Protocol adapter · 3 of 3
Deep-link / webhook transport adapter
The deep-link adapter performs a capability-scope check. For a configured HTTP webhook it submits the request; for a custom URL scheme it returns an intent record. Execution of that intent is host-specific. It does not itself make the canonical policy decision, check Authority, durably capture an Attempt, or produce AVAR evidence.
Availability
How you get the software. Aarmos is distributed to authorized workspaces as signed artifacts. Signing in establishes your account; evaluation access requires approval. Once approved, your evaluation workspace is created and the 30-day evaluation period begins. Nothing downloads until you ask for it. Public npm is not a supported distribution channel for Aarmos product or runtime packages. The open AVAR verification and conformance packages are the supported public npm surface, so anyone can check a receipt without our software.
The CLI is not publicly distributed. This page describes the adapter interface, not an available software release or a qualified deployment procedure.
Standalone interface example
This reference example assumes the adapter and its transport configuration are already supplied. It is not a policy configuration or a governed execution example.
const result = await deeplinkAdapter.invoke({
target: "deeplink://ops/post",
args: { text: "example notification" },
});Transport and governance boundaries
- HTTP webhook dispatch and custom-scheme intent creation are distinct operations. An intent record does not prove an OS hand-off occurred.
- The standalone adapter performs scope checks, not canonical consequence governance.
- Governed use requires the supported composed runtime integration; direct adapter use can operate outside that boundary.
- Live enforcement qualification is limited to the governed email-send path; it does not qualify this deep-link or webhook interface.
For a governed deployment, the agent must use the supported runtime entry point. Direct target credentials or another network route can bypass it; installing an adapter alone does not prevent that access. Browser policy controls and Bridge permissions are distinct from customer-operated runtime governance.
Evidence describes authorization, attempts, forwarding and observations within the supported visibility boundary. It does not establish a downstream business outcome.
See the threat model for deployment responsibilities and limits.