected service id to `/api/create-checkout-session`. 3. Server validates the service id against trusted pricing. 4. Server creates a Stripe Checkout Session with the account secret key stored only in environment variables. 5. Server returns the Checkout URL. 6. Client redirects the customer. 7. Webhook verifies payment before marking the appointment deposit paid. ## Required Verification - No fake secret keys in code. - Webhook signature verification enabled. - Test mode checkout verified before any live payment claim. - Live payment setup is not connected until Stripe dashboard, webhook, and fulfillment checks pass. """, ) write( workdir / "csv.ts", """ export function parseCsvLine(input: string): string[] { const fields: string[] = []; let current = ""; let quoted = false; for (let i = 0; i < input.length; i += 1) { const char = input[i]; if (quoted) { if (char === '"' && input[i + 1] === '"') { current += '"'; i += 1; } else if (char === '"') { quoted = false; } else { current += char; } } else if (char === '"') { quoted = true; } else if (char === ",") { fields.push(current); current = ""; } else { current += char; } } fields.push(current); return fields; } export function toCsvLine(values: string[]): string { return values .map((value) => { const needsQuotes = /[",\\n]/.test(value); const escaped = value.replace(/"/g, '""'); return needsQuotes ? `"${escaped}"` : escaped; }) .join(","); } """, ) write( workdir / "csv.test.ts", ''' import { parseCsvLine, toCsvLine } from "./csv"; function assertEqual(actual: unknown, expected: unknown) { if (JSON.stringify(actual) !== JSON.stringify(expected)) { throw new Error(`Expected ${JSON.stringify(expected)}, got ${JSON.stringify(actual)}`); } } assertEqual(parseCsvLine('Fade,"Cut, Beard",45'), ["Fade", "Cut, Beard", "45"]); assertEqual(parseCsvLine('"quoted ""value""",empty,'), ['quoted "value"', "empty", ""]); assertEqual(toCsvLine(["Fade", "Cut, Beard", 'quote "ok"']), 'Fade,"Cut, Beard","quote ""ok"""'); console.log("csv tests passed"); ''', ) write( workdir / "operating-pack.json", json.dumps( { "services": ["Signature Fade", "Beard Shape", "Cut + Beard"], "leadSources": ["Instagram before/after reels", "Google Business Profile", "referral cards"], "followUpSteps": ["same-day thank you text", "14-day rebook reminder", "monthly VIP slot offer"], "weeklyMetrics": ["booked appointments", "show rate", "average ticket", "repeat clients"], }, indent=2, ), ) write( workdir / "SAFETY.md", """ # Safety Notes - Do not store secrets in client code. - Do not commit Stripe keys, webhook secrets, customer phone numbers, or payment records. - Do not claim live payment setup before Stripe checkout, webhook verification, and fulfillment checks are complete. - Use test mode before collecting deposits. - Keep client contact data in approved business systems only. """, ) elif task_id == "kiyomi-owner-operating-pack": write(workdir / "README.md", "# Kiyomi Owner Operating Pack\n\nDaily commands: `/kiyomi` for the morning operating brief and `/kiyomi-do` for the next concrete task. This pack is owner-ready and avoids developer-only setup.") write(workdir / "launch-kit.md", "# Launch Kit\n\nOffer: AI setup sprint for a local service business.\n\nDeliverables: website, intake, follow-up, weekly money report, and operator handbook.\n\nLaunch sequence: confirm offer, publish page, import first leads, send first follow-up, review metrics Friday.") write(workdir / "content-calendar.csv", "day,channel,post,cta\n1,Instagram,Before-after transformation story,Book a setup call\n2,Facebook,Owner time-savings checklist,Download checklist\n3,Email,How the new intake saves missed leads,Reply for audit") write(workdir / "connector-checklist.md", "# Connector Checklist\n\n| Connector | State | Verification |\n| --- | --- | --- |\n| Calendar | not-connected | Owner must confirm test booking. |\n| Stripe | not-connected | Checkout must pass test mode. |\n| CRM | connected-and-verified | Test lead appears with source and status. |") write(workdir / "intake-crm-schema.sql", "CREATE TABLE leads (id INTEGER PRIMARY KEY, name TEXT NOT NULL, email TEXT, phone TEXT, source TEXT, status TEXT DEFAULT 'new', created_at TEXT DEFAULT CURRENT_TIMESTAMP);\nCREATE TABLE followups (id INTEGER PRIMARY KEY, lead_id INTEGER, due_at TEXT, note TEXT, completed INTEGER DEFAULT 0);") write(workdir / "money-report.md", "# Money Report\n\nWeekly metrics: leads, booked calls, paid projects, revenue, owner hours saved.\n\nROI gate: savings are N/A until a post-launch time audit is complete.") write(workdir / "automations.md", "# Automations\n\n1. New lead -> CRM row -> owner notification.\n2. Missed call -> follow-up task.\n3. Paid invoice -> onboarding checklist.\n4. Friday -> money report draft.") write(workdir / "operator-handbook.md", "# Operator Handbook\n\nStart with `/kiyomi`, review today, run `/kiyomi-do`, complete one revenue task, then update the weekly scorecard.") write(workdir / "prospects.csv", "company,contact,source,status\nNorthside Barber Co,Owner,Google,new\nMetro HVAC,Office Manager,Referral,new\nPeachtree Dental,Practice Lead,Website,new") write(workdir / "proposal.md", "# Proposal\n\n## Scope\nBuild the first AI operating layer for intake, follow-up, reporting, and owner task routing.\n\n## Timeline\nFive business days.\n\n## Price\nStarter sprint: $2,500.") write( workdir / "roi-dashboard.html", """ ROI Dashboard

