reef-core runtime

reef-core is the Konareef runtime and registry service: it receives published reefpods, resolves vault-managed secrets, executes pods, and emits signed custody proofs. It is open source and self-hostable — you can run the whole custody path on your own box today. It is not required for the local authoring tutorial.

Run your own reef-core

reef-core is Apache-2.0 at github.com/digitsu/reef-core. With Docker and the Compose plugin:

git clone https://github.com/digitsu/reef-core
cd reef-core
cp .env.example .env
# set REEF_DB_PASSWORD, SECRET_KEY_BASE (openssl rand -base64 48),
# and REEF_OPERATOR_TOKEN (openssl rand -hex 32)
docker compose up

This builds the release image, brings up Postgres with pgvector, migrates and provisions row-level-security roles on boot, and serves the API on 127.0.0.1:4000 — loopback-only unless you opt in to expose it. Point the CLI at it with --server http://localhost:4000.

What a self-hosted reef-core gives you

Publish: submit signed pod manifests to your own registry.
Run/spawn: execute reefpods over an HTTP + WebSocket API.
Vault: resolve provider keys and secrets by name, never in pod.toml.
Memory: pods reach an external memory system over MCP — a JSON-RPC tool contract (recall, writeback, inspect, review) served at a configurable endpoint, so memory is an interface rather than a hard dependency. Open Brain — an encrypted store (AES-256-GCM, two-envelope key model) — is the current default implementation behind that interface, and the one a self-hoster gets out of the box. Support for additional memory systems over the same MCP contract is planned.
Proofs: a signed, Merkle-rooted custody-proof chain per task, offline-verifiable with konareef verify.
Optional on-chain anchoring — off by default; only the 32-byte commitment hash is ever broadcast, never run data.

What the open-source core does not include

These are hosted-platform features and are deliberately absent from the custody core:

No ZK faithful-execution attestation. See the honesty note below.
No marketplace or listings — no pod discovery or browsing surface.
No credits, commission, or billing — spawns are metered by a no-op facade.
No multi-tenant admission — no account gating; you run your own box.

What a custody proof is — and is not

A custody proof is a signed, tamper-evident record of a pod run: a hash chain binding the run's inputs, execution log, captured memory and output, folded together with the pod's signed publisher identity, re-checkable offline.

It is not a zero-knowledge proof of faithful execution. It does not prove the model actually ran the disclosed prompt, or that the recorded tool calls are complete. It attests to what that reef-core instance recorded the pod as having done — an honest signed record, not a guarantee against a dishonest operator. See SECURITY.md for the full trust model.

Hosted reef-core

A hosted instance runs at beta-api.konareef.ai for the invite-only private beta — access is token-gated and issued out of band, not self-serve. The hosted service adds the marketplace, commissioning and the ZK faithful-execution tier on top of the same custody core. Self-serve signup is not open yet.

Do I need PayGate ZK for the Quickstart?

No. The Quickstart is local authoring and validation only, and the ZK proof path is a hosted feature — it is not part of the open-source core and not a dependency for pod init or pod validate.

Current recommended path

Start with Install konareef.
Then build your first reefpod.
Use pod.toml reference when you need exact manifest syntax.
To run pods end to end, self-host reef-core.