Install

How you get the software. Aarmos is distributed to authorized workspaces as signed artifacts. Signing in authorizes your workspace for evaluation automatically — no person to wait for — and the software is available the moment you choose to install it. Nothing downloads until you ask for it, and nothing is published to the public npm registry today. The open @avar-standard/* verifier packages are unaffected and remain publicly installable, so anyone can check a receipt without our software.

  1. 1Sign in. Your evaluation workspace and its bounded authorization are ready immediately.
  2. 2Choose. Acquisition follows need — the software is fetched when you decide to install it.
  3. 3Authenticate. Pair the CLI with your workspace from the device you will run on.
  4. 4Acquire. Pull the signed artifact at a fixed version for your authorized workspace.
  5. 5Verify. Check the artifact digest and signature before you run it.
  6. 6Run. Start the runtime and record your first governed decision.

What you receive

A built, scanned, signed artifact at a fixed version — never a source tree. Each release has a recorded digest you can check against what you installed. Artifacts are immutable: a change to the implementation means a new version, never a silent patch of one you already hold.

Get the CLI

There is no public download. Sign in, then open your account to acquire the signed CLI artifact for macOS, Linux, or Windows once your workspace is authorized. Check the published digest and signature, install it, then authorize the device:

aarmos login         # authorize this device for your workspace
aarmos --version
aarmos status

You do not need Node.js or npm to run the CLI artifact. The @aarmos/* npm packages are an internal build mechanism, not a customer distribution channel.

Container image

docker run --rm \
  -v aarmos-state:/var/lib/aarmos/state \
  -v aarmos-evidence:/var/lib/aarmos/evidence \
  aarmos/runtime:<version> serve

A standards-compliant OCI image — the same runtime, packaged differently. It runs under Docker, Podman, containerd and Kubernetes with no separate build. It runs as a non-root user, supports a read-only root filesystem, and keeps state, secrets and evidence on separate mounts. Pulling it requires an authorized workspace.

Independent verification (optional)

You do not need this to run your first governed action. When you later want to check a record without trusting us, install the open standalone verifier:

brew install aarmatix/tap/avar
avar verify ./bundle.avar.zip

The tap ships only the avar verifier — the open reference implementation used for independent, vendor-free verification. See verifying the binary.

First governed run

aarmos init          # scaffold a policy + demo agent
aarmos run demo      # run under policy — writes a signed receipt
aarmos activity      # human-readable log of what just happened
aarmos verify .aarmos/avar/receipt-*.json

Full walkthrough in the quickstart, or browse the CLI reference.