autonomy runtime start¶
Start the policy-gated tool-execution runtime service
Synopsis¶
Starts an HTTP service on --listen that evaluates policy before
executing each tool call request.
The active policy bundle is loaded from --policy-dir (default managed cache).
If no bundle is loaded, the runtime is deny-all.
Tool call requests must be POST /v1/tool with a JSON body:
{"kind":"tool.echo","params":{"message":"hello"}}
Supported tools:
tool.echo — returns the "message" param
tool.http_get — fetches an allowlisted endpoint (params.endpoint)
tool.shell — always blocked by policy
When --orchestrator-url (or AUTONOMY_ORCHESTRATOR_URL) is set, a background
release poll loop is started that periodically fetches the latest desired-state
release and emits ai.deployment.lifecycle telemetry events.
When a verified release differs from the currently active lock fingerprint, the
new policy bundle is pulled from the OCI registry, loaded into the managed cache,
and hot-swapped onto the live server without a restart. The active lock fingerprint
is persisted to active-lock.json in the WAL directory and survives daemon restarts.
Activation is fail-closed: if bundle pull or load fails, the current policy
remains active and the next poll cycle will retry.
Usage¶
autonomy runtime start [flags]
Options¶
--allow-insecure-registry allow a plain-HTTP artifact registry when verifying releases (localhost auto-detected; env: AUTONOMY_ALLOW_INSECURE_REGISTRY). Mirrors 'autonomy verify --allow-insecure-registry'.
--allowed-domains string comma-separated list of allowed endpoint keys for tool.http_get (host[:port] or URL with scheme) (default "api.anthropic.com,ifconfig.me")
--capture-action-input policy verify replay --from-wal opt-in: record each evaluated /v1/tool action (kind + params + scene + preflight) to an autonomy.action_input WAL frame under its audit_id, so policy verify replay --from-wal can faithfully re-evaluate real production decisions against a new bundle (#1313). OFF by default — it logs request payloads; combine with --capture-sample-n and --capture-params-allow to bound cost + redact sensitive params.
--capture-params-allow strings with --capture-action-input, capture ONLY these top-level param keys verbatim; all other params are dropped and named in the frame's redacted_params. Empty captures all params.
--capture-sample-n int with --capture-action-input, capture 1 in N evaluated actions (<=1 = every). (default 1)
--contract-refine-mode string ContractRefine mode: "disabled" | "advisory" | "enforce" (default: advisory per post-C12 #1032)
--cosign-pubkey string cosign public key path for release verification (env: AUTONOMY_COSIGN_PUBKEY)
--decision-only autonomy ros2 run --governed-bridge --runtime-url <this> decision-only oracle mode: /v1/tool runs all governance (policy + runtime-layer enforcement like the http_get allowlist/egress-DLP) and returns the verdict (200 decision=allow|deny), but SKIPS the tool's side-effecting delivery (the DDS publish, outbound GET, …). This is the server for autonomy ros2 run --governed-bridge --runtime-url <this>, where the bridge itself republishes allowed messages on the real DDS domain — so tool.ros2.topic.publish returns allow instead of failing on a mediator this runtime intentionally has none of (#1225).
--demo start with the embedded demo policy (no bundle file required; useful for iterating on agent logic)
--deployment-manifest string #1310: path to a deployment bundle manifest JSON whose runtime authorization gates (execution_window, scene_state_freshness) are enforced fail-closed at /v1/tool. For the local edge path (runtime start --policy, no orchestrator); on the managed-fleet path the same gates arrive signed inside the release lock. Takes precedence over a manifest persisted by a prior release activation. A malformed manifest refuses startup.
--enforcement mode enforcement mode (#1373): "enforce" (default, enact every decision) or "monitor" (aliases: observe, shadow). In monitor mode the runtime evaluates the REAL policy + execution-decision model and WAL-records the would-be policy decision (stamped enforcement_mode=monitor, enforced=false), but ALWAYS forwards the original proposed action unchanged, never dropping/holding/replacing/rejecting on the policy verdict (a separate in-execute layer such as the http_get allowlist still enforces and is recorded as a real, unstamped deny). Use it for an ungoverned baseline (raw action reaches the actuator while would-be verdicts are logged for 'policy verify replay --from-wal') and shadow/canary policy evaluation. Pair with --capture-action-input for faithful replay. (default "enforce")
--entitlement-dir string managed entitlement-bundle directory; enables §3.14 capability-entitlement enforcement (requires --entitlement-pubkey)
--entitlement-pubkey string cosign public key used to verify the active entitlement bundle (requires --entitlement-dir)
--extra-tool-kinds string comma-separated list of additional tool kinds /v1/preflight should accept in plan_shape (does NOT widen /v1/tool execution; for domain consumers — see runtime.UnionPlan; env: AUTONOMY_EXTRA_TOOL_KINDS)
--listen string TCP address to listen on (default "127.0.0.1:7777")
--node-id string node identity for rollout slot-rank computation and telemetry (default: hostname; env: AUTONOMY_NODE_ID)
--orchestrator-url string orchestrator base URL for release polling (env: AUTONOMY_ORCHESTRATOR_URL)
--override-grant stringArray path to a signed override grant file to admit at startup (repeatable)
--override-pubkey string cosign public key used to verify operator override grants; enables §3.14 override consult (requires --override-subject)
--override-subject string this node's subject identity that override grants must name (requires --override-pubkey)
--policy-dir string managed policy cache root (default: XDG_CACHE_HOME/autonomyops/policy/managed)
--poll-interval duration how often to poll the control-plane for new releases (default 30s)
--release-channel string release channel to poll (env: AUTONOMY_RELEASE_CHANNEL) (default "stable")
--rollout-gated enable node-side, condition-gated rollout activation: each poll's rollout plan is cohort-gated then evaluated against the rollout.activate policy over the node's live 'node' scene-state source, and only activated when the policy allows. The activation policy lives in the operator's EXISTING policy bundle (a built-in default applies until the bundle defines allow_rollout_activation). Requires a managed bundle and non-strict mode. Off by default (unconditional activation, unchanged).
--rollout-plan-pubkey string path to an Ed25519 PKIX PEM public key used to verify rollout plan integrity before activation (env: AUTONOMY_ROLLOUT_PLAN_PUBKEY). When unset, plan integrity verification is advisory only.
--wal-dir string telemetry WAL directory (default: XDG_CACHE_HOME/autonomyops/telemetry)
Options inherited from parent commands¶
--require-signed-manifest Refuse to start if the SHA256SUMS release manifest or its cosign signature is missing/invalid (Tier 2 binary-integrity check; default: build-time compile-in via -ldflags -X, build-hardened artifacts=true, all others=false)
See also¶
autonomy runtime— Manage the local tool-execution runtime service