Design principles
Kaizen Manas follows ten design principles. Each one says what the rule is and why it exists.
The owner stays in control
Risky actions wait for a button press from the owner. Why: Approval buttons put a person between the model and anything risky.
Safe by default
Dangerous features start off. The shell is off until the operator turns it on. Why: A new install should not be able to run host commands.
Fail closed
When a check cannot decide, it refuses. Why: An empty allow-list refuses everyone. A path that escapes the root counts as protected.
Phone first
The bot is built to be used from a phone in Telegram or Discord. Why: The author has no laptop. Replies are short and split to fit message limits.
Honest limits
The docs say what the checks cannot do. Why: Pattern checks are not a security boundary. The sandbox is not a container.
Keep secrets out of prompts
Secrets are placeholders until the moment code runs. Why: The model sees {=NAME=}. The real value is filled in after the scan and removed from output.
Exact matches only
Always Allow remembers one exact command, not a pattern. Why: A broad rule would approve commands nobody looked at.
Few tools at a time
Tools are grouped and groups can be switched off. Why: Fewer tools in the prompt means fewer wrong calls and fewer tokens.
Survive restarts
Pending approvals and settings are saved to disk. Why: A restart should not lose a waiting approval.
Bring your own model key
The owner supplies the model key and picks the model. Why: No hosted model service is bundled.
Checked against the source at commit f4fd89f on 29 Oct 2026. Everything here is merged on the main branch; no release has been tagged yet. The source is private, so these pages are the public description.