[CORE] Build cortexd system daemon (C++ native with llama.cpp)

[mikejmorgan-ai]

Problem

Cortex currently runs as a CLI tool invoked per-command. No persistent system presence or proactive capabilities.

Solution

Create cortexd - a native C++ daemon that:

• Runs as systemd service on boot
• Embeds llama.cpp for local inference (no Ollama dependency)
• Monitors system state continuously
• Exposes Unix socket for cortex CLI
• Provides proactive security alerts and suggestions

Architecture

┌─────────────────────────────────────────┐
│              cortex CLI                  │
│           (Python, user-facing)          │
└─────────────────┬───────────────────────┘
                  │ Unix Socket
                  ▼
┌─────────────────────────────────────────┐
│              cortexd                     │
│         (C++ daemon, systemd)            │
│  ┌─────────────────────────────────┐    │
│  │  llama.cpp (embedded inference) │    │
│  └─────────────────────────────────┘    │
│  ┌─────────────────────────────────┐    │
│  │  System Monitor (apt, dpkg, CVE)│    │
│  └─────────────────────────────────┘    │
└─────────────────────────────────────────┘

Technical Requirements

• Single static binary preferred
• Must start in < 1 second
• Memory footprint < 50MB idle (< 150MB with model)
• Logging to journald
• Graceful shutdown handling
• Consider sd-bus for D-Bus integration

Acceptance Criteria

• C++ daemon compiles on Ubuntu 22.04/24.04
• systemd service unit (cortexd.service)
• Unix socket API (/run/cortex.sock)
• Embedded llama.cpp inference working
• Basic system monitoring (disk, memory, apt state)
• CLI can communicate with daemon
• Documentation for building and installing

Dependencies

• Blocked by: Architecture doc (this issue's sibling)
• Enables: [FEATURE] AI Shell with lightweight apt-trained model for natural language command generation #424 (tiny model), [FEATURE] [CRITICAL] Autonomous Security Vulnerability Management & Patching #422 (security patching)

Bounty: $200 (+ $200 bonus after funding)

Paid on merge to main.

This is a critical path item for the 'AI operating system' vision.

[aybanda]

I'd like to work on this

[Anshgrover23]

@aybanda This Issue is assigned to the team, you can pick this One: #363

[sujay-d07]

Cortexd Daemon — Complete Architecture Design

Overview

This proposes a production-grade C++ daemon designed from scratch to fulfill all issue requirements.
The architecture is clean, modular, and extensible, with strong separation of concerns and systemd-native behavior.

---

High-Level Architecture

┌──────────────────────────────────────────────────────────────────────────────┐
│                              CORTEX CLI (Python)                             │
│                     cortex daemon status | health | alerts                   │
└───────────────────────────────────┬──────────────────────────────────────────┘
                                    │
                                    │ Unix Domain Socket (JSON-RPC)
                                    │ /run/cortex.sock
                                    ▼
┌──────────────────────────────────────────────────────────────────────────────┐
│                              CORTEXD (C++ Daemon)                            │
│  ┌────────────────────────────────────────────────────────────────────────┐  │
│  │                         MAIN EVENT LOOP                                │  │
│  │  ┌──────────────┐  ┌──────────────┐  ┌──────────────┐  ┌────────────┐  │  │
│  │  │   Signal     │  │   Timer      │  │   Socket     │  │  Shutdown  │  │  │
│  │  │   Handler    │  │   Events     │  │   Events     │  │ Coorinator │  │  │
│  │  └──────────────┘  └──────────────┘  └──────────────┘  └────────────┘  │  │
│  └────────────────────────────────────────────────────────────────────────┘  │
│                                                                              │
│  ┌─────────────────────────────────────────────────────────────────────────┐ │
│  │                              SERVICES                                   │ │
│  │  ┌─────────────────┐  ┌─────────────────┐  ┌─────────────────────────┐  │ │
│  │  │ IPC Server      │  │ System Monitor  │  │ LLM Engine              │  │ │
│  │  │ • JSON-RPC      │  │ • APT watcher   │  │ • llama.cpp wrapper     │  │ │
│  │  │ • Routing       │  │ • Disk/Memory   │  │ • Inference queue       │  │ │
│  │  │ • Responses     │  │ • CVE scan      │  │ • Context mgmt          │  │ │
│  │  └────────┬────────┘  └────────┬────────┘  └────────────┬────────────┘ │ │
│  └───────────┼─────────────────────┼───────────────────────┼───────────────┘ │
│              │                     │                       │                │
│  ┌───────────┴─────────────────────┴───────────────────────┴───────────────┐ │
│  │                           SHARED COMPONENTS                             │ │
│  │  Config Manager | Alert Manager | Logger (journald) | Metrics Collector │ │
│  └─────────────────────────────────────────────────────────────────────────┘ │
│                                                                              │
│  ┌─────────────────────────────────────────────────────────────────────────┐ │
│  │                           DATA STORES                                   │ │
│  │  Alert Store (SQLite) | Metrics Store (ring buffer) | Config (YAML)     │ │
│  └─────────────────────────────────────────────────────────────────────────┘ │
└──────────────────────────────────────────────────────────────────────────────┘
                                    │
                                    │ systemd integration
                                    ▼
┌──────────────────────────────────────────────────────────────────────────────┐
│                              SYSTEMD                                         │
│  • cortexd.service (Type=notify)                                             │
│  • cortexd.socket (socket activation)                                        │
│  • journald logging                                                          │
│  • Watchdog monitoring                                                       │
└──────────────────────────────────────────────────────────────────────────────┘

