ROVEv0.1.0
ROVE-ENGINE v0.1.0 — LOCAL AI RUNTIME
Copyright (c) 2026 Orvis Lab. All rights reserved.
Initializing subsystems...
[OK] ReAct agent loop
[OK] WASM sandbox runtime
[OK] LLM router (4 providers)
[OK] Ed25519 plugin verifier
[READY] Awaiting task input...

 ██████╗  ██████╗ ██╗   ██╗███████╗
 ██╔══██╗██╔═══██╗██║   ██║██╔════╝
 ██████╔╝██║   ██║██║   ██║█████╗  
 ██╔══██╗██║   ██║╚██╗ ██╔╝██╔══╝  
 ██║  ██║╚██████╔╝ ╚████╔╝ ███████╗
 ╚═╝  ╚═╝ ╚═════╝   ╚═══╝  ╚══════╝
AUTONOMOUS AI AGENT ENGINE
LOCAL-FIRST. RUST-POWERED. WASM-SANDBOXED.
root@localhost:~$ rove --start --mode autonomous
root@rove:~$cargo install rove
SYSTEM STATUS
LLM PROVIDERS██████████4/4
WASM SANDBOX██████████100/100
PLATFORMS██████░░░░3/5
PLUGINS████████░░8/10
SCROLL DOWN
root@rove:~$ ls --capabilities --verbose
total 9 capabilities loaded
ID KEY STATUS DESCRIPTION
──── ─────────────────────── ──────── ─────────────────────────────────────
F01REACT_LOOP[OK]
REACT AGENT LOOP
Reason-then-Act cycles. The agent brain plans, executes, and adapts until the task is resolved. Fully local, zero cloud dependency.
F02WASM_SANDBOX[OK]
WASM SANDBOX
Every plugin runs inside an isolated WebAssembly runtime. Strict OS capability boundary enforced by the RiskAssessor host module.
F03LLM_ROUTER[OK]
MULTI-PROVIDER LLM ROUTER
Route requests to OpenAI, Anthropic, Gemini, or local Ollama. Swap providers at runtime without changing agent logic.
F04PLUGIN_SIGN[OK]
ED25519 PLUGIN SIGNING
All plugins are signed with Ed25519 and verified via BLAKE3 hashing before execution. Supply-chain attacks are structurally prevented.
F05OTA_REGISTRY[OK]
OTA REGISTRY UPDATES
Cloudflare-backed static registry distributes plugin binaries. The engine syncs and verifies new versions automatically on boot.
F06SECRET_MGR[OK]
SECURE SECRET MANAGER
API keys stored in encrypted secure strings. Secrets injected at runtime, never accessible to WASM plugin code, never written to disk.
F07INTERFACES[OK]
HTTP · WS · MCP
HTTP REST API, WebSocket streaming, and Model Context Protocol. Integrate into any frontend, IDE extension, or automation pipeline.
F08CROSS_PLAT[OK]
CROSS-PLATFORM
Native macOS, Linux, and Windows support. Platform-specific paths, daemons, and line endings handled transparently by the engine.
F09SQLITE_MEM[OK]
SQLITE TASK MEMORY
Persistent task history, plugin state, and agent memory in local SQLite. No cloud, no telemetry, full privacy under your control.
[OK] All 9 subsystems operational. No errors detected.
root@rove:~$ journalctl -u rove --follow --example-task
EXECUTION LOGrove-engine.service
00:00:000[INFO ]daemonRove engine started. PID=29881.
00:00:012[INFO ]runtimeWASM sandbox initialized. Extism host loaded.
00:00:034[INFO ]llmLLM router ready. Providers: [openai, anthropic, gemini, ollama]
00:00:041[INFO ]registryPlugin manifest loaded. 8 tools verified (Ed25519 OK).
00:00:055[INFO ]conductorAgent brain online. SQLite memory connected.
00:00:057[READY]serverListening on 127.0.0.1:4321 (HTTP + WS + MCP).
00:01:203[TASK ]user"Summarise all git commits from the last 7 days and email a report."
00:01:204[INFO ]conductorTask received. Decomposing into subtasks...
00:01:205[PLAN ]brainStep 1: read_git_log(days=7) Step 2: summarise() Step 3: send_email()
00:01:210[CALL ]runtimeDispatching tool: fs-editor::read_git_log — sandbox OK
00:01:340[DONE ]runtimeTool returned 2.4 kB. Feeding result to brain.
00:01:341[CALL ]llmLLM call → anthropic/claude-3-5-sonnet. tokens_in=1842
00:01:890[DONE ]llmLLM returned summary. tokens_out=312.
00:01:892[CALL ]runtimeDispatching tool: remote::send_email — sandbox OK
00:02:140[DONE ]runtimeEmail dispatched. SMTP status=250.
00:02:141[ OK ]conductorTask completed successfully. Memory written.
00:02:142[----]shellroot@rove:~$
ENGINE MODULES
conductor/
Task planning & memory
runtime/
WASM + native execution
llm/
Multi-provider router
fs_guard/
Filesystem sandbox
server/
HTTP / WS / MCP
crypto/
Ed25519 + BLAKE3
daemon/
Process lifecycle
db/
SQLite task memory
secrets/
Secure credentials
config/
Configuration mgmt
root@rove:~$ ls -lah /usr/local/lib/rove/plugins/
total 8 (official plugins, verified)
/usr/local/lib/rove/plugins/
PERMS SIZE NAME DESCRIPTION
────────────────────────────────────────────────────────────────────────────────
-rwxr-xr-x124Kfs-editor.wasmRead/write files within approved workspace paths
-rwxr-xr-x 98Kfile-watcher.wasmMonitor FS events, trigger agent reactions on changes
-rwxr-xr-x201Kscreenshot.wasmCapture desktop screenshots for visual context
-rwxr-xr-x 67Knotification.wasmPush system notifications on task progress
-rwxr-xr-x 88Kapp-launcher.wasmOpen applications and deep-link URLs on the host OS
-rwxr-xr-x143Kremote.wasmExecute remote commands via secure channels
-rwxr-xr-x112Ktelegram.wasmSend/receive Telegram messages in automated workflows
-rwxr-xr-x310Kui-server.wasmServe a local web UI for real-time agent monitoring
SECURITY AUDIT — ZERO-TRUST MODEL
[OK] wasm32-unknown-unknown target only — zero raw OS API access
[OK] Ed25519 + BLAKE3 manifest verified before plugin load
[OK] RiskAssessor capability allow-list enforced at host boundary
[OK] Shell commands parsed and sanitised against injection attacks
[OK] Network limited to host-injected URL domain allow-list
[DENY]Arbitrary syscall access
[DENY]Raw filesystem handles accessible from plugin code
COMMUNITY REGISTRY
Build your own tools. Compile to wasm32-unknown-unknown, submit a PR. CI builds, signs with Ed25519, and publishes to the global Rove manifest automatically.
$ git clone https://github.com/orvislab/rove
$ cd community-plugins
$ cp -r template/ my-plugin/
$ cargo build --target wasm32-unknown-unknown
$ gh pr create --title "feat: my-plugin"
[OK] CI will handle the rest.
root@rove:~/core/sdk$ man rove-sdk
TERMINALsdk-example
$cat Cargo.toml | grep rove-sdk
rove-sdk = { path = "../sdk" }
$cat src/my_tool.rs
1 // src/my_tool.rs
use rove_sdk::core_tool::CoreTool;
use rove_sdk::types::ToolResult;

