Plugins and extensions
Plugins are signed extension packages that augment Speedwave with backend integration workers or Claude Code prompt assets (skills, custom commands, subagents, and hooks). Speedwave follows an open-core model: the core platform is licensed under Apache 2.0, while plugins are authored, verified, and distributed by Speednet.
Every plugin is packaged as an Ed25519-signed ZIP archive. Speedwave verifies cryptographic signatures on every filesystem access: installation, container compilation, resource mounting, catalog rendering, and startup audits. Any unauthorized byte modification invalidates the digest, preventing execution.
Plugins are installed globally for your user environment and enabled per workspace. Scoped service credentials are maintained independently per project. Worker containers adhere to Speedwave’s security baseline: dropped privileges, read-only root filesystems, and unprivileged user accounts.
For architectural details on signature verification, consult the Plugin mechanism.