# Developing for Peios

> How to build software for Peios.

All of Developing for Peios as one markdown file: [/peios/developing-for-peios/print.md](/peios/developing-for-peios/print.md)

- [SDK Reference](/peios/developing-for-peios/sdk-reference.md): Header-by-header reference for the Peios SDK — the conventions every call follows, then security descriptors, tokens, access checks, files, processes, the registry, events, msgpack, and the registry-source interface.

## Debugging the kernel

- [Debugging the kernel](/peios/developing-for-peios/debugging-the-kernel/overview.md): The PKM subsystems — KACS, KMES, LCS — expose static tracepoints to the standard Linux tracing stack of ftrace, perf, and eBPF.
- [Kernel tracepoints](/peios/developing-for-peios/debugging-the-kernel/kernel-tracepoints.md): Enabling and reading the kacs:, kmes:, and lcs: tracepoint systems — at runtime through tracefs, at boot through the kernel command line.

## Documenting configuration

- [Writing regman pages](/peios/developing-for-peios/documenting-configuration/writing-regman-pages.md): How to document your package's registry keys so regman can explain them. You ship a .regman fragment in /usr/share/regman/; this is its fenced format, the fmt/lint workflow, and the rules the tools won't catch for you.

## SDK basics

- [What is the Peios SDK](/peios/developing-for-peios/sdk-basics/what-is-the-peios-sdk.md): The Peios SDK is the C-ABI library family you use to talk to Peios from your own programs — access control, the registry, and events. Its first and largest member is libpeios.
- [Installing and linking](/peios/developing-for-peios/sdk-basics/installing-and-linking.md): The packages that make up libpeios, the headers you include, and how to compile and link against the library — with pkg-config, by hand, statically, and from non-C languages.
- [Your first program](/peios/developing-for-peios/sdk-basics/your-first-program.md): A small, complete C program that parses a security descriptor, reads its owner, and formats the SID back to text — putting the two-call protocol, views, and the error model to work.
- [Using the SDK from Rust](/peios/developing-for-peios/sdk-basics/using-the-sdk-from-rust.md): The Peios SDK ships first-class Rust bindings — the peios-sys raw FFI crate and the safe, idiomatic peios wrapper. This page is the on-ramp; the crate's rustdoc is the API reference.

## Access control

- [Access control overview](/peios/developing-for-peios/sdk-access-control/overview.md): How the KACS pieces fit together from a developer's seat — identities, tokens, security descriptors, and access checks — and which part of the SDK you reach for.
- [Working with tokens](/peios/developing-for-peios/sdk-access-control/working-with-tokens.md): Answer "who am I?", "who is calling me?", and "act as someone else" with the KACS token API — opening tokens, peer identity over sockets, impersonation, and dropping privilege.
- [Checking access](/peios/developing-for-peios/sdk-access-control/checking-access.md): Make an authorisation decision end to end — build a security descriptor, run an access check against a token, and interpret the granted mask.
- [Securing files](/peios/developing-for-peios/sdk-access-control/securing-files.md): Open files the native KACS way, and read and write a file's security descriptor by path or by fd.
- [Hardening a process](/peios/developing-for-peios/sdk-access-control/hardening-a-process.md): Turn on process mitigations to harden your program, and understand the one-way, fail-closed semantics.

## The registry

- [Registry overview](/peios/developing-for-peios/sdk-registry/overview.md): How LCS — the layered registry — works from a developer's seat: keys, values, layers and precedence, transactions, and watches.
- [Reading and writing](/peios/developing-for-peios/sdk-registry/reading-and-writing.md): Open a registry key, read its effective values, write into a layer, enumerate, and do lost-update-safe updates with compare-and-swap.
- [Watching and transactions](/peios/developing-for-peios/sdk-registry/watching-and-transactions.md): React to registry changes through a pollable key fd, and apply multi-step edits atomically with transactions.

## Events

- [Events overview](/peios/developing-for-peios/sdk-events/overview.md): How KMES works from a developer's seat — the single event path, per-CPU ring buffers, trusted metadata, and MessagePack payloads.
- [Emitting events](/peios/developing-for-peios/sdk-events/emitting-events.md): Build a MessagePack payload and emit an event — singly, and in batches for high-rate producers.
- [Consuming events](/peios/developing-for-peios/sdk-events/consuming-events.md): Drain the per-CPU KMES rings with the high-level reader, parse payloads, track lost events, and know when to drop to the low-level ring API.

## Registry sources

- [Registry sources overview](/peios/developing-for-peios/registry-sources/overview.md): What a registry source is, how the RSI protocol flows, and the shape of a source's serve loop — the provider side of the registry, built with librsi.
- [Registering a source](/peios/developing-for-peios/registry-sources/registering-a-source.md): Declare the hives your source backs and register with the kernel to obtain the source fd.
- [Serving requests](/peios/developing-for-peios/registry-sources/serving-requests.md): The source serve loop end to end — read a framed request, parse its header, dispatch on the op-code, and decode the payload with its typed parser.
- [Building responses](/peios/developing-for-peios/registry-sources/building-responses.md): Reply to RSI requests the right way — status-only for most ops and failures, payload-bearing helpers for the five ops that return data, and the validation contract to respect.

## DWE

- [What DWE is](/peios/developing-for-peios/dwe/what-dwe-is.md): Developer Workflow Embeddings — development paths built into core Peios software. Its first component, dwed, is an unauthenticated SYSTEM control surface that lets you drive a running machine from outside, across as long as an investigation takes.
- [Driving a machine](/peios/developing-for-peios/dwe/driving-a-machine.md): Booting a Peios machine with a vsock device, pointing the dwe client at it, and running commands, moving files and detaching long work that outlives the connection.
- [The DWE protocol](/peios/developing-for-peios/dwe/protocol.md): The dwed wire protocol — newline-delimited JSON over vsock or TCP, the request and reply shapes for every operation, error codes, and the transport and versioning rules.