The mechanism page asks who gets to put books in the library. This page is
the library: the hook book, the four adapter books, the receipt stamps, the
enrollment desk, and the self-host wing.
Everything here is the code the hook actually ships from
(hook/installer, hook/platforms). Every command below was run against a
scratch config before this page was written; nothing is a mockup and
nothing is roadmap.
One binary, one command. airmemo-hook install merges the hook into a
platform's config file and pins the binary's SHA-256. The installer never
overwrites an existing entry: it appends or merges, and a config it cannot
parse as JSON is refused, never clobbered. The same promise is a terms
clause (terms §5(d)).
The binary ships at the v0.1.0 public release, hash-pinned against
SHA256SUMS before anything runs. Nothing is downloadable yet, so there are
no private links and no preview pipes. When it is out, one command per
platform:
airmemo-hookinstall--platformclaude# claude | codex | copilot | geminiairmemo-hookuninstall--platformclaude# removes only AirMemo's entries
Hash pinning is the fingerprint rule: reinstalling with a different binary
is refused until you re-pin with --force. --config, --events,
--timeout and --cwd override the defaults; --keep-config on
uninstall clears the pin and leaves the config byte-identical for
MDM-owned setups.
The shelf holds four books, one per adapter. Each entry states the real
config file the installer writes and the real events it wires. The sample
documents were rendered by the shipping adapters themselves, not by hand:
hook/scripts/render-all regenerates them and make artifact commits the
result, so the demo cannot drift from the product.
Same hookSpecificOutput envelope. The sample memo renders 141 tokens.
GitHub Copilot
writes .github/hooks/airmemo.json at the repo root · wires sessionStart
Flat payload, no envelope: additionalContext only. modifiedPrompt is dropped by the runtime, so the hook never emits it. The sample memo renders 127 tokens.
Gemini CLI
writes .gemini/settings.json at the working dir · wires SessionStart, BeforeAgent
Same hookSpecificOutput envelope. The sample memo renders 141 tokens.
Want the full picture? One memo, four vendors: side by side. The artifact itself is committed at public/render-all/renders.json with a proof hash of the exact document bytes.
Every delivery writes a receipt: a signed, append-only record of what was
delivered, to which agent, on which platform, and when it expired.
Delivered memos are visibly stamped as authorized, so agents and reviewers
can always tell the shelf from graffiti:
[AIRMEMO · authorized · memo_4821]
Where the receipts live:
On the device: airmemo-hook receipts prints the local journal as
JSON: count, then one row per delivery (memo id, platform, tokens
injected, proof, whether it was receipted, queued time).
In the portal: /app/#/receipts drills from memo to receipts to
devices, so a receipt never disappears when its memo ages out of the
newest list.
Server-side: append-only. Receipts and audit have no UPDATE and no
DELETE, so the served count can only go up.
Create the org yourself at the portal signup, then mint
the enrollment key in the portal (Settings → Devices). Enroll needs the
org slug and that key; nothing else. The device identity lands in a
0600-permission config file, and a second enroll is refused rather than
overwritten.
The hook then rides the lifecycle events your agent already exposes
(session start and prompt submit), checks one thing: does the shelf hold
an authorized memo for this agent? If it does, the memo is delivered into
the session context, prompt-visible on the next turn. Fail-open: the hook
never blocks an agent turn; a platform or network failure degrades to
memo delayed, never agent blocked.
Self-hosting runs 1.5 to 2 times list. The same codebase, one image,
deployed where your fleet lives.
What the private wing does not include:
No uptime or availability SLA during the pilot (terms §9, §20).
SSO is enterprise-triggered, deferred per the security posture, not
claimed at Business tier (pricing notes, whitepaper §4).
EU data processing residency is a documented migration card, not a
claim: setting region: eu never moves a byte, and this page says so
(whitepaper §4.1).
The cloud hosts demos and pilots; production fleets run the same
codebase self-hosted (whitepaper §4).
Spine notes: the contract documents that bind the shelf.
Terms of Service: pilot terms, fees, the merge-safe installer clause