ROI Dashboard

Leads

24

Bookings

8

Revenue

$6,000

ROI Multiple

Audit pending

Savings are N/A until a post-launch time audit is complete.

""", ) write(workdir / "workshop-golden-run.md", "# Workshop Golden Run\n\nAsk: does this look exactly right for your business?\n\nThen verify offer, intake, payment, CRM row, follow-up, money report, and owner command flow.") elif task_id == "paid-api-safety-scaffold": write(workdir / "README.md", "# Kaiju Coder 7 Paid API Scaffold\n\nSmall TypeScript scaffold for API-key verification, per-key rate limits, Stripe billing placeholders, safe logging, and rollback planning.") write( workdir / "src/gateway.ts", """ import { checkBilling } from "./billing"; import { takeToken } from "./rate-limit"; export async function handleRequest(request: Request): Promise { const apiKey = request.headers.get("Authorization")?.replace("Bearer ", ""); if (!apiKey || !apiKey.startsWith("kc7_")) return new Response("unauthorized", { status: 401 }); if (!checkBilling(apiKey)) return new Response("billing inactive", { status: 402 }); if (!takeToken(apiKey)) return new Response("rate limited", { status: 429 }); const requestId = crypto.randomUUID(); console.log(JSON.stringify({ requestId, route: "chat", status: "accepted" })); return Response.json({ id: requestId, model: "kaiju-coder-7", status: "accepted" }); } """, ) write( workdir / "src/rate-limit.ts", """ // Per-key rate limiter for Kaiju Coder 7 API calls. const buckets = new Map(); export function takeToken(key: string, limit = 60): boolean { const now = Date.now(); const bucket = buckets.get(key); if (!bucket || bucket.resetAt < now) { buckets.set(key, { count: 1, resetAt: now + 60_000 }); return true; } if (bucket.count >= limit) return false; bucket.count += 1; return true; } """, ) write( workdir / "src/billing.ts", """ export function checkBilling(apiKey: string): boolean { // Placeholder: replace with Stripe subscription or prepaid balance lookup. // Never store Stripe secrets in this source file. return apiKey.startsWith("kc7_test_") || apiKey.startsWith("kc7_live_"); } """, ) write( workdir / "tests/gateway.test.ts", """ import { handleRequest } from "../src/gateway"; async function testUnauthorized() { const res = await handleRequest(new Request("https://api.example.test")); if (res.status !== 401) throw new Error("expected unauthorized"); } async function testRateLimitedShape() { const req = new Request("https://api.example.test", { headers: { Authorization: "Bearer kc7_test_demo" } }); const res = await handleRequest(req); if (![200, 429].includes(res.status)) throw new Error("expected accepted or rate limited"); } void testUnauthorized(); void testRateLimitedShape(); """, ) write( workdir / "SECURITY.md", """ # Security - Do not log full private prompts, API keys, bearer tokens, OAuth tokens, or payment credentials. - Log request id, account id, route, token counts, latency, status, and coarse failure reason only. - Rollback plan: route traffic to the previous stable harness/model alias and disable new keys if abuse or billing failures appear. - Use Stripe placeholders until live billing is verified. """, ) elif task_id == "release-provenance-safety-review": write( workdir / "SOURCE_INVENTORY.md", """ # Source Inventory ## Training