Skip to main content

File System

Every operation works against a single distributed, shared filesystem, rooted at cracken://. It is distributed because an operation can run across several Tentacles on different hosts and networks; it is shared because those Tentacles and the platform all read and write the same storage instead of leaving files on whichever Tentacle happened to run a step. That is why an operation can hand off between Tentacles, why a report written earlier is still there later, and why captured artifacts stay reachable after a step finishes.

At a glance​

  • What it is — One distributed, shared filesystem per operation, rooted at cracken://, that every Tentacle and the platform read and write.
  • When you touch it — Retrieving tool results and captured evidence, finding reports and outputs, or (soon) connecting your own tools over WebDAV.
  • What lives here — Shared library and playbook content, plus per-operation assets, tool results, and outputs.
  • Related objects — Operations, Reporting, Tentacles

The tree​

cracken://
├── shared/
│   └── library/                system playbooks & skills, shipped by Cracken
├── tenant/
│   └── library/                your tenant's own playbooks & skills
└── realm/
    └── operations/
        └── <operation-uuid>/
            ├── assets/         inputs the operation reads
            ├── tool_results/   raw output every tool run captures
            ├── outputs/        deliverables the agent writes
            └── playbook/       the playbook bundle staged for this run
  • shared/library/ — Cracken's system playbooks and skills, available to every tenant. Read-only.
  • tenant/library/ — your tenant's own playbooks and skills. The markdown here is the source of truth: editing a playbook or skill in the product writes to this file, and running an operation reads it back. Changed through the product's playbook and skill tools, not by arbitrary edits.
  • realm/operations/<operation-uuid>/assets/ — the files an operation reads: scope files and evidence you upload, plus the playbook assets staged for the run.
  • realm/operations/<operation-uuid>/tool_results/ — the raw output each tool run captures (command output, a browser screenshot, a scan log), grouped per run. This is the evidence that feeds later steps and artifact capture. Written by the operation; read-only to you.
  • realm/operations/<operation-uuid>/outputs/ — the operation's deliverables: the reports and documents the agent authors, downloadable as PDF or Markdown. Read-write.
  • realm/operations/<operation-uuid>/playbook/ — the playbook bundle staged for this operation. Runtime-managed.

Everything is scoped: shared/ spans the deployment, tenant/ is your tenant, and realm/ narrows to one realm and one operation — so one realm's work is never visible from another.

How Tentacles connect​

Every Tentacle in a realm mounts this filesystem, so they all read and write the same files — the agent picks up on one Tentacle exactly where another left off, and the backend and the operation ledger see the same state.

The exception is the account-gated Covert deployment (Tentacles). A Covert Tentacle is not given the full shared mount; to keep its footprint on the target host minimal, it receives only the specific assets an instruction needs, staged per-operation, rather than the whole filesystem. Everything else on this page describes a normally connected Tentacle.

Connect your own tools Coming soon​

The filesystem is served over WebDAV — the same protocol the Tentacles use to mount it. The plan is to let you point your own file client at it over the network — Finder, Windows Explorer, rclone, or a code editor — and work these files directly: whatever you drop in is shared with the backend and with every Tentacle in the realm, so your own scripts and tools sit alongside the agent's on the same storage.

Today the WebDAV endpoint authenticates as a Tentacle, so a direct user connection from your laptop is not yet exposed. The protocol and server are already in place; the user-facing connect flow is what is still landing.

Next steps​

  • Reporting — download the deliverables the agent writes to outputs/.
  • Operations — the work that reads and writes these files.
  • Realms — the boundary that scopes the filesystem.