Hovel - authorized red-team emulation framework

The pitch

As a red-team operator, I want one local engine to manage modules, providers, Mesh operations, workspace PKI, throws, events, artifacts, installed payloads, and sessions.

As an exploit developer or module author, I want a clear descriptor and testable runtime contract so third-party capabilities are easy to build, inspect, and operate safely.

What is here

Hovel is a platform for wrapping and operating third-party proofs of concept, not a catalog of first-party exploits. The project provides the engine, SDKs, descriptors, providers, strongly typed credential delivery, guardrails, examples, installed-payload inventory, and operator experience that make third-party modules acceptable to run and inspect.

The central runtime is a local engine, hoveld, which owns operations, chains, throws, module processes, provider-backed payload state, Mesh listeners and bridges, encrypted PKI custody, installed payload records, sessions, events, artifacts, and workspace storage. Interactive cli mode, one-shot chain-file execution, and the MCP agent front end are implemented clients over the same application services. hovel tui is an explicit not-implemented role. The daemon publishes a stable OpenAPI-described local HTTP/JSON contract; a remotely authenticated REST deployment, general managed-service processes, and richer MCP resources and prompts remain future work.

Start here

00 // Use User guide Run Hovel, throw a saved chain, build a chain interactively, inspect results, and operate sessions with generated demos. 01 // Read Introduction What Hovel is, what is implemented, and what remains future work. 02 // Read Architecture Daemon contract, application services, command registry. 03 // Read Modules & services Runtime, lifecycle, Python SDK, protocol position. 04 // Read Testing strategy Task-backed local gates, CI jobs, test layers, and coverage goals. 05 // Build Development guide Task entry points, partial-checkout checks, slice boundaries, and development decisions. // Full Book index Every chapter, in order. // Safety Scope & trust What Hovel is for, and what it is not. // Build Write a module Python, Go, and Rust SDKs over one stdio JSON-RPC protocol. // Trust TLS & Workspace PKI Authorities, profiles, encrypted custody, trust sets, assignments, rotation, revocation, and post-quantum-hybrid TLS policy. // Operate TLS Operations A start-to-finish runbook for issuing, assigning, delivering, rotating, revoking, and auditing certificates. // Route Mesh Development Build the smallest useful provider, add listening posts, route ordinary modules, and consume assignment-bound TLS material. // Modules Module catalogue Integrated module spaces with user guides, build notes, tests, and references. // API SDK API Reference Generated Python, Go, and Rust SDK reference from source docs. // CI Test Report Static Bazel test evidence with suite, target, case, log, XML, and artifact drilldown.

Build it

Everything goes through Task — the single entry point. Run task --list to see all commands.

task checkout:status
task check   # available-slice gate for partial checkouts
task build
task test
task ci      # full-checkout guard plus wired core gate