Concept

Playbooks, signing & packs

The companion package is invoked as aarmos-bridge. Aarmos CLI software is not publicly distributed; commands here are reference examples, not instructions you can run today.

A playbook is a JSON file describing steps the agent should attempt in order. Only steps marked autoApply: trueexecute unattended; everything else is dry-run and logged as needs-approval for you to review in the PWA.

Safe by default

Destructive verbs (kubectl delete/drain, git push --force, Jira DELETE /issue/{id}) force approval unless the step sets acknowledgeDestructive: true AND the playbook is Ed25519-signed with --enforce-signatures --trusted-pubkey. Runtime enforcement, not just lint.

Signing

aarmos-bridge playbook keygen writes an Ed25519 keypair; aarmos-bridge playbook sign seals a playbook so tampering invalidates the signature.

Packs

Packs (aarmos-bridge pack install/list/verify) are signed JSON bundles of playbooks + scope allowlists. Installing a pack widens the shell/http/mcp allowlists for that workspace only.

Attestation

aarmos-bridge attest produces a single JSON bundle: hash-chained receipts within a time window, the playbook hash, the policy config hash, installed pack hashes, and a sequential rootHash — optionally signed. aarmos-bridge attest verify --file <bundle> re-computes and checks it offline.

See FAQ · headless runs and FAQ · signing & packs.