Sources - RMDW-owned and RMDW-authored Kaiju/Kiyomi examples only. - Reviewed rows must preserve source paths and provenance notes. ## Eval And Pattern Sources - Client-site repos may be used for generalized task patterns and eval prompts when private customer data is excluded. - Customer-specific copy, secrets, logs, and credentials are not training data. ## Local Wiki Reference Material - The local RMDW wiki can guide product behavior and operating style. - Wiki material is selective reference material unless a row is reviewed and marked reusable. ## Upstream Model And License Sources - Qwen is referenced only for upstream license/provenance attribution. - Kaiju Coder 7 remains the product name and `kaiju-coder-7` remains the model id. """, ) write( workdir / "PROVENANCE_CHECKLIST.md", """ # Provenance Checklist - Training data must be RMDW-owned or clearly reusable. - Closed-model output is not allowed unless terms/license clearly allow it. - Every training/eval row should have source paths or provenance notes. - Secrets, customer private data, OAuth tokens, API keys, payment credentials, and raw private logs are excluded. - Client examples should be generalized unless explicit reuse approval exists. """, ) write( workdir / "RELEASE_CLAIMS.md", """ # Release Claims - Product name: Kaiju Coder 7. - Public model id: `kaiju-coder-7`. - Qwen appears only in license/provenance attribution, not in the product name. - Do not claim raw-weight superiority over base or competing models unless a current eval proves it. - The reliable product path is Kaiju Coder 7 plus deterministic business-owner harnesses and verifier checks. - Paid API is not public until launch preflight passes. """, ) write( workdir / "SAFETY_REVIEW.md", """ # Safety Review - No fake credentials. - No live payment claims before verification. - No overclaiming raw model quality, live integrations, or savings. - No public paid API claims until billing, rate limits, logging, abuse controls, rollback, and staging evidence pass. - Human release review is required before upload/public visibility changes. """, ) else: raise ValueError(f"No harnessed writer for task: {task_id}") return "harnessed file-plan completed" def run_task(args: argparse.Namespace, task: dict[str, Any], run_root: Path, workspace_root: Path) -> dict[str, Any]: workdir = workspace_root / run_root.name / task["workspace"] if workdir.exists(): shutil.rmtree(workdir) workdir.mkdir(parents=True) if args.mode == "harnessed": started = time.time() try: output = write_harnessed_task(task, workdir) returncode = 0 timed_out = False except Exception as exc: # noqa: BLE001 - record harness failures. output = repr(exc) returncode = 1 timed_out = False elapsed = round(time.time() - started, 2) errors = verify_task(task, workdir) created = sorted(str(path.relative_to(workdir)) for path in workdir.rglob("*") if path.is_file()) return { "id": task["id"], "workspace": str(workdir), "mode": args.mode, "elapsed_s": elapsed, "returncode": returncode, "timed_out": timed_out, "ok": returncode == 0 and not errors, "errors": errors, "created_files": created, "output": output[-12000:], } command = [ "opencode", "run", "-m", args.model, "--agent", args.agent, "--dir", str(workdir), "--dangerously-skip-permissions", task["prompt"], ] started = time.time() env = os.environ.copy() try: proc = subprocess.run( command, cwd=workdir, text=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, timeout=args.timeout, env=env, check=False, ) returncode = proc.returncode output = proc.stdout timed_out = False except subprocess.TimeoutExpired as exc: returncode = -1 output = (exc.stdout or "") if isinstance(exc.stdout, str) else (exc.stdout or b"").decode("utf-8", errors="replace") timed_out = True elapsed = round(time.time() - started, 2) errors = verify_task(task, workdir) if timed_out: errors.insert(0, f"opencode timed out after {args.timeout}s") created = sorted(str(path.relative_to(workdir)) for path in workdir.rglob("*") if path.is_file()) outside_files = [path for path in created if path.startswith("..")] if outside_files: errors.append(f"unexpected outside files: {outside_files}") return { "id": task["id"], "workspace": str(workdir), "mode": args.mode, "elapsed_s": elapsed, "returncode": returncode, "timed_out": timed_out, "ok": returncode == 0 and not errors, "errors": errors, "created_files": created, "output": output[-12000:], } def main() -> int: parser = argparse.ArgumentParser(description=__doc__) parser.add_argument("--tasks", type=Path, default=DEFAULT_TASKS) parser.add_argument("--out-root", type=Path, default=DEFAULT_OUT) parser.add_argument( "--workspace-root", type=Path, default=DEFAULT_WORKSPACES, help="Directory for temporary OpenCode project workspaces. Keep this outside the repo.", ) parser.add_argument("--model", default="kaiju/kaiju-coder-7") parser.add_argument("--agent", default="kaiju-coder-7") parser.add_argument("--mode", choices=["harnessed", "raw-opencode"], default="harnessed") parser.add_argument("--max-tasks", type=int, default=None) parser.add_argument("--timeout", type=int, default=900) args = parser.parse_args() tasks = load_tasks(args.tasks, args.max_tasks) if not tasks: raise SystemExit(f"No tasks loaded from {args.tasks}") stamp = time.strftime("%Y%m%dT%H%M%SZ", time.gmtime()) run_root = args.out_root / stamp run_root.mkdir(parents=True, exist_ok=True) workspace_root = args.workspace_root workspace_root.mkdir(parents=True, exist_ok=True) results_path = run_root / "results.jsonl" records = [] with results_path.open("w", encoding="utf-8") as handle: for task in tasks: print(f"Running {task['id']} in {workspace_root / stamp / task['workspace']}", flush=True) record = run_task(args, task, run_root, workspace_root) records.append(record) handle.write(json.dumps(record, ensure_ascii=False) + "\n") handle.flush() status = "ok" if record["ok"] else "failed" print(f" {status} in {record['elapsed_s']}s", flush=True) for error in record["errors"]: print(f" - {error}", flush=True) passed = sum(1 for record in records if record["ok"]) summary = run_root / "summary.md" summary.write_text( "\n".join( [ "# Kaiju OpenCode Customer Readiness", "", f"- Model: `{args.model}`", f"- Agent: `{args.agent}`", f"- Mode: `{args.mode}`", f"- Tasks: {len(records)}", f"- Passed: {passed}/{len(records)}", f"- Results: `{results_path}`", f"- Workspace root: `{workspace_root / stamp}`", ] ) + "\n", encoding="utf-8", ) print(f"Summary: {summary}", flush=True) return 0 if passed == len(records) else 1 if __name__ == "__main__": sys.exit(main())