pub struct GitSummaryTool;

impl CoreTool for GitSummaryTool {
    fn name(&self) -> &str {
        "git-summary"
    }

    fn description(&self) -> &str {
        "Returns a concise summary of recent git activity.
        Input: { \"days\": 7 }"
    }

    async fn run(&self, input: &str) -> anyhow::Result<ToolResult> {
        // host::read() provides sandboxed FS access
        let log = rove_sdk::host::read_git_log(input).await?;
        Ok(ToolResult::text(log))
    }
}
$cargo build --release --target wasm32-unknown-unknown
SDK MODULES
core_tool.rsCoreTool trait — implement this
types.rsToolCall, ToolResult, TaskStatus
manifest.rsPlugin manifest parse + validate
errors.rsCommon error types
helpers.rsUtility functions
host/Host function bindings (sandboxed)
BUILD PIPELINE
[01]Implement CoreTool trait
[02]Add rove-sdk to Cargo.toml
[03]cargo build --target wasm32-unknown-unknown
[04]Sign manifest with generate_keys.py
[05]Submit PR → CI auto-publishes
VIEW SDK SOURCE
root@rove:~$ rove --help install
QUICK START GUIDE
[01]INSTALL RUST TOOLCHAINmacOS / Linux
$curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
$rustup target add wasm32-unknown-unknown
[OK] Rust 1.75+ installed
[02]CLONE & BUILD
$git clone https://github.com/orvislab/rove.git
$cd rove/core
$cargo build --release -p engine
Compiling rove-engine v0.1.0...
[OK] Build finished in 42.3s
[03]RUN THE ENGINE
$./target/release/rove
[OK] Daemon started. PID=29881
[OK] Listening on 127.0.0.1:4321
[READY] rove>