/technology/capabilities/ · The whole surface
Every capability, its status, and the evidence.
Two things are described here and the label controls the tense. Harness is the open-source Rust core, and most of it is shipping in the public repo today. Cratefield is the managed service that would run it, and it is not running yet. Nothing below claims otherwise, and every shipping row links to the code that backs it.
Shippingmerged, tested, in the public repo Designedspecified in public issues, unbuilt Plannednamed, unspecified
| Capability | What it is | Status | Evidence |
|---|---|---|---|
| Harness core | Module trait, Harness builder, 23 ports, problem+json errors, request scope, event bus, template registry | Shipping | cratefield-core 0.10.1 |
| Edge runtime | D1, KV, rate limiting and wait_until mapped to ports | Shipping | cratefield-runtime-cloudflare 0.5.0 |
| Adapters | SQLite, Postgres, Resend, Turnstile, APNs, FCM, Web Push, Stripe, Polar and more | Shipping | 24 published adapter crates |
| Modules | 17 published module crates — email-signup, waitlist, cms, notifications, webhooks, telemetry and more; email-signup, waitlist and cms each declare a UI surface | Shipping | crates/module-* |
| fz CLI, conformance kit, contract versioning | CI: fmt, clippy -D warnings, tests, cargo deny, worker-build --release | Shipping | .github/workflows |
| Postgres adapter, native runtime | The same modules as a native tokio binary on Postgres; every module tested against both engines; fz data export moves a venture across | Shipping | #18–#21 |
| Payments | A Payments port with Stripe and Polar adapters — Stripe over the form-encoded REST API with HMAC webhook verification, Polar as merchant of record. No card data crosses the port | Shipping | #102, #690, cratefield-adapter-stripe 0.3.4, cratefield-adapter-polar 0.2.3 |
| Push | A Push port with an APNs adapter and an ES256 provider JWT. The code is merged and tested; a live send against Apple’s sandbox is not yet on the record | Shipping | #104, cratefield-adapter-apns 0.3.2 |
| Blob storage | A Blob port with an R2 adapter on the Cloudflare runtime and a directory adapter on the native one | Shipping | #105 |
| Realtime | A Realtime port with an in-process adapter, which is the native runtime’s half | Shipping | #103 |
| AI models | A TextModel port asked by tier, never by vendor: streaming, structured output, tool calling and image input, with Anthropic and OpenAI-compatible adapters — the latter at any base URL: OpenAI, OpenRouter, Workers AI’s compatible endpoint, or a local server | Shipping | anthropic, openai-compatible |
| Vector search | A VectorIndex port with namespace-scoped cosine search — exact in-process on the native runtime, Cloudflare Vectorize on the edge — and an Embedder port; no provider embedder ships yet, so the venture supplies its own | Shipping | #561 |
| Classifier | A Classifier port for typed, calibrated decisions over batched questions, with adapters over a purpose-trained model, over any wired TextModel, and over Workers AI | Shipping | typesafe, classifier-llm, workers-ai |
| Declared tables and data API | Tables declared in the venture manifest become DDL, row validation and a JSON Schema view, served as permission-checked CRUD routes with a typed client generated from the published contract | Shipping | #153, tables |
Outbound mail over the Mailer port — Resend or Owlpost — venture-themed HTML and plain-text templates, and inbound mail verified and deduplicated before a module sees it | Shipping | resend, owlpost, mail-templates | |
| Background work | Cron-scheduled jobs fanned out to every module on both runtimes, a transactional outbox with at-least-once delivery, an inbox dedup ledger, and deferred work that outlives the response | Shipping | cratefield-core |
| Tracker | Filing into someone else’s tracker with per-tenant, envelope-encrypted credentials — GitHub Issues, Jira, Linear, or a signed webhook | Shipping | github-issues, jira, linear, webhook-tracker |
| Usage metering | A durable per-subject allowance counter — what a subject may spend this period and what they have spent, checked locally before the network call | Shipping | #588 |
| Telemetry | Counted aggregate usage telemetry with a consent model built in — pseudonymous, failing closed, accumulated in the venture’s own database | Shipping | telemetry |
| Custom hostnames | Customer-owned hostnames served by the venture over Cloudflare for SaaS; refusals are recorded failures, not silent | Shipping | cloudflare-saas, #590 |
| Orgs | Organizations, memberships, roles, invitations, service accounts, access grants and an audit log | Shipping | orgs |
| Connections | Per-subject OAuth connections — authorize, sealed token storage, refresh, revoke — with presets for X, Google, LinkedIn, Vercel, GitLab and Linear | Shipping | connections, oauth-client |
