Get started · Airlock

01 / prerequisites

Bring one known binary

Build the separate airlock Go binary and pass its absolute executable path.
Keep the requester URL as an explicit loopback IP and port, normally http://127.0.0.1:8787.
For --instructions install, install and enable the native hermes-plugin-airlock in the selected HERMES_HOME.
Ensure a non-empty global ~/.codex/AGENTS.override.md is not shadowing AGENTS.md.

02 / install

Happy path with explicit awareness

terminalexplicit opt-in

python3 tools/airlock_bootstrap.py install \
  --binary /absolute/path/to/airlock \
  --instructions install

This installs Claude Code and Codex MCP/plugin registrations, enables the bounded Hermes prompt section, and adds digest-owned blocks to user-global Claude and Codex instruction files.

Safe default: omit --instructions install and every instruction surface remains untouched.

terminalregistrations only

python3 tools/airlock_bootstrap.py install \
  --binary /absolute/path/to/airlock

03 / preview

See every planned mutation first

terminalno writes or CLI calls

python3 tools/airlock_bootstrap.py install \
  --binary /absolute/path/to/airlock \
  --instructions install \
  --dry-run

Dry-run prints the content-addressed copy path, state path, backup paths, harness commands, Hermes prerequisite, config toggle, and exact instruction-file diffs.

04 / profile targeting

Make profile selection explicit

Without --home, an ambient HERMES_HOME is honored. With an explicit --home, an ambient Hermes profile outside that home is refused to prevent disposable runs from touching live state.

terminalintentional external Hermes profile

python3 tools/airlock_bootstrap.py \
  --home /tmp/isolated-home \
  --hermes-home /explicit/hermes/profile \
  install \
  --binary /absolute/path/to/airlock \
  --instructions install

05 / verify and remove

Doctor before claims. Ownership before removal.

terminallifecycle

python3 tools/airlock_bootstrap.py doctor
python3 tools/airlock_bootstrap.py uninstall

doctor validates package invariants, exact plugin identity, MCP registration, three-tool discovery, Hermes prompt state, and managed block digests. Uninstall refuses missing, edited, unowned, or ambiguous content before removing anything.

06 / runtime

Registration is not deployment

The stdio MCP process can initialize and advertise its tools while the requester is offline. Actual capability, request, and receipt operations require the local requester service:

terminalseparate Airlock repository

airlock requester serve --config /path/to/requester.json

Trusted-node deployment, isolated GitHub CLI authentication, adapters, and the reviewer-only direct-execution UI remain separate operational responsibilities. Configure an absolute CLI path, isolated CLI config directory, and bounded timeout; never authenticate through the web UI.