Quickstart
Four commands. About two minutes.
Setup provisions a hardware key and writes a local policy file. No account, no registration, nothing sent anywhere.
Step 01 — Install
Pulls the six plugins as one package. The shell installer is the same thing with a version pin.
Step 02 — Setup
The wizard generates the hardware key, asks which route you want declared, and writes the policy file. It refuses to finish half-configured.
Step 03 — Verify
One line per guarantee. Exits non-zero if any of them is unmet, so it works in a pre-flight script too.
hermes-mordred status
5 guarantees met · exit 0
Step 04 — Run
Your usual agent command, with the policy attached. From here on, anything the policy forbids simply does not happen.
What just happened on your machine.
A key was born
Created inside the Enclave or TPM with export disabled at creation. It cannot be copied to another machine — including by you.
A policy was written
Plain TOML at ~/.mordred/policy.toml. Read it, diff it, put it in version control. It is the whole configuration.
Nothing was sent
No account, no registration, no version ping. The only network traffic was the package download itself.
Disable or remove
Turning a plugin off is explicit and logged — there is no silent bypass flag.
[TBD]Uninstalling leaves the hardware key in place; the destroy command is pending engineering.