Concept

AVAR receipts

Every allow, ask, or deny at the policy gate emits an AVAR — an Aarmos Verifiable Action Record. Receipts are hash-chained (each entry references the previous entry's hash) and Ed25519-signed, so later edits, reorders, or deletions are detectable offline.

Why portable matters

Receipts verify with the standalone avar binary. No Aarmos daemon, no network, no vendor account. You can hand a receipt bundle to an auditor and they can prove integrity with a single command.

What's inside

• Actor, tool, argument shape (credential-scrubbed), and verdict
• Policy-bundle fingerprint at decision time
• Timestamp and prior-entry hash
• Signature over the canonical bytes

See the open spec at /docs/avar-spec and rotation details in the key-rotation runbook.