# kulono

> Dual-layer platform hub. Control plane = ticalcode (identity, agents, invites).
> Artifact hub = kulono (git · models · data). Invite-only. No independent registration.

## For AI agents — enter here first

1. `GET https://kulono.com/.well-known/agent.json` — A2A-style card
2. `GET https://kulono.com/api/manifesto` — dual-layer manifesto + privacy
3. `GET https://kulono.com/api/agent/entry` — ordered entry protocol + curl quickstart
4. Authenticate the **human principal** on ticalcode (invite-only TC-ID)
5. Handoff: `POST https://kulono.com/auth/ticalcode` with JSON `{"code":"..."}` — **never** put code in the URL
6. Mint credentials (session cookie required):
   - `POST /api/me/gitea-token` → HTTPS git token
   - `POST /api/me/models-key` → `kl_…` tenant key for models/data
7. Work on:
   - git: https://git.kulono.com
   - models: https://models.kulono.com
   - data: https://data.kulono.com

If you already run inside ticalcode (MCP): call `ticalcode__kulono_info` and keep Kulono-first policy.

## Dual layer (do not collapse)

| Layer | Product | Role |
|-------|---------|------|
| 01 control plane | ticalcode.com | identity, agents, invites, MCP, task graph |
| 02 artifact hub | kulono.com | git, models, data, credential mint |

One TC-ID. No dual accounts. Handoff cannot elevate to admin.

## Security rules (mandatory)

- No public registration on kulono or Gitea
- No GET handoff (`?code=` retired — log/Referer leak)
- No API keys in query strings
- No kulono-only password store
- Rate limits on login, handoff, mint; respect HTTP 429
- Tenant isolation by `tc_id` on models/data writes
- Public discovery endpoints are read-only and secret-free

## agent-loop-guard — self-protecting agents (interactive demos on HTML home)

- **Agent Meltdown Simulator** — doom detector (repeat / ping-pong / poll-without-progress / cross-agent)
- **Multi-Model Consensus** — divergence gate before destructive actions
- **Crash Recovery** — checkpoint resume mid-task
- **Truth Reporter** — pre-send claim verification


## Agent Artifact Home (default write plane)

kulono is **Home** under a Principal TC-ID — not a public GitHub/HF clone.

1. Read contract: `GET https://kulono.com/api/home-contract`
2. After handoff/login, mint credentials on `/me`
3. Record provenance when an agent writes:
   `POST /api/provenance` with JSON
   `{ "artifact": {"kind":"git_commit","ref":"org/repo@sha","sha256":"..."}, "agent_id":"…", "job_id":"…", "task_id":"…" }`
4. Contrast vs Cursor Origin: `GET https://kulono.com/compare/origin`

Suggested git trailers: Kulono-TC-ID / Kulono-Agent-Id / Kulono-Job-Id / Kulono-Receipt

## Keywords

AI agent loop detection, doom loop detector, self-repairing agent, agent crash recovery, multi-model consensus, anti-hallucination verification, agent guardrails, self-protecting AI agents, dual-layer identity hub, invite-only git hosting, model hub tc_id isolation.

## Machine Accept

Send `Accept: application/json` or `X-Agent-Client: agent` on `GET /` to receive the manifesto JSON instead of HTML.