Create a package
ping and note, a one-step SOP, a skill, a record schema, and the WIT interface files. Each file starts with a note saying what to replace.
The manifest
manifest.toml
string[]
required
What the package provides.
tool for tools, skill for a skills/ directory. The runtime also understands channel, memory, and observer.string[]
What the tools may use:
state_read, state_write, config_read, http_client, websocket_client, socket_client, memory_read, memory_write, file_read, file_write. Anything not listed is denied at the host boundary.string[]
Hosts the plugin intends to reach, exact names or
*.suffix patterns. A declaration is not a grant. The effective allowlist lives in the operator’s config (plugins.entries[].egress_hosts). On first install it is seeded from this list and printed, and a reinstall never widens an existing grant.object
JSON Schema for the plugin’s own config section. A top-level string property with
x-secret = true is withheld from public config and served only through the secrets import. Add config_read to permissions together with a schema.Write tools
A multi-tool package implements thetools-plugin world. The host calls list-tools once at load time and registers each name, then calls execute per invocation.
src/lib.rs
A single-tool component can export the older
tool interface from the tool-plugin world instead. Both are supported.
Build
kinetic build runs the system Cargo for the wasm32-wasip2 target, copies the component to wasm_path, and writes its SHA-256 into the manifest:
Install a package
1
Verify the component
The component is copied into the plugins directory and loaded against this host’s WIT. A component built against a different interface is refused.
--no-verify skips this check, and a plugin that does not load is then skipped at startup.2
Seed config and egress
A
[[plugins.entries]] row is created for the plugin. Declared egress hosts are granted and printed. Plugin config values are set with kinetic config set plugins.entries.<name>.config.<key>.3
Install the procedure
If the package has
sop/SOP.toml and SOP is enabled, the procedure is copied to <sops_dir>/<name>/. An existing procedure with the same name is left in place.4
Write the record schema
If the package has
records.example.toml, its fields replace [records] in the device config. Comments elsewhere in the config are kept.Manage plugins
Plugin tools are not attested automatically. Attest completed operations explicitly with
monad_attest, usually as the last step of a SOP.