entorhinal

entorhinal is the project and agent registry for CortexKit. It gives every project a durable id (pj-…) and answers which project a directory belongs to, so modules that keep per-project state agree on what a project is, even when a directory moves or has several names. It also holds agent identity (names, roles, placement), records which of the operator's machines holds an agent or a role, moves idle agents between machines, and keeps the consent state behind the tools agents use to create workspaces, projects and hires. It runs as a module supervised by the subc daemon and provides the project-identity/v1 and agent-identity/v1 capabilities; modules that cannot work without them declare them required, and the daemon holds those modules unroutable until entorhinal has registered.

The fleet's optional user profile also lives here. user.get reads it and user.set changes one field through the shared identity log; Direct writes require operator confirmation. These are module operations, not CLI commands. See module surface for their contracts. A user.get token is meaningful only for the same request context it came from: the same project_id, or no project_id for an unscoped read.

Crate	Role
crates/entorhinal-core	The store and every domain rule: projects, roots, agents, the registry journal, shared-log entries, move checkpoints and consent state. Knows nothing about subc.
crates/entorhinal-module	The ck-entorhinal binary: the supervised module (admission, dispatch, the shared-log writer, move and consent drivers) and the ck projects, ck workspaces, ck agents and ck roles commands.

Build and test

These need only a Rust toolchain and a C compiler (SQLite is built from the bundled source). Every CortexKit dependency comes from crates.io, so a fresh clone builds on its own.

cargo build --workspace --release
cargo test --workspace --all-targets --locked

The tests open their own scratch stores and run the other modules they talk to as in-process stand-ins, so they need no daemon. CONTRIBUTING.md lists the full gate CI runs.

One test needs more: real_daemon_e2e starts a real subc daemon built from a subconscious checkout placed next to this repository, so it is ignored by default. Run it explicitly with:

cargo test --workspace --test real_daemon_e2e -- --ignored --nocapture

ck-entorhinal --manifest prints the module manifest as JSON without connecting to anything. Everything else needs a running subc daemon.

Commands

The binary ck-entorhinal is the module. People use it through ck, which runs it under the names ck-projects, ck-workspaces, ck-agents, ck-roles and ck-packages:

ck projects list | resolve | register | remove | add-root | attach | remove-root
            move-root <dir> --to-new-project <name>
            rebind | owned-remotes | approve | unapprove | trust | verify
            log status | log name | log enable
ck workspaces list | assign | set-root | clear-root
ck agents   create | rename | retire | tag | labels | hire-cap | list | show
            avatars | repair-workspaces | where | move | moves | move-abort | lid-close-moves
ck roles    read | take
ck packages registry add | repin | remove | list
            seed | publisher trust | publish

ck projects, ck workspaces, ck agents, ck roles or ck packages on its own prints the full usage. --json prints the raw response. Agent identity writes, hire caps, role takes and moves from ck land only after the operator approves the exact change at a presence prompt the daemon shows (Touch ID on macOS, Windows Hello on Windows). Linux has no presence provider, so there these writes refuse operator_presence_unavailable.

ck packages includes the built-in https://catalog.cortexkit.io registry, scoped only to @cortexkit (not the default registry). Existing operator mappings and repins are preserved. Remove it with ck packages registry remove https://catalog.cortexkit.io; the machine remembers the opt-out across restarts. Removal still refuses while status history is held; use ck packages registry repin to rotate a key without discarding that history. Restore a removed mapping with:

ck packages registry add https://catalog.cortexkit.io --scope @cortexkit --key-id genesis --public-key 57e7fcba3ee643f26196fc3f36174515e2aa01e4e0b00bda0e8f42d62cba36a4

ck projects move-root <dir> --to-new-project <name> separates one checkout and its repository key from a multi-root project into a new project. The source must keep another root, and no other local root may carry the transferred key. The move is atomic and shared when identity sharing is enabled; ordinary remove-root does not release a repository key. The new root needs ck projects approve <dir> and the project needs ck workspaces assign <project-id> <workspace-id> before creating the project's head agent (its lead agent). This operator command does not ask for a presence prompt.

Documentation

Start with ARCHITECTURE.md; STRUCTURE.md maps the code.

• Reference: data model, module surface.
• Contracts: identity log, agent moves, consent, session liveness.
• Operator guides: projects and roots, agents, sharing between machines, moving agents.
• CONTRIBUTING.md and SECURITY.md.

License

MIT. See LICENSE.