The Cube 0.1.0

The Cube 0.1.0 (alpha)

The first public release of The Cube, on the alpha channel (tag
cube-v0.1.0). "Alpha" is the channel: the version is 0.1.0, and the formats
it writes (cube_format 1, kit_schema 1) are the ones later releases read.

The Cube checks a knowledge base kept in git: specs, decisions, notes and the
references between them, as plain files. This release is for people who want
to try it on their own knowledge base and tell us what breaks.

What is in it

The engine, cube

• cube adopt takes over an existing knowledge base without changing its
  content files: it writes .cube/cube.toml, .cube/cube.lock, the git hook
  scripts and the agent skill, and commits them.
• cube check runs every check: the native checks (parse errors, duplicate
  and ambiguous ids, dangling references and links, unknown states, missing
  tl;dr lines and companion files, stale tokens, real addresses, and the
  shortcuts an agent might take: a weakened rule, a suppression, an edited
  test, a placeholder, a forged trailer) and the checks your kit declares.
  It exits 1 when a finding is an ERROR. --format json prints the
  cube-findings/v1 document; --format agent prints the fix brief: per
  ERROR, its rule, a real fix, what is not a fix, and the act it needs.
• cube ls lists every indexed file with its kind, app, title and state;
  cube show shows one file's preview and facts.
• cube, with no command, opens the terminal explorer: the knowledge base as
  a tree, a preview of each file and its facts, the Graph screen (a node and
  its neighbours) and the impact view (what depends on it).
• cube doctor (Linux) checks the environment (git, Python, the hooks, the
  kit's tools, the formats) and says what to fix; cube inbox lists the agent acts
  that wait for acknowledgement.
• cube setup and the git hooks (Linux): every commit, merge and push runs
  the checks; a commit is refused while an ERROR remains, unless its message
  carries the act the fix brief names.
• cube skill render writes a Claude Code skill from this cube's own
  command line, its findings and your kit, so an AI agent uses the same
  checks; cube check reports a stale copy.
• cube pack list|add|remove manages the layer packs of your kit.
• cube <tool> runs the tool program cube-<tool> from the folder of cube
  itself, never from the current folder or PATH; cube tools lists them.

The tools

• cube-index builds the index of the knowledge base, and cube-graph
  queries its graph: impact, dependents, deps, ego, search,
  stats, sub-specs, event, field-trace, build-context, validate,
  export, and visualize (one self-contained HTML page). Both are ports of
  the Python tools of the original kit and give the same results on a frozen
  test corpus.

Kits and packs

• The starter kit 0.1.0 (kit-starter-0.1.0.tar.gz): a generic knowledge
  base to start from, with zero findings, Claude Code skills that fill its
  skeletons (SaaS features, design system, conventions, architecture
  decision records), and its checks.
• The architecture pack 0.1.0 (pack-architecture-0.1.0.tar.gz): an opt-in
  layer with a small model of the application and technology landscape in
  shared/landscape/, linked to the specs and decision records, and skills
  that document, model and review architecture.

Speed (release build, median of 5 runs, a test base of about 3,000
files, a shared Linux server): cube ls 0.17 s, cube check 0.22 s,
cube-graph impact 0.05 s, the pre-commit hook 1.6 s.

Known limits

• macOS and Windows: cube check runs the engine's own checks and
  skips the kit's checks with a warning (KIT_CHECKS_SKIPPED): the check
  that a program is safe to run exists only for Linux so far. The git hooks
  (and cube setup) refuse there until a later release adds the macOS and
  Windows forms, and so does cube doctor. The other commands work.
• Per-user install. The installer puts cube in your home folder. The
  git hooks run a program your account owns only after you opt it in
  (cube setup prints the git config --global --add cube.allowUserOwned
  command), and then every hook warns that it is not tamper-proof: an agent
  that runs as your account could replace the program or change your git
  settings. An install owned by root, which closes this gap, comes in a later
  release.
• No self update. There is no cube self update and no update check yet.
  To update, run the installer again.
• Signatures. cube itself does not check signatures yet. The installer
  checks the manifest's minisign signature only when the minisign program
  is installed. It always checks GitHub's record of the release (immutable,
  and the same SHA-256 digest as the manifest), which is a second,
  independent source, and the SHA-256 of the download. The release that
  brings cube self update checks signatures in cube itself.
• Kits and packs. They are plain archives, not yet signed bundles with an
  index.
• No code signing. The programs are not code-signed in the alpha and
  beta. Windows Smart App Control can block them. On macOS, a copy
  downloaded with a web browser is quarantined; the installer downloads with
  curl, which does not quarantine it, so use the install command.
• Agents. cube and its git hooks work with any agent that runs shell
  commands. The kits' agent guidance (skills, helper agents, slash
  commands) uses Claude Code's .claude/ layout for now; other agents get
  the checks and the hooks but may not load that guidance on their own.
• Python. The kit's checks need Python 3 with PyYAML.
• Not yet. cube setup mergiraf, the AGENTS.md target of cube skill render, and acknowledging agent acts in cube inbox.

Install

Until https://cube.happonomy.org is live, the site and the installers are on
GitHub Pages at the address below. After the move, GitHub forwards this
address to the new one, so these commands keep working.

Linux and macOS:

curl -fsSL https://happonomyorg.github.io/cube-releases/install.sh | sh

Windows (PowerShell 5.1 or 7):

irm https://happonomyorg.github.io/cube-releases/install.ps1 | iex

The installer installs nothing unless the signature (when minisign is
installed), GitHub's record and the SHA-256 all agree; on any failure it
leaves no new program. If GitHub's API cannot be reached, it stops and names
the opt-out CUBE_INSTALL_SKIP_GITHUB_CHECK=1. The README in every archive
has a quick start.

Verify

The files of this release:

File	What it is
cube-x86_64-unknown-linux-musl.tar.gz	Linux, x86_64
cube-aarch64-unknown-linux-musl.tar.gz	Linux, arm64
cube-x86_64-apple-darwin.tar.gz	macOS, Intel
cube-aarch64-apple-darwin.tar.gz	macOS, Apple silicon
cube-x86_64-pc-windows-msvc.zip	Windows, x86_64
kit-starter-0.1.0.tar.gz	The starter kit
pack-architecture-0.1.0.tar.gz	The architecture pack

Each program archive holds cube, cube-index, cube-graph (.exe on
Windows), LICENSE, THIRD-PARTY-NOTICES.md and README.md; each file has
a .sha256 file beside it.

To check a file by hand: download https://happonomyorg.github.io/cube-releases/alpha.json and
alpha.json.minisig; check the signature with minisign -V -m alpha.json -P <key> against either public key on https://happonomyorg.github.io/cube-releases; compare the
file's SHA-256 with the manifest's; and compare both with GitHub's digest
(gh release verify-asset cube-v0.1.0 <file> -R HapponomyOrg/cube-releases,
or the digest field of the release in GitHub's API).

Licence

Proprietary, free to use: see LICENSE in every program archive. The
open-source components and their licences are listed in
THIRD-PARTY-NOTICES.md.

The starter kit and the architecture pack are MIT-0 (MIT No Attribution); the
licence covers them, not your own content. The kit's terms are in
_kit/LICENSE and _kit/NOTICE, the pack's in its LICENSE and NOTICE;
each NOTICE lists the third-party parts and their own licences.

Report problems at https://github.com/HapponomyOrg/cube-releases/issues.