Smash Quickstart -- 30 minutes to your first audit-chained action

01Install the binaries

The install script detects your OS and architecture (macOS arm64, macOS x86_64, Linux x86_64) and drops 30 CLIs plus 5 daemons into ~/.local/bin. Make sure that directory is on your PATH.

$ curl -sSf https://smsh.run/api/install | bash $ echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.zshrc $ exec zsh $ smash --version smash 4.6.159

During early access, the install endpoint returns a polite scaffold and asks you to email support@smsh.run for binary delivery tailored to your platform. Public release is on the way.

02Request a developer key and log in

Smash production binaries fail closed without an API key. Request a 30-day developer key, then save it locally with smash auth login. The key is encrypted at rest in ~/.config/smash/credentials with file mode 0600.

# browser $ open https://smsh.run/access # once you have your key $ smash auth login --token smsh_dev_xxxxxxxxxxxxxxxxxxxx ok credentials saved key: *******************xxxx file: /Users/you/.config/smash/credentials $ smash auth status active source : stored active key : *******************xxxx

For CI, scripts, or ephemeral shells, the SMASH_API_KEY environment variable still works and takes precedence over stored credentials. For SCIF, IC, or air-gap deployments, key issuance goes through a different path -- email support@smsh.run directly.

03Initialize the substrate

smash init spins up the five daemons (mema, noisa, toda, tima, comintela), runs a self-test, writes agent-kit Markdown templates for Claude Code / Cursor / Gemini if those configs exist, and registers a session hook so subsequent agent sessions inherit the cold-start ritual.

$ cd ~/your-repo $ smash init [smash init] starting daemons (mema, noisa, toda, tima, comintela)... ok [smash init] writing CLAUDE.md cold-start ritual... ok [smash init] registering .husky/post-commit hook... ok [smash init] self-test passed in 1.4s $ smash status

Re-running smash init is safe; it is idempotent. Templates skip files that already exist unless you pass --force.

04Meet the substrate

The substrate is six daemons composing through shared memory, tasks, real-time feed, scheduling, and protocol. Every CLI talks to them. You will use these constantly.

mema

Persistent typed memory store. 19 memory types (Fact, Decision, Problem, Episodic, Semantic, Goal and more). Records survive sessions, link via CRNs, and are queryable across every tool.

toda

Task tracking. Priorities, contexts, blocking relations, AHP claim handoffs. toda add, toda complete, toda search --all. Tasks live in named contexts so projects do not contaminate each other.

noisa

Real-time activity feed. 400-character posts that show what an agent (or you) is doing right now. noisa post, noisa view. The agent-handoff context is how parallel sessions stay aware of each other.

tima

Scheduling and time tracking. Cron-like recurring jobs, single-shot reminders, time logs against contexts. Pair with TOML pipeline templates to automate without writing shell scripts.

handa

Agent Handoff Protocol (AHP). Claim a task, post claim+completion handoffs, validate the round-trip with handa selftest. Designed so multi-agent work has a tamper-evident chain across the substrate.

tracea

BLAKE3 audit chain verification. Every action lands in a hash-chained log. tracea verify proves the chain has not been tampered with; tracea certificate emits compliance-ready artifacts.

05A five-minute dogfood loop

The fastest way to feel the substrate is to use it. Capture a decision, track the work, post status, schedule a follow-up, and verify the audit chain.

# 1. Capture a decision $ mema add --type Decision --context my-project \ "Switch the parser from regex to a proper PEG; regex hits 0.92 on the corpus." # 2. Track the follow-up work $ toda add "Migrate parser to pest 2.x" \ --context my-project --priority 4 --tags "refactor,parser" # 3. Post status to the feed $ noisa post --context my-project -- \ "Decision recorded; opened toda for parser migration." # 4. Schedule a check-in $ tima add "review parser migration" \ --context my-project --in 2d # 5. Prove nothing was tampered with $ tracea verify audit chain valid=true entries=128,079 daemons=4

Every command above wrote to a BLAKE3-anchored log. Every command above is queryable across tools by context. This is what we mean by sovereign intelligence: the substrate is the long-term memory and the audit trail in one piece.

06Gotchas to save you an hour

noisa posts have a 400-character hard limit.

The server rejects anything longer. Offload detail to mema; treat noisa as the log line, not the log file.

BLAKE3 is the default hash everywhere.

SHA-2 only appears inside FIPS / JWT / KMS-gated primitives where external standards force it. If you see SHA-256 in your output, something is wrong unless it is one of those gates.

Code comments are off by policy.

The shipped binaries enforce zero inline comments and zero AI attribution. If your team relies on comments, adjust your CI gate, not the code.

toda priorities are integers.

--priority 4, not --priority P4. The CLI rejects the prefixed form. Lower number = higher priority.

handa AHP is opt-in, not opt-out.

Use --ahp to engage the protocol. Older docs reference --no-ahp; that flag was removed.

toda search treats # as a hashtag, not a task ID.

For known IDs, use toda get <id> --context <ctx>. toda search --all searches across every context.

The first `mema` call after a fresh install can take 20-60 seconds.

The mema daemon backfills FTS indexes on startup over the entire memory corpus. Do not kill it; let it finish.

07Send feedback

Found a rough edge, a missing capability, or something that surprised you in a bad way? Tell us. The Smash design partner loop runs through email until the public issue tracker opens.

Email support@smsh.run with subject smash-feedback. Attach the relevant tracea certificate if you can; it makes everything reproducible. SCIF, IC, and air-gap deployments: same address, subject smash-secure.