How-to

Restore governance from a Recovery Point

Restoring machines is not the same as restoring governance. This walkthrough verifies that policy, authority, identity, the receipt chain, and configuration all resolve on this device — and only then resumes.

1
Get a Recovery Point. Export one from Operations → Continuity, take a line from your NDJSON history, or list what the CLI already holds under .aarmos/recovery.
```
aarmos grp list
```
2
Verify it offline. Verification is pure — no clock, no network — and checks the identity digest and the envelope signature. It writes nothing to receipts, policies, or the audit stream.
```
aarmos grp verify --file recovery-point-<digest>.json
```
3
Describe what this device can actually resolve. The observed-state file lists the policy bundle, authority frame, identity version, receipt head, and configuration digest present locally. Omit it and restore correctly reports Incomplete.
```
{
  "policyBundleHash": "…",
  "authorityFrameVersion": "…",
  "identityVersion": "…",
  "receiptHead": "…",
  "configDigest": "…"
}
```
4
Dry-run the restore. Every component is printed with a ✓ or ✗, plus the receipt-gap count and a recoverability state — Complete, or Incomplete with each unverified component named. It is a state, never a score.
```
aarmos restore --from recovery-point-<digest>.json --observed observed.json --dry-run
```
5
Close each named gap. Restore is all-or-nothing on purpose: a workspace that is partly recoverable is ungoverned in a place you have not located yet. Restore the missing bundle, key, or receipt segment, then re-run.
6
Resume. With recoverability Complete, drop --dry-run. Exit code 0 means governance can continue; 1 means incomplete or invalid; 2 means a file was missing.
```
aarmos restore --from recovery-point-<digest>.json --observed observed.json
```
7
Capture a fresh point after resuming, so the post-recovery state is recorded alongside the one you restored from.
```
aarmos grp create
```

Open Continuity