Intro to Aarmos

The 7-bullet recap

1. 1
   Install in one line, nothing dials home

   curl-installable CLI plus a PWA. Credentials, tokens, and policies stay on your device.

2. 2
   Write policy in plain text

   ASP is a small YAML/HCL dialect: allow, deny, approve, with obligations like PII masking or approval TTLs.

3. 3
   The gate stands between agent and OS

   Governed tool calls — MCP, OpenAPI, deep-link, A2A — pass through one policy gate. Predictable microsecond-scale p99 (≈1µs steady, measured).

4. 4
   Every decision is a signed receipt

   Allow, deny, or approve — each produces an Ed25519-signed receipt chained by hash to the previous one.

5. 5
   Above the call sits the Decision

   Name the business action, declare the inputs it depends on, bind the participants that must weigh in. Aarmos composes their answers into one verdict and records it as evidence.

6. 6
   Verify offline, forever

   avar verify walks the receipt chain with no daemon and no network. 3 MB single binary, Apache-2.0.

7. 7
   Own the agent. Govern the execution. Prove it.

   That's the core loop. Operations then turns the signed decision stream into understanding and improvement.

Then: understand, then improve

Governed execution produces a stream of signed decisions. Operations turns that stream into a flight recorder, trust posture, and counterfactual replay — so you can spot drift, simulate policy changes, and continuously improve without guessing.

Keep going