---

Directory Structure

daemon/
├── CMakeLists.txt
├── README.md
├── include/
│   └── cortexd/
│       ├── common.h
│       ├── config.h
│       ├── logger.h
│       ├── ipc/
│       ├── monitor/
│       ├── llm/
│       ├── alerts/
│       └── core/
├── src/
│   ├── main.cpp
│   ├── core/
│   ├── config/
│   ├── ipc/
│   ├── monitor/
│   ├── llm/
│   ├── alerts/
│   └── utils/
├── systemd/
│   ├── cortexd.service
│   └── cortexd.socket
├── config/
│   ├── cortexd.yaml.example
│   └── cortexd.default
├── scripts/
│   ├── build.sh
│   ├── install.sh
│   └── uninstall.sh
└── tests/
    ├── unit/
    └── integration/

---

Implementation Plan

Phase 1 — Core Infrastructure

• CMake + build scripts

• Daemon lifecycle & signal handling

• systemd sd_notify

• Unix socket IPC + JSON-RPC

• journald logging

Phase 2 — System Monitoring

• Memory (/proc/meminfo)

• Disk (statvfs)

• CPU (/proc/stat)

• APT update detection

• CVE scanning + caching

• Alert lifecycle (SQLite)

Phase 3 — LLM Integration

• llama.cpp backend

• Tokenization & context mgmt

• Inference queue + rate limiting

• Streaming support

Phase 4 — Integration & Polish

• Python CLI integration

• Tests (unit + IPC)

• Performance benchmarks

• Documentation

---

Threading Model

Main Thread
 ├─ Signal handling
 ├─ Service coordination
 └─ Graceful shutdown


IPC Thread
 └─ accept / recv / send


Monitor Thread
 └─ 5-minute system checks


LLM Thread
 └─ Inference queue processing

---

Key Design Decisions

Memory

• std::unique_ptr by default

• std::shared_ptr only when needed

• No raw new/delete

• Pre-allocated buffers

Error Handling

• No exceptions in hot paths

• std::optional / std::expected

• Full error context logging

• Graceful degradation

Security

• Drop privileges after socket bind

• Optional seccomp

• IPC input validation

• Request rate limiting

• No shell injection

---

Expected Performance

Metric | Target
Startup time | < 1s
Idle memory | < 50MB
Active memory | < 150MB
IPC latency | < 50ms
Monitor overhead | < 1% CPU

[yashranaway]

@Anshgrover23 Open for all or internally?

[Suyashd999]

@Anshgrover23 Open for all or internally?

already a dev working on this, please look into those issues which arent assigned yet

[Suyashd999]

#541
This PR will be split into three focused PRs for clarity and reviewability.
PR 1: Introduces the core daemon infrastructure with systemd integration and Unix socket IPC.
PR 2: Adds system monitoring and persistent alert management on top of the daemon.
PR 3: Completes the LLM story by embedding llama.cpp for local inference and removing HTTP-based LLM dependencies.