Concept

Coverage and status

The question that matters on any given morning is small and specific: is this thing governed right now? Aarmos answers it from facts it has observed, and refuses to answer it from configuration.

The four answers

Status	What it means	What earned it
Never enrolled	Aarmos has never seen this runtime take part in governance.	Nothing has happened yet.
Enrolled, not yet governed	A policy resolved and the runtime is configured, but no real decision has crossed the gate.	Configuration only. Configuration is a promise, not proof.
Governed	A real decision crossed the gate recently enough to still be inside the freshness window.	A governed decision, backed by a receipt.
Governance unconfirmed	This runtime was governed before, but nothing has crossed the gate inside the freshness window.	The last proof aged out. Aarmos says 'unconfirmed', never 'ungoverned' — it does not know which.

A live runtime is not a governed one

Aarmos tracks liveness and governance as two independent facts. A heartbeat proves a process answers; only a decision crossing the gate proves governance. A reachable runtime whose last governed decision is hours old is reported as unconfirmed, because that is precisely the case where a misconfigured agent is quietly bypassing the proxy.

The freshness window

Each binding declares how recently a governed decision must have been observed for coverage to still count as current. A busy production gateway may declare minutes; a nightly batch job may declare a day. The window is part of the policy binding, not a global constant, so Aarmos never invents a deadline your workload cannot meet.

Asking

aarmos status
aarmos status --runtime payments-dev
aarmos status --require-governed

Plain status reports the truth and exits successfully even when something is unconfirmed — reporting is not gating, and a status command that fails your shell every time a dev container went idle is a status command people stop running. Use --require-governed when you deliberately want CI to fail on anything less than governed.

Retiring a runtime

Ephemeral containers and CI runners would otherwise accumulate forever as permanent unconfirmed noise. Retiring one removes it from active reporting while keeping its history queryable — nothing is deleted.

aarmos retire payments-ci-1234

In the browser

The Operations view shows the same answer, because it is the same answer: the runtime derives coverage and the browser renders what it derived. When no runtime is paired, Aarmos says coverage is unknown rather than showing an empty, reassuring page.