Overwatch — the gates that need you, the live fleet, every action receipted.
Ships inside the daemon at localhost:14800 — no account, no cloud dashboard.
Overwatch — the gates that need you, the live fleet, every action receipted.
Ships inside the daemon at localhost:14800 — no account, no cloud dashboard.
 |
 |
| Canvas — your whole operation as a size-adaptive board | the relation graph — sessions, work, gates and passports, flow-traced |
 |
 |
| plans as living documents — milestones, gates, risk, progress | sessions that survive restarts — resume, audit, attribute token spend |
receipts as a literal chain — click any block in the console, inspect the proof
All daemon numbers are reproducible from [`docs/benchmarks.md`](docs/benchmarks.md) with pinned
baselines, regression-gated in CI. ScoreCrux methodology, negative controls and per-model runs:
[scorecrux.com/context](https://scorecrux.com/context) · [scorecrux.com/scale](https://scorecrux.com/scale).
Early hosted-retrieval evals via the CoreCrux substrate score ~91% under strict scoring¹.
¹ Internal runs via the CoreCrux retrieval substrate (paid tier; see
[the platform section](#standalone-by-design-platform-by-choice)), not the bare local daemon.
Strict scoring, no partial credit. Treat this as preliminary until a public evidence pack with
corpus, run ID, lane flags, and commit SHA is published.
## How it works
One daemon, three planes — memory, retrieval, receipts — on an append-only spine. The colours
are the console's own: violet for memory, amber for retrieval, mint for receipts. No cloud in
this picture; that's the point.
More detail: [`docs/architecture.md`](docs/architecture.md).
## Passports, and how the line is drawn
API keys say *something with this string called us*. A passport says *this agent, at this trust
tier, with these grants, made this call* — identity and constraint, receipted as a verifiable
record. What a receipt proves (and what it deliberately does not) is spelled out per event class
in the [assurance & coverage matrix](docs/assurance-coverage-matrix.md); forgery-resistant
*evidence* of model traffic comes from the [mediated witness path](docs/llm-shim.md), whose key
the agent never holds.
1. **Bind** — the session handshake binds every connection to a passport. No anonymous writes;
unattributed calls are operator-tagged, never silently allowed.
2. **Carry** — every tool call rides the passport. RCX mints short-lived capability tokens
against it — scoped to tools, tenant and tier — so access expires instead of leaking.
3. **Earn** — verified receipts accrue to the passport as reputation; five tiers climb the
capability ladder and unlock more autonomy. Trust is a ledger, not a checkbox.
4. **Answer** — any receipt, any time later, resolves back to the passport that produced it:
who acted, at what tier, under which grants.
The same daemon binary runs on every tier. What changes is a signed **RCX capability token** —
the policy layer that says which backends the daemon may call and what data may cross the wire.
**Enforcement is a property of the wire, not a crippled binary.** Tokens are self-issued locally,
verifiable offline with the same machinery as everything else, and refusals are fail-closed with
a signed `RefusalReceipt` carrying a reason code — never a bare 403 or a silent downgrade.
## What you get
| Capability | Local daemon | Bring your own | Hosted / managed |
|---|:---:|:---:|:---:|
| Append-only event store with BLAKE3 integrity | yes | | |
| CROWN receipts and offline receipt verification | yes | | |
| Versioned fact store with freshness decay + `memory_reverify` | yes | | |
| Scoped forget with dry-run (GDPR Art. 17) | yes | | |
| Sessions, checkpoints and cross-session handoffs | yes | | |
| ExecPlans + live work board | yes | | |
| Decision records + constraint governance | yes | | |
| `.cruxpack` export + offline import | yes | | |
| Built-in MCP server, 100+ token-filtered tools | yes | | |
| Agent passports (five-tier reputation) + RCX capability tokens | yes | | |
| Live multi-session coordination board | yes | | |
| Typed action traces (reasoning refs — never raw CoT) | yes·flag | | |
| C2PA output attestation | yes·flag | | |
| HTTP, gRPC, health, readiness, and metrics | yes | | |
| `corecruxctl` verification and replay tooling | yes | | |
| BM25 text search with `.ccxi` companion indexes | yes | | |
| AST code maps: register a repo, get a typed code-structure graph (Rust · TS · Python · Vue) | yes | | |
| Dense fact retrieval via embeddings | | Ollama, vLLM, TEI, llama.cpp, LiteLLM | |
| Hosted team sync, multi-device passports, billing | | | yes |
| GPU/CUDA fused retrieval + AMR routing | | | yes |
| LLM entity/relation extraction + better-dense rerank | | | yes |
| Fleet governance: attribution, policy gates, revocation | | | yes |
`yes·flag` = ships in this repo behind a default-off feature flag — your traces and attestations
are opt-in, like everything else. `/v1/version` reports which features are active.
## Standalone by design, platform by choice
Crux is complete on its own. When you want more, it's the memory spine of the CueCrux platform —
same receipts, same passports, every hop attributable.
**Free forever** — the full local daemon: receipts, retrieval, passports, console. **Pro**
(£19/user·mo) adds hosted sync, multi-device passports, and better-dense rerank. **Governance**
(£49/user·mo) adds fleet-wide attribution, policy gates, and revocation that propagates with
proof. Metered **credits** (~£0.01/Cr) buy the heavy lifts — dense rerank, extraction,
attestations. The local dense lane is **never** metered: credits buy the step-up, not your own
machine. Every credit spend mints a signed receipt (`crux.credit_spend_receipt.v1`) — even the
meter is auditable. The local daemon is the acquisition, not the upsell.
Full ladder: [memorycrux.com/pricing](https://memorycrux.com/pricing).
