First week

First week

2026-07-23

Historical recap, not a current availability or qualification statement. The evaluation CLI and standalone verifier binary are not publicly distributed; the receipt specification is not currently publicly published.

Aarmos is now live as the governance runtime for AI agents. This first week was about making the core trust story concrete — not with slides, but with things you can click, download, and verify yourself.

What shipped

  • Verification Showcase — drop any .avar.zip receipt at /trust/verify and verify signatures, hash-chain integrity, and governance provenance entirely in your browser. Nothing is uploaded.
  • SIEM dry-run preview — preview the exact payloads for Splunk HEC, Datadog Logs, webhooks, syslog, CEF, LEEF, and NDJSON (shipped that week as a preview page; it has since become staff-only).
  • Signed release pipeline (stage 1) — every avar release now ships with SHA-256 checksums, GitHub build-provenance attestation (SLSA), and Sigstore keyless cosign signatures. Three independent trust roots, zero new secrets required.
  • CLI contract stable — public/docs/aarmos-cli-contract.v0.1.json is now marked stable, locking the install paths, adapter shapes, and receipt guarantees for the v0.1 generation.

What we verified

The browser verifier, the CLI verifier, and the standalone avar binary all produce the same verification result for the same bytes. That parity is the point: governance is only meaningful if it can be proven independently of the runtime that produced it.

What's next (and blocked on certs)

Apple notarization and Windows Authenticode signing are the two remaining platform-level trust improvements. Both require paid third-party credentials we do not yet have, so they stay on the blocked list until enrollment completes. Until then the three verification paths above let you check integrity and provenance independently — they don't remove the OS-level warning.

If you want to try the verification flow yourself, start at /see-it-govern, then check supported evidence in the browser verifier or with the public @avar-standard/verify library.