KalmOps

Turns messy project ideas into bounded, security-aware launch plans with explicit human review gates—built for solo builders, not project-management textbooks.

Comment

Inspiration & Our Collaborative Team

This project was built through a tight collaboration between human developer and AI partners: ChatGPT Work & Codex (5.6), Gemini & Antigravity (3.5)

Solo builders and non-technical entrepreneurs often have great project ideas but struggle to construct a bounded, security-conscious execution plan. Existing project management tools are designed for large enterprise teams, not single builders. We wanted to build a "secure launch compass" that helps solo builders frame their ideas, qualify assumptions, define scope, identify risks, and set up security controls—with one-click simplicity and absolute control.

What it does

KalmOps takes an unstructured project brief (Idea, Audience, Outcome, Constraints, Timeline), validates the inputs, passes them through a secure gate, and uses OpenAI's Responses API to generate a structured, bounded Kalm Plan. The plan covers:

  • Project Charter: Problem, target user, and desired outcome.
  • Scope Limits: Must-haves and what can wait (Not-now).
  • Execution Phases: Bounded steps with tasks and explicit completion criteria.
  • Risk Register: Likelihood, impact, mitigation, and gates requiring manual approval.
  • Security by Design: Verification checks for inputs, data, and access.
  • Unresolved Decisions: Key product recommendations and rationales.
  • Launch Evidence Checklist: A clear checklist for solo builders. Builders review and approve the plan locally—retaining complete control over the launch process (no autopilot loops).

How we built it

The architecture is designed as a Thin PWA (React + TypeScript + Vite) connected to a Gen 2 Firebase Cloud Function. The function performs validation using Zod, enforces server-side rate limits, and securely queries OpenAI's Responses API (using gpt-5.6-luna) with keys loaded from GCP Secret Manager. We integrated reCAPTCHA Enterprise via Firebase App Check to secure our endpoints.

Our development journey went through three clear collaborative phases:

  1. Phase 1: Mapped out the architecture and built the base PWA frontend and endpoints.
  2. Phase 2: Designed the security controls and endpoint authorization gates.
  3. Phase 3: When integration bugs emerged and weekly usage quotas were hit, handed the workspace off to Antigravity to resolve the environment, structured JSON schemas, and Zod validation edge cases.

Challenges we ran into

  • Structured Outputs Schema Constraints: OpenAI's Responses API does not support advanced JSON Schema properties generated by Zod like minLength, maxLength, .refine(), or .url(). We solved this by decoupling the Zod schemas: creating KalmPlanOpenAiSchema (simple base types) for the OpenAI request format, while retaining the strict KalmPlanSchema validation locally on the parsed output.
  • Zod Error Resilience: Minor variations in LLM outputs (like short recommendations such as "Yes", "No", or "TBD") originally triggered local Zod validation errors. We resolved this by relaxing local string constraints and updating the model's system instructions to explicitly specify schema limits.
  • Secret Trailing Whitespaces: Trailing newlines loaded from Google Secret Manager initially caused hash mismatches in our Access Gate, which we corrected by adding strict hex validation and trimming.

Accomplishments that we're proud of

  • We achieved a clean, robust vertical slice that is exceptionally secure. The client-side code possesses zero API keys or secrets.
  • Decoupled schema validation that handles LLM response constraints gracefully.
  • A beautiful, premium UI/UX that feels highly responsive and reliable.

What we learned

Decoupling the LLM's structured output format from strict local validation schemas is an elegant and robust pattern for building reliable AI integrations.

What's next for the project

We plan to implement local-first offline state persistence, a workflow state engine in Firestore, and a background task queue for larger deployments.

Built With

  • chatgpt
  • firebase-app-check
  • firebase-auth
  • firebase-cloud-functions
  • firebase-hosting
  • google-antigravity
  • google-cloud-secret-manager
  • google-gemini
  • gpt-5.6-luna
  • openai-responses-api
  • react
  • typescript
  • vite
  • vitest
  • zod
Share this project:

Updates