Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.automagik.dev/llms.txt

Use this file to discover all available pages before exploring further.

This page describes the direction Genie’s distribution is moving toward, anchored by the aegis-distribution-sovereignty umbrella merged in PR #1425. Some of the install paths described below ship in 2026-Q2/Q3 — see the per-component status notes.

​
The threat we’re closing

In April 2026, the @automagik/genie npm package was weaponized as part of the CanisterWorm/TeamPCP compromise. The detection-and-response runbook ships through the same npm pipe that carried the malicious payload. As long as Genie is acquired through npm install -g @automagik/genie, three structural exposures remain:
  1. No cosign enforcement at install time. npm verifies a tarball checksum but knows nothing about Sigstore certificates. A compromised publish token bypasses every cryptographic control upstream of npm.
  2. Arbitrary postinstall scripts in transitive deps. A single compromised dependency anywhere in the resolved tree runs arbitrary code on the operator’s machine before Genie’s own code executes.
  3. Threat-intel cadence locked to npm publish. The signature packs Genie uses to detect new IOCs are tied to whatever release rhythm npm allows. Worms propagate in hours; signature updates need to arrive in minutes.
This page documents how Genie sidesteps all three.

​
The new install path

curl -fsSL https://get.automagik.dev/genie | bash
This single line is the canonical install. Internally it:
  1. Detects your platform (uname -s / uname -m, with Rosetta 2 awareness on Apple Silicon and libc detection on Linux). Mirrors Claude Code’s bootstrap pattern.
  2. Downloads the platform-appropriate static binary from cdn.automagik.dev/genie/<channel>/<version>/<platform>/genie. The binary is a single file produced by bun build --compile — no Node, no npm, no transitive dep tree.
  3. Verifies SHA256, cosign, and SLSA L3 provenance. Three independent gates. Tamper at any layer fails the install with a clear exit code.
  4. Hands off to the binary’s own install subcommand to wire shell integration, install completions, and create ~/.genie/.
Operators on networks that block cdn.automagik.dev can fall back to the GitHub Releases mirror — same artifacts, same signatures, different transport.

Linux x86_64

glibc + musl, both supported.

Linux ARM64

Native ARM64 binary, glibc.

macOS x86_64

Intel Macs.

macOS ARM64

Apple Silicon, with Rosetta detection so the right binary is picked even when running under emulation.
Native Windows is not yet on the matrix — WSL2 with the Linux x86_64 binary works today; native Windows distribution is a v2 deliverable.

​
The verification stack

Each release publishes:
ArtifactPurposeVerifier
genie (per platform)The binary itselfshasum -a 256 against manifest.json
genie.sigCosign signature, keyless via OIDCcosign verify-blob
genie.certFulcio certificate identifying the workflow + commitembedded in cosign verify-blob check
provenance.intoto.jsonlSLSA Level 3 provenance attestationslsa-verifier verify-artifact
manifest.jsonSchema-versioned envelope listing all of the aboveJSON Schema validation against docs/security/manifest.schema.json
install.sh bundles tiny static portable verifiers (sigstore-rs + slsa-verifier, ≤2 MB each) so an operator with no preinstalled cryptographic tooling can still run the full chain. The verifiers are themselves cosign-signed by the same OIDC identity, with their SHA256 inlined in install.sh to defeat verifier-substitution attacks. The cosign certificate identity is pinned across four independent channels. Cross-check before you run.

​
What about npm?

@automagik/genie on npm is being soft-deprecated, not yanked. Existing operators on npm install -g @automagik/genie continue to work — but the package contents shrink to a ≤50-LOC postinstall.js shim that:
  1. Detects the platform (mirroring install.sh’s logic).
  2. Downloads install.sh from the CDN, verifying an inlined SHA256.
  3. Runs bash install.sh with platform pre-set.
  4. Prints a loud deprecation banner pointing at the canonical install path and the sunset date.
The shim’s own postinstall is what enforces the trust chain — even an operator who never updates their muscle memory ends up with a cosign-verified binary on disk. After the sunset window (90 days post-v1 GA), the npm package is npm deprecate-flagged with a stronger message; existing pinned versions continue to install via the shim, but the package itself is no longer the recommended path. We do not unpublish. Forensic tooling and dependency graphs benefit from the package’s continued existence; the shim’s loudness handles the rest.

​
What this does NOT solve (yet)

Distribution sovereignty closes the acquisition exposure. Three larger exposures remain in flight:
  • Build-time supply chain. Genie itself is built from bun install. A compromised dependency in our build environment defeats every downstream control. Tracked under a separate future umbrella (genie-build-sovereignty); not in scope here.
  • Runtime privilege boundary. Once Genie runs, it has full host permissions. The Aegis runtime sandbox (in flight) adds default-deny network egress and continuous workspace scanning. v1 is observe-only; v2 graduates to kernel-level enforcement.
  • Content inspection at the prompt boundary. Prompt-injection / PII / data-leak detection lives in our enterprise tier (@khal-os), not in the OSS distribution covered by this page.
The CanisterWorm response covers what to do if the current boundary is breached: see /genie/incident-response/canisterworm.

​
Status

ComponentStatusTracker
Cosign keyless + SLSA L3 signing✅ Shippedgenie-supply-chain-signing
Signature packs + version-gated matching✅ Shippedsec-signature-registry (@automagik/genie-signatures)
cdn.automagik.dev + per-platform binaries + install.sh🚧 Wave 1distribution-exodus (Wave 1 of the umbrella)
genie self-update🚧 Wave 2genie-self-update
Aegis runtime sandbox🚧 Wave 2aegis-runtime
Aegis continuous scanner🚧 Wave 3aegis-scanner
npm soft-deprecate + sunset🚧 Wave 1 finaledistribution-exodus Group 5
The umbrella DESIGN.md sits at .genie/brainstorms/aegis-distribution-sovereignty/DESIGN.md on the genie repo.