AI Wind Tunnel

Turn a natural-language brief into an evidence-backed, read-only-by-default contract and report. Executable target protocols cover Web and CLI. Probe other target types only for capability; without an explicit protocol, do not claim execution and record BLOCKED or UNVERIFIED. Work through public interfaces only; never inspect source, hidden state, credentials, or an unapproved external system.

Core flow

1. Write the safety contract (S1). Record the target, purpose, synthetic inputs, allowed side effects, forbidden actions, evidence requirements, and exact authorisation. Register every ambiguity. Keep irreversible actions, production load, real accounts, real data, and credentials out of the run.
2. Probe capabilities (S2). For a Web target, record available normal browser controls, accessible tree and keyboard focus, visible Network activity, and already-documented localhost HTTP interfaces. For a CLI target, record only the brief-declared commands, arguments, standard streams, exit code, and temporary output files. For any other target type, record the declared public surface and keep cases BLOCKED/UNVERIFIED unless an explicit executable protocol is present. An unavailable surface remains unavailable; do not replace it with source inspection or a newly installed dependency.
3. Choose the target protocol. Follow target-protocols.md. Discover Web methods, paths, and schemas only from the brief, public documents, or visible UI/Network behavior. For CLI, execute only brief-declared public commands with synthetic fixtures in a new temporary directory. Never infer a hidden interface or inspect implementation. If no permitted surface can produce evidence, mark the case BLOCKED or UNVERIFIED.
4. Apply the smallest pressure matrix. Cover the six axes in pressure-model.md. For every Web key side effect, perform one concurrent or rapid-repeat attempt and one mid-flow reload/back recovery attempt. For CLI, include a fresh-process repeat and a mid-input failure that checks exit status and output atomicity. Do not infer either result from a happy path.
5. Execute for real and capture evidence. Use synthetic local values and the selected public protocol. For Web, record actions, visible state, accessibility, and visible Network evidence. For CLI, record argv, exit code, stdout, stderr, output members or records, and time order. Each case states its expected invariant, minimal reproduction, and evidence-relative paths. Other target cases remain BLOCKED/UNVERIFIED when no executable protocol is available.
6. Derive the report, fail closed (S3). Follow report-contract.md. Missing evidence, escaped evidence paths, a key failure, or a key unverified/blocked case prevents PASS; never copy a claimed verdict from input.
7. Check the package gate (S4). Before delivery, ensure the archive is self-contained, has exactly one root SKILL.md entry, keeps any needed supporting files such as references/, scripts/, tests/, or LICENSE, has complete frontmatter, and is within the platform size limit. A failed gate is BLOCKED.
8. Shrink and retest. Reduce a failure to the smallest synthetic sequence, rerun from a fresh state, and retain both the original and confirming evidence. A change in host capability resets affected cases to UNVERIFIED until re-executed.

Optional localhost model host

When the productivity Agent requires an OpenAI-compatible local model, use the included loopback bridge only with an already-installed openvino_genai runtime and an already-present local model directory:

python3 scripts/openvino_chat_server.py \
  --model-dir /absolute/path/to/local-openvino-model \
  --model-id Qwen3-4B-int4-ov --port 8766

Configure the Agent's Custom OpenAI model with endpoint http://127.0.0.1:8766/v1, model Qwen3-4B-int4-ov, and a non-secret local placeholder if its UI requires an API key. Disable tool calls, image input, and reasoning mode. The bridge binds only to loopback, accepts text chat, generates deterministically, and provides buffered SSE for streaming clients. It never downloads a model or falls back to cloud inference. A missing runtime, failed load, unsupported tool request, or unavailable localhost surface is BLOCKED/UNVERIFIED, never a reason to use a remote model silently.

The bridge enforces a 4,096-token local context budget. When a host injects a larger system prompt, it preserves the formatted prompt's head and tail, inserts an explicit middle-context removal notice, and returns system_fingerprint=ai-wind-tunnel-context-truncated. Treat runs that depend on removed middle context as UNVERIFIED; do not describe this as full-context equivalence.

Web accessibility check

For every critical icon-only control, inspect its public accessible name, role, state, focusability, tab order, and keyboard activation. Confirm that the resulting status announcement and visible state change match the expected invariant. An empty name, unreachable control, or unannounced failure is a finding even when a pointer click appears to work.

Safety stop

Stop before an action when its object, scope, time window, or acceptance check is not explicitly authorised. Record BLOCKED; do not guess, broaden scope, or turn a lack of evidence into success.