Daemon

The Signet daemon owns the HTTP API, dashboard, workspace database, background workers, diagnostics, telemetry, and harness-facing services. Its default local address is http://127.0.0.1:3850.

Lifecycle

signet daemon start
signet daemon stop
signet daemon restart
signet daemon status --json
signet daemon logs

Top-level signet start, signet stop, signet restart, and signet logs remain aliases. Prefer the signet daemon form in automation and operator runbooks.

A successful process start is not readiness. Verify both process state and readiness after a restart:

signet daemon status --json
curl -fsS http://127.0.0.1:3850/health/live
curl -fsS http://127.0.0.1:3850/health/ready

/health/live is a cheap process liveness probe. /health/ready includes readiness gates and can return a non-success response while the daemon is still starting or a required subsystem is unavailable.

Network binding

SIGNET_PORT defaults to 3850. SIGNET_BIND controls the listening interface. SIGNET_HOST is the daemon’s local-call host. SIGNET_PATH selects the workspace for the process.

The default network mode is loopback-only. For a trusted tailnet or private LAN, configure the workspace and restart:

network:
  mode: tailscale

signet daemon restart
signet daemon status --json

A deployment manager can override the bind address explicitly:

SIGNET_BIND=0.0.0.0 SIGNET_PORT=3850 signet daemon start

An exposed interface is not an authentication setting. Use auth.mode: team for an untrusted or Internet-facing deployment. hybrid is convenient for a trusted workstation, but is not a public reverse-proxy security boundary. See Authentication and Self-Hosting.

Runtime configuration

The daemon loads agent.yaml from the selected workspace. Some files and service settings can be observed after startup, but long-running pipeline workers begin from a configuration snapshot. Restart after changing pipeline, embedding, inference, auth, or network configuration.

A configured workspace is not treated as first-run state after it disappears. The daemon exits before creating .daemon/, opening SQLite, or writing plugin and telemetry state when the selected workspace is missing or incomplete. Use signet workspace status to inspect the state, then restore the configured path or run an explicit setup or replacement action.

signet daemon restart
signet daemon status --json

Do not assume a file watcher makes every configuration key live. Use /api/status, /api/pipeline/status, readiness, and representative operator checks to confirm the intended effect.

Operator endpoints

Endpoint	Purpose
`/health`, `/health/live`, `/health/ready`	Liveness and readiness probes.
`/api/status`	Daemon, binding, workspace, runtime, and update state.
`/api/pipeline/status`	Pipeline state and runtime configuration summary.
`/api/diagnostics`	Health report for authenticated operators where required.
`/api/repair/*`	Explicit repair actions with admin protection.
`/api/analytics/`, `/api/telemetry/`, `/api/timeline/*`	Operational metrics and investigation surfaces.

The full request and response surface is in HTTP API. Do not automate against a dashboard rendering when an API endpoint exists.

Logs and local state

Runtime state lives under $SIGNET_WORKSPACE/.daemon/. By default, daemon logs are written there; SIGNET_LOG_FILE can select an explicit log file and SIGNET_LOG_DIR can select a log directory. Use the CLI first:

signet daemon logs

If the daemon will not start, capture the exact validation error and preserve the workspace before changing data. Do not delete the SQLite database, auth secret, or PID file as a routine recovery step.

Persistent deployment

The CLI manages daemon lifecycle; first-party persistent container deployment is documented in Self-Hosting. If you run a host service manager, make it own a single daemon process, set SIGNET_PATH and networking explicitly, and verify restart behavior with health probes. Do not point multiple writers at one workspace.