| Device auth | The OAuth 2.0 device authorization grant (RFC 8628): a client shows a code, a signed-in person approves it, and the venture’s issuer mints the credential | Shipping | device-auth, #587 |
| Outbound webhooks | Per-subscriber endpoints with HMAC-signed deliveries, exponential backoff, dead letters and replay | Shipping | webhooks, #536 |
| Privacy | Subject access and erasure driven by what each module declares it holds — one export or erase reaches the whole venture | Shipping | privacy |
| Changelog | A project’s GitHub releases or CHANGELOG.md mirrored into the venture’s own database and served over an API — reads hit the database, never GitHub | Shipping | changelog |
| Telegram | A TelegramBot port over the Telegram Bot API, with a module for bot-side state and flows | Shipping | telegram-bot, telegram |
| CRM | Contacts, organisations and tags, with an idempotent upsert API other modules can call | Shipping | crm |
| Sealed | The server half of client-side sealed blobs — opaque ciphertext at rest, crypto-shred erasure, no server-side recovery path | Shipping | sealed |
| Wallets, keys and guardrails | Link EVM and Solana wallets by signature; sign by key reference through a policy engine — hard denies, allowlists, required simulation, micro-USD caps, a kill switch and audit — with Turnkey as a provider | Shipping | wallets, guardrails, turnkey |
| i18n | Server-side localisation: Fluent catalogs, BCP 47 negotiation and text direction, shared by mail, push and the auto-constructed UI | Shipping | i18n |
| Supabase importer | A read-only inspect that classifies every schema object, RLS policy and auth provider, then moves auth users with a dry-run by default | Shipping | import-supabase |
| MCP server | The fz CLI as MCP tools — plan, deploy, add modules, verify — so a coding agent drives the same commands a developer would; served from source, not on crates.io | Shipping | mcp |
| Browser runtime | The same harness compiled to wasm on sqlite-wasm/OPFS for in-browser preview; unpublished, and not a third deployment target yet | Shipping | runtime-browser |
| Realtime at the edge | The same port backed by a Cloudflare Durable Object, so realtime works on the hosted runtime too. Specified, unbuilt | Designed | #103 |
| Notifications | One notify() call fans out across push (APNs on iOS, FCM on Android, Web Push for browsers and for Google-free Android over UnifiedPush, since both speak RFC 8030), an in-app inbox that needs no permission and updates live over the Realtime port, and email over the Mailer port with RFC 8058 one-click unsubscribe, each in the recipient’s own language resolved at delivery time | Designed | epic #192, #177–#191, #201 |
| Auto-constructed UI | Modules declare a surface; the harness serves /__surface, renders forms and admin pages at /ui, and ships a 4 KB embed for static sites | Shipping | cratefield-ui 0.4.2 |
| Auth: passkeys, Google | Sessions, account linking, authorization code + PKCE, ES256 JWTs with JWKS, and a client crate that verifies them | Shipping | auth-core, auth-passkeys, auth-oidc |
| Auth: the rest | Apple, Meta, email and password, magic links, rate limiting and lockout. Email and password needs the paid Workers plan: Argon2id at m=19456, t=2, p=1 is ~40 ms per verify and the free tier allows 10 ms of CPU | Shipping | Apple in auth-oidc; auth-meta, auth-password, auth-magic-link |
| Sidecar mount | A module as its own worker over a service binding, mounted at the same path, its surface merged into /__surface | Shipping | #57, #60, #76 |
| Sidecar programme | Build-artifact cache, cold-start handshake, module template, conformance parity across both mounts, deployment model (#67 decided for v1) | Designed | #56, #59, #61–#67 |
| Multi-tenant schema system | Per-tenant migration history and checksums ship; boot-time reconciliation and one database per tenant on the native runtime are specified, unbuilt | Designed | #23, #26–#36 |
| Secrets, KMS, audit | Two-tier secrets, envelope encryption, KMS trait, tamper-evident audit chain, key rotation | Shipping | cratefield-secrets 0.4.2, cratefield-kms 0.2.0 |
| Cratefield control plane | Sign in behind a whitelist, pick modules, connect Google, get a running backend: accounts, catalog, connections and the provisioning engine | Planned | building in the open · not running |
| Hosted on our account | Workers for Platforms, dispatch namespaces | Planned | a pre-scale upgrade, not adopted |
| Published crates | 65 crates on crates.io, MIT. cratefield-core is at 0.10.1. cargo add cratefield pulls the core and picks a runtime, adapters and modules by feature | Shipping | crates.io, version history |
Every published module has a page under /modules/, with the ports it asks for and the routes it serves. The managed control plane is being built in the open in Cratefield/harness. It is not running and not available, so it stays Planned, and no fee for it is purchasable; when it runs, this table says so.