LLM keys and OAuth tokens live in an AES-GCM locker in browser storage. Set a device password and the vault key is wrapped via PBKDF2-SHA256 (WebCrypto), with a one-time recovery code. Required before connecting any OAuth service.

Every call resolves to allow, ask, or deny. Session and 24-hour grants are logged. Writes, sends, deletes, and payments require explicit approval by default.

Consent decisions append to a chain-linked on-device ledger with verifiable chain integrity. Community and above adds Ed25519-signed run traces — tool calls, provider handshakes, delegation steps — exportable as an .avar.zip bundle any auditor can verify offline in a browser or the portable avar CLI. Open spec: AVAR 1.0 (normative), CC BY 4.0; the verifier is Apache-2.0.

Drop any receipt bundle to check signatures, chain integrity, and envelope — the same checks the portable avar CLI runs offline. Pin a signed trust manifest first and every governance-stamped entry reconciles against it. Runs on-device; nothing uploaded.

Re-hashes a sample of the served PWA assets and verifies the release manifest against a hard-pinned Aarmos key. Runs on-device. Never blocks execution.

Operator-controlled kill switch producing signed evidence of every intervention — the oversight primitive referenced by EU AI Act Art. 14 and NIST AI RMF MANAGE-2.3 (mechanism claim, not a compliance claim). Cockpit chip, triple-Esc panic gesture, scoped kill (all / writes / destructive). Every toggle is a signed AVAR receipt on the same chain as tool decisions.

Author signed policy bundles in reviewable YAML. Lint, golden-test, and sign offline with the aarmos CLI, then ship via your GitOps pipeline. Evaluation and signing run on your machines — no hosted control plane.

AVAR receipts map to evidence expectations in EU AI Act Art. 12 & 14, HIPAA §164.312(b), SOC 2 CC7.2, NIST AI RMF MEASURE-2.7 & MANAGE-2.3, and ISO/IEC 42001 §8.4. Mechanism claim, not a certification.

Export an AES-GCM bundle: vault, connector configs, agents, policy state, optionally the ledger. Restore with the device password or recovery code. Fingerprint verification catches tampered files on import.

Every Connector fetch (MCP, OpenAPI, A2A, deep-link) is stamped into an AVAR receipt with destination, tool, protocol, and outcome. Enforced at the Connector boundary — no TLS decryption. Honest scope: covers Connector fetches only; XHR, WebSocket, SSE, sendBeacon, and OS syscalls are not observed here — daemon and OS tripwires are on the roadmap.

Import an admin-signed JSON bundle (Ed25519) pinning allowed MCP servers, tools, and OAuth scopes. Invalid, expired, or untrusted bundles are ignored. A kill-switch bundle disables every tool until admin ships a fresh one. Offline devices keep enforcing the last valid bundle for up to 7 days.

Delegation depth caps at 4; allowlists intersect at every hand-off — a callee never widens its caller's authority. Every hand-off is stamped in the receipt's delegation chain.

A decision is the smallest governable business action. Aarmos records which participants were required, which inputs they consumed, how each responded, and the composed verdict — then seals it into the receipt. Decision identities are permanent, so the same decision can be replayed and compared later. Aarmos orchestrates the evaluation and records the outcome; it does not invent business rules.

Forward workspace audit events to Splunk HEC, Datadog Logs, or an HMAC-signed webhook as they are written. Only the event envelope leaves — never chat, tool results, keys, or tokens. Delivery credentials are referenced by env-var name, never stored. Team includes one destination; Enterprise removes the cap.

Execution evidence is append-only and leaves only through the retention policy — there is no delete. Governance state changes are receipted: archiving an agent stops it running, restoring it grants authority again, and both are signed. Conversation transcripts are navigation, not evidence, so you can clear them at any time; the run row survives with the prompt and reply removed.

Your evidence is yours to take. Export the full signed corpus at any time as an .avar.zip bundle and verify it with the open-source avar CLI — no account, no network call, no Aarmatix involvement. The receipt format is an open specification (CC BY 4.0) and the reference verifier is Apache-2.0, so a bundle stays readable and checkable long after any contract with us ends.

Governance is local-first. Evidence aggregation is optional. The relay transports governance evidence and never participates in governance: it never transforms, normalizes, enriches, repairs, or interprets, so stored bytes are the bytes your device signed. Evidence arrives under a typed contract with size ceilings; policy evidence is a separate class you can encrypt independently. You choose where the relay runs — hosted by us, your own object storage, or your own environment — and every implementation must pass the same published conformance checks: hashes, signatures, ordering, replay, offline verification, and byte preservation. A relay outage is not a governance outage.

Aarmos governs the execution of declared governance. It does not determine what governance ought to be. Decision definitions, business rules, participant logic and policy content belong to you; execution, composition, evidence and replay belong to us — and every contribution is named on the receipt. Both lists are published, so there is no gap between what we promise and what the receipt shows.