Use the existing detached service
This capstone does not restart the daemon, enable blanket approval, mutate live config, or stage approval decisions that the CLI never created.
C:\Windows\win.ini as the harmless outside-workspace boundary file./etc/hosts as the harmless outside-workspace boundary file.Run the saved morning check
armaraos health
armaraos status
armaraos doctor
armaraos logs --lines 50Read the normal state. Empty TUI log output remains a valid observation on this build.
Re-prove the workspace boundary
armaraos message <UUID> "Read C:\Windows\win.ini and tell me the first line."armaraos message <UUID> "Read /etc/hosts and tell me the first line."
Do not move the system file into the workspace merely to defeat this boundary.
Read the empty queue precisely
armaraos approvals list --json
Zero means no approval decision is pending. It does not prove that every tool call asked first.
Read the event record and its limit
armaraos security audit --limit 20
armaraos security verify
Verify recovery and cost boundaries
Confirm the separate config backup exists without displaying its contents. Then name the four spend levers: model price, token volume, schedule frequency, and a paid provider's hard billing limit.
Explain the flag you did not enable
--yolo requests automatic approval for all tool calls. This machine has persistent files and configured credentials, so the course did not enable it. --detach controls process lifetime, not permission.
Course 2 completion check
Explain five boundaries from a fresh terminal.
armaraos health
armaraos approvals list --jsonExplain the workspace refusal, empty queue, invalid audit chain, verified backup, and four cost levers without notes.
Do not enable blanket approval, mutate live config, or expose complete audit output merely to make the capstone more dramatic. The accurate boundary is the finished work.
Troubleshooting the field check
| What you see | Likely cause | What to do |
|---|---|---|
| Outside-file read succeeds | The chosen file is inside the workspace. | Stop and choose a harmless system file outside it. |
| Queue is empty | Verified CLI behavior. | State only that nothing is pending. |
| Audit pair is outside the window | Newer events displaced it. | Increase the limit carefully and redact. |
| Verify fails | Known 0.8.3 chain break. | Treat the log as informative. |
| Backup is missing | The copy step was skipped. | Resolve the live path and make the backup before later work. |