Framework guide · AutoGen (agentchat)

AutoGen under Aarmos in 60 seconds.

Keep your existing AutoGen assistant exactly as-is. No aarmos import, no framework wrapper. Environment variables route every outbound HTTP call through the local aarmos daemon, where the policy gate decides and a signed AVAR receipt is written.

0 · Sanity-check your environment

aarmos doctor

1 · Start the daemon

aarmos daemon
▸ listening on 127.0.0.1:7681
▸ policy: ./aarmos.json

2 · Your existing AutoGen assistant — unchanged

# src/agent.py — stock AutoGen. No aarmos imports.
import asyncio
from autogen_agentchat.agents import AssistantAgent
from autogen_ext.models.openai import OpenAIChatCompletionClient

async def main():
    model = OpenAIChatCompletionClient(model="gpt-4o-mini")
    agent = AssistantAgent(name="assistant", model_client=model,
                           system_message="Answer in one sentence.")
    result = await agent.run(task="What is a receipt?")
    print(result.messages[-1].content)

asyncio.run(main())

3 · Run it under Aarmos

aarmos proxy &                 # start the local runtime (mints a session)
eval "$(aarmos env)"           # authenticated HTTPS_PROXY + HTTP_PROXY
python src/agent.py

▸ gate: api.openai.com  (verb: communicate)  ✓ allowed
▸ AVAR receipt: .aarmos/avar/2026-…json

4 · Inspect the receipt

aarmos verify .aarmos/avar/latest.json
✓ signature valid
✓ chain intact
✓ policy match: aarmos.json@sha256:…

Or open /audit in the PWA for the same call with hashes, verb, latency, and the policy that allowed it.

Multi-agent teams

AutoGen's RoundRobinGroupChat and SelectorGroupChat route every model call through the same HTTP client, so the same env vars govern the whole team. Each turn produces a distinct AVAR receipt bound to the speaking agent's name.

Honest limits

• autogen-ext[docker] code-executor tools spawn a Docker container — outbound traffic from inside that container does not honor the host's proxy env unless you set it in the container too.
• Local Python function-tools do not touch the network and are not gated by this path.
• Streaming responses hash on close; a truncated stream is recorded as truncated.

Interception runs on your device. Tamper-evident, not tamper-resistant against a modified build — see the threat model.

LangChain guide → · CrewAI guide → · AVAR spec