Concept

Playbooks, signing & packs

A playbook is a JSON file describing steps the agent should attempt in order. Only steps marked autoApply: trueexecute unattended; everything else is dry-run and logged as needs-approval for you to review in the PWA.

Safe by default

Destructive verbs (kubectl delete/drain, git push --force, Jira DELETE /issue/{id}) force approval unless the step sets acknowledgeDestructive: true AND the playbook is Ed25519-signed with --enforce-signatures --trusted-pubkey. Runtime enforcement, not just lint.

Signing

aarmos playbook keygen writes an Ed25519 keypair; aarmos playbook sign seals a playbook so tampering invalidates the signature.

Packs

Packs (aarmos pack install/list/verify) are signed JSON bundles of playbooks + scope allowlists. Installing a pack widens the shell/http/mcp allowlists for that workspace only.

Attestation

aarmos attest produces a single JSON bundle: hash-chained receipts within a time window, the playbook hash, the policy config hash, installed pack hashes, and a sequential rootHash — optionally signed. aarmos verify re-computes and checks it offline.

See FAQ · headless runs and FAQ · signing & packs.