autonomy runtime start

Start the policy-gated tool-execution runtime service

Synopsis

Starts an HTTP service on --listen that evaluates policy before
executing each tool call request.

The active policy bundle is loaded from --policy-dir (default managed cache).
If no bundle is loaded, the runtime is deny-all.

Tool call requests must be POST /v1/tool with a JSON body:
  {"kind":"tool.echo","params":{"message":"hello"}}

Supported tools:
  tool.echo     — returns the "message" param
  tool.http_get — fetches an allowlisted endpoint (params.endpoint)
  tool.shell    — always blocked by policy

When --orchestrator-url (or AUTONOMY_ORCHESTRATOR_URL) is set, a background
release poll loop is started that periodically fetches the latest desired-state
release and emits ai.deployment.lifecycle telemetry events.

When a verified release differs from the currently active lock fingerprint, the
new policy bundle is pulled from the OCI registry, loaded into the managed cache,
and hot-swapped onto the live server without a restart. The active lock fingerprint
is persisted to active-lock.json in the WAL directory and survives daemon restarts.

Activation is fail-closed: if bundle pull or load fails, the current policy
remains active and the next poll cycle will retry.

Usage

autonomy runtime start [flags]

Options

      --allow-insecure-registry                                                  allow a plain-HTTP artifact registry when verifying releases (localhost auto-detected; env: AUTONOMY_ALLOW_INSECURE_REGISTRY). Mirrors 'autonomy verify --allow-insecure-registry'.
      --allowed-domains string                                                   comma-separated list of allowed endpoint keys for tool.http_get (host[:port] or URL with scheme) (default "api.anthropic.com,ifconfig.me")
      --contract-refine-mode string                                              ContractRefine mode: "disabled" | "advisory" | "enforce" (default: advisory per post-C12 #1032)
      --cosign-pubkey string                                                     cosign public key path for release verification (env: AUTONOMY_COSIGN_PUBKEY)
      --decision-only autonomy ros2 run --governed-bridge --runtime-url <this>   decision-only oracle mode: /v1/tool runs all governance (policy + runtime-layer enforcement like the http_get allowlist/egress-DLP) and returns the verdict (200 decision=allow|deny), but SKIPS the tool's side-effecting delivery (the DDS publish, outbound GET, …). This is the server for autonomy ros2 run --governed-bridge --runtime-url <this>, where the bridge itself republishes allowed messages on the real DDS domain — so tool.ros2.topic.publish returns allow instead of failing on a mediator this runtime intentionally has none of (#1225).
      --demo                                                                     start with the embedded demo policy (no bundle file required; useful for iterating on agent logic)
      --extra-tool-kinds string                                                  comma-separated list of additional tool kinds /v1/preflight should accept in plan_shape (does NOT widen /v1/tool execution; for domain consumers — see runtime.UnionPlan; env: AUTONOMY_EXTRA_TOOL_KINDS)
      --listen string                                                            TCP address to listen on (default "127.0.0.1:7777")
      --node-id string                                                           node identity for rollout slot-rank computation and telemetry (default: hostname; env: AUTONOMY_NODE_ID)
      --orchestrator-url string                                                  orchestrator base URL for release polling (env: AUTONOMY_ORCHESTRATOR_URL)
      --policy-dir string                                                        managed policy cache root (default: XDG_CACHE_HOME/autonomyops/policy/managed)
      --poll-interval duration                                                   how often to poll the control-plane for new releases (default 30s)
      --release-channel string                                                   release channel to poll (env: AUTONOMY_RELEASE_CHANNEL) (default "stable")
      --rollout-gated                                                            enable node-side, condition-gated rollout activation: each poll's rollout plan is cohort-gated then evaluated against the rollout.activate policy over the node's live 'node' scene-state source, and only activated when the policy allows. The activation policy lives in the operator's EXISTING policy bundle (a built-in default applies until the bundle defines allow_rollout_activation). Requires a managed bundle and non-strict mode. Off by default (unconditional activation, unchanged).
      --rollout-plan-pubkey string                                               path to an Ed25519 PKIX PEM public key used to verify rollout plan integrity before activation (env: AUTONOMY_ROLLOUT_PLAN_PUBKEY). When unset, plan integrity verification is advisory only.
      --wal-dir string                                                           telemetry WAL directory (default: XDG_CACHE_HOME/autonomyops/telemetry)

Options inherited from parent commands

      --require-signed-manifest   Refuse to start if the SHA256SUMS release manifest or its cosign signature is missing/invalid (Tier 2 binary-integrity check; default: build-time compile-in via -ldflags -X, build-hardened artifacts=true, all others=false)

See also