Build for the agent-native OS.

Every HYVE Ether OS ships with a local AI stack — no cloud keys, no per-token bill, no install step. When you build a program for HYVE, you're not chasing a free-tier audience: you're shipping to people who chose a sovereign machine and want more for it.

A HYVE program is two things working together: a surface (the UI the owner sees, registered into the shell) and, when it needs to do real work, an organ (a local loopback service). You ship both inside a single signed .hyvepkg. Here's the whole pipeline.

The .hyvepkg package format

A .hyvepkg is a plain tar archive of exactly three members. The manifest describes your program; the payload is your files; the signature proves HYVE signed it.

your-program-1.0.0.hyvepkg   (a tar archive)
├── manifest.json     # { schema, id, name, version, type,
│                     #   description, author, created, size,
│                     #   payload_sha256, … }
├── payload.tar.gz    # your program / organ / asset files
└── manifest.sig      # base64 Ed25519 signature over the
                      # canonical manifest.json bytes

Signing & offline verification

Packages are built and signed with the hyve-pkg tool. The signature is an Ed25519 signature over the canonical (sorted-keys, compact) manifest bytes. HYVE holds the signing private key offline; every copy of the OS bakes in the matching public key and verifies entirely on-device. Package verification never contacts a server — the human is the transport.

# HYVE builds + signs your program (you submit; HYVE signs):
hyve-pkg build ./payload \
  --id com.yourname.tool --name "Your Tool" \
  --version 1.0.0 --type program \
  --desc "What it does"

# Paid title? add the license gate (Store handles the token):
hyve-pkg build ./payload --id com.yourname.tool \
  --name "Your Tool" --version 1.0.0 \
  --requires-license --product-id your-title

# The OS-side Depot organ verifies, 100% offline, before install:
#   1. Ed25519-verify(manifest.sig, manifest.json) w/ baked HYVE pubkey
#   2. sha256(payload.tar.gz) == manifest.payload_sha256
hyve-pkg verify your-program-1.0.0.hyvepkg
# → ✓ VERIFIED — signed by HYVE, payload intact

You don't hold a signing key — HYVE does. You build and submit your program; HYVE reviews and signs it before it's distributed. The OS's HYVE Depot organ is the on-device trust anchor: it imports a signed package, verifies the signature and payload hash against the baked-in HYVE public key, and only then installs it locally. An unsigned or tampered package is rejected as UNTRUSTED.

Surfaces — your program in the shell

A surface is a program registered into the shell. You add one entry to the surface registry (src/surfaces.ts) — the single source of truth for every program's label, glyph, hint, category, and where it shows (desktop grid, Start menu, search) — and route its component in App.tsx. That's it: it appears everywhere consistently, with a real window, title, and icon.

{ id: "yourtool", label: "Your Tool", glyph: "◆",
  hint: "What your program does, in one line",
  category: "tools", desktop: true, startMenu: true }

<Show when={props.surface === "yourtool"}>
  <YourToolSurface />
</Show>

Organs — your local backend

When your surface needs to do real work — talk to the local model, touch the filesystem, run a job — it calls an organ: a small local service bound to 127.0.0.1 on its own port (HYVE's own organs live on ports like :7904, :7910, and up). Organs are loopback-only, started by the OS's organ watchdog, and never exposed to the network. Your surface talks to your organ over plain HTTP on localhost — the same way every native HYVE program does.

# ~/your-tool/run.sh — the OS organ watchdog keeps this alive
export YOURTOOL_PORT=7920          # 127.0.0.1 only, never 0.0.0.0
exec python3 server.py             # stdlib HTTP on the loopback port

Hello-world HYVE program — the whole shape

Putting it together, the smallest complete HYVE program is a surface that calls a loopback organ, packaged and signed into one .hyvepkg:

hello-hyve/
├── surface/
│   └── HelloSurface.tsx      # 1 entry in surfaces.ts +
│                             #   1 route in App.tsx
├── organ/
│   ├── server.py             # 127.0.0.1:7920  GET /hello
│   └── run.sh                # watchdog-started launcher
└── manifest.json             # id/name/version/type=program

# 1. Build the surface: register it, route it, it has a window.
# 2. Build the organ: bind loopback, answer /hello.
# 3. Submit to HYVE. HYVE reviews + signs → your-1.0.0.hyvepkg.
# 4. The Depot verifies offline and installs. Owner clicks the
#    tile → your surface opens → it fetches 127.0.0.1:7920/hello.

from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
import json, os

class H(BaseHTTPRequestHandler):
    def do_GET(self):
        if self.path == "/hello":
            body = json.dumps({"msg": "Hello from your organ"}).encode()
            self.send_response(200)
            self.send_header("Content-Type", "application/json")
            self.end_headers()
            self.wfile.write(body)
        else:
            self.send_response(404); self.end_headers()

port = int(os.environ.get("YOURTOOL_PORT", "7920"))
ThreadingHTTPServer(("127.0.0.1", port), H).serve_forever()

Publishing to the HYVE Store

Approved developers submit a built program through the developer portal. HYVE reviews it, signs it, and lists it in the Store with the per-title price you set. For paid titles, the Store mints a per-customer license token at purchase, signed with HYVE's license key; the buyer imports the signed package plus their token, and the Depot verifies both offline before installing. Only buyers can install your paid program — no account check and no server round-trip.

Tell us who you are and what you want to build. Approval is manual — the founder reviews every application personally. If it's a fit, we'll reach out with the developer SDK, the submission portal, and the program's revenue-share details.

MANUAL REVIEW · GOES STRAIGHT TO THE FOUNDER