Getting started

Imara Documentation

Imara is a secure agent runtime for regulated financial services. It enforces policy bounds, writes every action to an immutable ledger, and cryptographically chains entries so audit trails are tamper-evident by default.

Architecture overview

Every request flows through a four-stage pipeline before anything is written to disk. No stage can be bypassed; the entire pipeline is synchronous on the hot path.

Classify

The dispatcher maps natural-language intent to a concrete action type (e.g. ACTION_PAYMENT_INITIATE).

Enforce

The policy engine checks the classified action against your TOML rules. No match → blocked, logged, chain entry written.

Execute

The permitted action runs. Result, latency, token count, and session ID are captured.

Chain

A ledger entry is SHA-256 hashed over the full payload + previous hash, then appended and optionally replicated.

Quick start

Boot the runtime, dispatch a syscall, and inspect the ledger in under two minutes.

1. Build and start

make build
make run

2. Dispatch an intent

curl -X POST http://localhost:7070/syscall \
  -H 'X-Imara-Token: stratus-dev-token-change-me' \
  -H 'Content-Type: application/json' \
  -d '{"intent": "Initiate a payment of $500 to account 9876"}'

3. Read the ledger

curl http://localhost:7070/ledger | jq .

4. Verify the chain

curl http://localhost:7070/ledger/chain | jq .chain_valid

Runtime surfaces

:7070

Syscall API

Intent dispatch, ledger, agent spawn, policy status.

:7071

S3 Bridge

AWS-compatible object surface over the VFS.

:7072

Bedrock Bridge

Maps Bedrock-shaped calls onto local Ollama.

Guides

Policy Engine

Define capability bounds in TOML. Understand allow/deny rules, action types, and the fail-closed enforcement model.

S3 Replication

Configure async ledger replication to AWS S3, GCS, Azure Blob, or any S3-compatible store.

Chain Verification

How SHA-256 hash chaining works, how to verify a chain head, and how to detect tampering.

Regulator Portal

Set up the regulator-facing fleet dashboard and grant read-only access to compliance teams.