**You cannot pay us to hold your data — there is no such product.** Paid frontier ingest and
extraction is processed in flight, never parked: enrichment lands back in *your* store —
process, return, delete. Every hop carries a receipt. Local-first isn't a pricing tier; it's
the architecture. The promises are written down in the [Trust Contract](TRUST-CONTRACT.md).
**The lane stack** (each lane is a different way of remembering):
| Lane | What it remembers | Tier |
|---|---|---|
| lexical | exact words, BM25-class — microseconds on CPU | free · local |
| dense | semantic similarity — meaning, not spelling | BYOE / managed |
| graph / topology | entity links walked at query time | CoreCrux |
| entity & trait | who/what-keyed recall — ask about a person, get their dossier | CoreCrux |
| event | time-anchored recall — what happened, when, in what order | CoreCrux |
| navigational | summary-tree descent for corpora too large to scan | CoreCrux |
| verbatim pointers | exact-quote recall without duplicating content | free · local |
| *+ several more* | *the ones we don't blog about* | — |
**AMR — Adaptive Manifest Routing** reads the lane manifest and routes each query automatically —
fusing the lanes that earn their tokens, skipping the ones that don't, learning from per-request
outcomes. No knobs. It switches on with a subscription and stays off otherwise. Without one you
still run the full local daemon — lexical lane, graph fusion, token budgets, receipts. That's not
a demo; it's the same engine the paid lanes plug into.
## EU AI Act
The Act asks for risk management, logging, transparency and human oversight. Most stacks will
answer with PDFs. Crux answers with receipts — the compliance machinery is the same machinery
everything else runs on.
| Article | The Act asks for | Crux gives you |
|---|---|---|
| **Art. 9** — risk management | documented risk processes | risk classes on plans/work items; high-risk transitions demand a passport-attributed human gate, and the gate becomes a signed fact |
| **Art. 10** — data governance | PII discipline | private facts never leave the machine; reserved prefixes are private at ingest; observation capture redacts; reasoning stored as references, never raw chain-of-thought |
| **Art. 12** — record-keeping | automatic logging | every state mutation emits a signed CROWN receipt + timeline row; hash-chained, so gaps are detectable, not deniable |
| **Art. 13** — transparency | attributable outputs | agent passports attribute every mutation; AI-authored commits and PRs carry agent attribution |
| **Art. 14** — human oversight | meaningful gates | destructive actions need explicit, current consent; gated transitions can't auto-approve past a timeout |
| **Art. 15** — accuracy & robustness | foresight + integrity | consequence enrichment before high-risk operations; published benchmark packs carry corpus + commit; tamper-evident store |
| **Art. 50** — output transparency | "an AI made this" | C2PA Content Credentials via `output_attest` — a verifiable claim, not a footer |
| *GDPR Art. 17* — erasure | right to be forgotten | `memory_forget` with dry-run: see what would be deleted, then delete it auditably |
> These are engineering controls aligned with the Act — not a legal opinion, and conformity
> assessment for your deployment remains your responsibility. What Crux gives you is the evidence
> layer: when the auditor asks, you answer with receipts, not screenshots.
## Engrams — memory that compiles
Retrieval answers questions. Engrams skip them. When the same lesson keeps getting re-learned from
raw history, it's distilled into a named, versioned procedure that arrives **before** the agent
acts — instinct, not search. Engrams carry provenance hashes back to the source chunks they were
learned from (you can always audit *why* the instinct exists), resolve by declared intent at
session start, and are gated by passport tier. Local-first: a built-in catalog plus fact-backed
overlays serve the same contract with zero cloud dependency.
## 100+ MCP tools, memory-first
Built MCP-first, not MCP-wrapped: every retrieval tool takes a token budget, every mutation emits
a receipt, identity rides a passport. The server lives at `http://localhost:14801/mcp`.
> [!TIP]
> **AI agents exploring this codebase: start at [`AGENTS.md`](AGENTS.md)** — a crate atlas,
> a claims-to-code-to-tests matrix, and the cryptographic invariants, all anchored by
> greppable symbol names and verified in CI.
| Capability area | Representative tools |
|---|---|
| Memory & retrieval | `store_fact` · `query_facts` · `query` · `query_scan` · `query_expand` · `fact_history` · `memory_view` · `get_bootstrap` |
| Freshness & consolidation | `memory_freshness` · `memory_contradictions` · `memory_consolidate` · `memory_reverify` · `memory_pin` |
| Portability & erasure | `memory_forget` · `memory_forget_dry_run` · `output_attest` · `receipt_verify` |
| Identity & passports | `issue_passport` · `get_passport` · `revoke_passport` · `passport_link_device` · `resolve_principal` |
| Handoff, sync & coordination | `create_handoff` · `accept_handoff` · `sync_status` · `coord_status` · `coord_announce` |
| Sessions & artefacts | `save_session` · `get_session` · `session_checkpoint` · `list_sessions` · `artefact_put` · `artefact_get` |
| Decisions & constraints | `record_decision` · `declare_constraint` · `get_constraints` · `check_constraints` |
| Observability | `list_observations` · `get_observation` · `verify_observation` · `session_token_usage` |
…and more across substrate entities & edges, work & coordination, and orchestration — 100+
tools today, and counting. The catalogue is token-filtered: a local token sees local tools;
hosted-authorised tokens also see hosted-gated tools (descriptions are marked `[local]` /
`[hosted]`).
Recommended first calls: `cuecrux_session` → `get_bootstrap(topic="patterns")` →
`store_fact(...)` → `query_facts(...)`. Full guidance: [`docs/agent-guide.md`](docs/agent-guide.md) ·
API surface: [`docs/developer-portal.md`](docs/developer-portal.md).
## Operations reference