AVAR spec

Aarmos Verifiable Action Record · AVAR 1.0 (Normative) · avar/1

Receipts that survive the vendor.

AVAR is the receipt format Aarmos emits for every agent turn. It is open, unencumbered, and portable. Every AVAR bundle verifies against nothing but the Ed25519 public keys included with it — no Aarmos service required, no proprietary parser, no license lookup.

The commitment. AVAR is not a proprietary format we hold hostage. The spec is public, the verifier ships as a portable Apache-2.0 artifact (npm + standalone binary + in-browser Wasm) that runs offline against nothing but the keys in the bundle, and we refuse to build format lock-in as a moat. If we disappear, your evidence still verifies.
Spec is public. AVAR 1.0 (Normative) — the spec text, changelog, and examples live at github.com/Aarmatix/avar-spec. Spec text is licensed CC-BY-4.0; the open reference verifier @avar-standard/verify ships on npm under Apache-2.0 — zero-dependency, browser + Node.
Independent reference verifier. A clean-room verifier lives at github.com/Aarmatix/avar — Apache-2.0, derived only from the public spec text (see CLEAN-ROOM.md). It carries no code lineage from the shipped Aarmos verifier and exists so that receipts are checked against the standard rather than against a single vendor. The conformance suite at github.com/Aarmatix/avar-conformance (dual-licensed CC BY 4.0 for vectors, Apache-2.0 for the harness) lets any implementation self-certify.
Status: AVAR 1.0 (Normative). The wire format, canonical JSON rules, and chain algorithm are frozen, and the normative fixtures are the specification of record — an implementation conforms when it reproduces them. Additive changes land as minor revisions (avar/1.1, avar/1.2) that stay readable by earlier avar/1 verifiers.
v2 extension. Access-model receipts add an x-access-v2 block (action, resource, tenant, policy_hash, obligation ledger) inside each entry. The extension is additive — older avar/1 verifiers ignore it per §2.3. Vocabulary at /docs/actions.

Bundle layout

An AVAR bundle is a ZIP archive with a fixed member set. See spec §5 for the normative definition.

bundle.avar.zip
├── SPEC-VERSION        # exact bytes: "avar/1"
├── manifest.json       # bundle metadata, entry count, chain tips
├── entries.ndjson      # one signed AvarEntry per line, chain-ordered
└── pubkeys.json        # { kid → raw Ed25519 public key (base64url) }

Verification algorithm

Every conforming verifier — the browser drop-zone, the CLI, and @avar-standard/verify — runs the same steps against the bundle. See spec §6 for the normative sequence.

  1. Read SPEC-VERSION; reject unknown majors.
  2. Parse manifest.json and pubkeys.json. Load each entry from entries.ndjson.
  3. For each entry, canonically re-serialize the signed body (entry minus signature and devicePubKey) and verify Ed25519 against the devicePubKey in pubkeys.json for the matching kid.
  4. Recompute each entry hash from its canonical bytes; recompute per-step hashes; check that prevHash chains correctly from genesis.
  5. Emit a VerificationReport: overall verdict plus per-entry status (valid, unsigned, tampered, unchained).

What AVAR does not carry

  • Full prompts, chats, or tool-call arguments in the clear — only content hashes.
  • User credentials or vault contents.
  • Any pointer to Aarmos-hosted services. AVAR is a self-contained evidence file.

Verifier

Verification ships in three parity-tested runtimes: the browser drop-zone at /trust/verify, the aarmos verify command in @aarmos/cli, and the open @avar-standard/verify library. All three call the same verifyBundle() — divergence is guarded by golden fixtures in the spec repo.

aarmos verify path/to/bundle.avar.zip

✓ verdict: valid
  entries:   N
  signed:    N
  unsigned:  0
  unchained: 0

verified locally — no Aarmos service was contacted.

← Back to quickstart · Trust & governance