Portable Kits
Free for noncommercial use under PolyForm Noncommercial 1.0.0; commercial use needs a licence from Rico. View the source
This folder defines what an installable AI kit is and enforces it:
Experimental
The problem
Handing an AI agent a folder of prompts and scripts and saying "install this" usually produces an install nobody can check: the agent improvises file operations, silently skips what its environment cannot do, and reports success either way. This contract makes the kit declare its desired finished state and the agent report, honestly, which mode it actually achieved.
How it works
Every kit carries INSTALL.md (agent-facing instructions), kit.json and its schema, README.md, VERSION and CHANGELOG.md. The agent owns environment detection and tool choice; the kit owns the finished state, declared runtimes, safety boundaries and proof of success. The installing agent picks the strongest mode it can honestly support (full, persistent files, session only, or handoff required) and ends with a fixed-format receipt. The validator and the contract test suite keep the reference kit conforming.
Features
- Declared, inspectable installs
- Honest install modes
- Runtime policy
- Reference panel kit
How it was built
The first version merged on 2026-07-16 to make small-business AI kits installable in any AI app. The weak point was the install itself, where an agent improvises, skips steps and reports success anyway.
A kit declares its finished state in a schema-validated file, and the agent reports the strongest install mode it honestly reached in a fixed-format receipt.
Version 0.1.1 the same day added integrity records and regression tests for path traversal, symlink escape and corrupted installs. The changelog states the check proves a copy matches its source and does not authenticate a publisher.
On 2026-08-12 room lifecycle commands made panel rooms reusable, all archive-only and written for the bash version macOS ships. On 2026-08-13 every kit had to work in every supported AI app, not just the one it was built in.
AI agents built and reviewed the line, including an audit on a second AI runtime before the first merge. Rico kept real use in copies, so no customer data ever lands in the source.