Thin project layer. This repo is the prism harness. The authoritative harness instruction set — hard boundaries, the engineering pipeline, git workflow, model strategy, and the skills/commands index — lives in
packages/prism-core/AGENTS.md. Read it first for any harness-affecting work. It is also whatpackages/prism-core/scripts/install-global.shdeploys to~/.pi/agent/AGENTS.md(global, loaded every session). pi concatenates the global core and this project layer into the system prompt, so the two never duplicate — this file carries only what is specific to this repository.
kyaulabs/prism — the prism pi coding harness, shipped as two pi packages
under packages/ and dogfooded from this same checkout:
packages/prism-core— language-agnostic core (global: skills, prompts, safety and bounded web-access extensions,AGENTS.md,APPEND_SYSTEM.md).packages/prism-php-web— PHP/web stack adapter (project-local).
The bounded web-access extension exposes only web_search and fetch_content
under independent standing consent managed by /setup.
The repo also carries PHP/Aurora project heritage (aurora/ submodule,
backend/, cdn/, tests/), so it is itself a PHP project — the
php-web-stack adapter skill applies (see Stack below).
composer.json and aurora/ are present, so load the php-web-stack
skill for stack specifics: PHP 8.5+, MariaDB, nginx, SCSS → Dart Sass, vanilla
JS, Pest 5 on PHPUnit 13, no-MVC, flat procedural PHP. The adapter's
tdd-php, rcs-header, aurora-page, scss-mobile-first, database,
security-coding-php, and related skills apply for PHP work in backend/,
cdn/, tests/, and aurora/.
This repo is not a deployable web app — there is no
<app>/webroot,*.sql, or*.nginx.confat the root.aurora/,backend/, andcdn/are heritage and test infrastructure. The production-env paths described inphp-web-stackrefer to downstream consumers, not this checkout.
.pi/settings.json loads prism-core + prism-php-web
skills/prompts/extension from disk (../packages/...), so a pi session
opened here has the full harness + adapter available with no install step. The
Core's safety extension is live and enforces the credential-path deny floor
(ADR-0047) and the rm -rf safe-zone policy. Its web-access extension
provides bounded public textual search and retrieval under standing consent.
- Fresh clone:
git submodule update --init(aurora/is a submodule:kyaulabs/aurora, branchmain). - Hooks: run
prism-tool resolve scripts, retain the returned absolute directory, then runbash /absolute/resolved/scripts/install-hooks.sh(pre-commit, commit-msg, pre-push). - Gate:
/check→ delegates to/check-php(php-cs-fixer + stylelint + eslint + Pest coverage ≥ 80%). - Assets:
/build-assets(adapter command — Dart Sass + uglify-js) whencdn/sassorcdn/jssources change. Never edit generatedcdn/css/*.min.cssorcdn/javascript/*.min.js. - Commits:
prism-tool commitresolvesSigned-off-byfrom the optional Prism identity override or Git config and fails closed when unavailable.
CODING_HARNESS.md— orientation: pi mapping, pipeline overview.CONTEXT.md— domain glossary, entities, invariants.adr/— Architecture Decision Records (0001–0054 opencode-era frozen; 0055+ pi-era).README.md— install + quickstart.docs/follow-ups/— deferred work (evals, more adapters, publish).