# Manifest-first. Git-native. Ejectable.

**Manifest-first. Git-native. Ejectable.**

If you are the person who will be blamed when this is unmaintainable in eighteen months, this page is for you. The short version: the canonical artefact is a file, it lives in your repository if you want it to, and you can leave with everything.

For engineering

[Read the quickstart](/quickstart) [Get a dev token](/signup)

## You are not trapped.

Export a complete engineering repository at any time. Not a JSON blob — a project that builds, tests and deploys.

```
$ krewos export --project lawcrew-doc-review --mode eject

lawcrew-doc-review/
  crew-manifest.yaml        # canonical source of truth
  components/               # agents, pods, deterministic nodes
  schemas/                  # typed port contracts
  prompts/                  # versioned, with bindings
  policies/                 # deterministic rules
  evaluations/              # suites, datasets, scorers
  tests/                    # unit + integration
  extensions/               # your custom tools and actions
  deploy/                   # container + IaC
  AGENTS.md  CLAUDE.md      # agent instructions
  README.md

ejected  this project is yours. runtime APIs continue to work.
```

**Linked projects round-trip**

Keep the project linked and changes flow both ways through a reviewed diff. A Studio edit appears as a proposed commit; a commit appears as a change plan a reviewer accepts or rejects. No silent overwrite in either direction.

**Ejected projects are yours**

Full stop. No licence revocation clause on your manifests, no phone-home requirement, and the deployed runtime APIs keep working. Packs are separately licensed and that licence is what ends — not your code.

**Everything is scriptable**

Validate, test, package, deploy and inspect from the CLI. The web Studio calls the same API surface you do; there is no privileged path.

**Eleven API domains**

Runs, approvals, releases, components, knowledge, evaluations, audit, cost, secrets, identity and webhooks. OpenAPI spec published, with a downloadable collection.

The manifest schema is published and versioned. If you want to generate manifests from your own tooling and never open Studio, that is a supported way to use the product, not a workaround.

## What we own so you do not.

Each of these is a system you would otherwise build, staff and carry. [The full build-versus-buy breakdown →](/vs)

**Durable state and checkpointing**

Runs that survive worker restarts and deploys, with replay semantics you do not have to reason about.

**Idempotency and compensation**

Keys, retries and declared compensating actions on every externally visible effect.

**Secret injection**

Credentials injected at call time by the gateway, never present in prompts, logs, manifests or exports.

**Permission enforcement outside the prompt**

A component cannot talk its way into a permission it was not granted, because the grant is not in the context window.

**Cost attribution**

Per-node metering that reconciles to a business outcome unit with no unattributed spend.

**Evaluation harness and audit trail**

Datasets, scorers, confidence bounds, release gating, and an immutable exportable trace.

## Extension contract and sandbox rules.

Stated plainly, because engineers respect a clear boundary more than a generous one.

| You can write | Against | Appears in Studio as |
| - | - | - |
| **Custom Tools** | Published Tool interface — typed input and output, no external side effect. | A block, with its contract shown on the node |
| **Custom Actions** | Action interface — must supply an idempotency key and declare compensation behaviour. | A block flagged as effect-causing |
| **Deterministic nodes** | Pure function interface. No model call, fully replayable. | A block the compiler can reason about |
| **Scorers** | Evaluation scorer interface — case in, score and rationale out. | An option in the Evaluation Lab |
| **Connectors** | Connector interface with a declared permission scope and read/write classification. | An entry in your Tools registry |

**Sandboxed execution**

Generated and custom code runs sandboxed with network and filesystem restrictions declared per component. Nothing runs with ambient credentials.

**Dependency scanning**

Every dependency is scanned on registration and on a schedule. A new critical advisory on a registered component notifies its owner and blocks new releases that include it.

**Review before registration**

Custom components are reviewed before they are registered in a tenant catalogue, by your reviewers under your bar. The workflow is the same one the Hub uses.

### Quickstart, on this page.

Twenty minutes from nothing to a governed run with a readable evidence record.

```
# 1. install and authenticate
$ npm i -g @krewos/cli
$ krewos auth login                      # opens browser, stores a scoped token

# 2. start from a template rather than a blank canvas
$ krewos init --template content-studio --name first-crew
  resolved  content-studio@2.4.1  · 11 components  · pinned

# 3. attach the sample corpus and validate
$ krewos knowledge add ./samples/corpus --pack sample-corpus
$ krewos validate
  schema ok  ·  ports ok  ·  effects ok  ·  budget ok

# 4. run a sample case in the development environment
$ krewos run --case ./samples/brief-01.json --watch
  research    done   8 sources, sufficiency 0.81  (floor 0.70)
  draft       done   1,140 words, 8 claims cited
  compliance  done   6 checks passed
  approval    waiting  task assigned to you

# 5. approve, then read the trace
$ krewos approve --task t-7741 --note "tone fine, sources check out"
$ krewos trace --run r-8f21 --format json > trace.json
  42 events  ·  cost 38 credits (S$0.38)  ·  0 unattributed
```

---

Canonical page: https://dev.krewos.ai/role-eng