Framework guide · AutoGen (agentchat)

AutoGen under Aarmos in 60 seconds.

The CLI is not publicly distributed. Commands on this page are reference examples, not instructions you can run today.

Keep your existing AutoGen assistant exactly as-is. No aarmos import, no framework wrapper. HTTP clients configured to honor the proxy settings can route their calls through the local Aarmos proxy. Calls that ignore those settings are outside this path.

0 · Sanity-check your environment

aarmos doctor

1 · Start the daemon

aarmos daemon
▸ listening on 127.0.0.1:7681
▸ policy: ./aarmos.json

2 · Your existing AutoGen assistant — unchanged

# src/agent.py — stock AutoGen. No aarmos imports.
import asyncio
from autogen_agentchat.agents import AssistantAgent
from autogen_ext.models.openai import OpenAIChatCompletionClient

async def main():
    model = OpenAIChatCompletionClient(model="gpt-4o-mini")
    agent = AssistantAgent(name="assistant", model_client=model,
                           system_message="Answer in one sentence.")
    result = await agent.run(task="What is a receipt?")
    print(result.messages[-1].content)

asyncio.run(main())

3 · Run it under Aarmos

aarmos proxy &                 # start the local runtime (mints a session)
eval "$(aarmos env)"           # authenticated HTTPS_PROXY + HTTP_PROXY
python src/agent.py

▸ gate: api.openai.com  (verb: communicate)  ✓ allowed
▸ AVAR receipt: .aarmos/avar/2026-…json

4 · Export and verify the evidence

aarmos keys init                                  # once: local evidence-signing key
aarmos incident export --last 24h --out ev.aarmos
aarmos verify ev.aarmos --trusted-signer sha256:…  # your key's fingerprint
  signer trust: established against your supplied trusted signer sha256:…
  signature scope: export-time packaging only — not event-time signing or approval

Individual call records are hash-chained, not signed. The signature is applied when you export evidence; verification checks it against the signer you trust and refuses altered records.

To review calls before you export, run aarmos activity on the same machine — it lists recent calls from the local evidence log as authorized or denied, with the rule that decided each one. Proxied calls stay on your machine: they do not appear in the web app's audit page, which lists only runs made inside the web app. The exported file is the evidence you verify and share.

Multi-agent teams

AutoGen's RoundRobinGroupChat and SelectorGroupChat can use this path only for model clients configured to honor the proxy settings. Whole-team execution has not been qualified by this review. Receipts from the run are hostname-level and carry the run's identity — the proxy cannot tell which team member made which call, and the team's internal spawn graph stays in process memory. No AutoGen lineage adapter ships today, so this path cannot attribute calls to individual agents.

Honest limits

• autogen-ext[docker] code-executor tools spawn a Docker container — outbound traffic from inside that container does not honor the host's proxy env unless you set it in the container too.
• Local Python function-tools do not touch the network and are not gated by this path.
• The HTTPS proxy does not decrypt request or response payloads. This path cannot hash streamed model content or establish that a model response was truncated.

Interception runs on your device. Tamper-evident, not tamper-resistant against a modified build — see the threat model.

LangChain guide → · CrewAI guide → · AVAR spec