Part 16 of 16
Extending the daemon
Thirteen chapters on building on corecruxd: packs, external tools, sandboxed modules, connectors, and publishing what you build.
- IndexIndex and entry points for building on the Crux Daemon: who each chapter is for, the three principles the whole extension surface follows, and three copy-paste quickstarts.
- ArchitectureWhat you build against: one binary with HTTP, MCP and gRPC listeners, the data-dir layout, the auth modes and scopes, and the error shape every route returns.
- Integration packsThe crux.integration.v1 manifest field by field, all nine entry kinds, and the single validate() gate that every install path runs.
- Capabilities & grantsThe 14 declarable capabilities, the two grant models that share vocabulary but no storage, and the operator posture that decides what installed code may actually do.
- Signing & trustEd25519 signing end to end: the signature envelope, the operator keyring, trust tiers, the curator-signed community index, and the development bypasses.
- External toolsThe HTTPS extension path: the wire contract for your own service and the full enforcement pipeline the daemon runs on the way out and back.
- WASM extensionsRunning sandboxed code inside the daemon process: the wasmtime sandbox, the host ABI, hash pinning re-verified on every dispatch, and the fuel, memory and wall-clock limits.
- Connectors & syncPush-based work: the shared scheduler, the status facts a job writes, the vault watcher, and the GitHub and OpenAI connectors that ship today.
- Studio packs & workspacesShipping dashboards other people install: the crux.studio.v1 payload, canonical JSON, build and verify, the underlying fact schemas, and the curator-signed template library.
- Registry & publishingBoth distribution rails end to end, from authoring and signing through curation, sync and install, plus the full corecruxctl command reference.
- MCP surfaceHow an installed, granted extension tool reaches an agent tool list beside the built-in tools, and what happens when the passport is missing.
- Security modelA plain statement of the extension trust boundaries and which controls are enforced, which are advisory, and which are declared but not yet wired.
- TroubleshootingReal error strings quoted from the code that emits them, what each one means, and the silent-failure modes that produce no error at all.