A signed package receives a limited set of hardware, MAVLink, telemetry, mission and network capabilities, runs as a separate process and communicates with the host through verifiable IPC. An extension failure must not stop flight-critical services.
The extension model and CLI are described as a target contract; the KairOS registry, signing root and public SDK have not yet been released.
KairOS repository ↗On this page +
Five protective boundaries
Package
An extension is packaged as a .kairosplug with a manifest, version, entry point, requested capabilities and signature.
Trust
The Ed25519 signature is verified before extraction; the revocation list is applied at boot. Unsigned packages are allowed only in developer mode.
Operator grant
Permissions are shown to the user before installation; sensitive permissions require a separate additional confirmation.
Process boundary
Each plugin runs in its own subprocess/cgroup with CPU, memory and PID limits.
Capability IPC
msgpack RPC over a Unix socket verifies the capability token on every host API call.
Permissions are grouped by actual resource
| Group | Example capabilities |
|---|---|
| Hardware | UART, I²C, SPI, GPIO, USB serial/UVC, CSI |
| MAVLink | Read, write and registration of an independent component |
| Telemetry | Subscribe, extend and publish events |
| Sensors / payload | Register a sensor or payload interface |
| Mission | Read, write and record mission data |
| Network | HTTPS egress only to the manifest allowlist |
A permission does not grant direct access to the entire system. For example, a UART permission should grant a specific device or brokered handle, while network egress should cover only predeclared domains. The operator can revoke a grant from Mission Control.
Manifest and minimal plugin context
name: cell-balance-monitor
version: 0.1.0
agent:
entry: cell_balance:run
capabilities:
- telemetry.read
- event.publishfrom kairos_sdk import PluginContext
async def run(ctx: PluginContext):
async for battery in ctx.telemetry.subscribe("telemetry.battery"):
cells = battery.get("cells", [])
if cells and max(cells) - min(cells) > 0.15:
await ctx.events.publish(
"alert.cell_imbalance",
{"spread_v": max(cells) - min(cells)},
)Installation, permissions, logs and tests
kairos plugin install ./thermal-cam.kairosplug
kairos plugin enable thermal-cam
kairos plugin list
kairos plugin disable <name>
kairos plugin remove <name>
kairos plugin info <name>
kairos plugin perms <name>
kairos plugin logs <name>
kairos plugin test <path>install verifies the package and signature, then displays requested permissions. enable starts the process only after a grant. info and perms support audits, logs support diagnostics, and test supports local authoring. Removal must stop the process and clear its scoped state without touching other extensions.
Three built-in plugins and device extensions
geofence
Checks position against permitted zones and publishes an observable event.
telemetry-logger
Records selected telemetry streams with storage limits and an explicit lifecycle.
mavlink-inspector
Displays frames for diagnostics without changing flight state by default.
Thermal camera
FLIR Lepton USB UVC, radiometric Y16, Celsius, palette/isotherm and MAVLink camera surface.
MAVLink Gimbal v2
External controller bridge, attitude command/status and component 154.
Separating the first release from later stages
| First target release | Next stage |
|---|---|
| Local signed install | Hosted searchable registry |
| Capability enforcement on every IPC call | Public standalone kairos_sdk package |
| Built-ins and CLI | Scaffolder and templates |
| Permission review and revocation | Install from a Git URL |
| Test runner | Shared driver layer and complete authoring documentation |