Install

INSTALL ELIXIR WHERE YOUR AGENTS LIVE.

Elixir is designed to run close to the agent and runtime it protects. It needs to observe real runtime state, and it can only observe what it can reach — so it goes on the machine where the agent actually runs, not somewhere convenient.

Access

GETTING ACCESS

Elixir is a public download, so the first step is Step 1. The alpha is how you reach us afterwards.

What the alpha is

Self-hosted
Elixir runs on your machines, beside your agents. Nothing is sent to us.
Bring your own model
You supply the provider credentials. Elixir never marks up token usage.
Apache-2.0
The licence the artifact ships under.
Developer tier is free
The public artifact protects one agent without a card. Paid plans use Stripe-hosted Checkout.

How access works

The certified Elixir release artifact is a public download, so the alpha is about support and feedback rather than about getting the software. Everything below is the real guide — the commands, the refusals, the limits of each proof.

Elixir is a public download — see Step 1. You do not need a GitHub account, repository access or a source checkout at any point. Alpha access below is for support and feedback, not for obtaining the software.

Email bryan.jones@efficiencystrengthtraining.com

Choose your setup

TWO WAYS TO INSTALL

The same certified artifact either way. The difference is who does the mechanical work.

Guided setup

Recommended

For anyone who would rather talk to an AI agent than administer a Linux box. You download Elixir, hand the bundle to an AI orchestrator you already use, and answer one question: which of my agents should Elixir protect?

What happenstext

Download Elixir
  ↓  give the bundle to your orchestrator
It verifies the bundle, installs it, and asks
  ↓  you choose which agents to protect
Only the agents you named become patients
  ↓
npm run doctor  →  verified install

The orchestrator does the mechanical work. It does not gain the authority to choose your patients: setup stops and waits for your selection, there is no flag that protects everything, and nothing it does grants production treatment.

Orchestrator support

Any capable AI orchestrator
Needs only the manifest, the bundle verifier and the guided setup command. Proven in a clean room.Proven
Hermes
Completed by an operator from this release: Hermes handed off the bundle and registered only the selected agents.Proven
OpenClaw
Uses the same generic contract. No OpenClaw environment was available to prove it.Not yet proven

Developer setup

For operators who want the terminal. Everything below on this page is that path, start to finish — download, checksum, extract, install, configure, doctor.

Nothing is hidden from you in the guided route either: it runs these same commands.

Start the developer path

Before you start

REQUIREMENTS

Node.js 20 or newer
The artifact declares engines.node: >=20. Development and proving happened on Node 22.
npm
Used for the lockfile install and every command below.
A way to unpack what you receive
The artifact arrives as an archive or a directory; nothing beyond the standard tools your platform already has.
Linux or macOS
Both are supported. The reference deployment is Linux.
One supported executor
A managed runtime CLI, or credentials for a model runtime. Elixir refuses to start a session without the one you configured.
A runtime adapter
How Elixir observes your fleet — see below.

Dependencies

Elixir has three runtime dependencies — ajv, ajv-formats and js-yaml — plus Node’s built-in test runner. That is deliberate: a governance tool with a large dependency tree is a governance tool with a large attack surface.

Credentials are supplied through the environment or your secrets manager. No credential belongs in a config file, and no config file on this page holds one.

Step 1

GET THE ARTIFACT

Elixir is distributed as a certified release artifact built from the private development repository — not as a source checkout.

v0.3.3-alpha

Public download

Download the certified artifact and its checksum, then continue at Step 2. No account, no repository access, no checkout.

Download Elixir 0.3.3-alpha

Release notes and known limitations

Install the artifact we tested

Elixir releases are distributed from the same packaged artifact that passes the shipped test suite and the shipped validator — 384 files, with 1,321 tests run inside the package against an empty deployment.

The build deletes its own output if either the suite or the validator fails, so what was certified and what you install are the same bytes.

Version: v0.3.3-alpha (alpha)
Licence: Apache-2.0
Requires: Node.js >=20
Format: tar.gz, reproducible
Integrity: SHA-256 published beside it

Option A — download directly on the VMbash

mkdir -p ~/elixir-handoff
cd ~/elixir-handoff
curl -fLO https://github.com/bdjones0545/elixir-releases/releases/download/v0.3.3-alpha/elixir-v0.3.3-alpha.tar.gz
curl -fLO https://github.com/bdjones0545/elixir-releases/releases/download/v0.3.3-alpha/elixir-v0.3.3-alpha.tar.gz.sha256

Option B — copy a download from your computerbash

# Run on the VM first:
mkdir -p ~/elixir-handoff

# Run on your computer; replace the two ALL_CAPS placeholders:
scp ~/Downloads/elixir-v0.3.3-alpha.tar.gz VM_USER@VM_HOST:~/elixir-handoff/
scp ~/Downloads/elixir-v0.3.3-alpha.tar.gz.sha256 VM_USER@VM_HOST:~/elixir-handoff/

Step 2

VERIFY IT, THEN UNPACK IT

Check the checksum before you extract anything. Refuse to install on any mismatch.

Download the archive and its checksumbash

curl -LO https://github.com/bdjones0545/elixir-releases/releases/download/v0.3.3-alpha/elixir-v0.3.3-alpha.tar.gz
curl -LO https://github.com/bdjones0545/elixir-releases/releases/download/v0.3.3-alpha/elixir-v0.3.3-alpha.tar.gz.sha256

Verify — Linuxbash

sha256sum -c elixir-v0.3.3-alpha.tar.gz.sha256

Verify — macOSbash

shasum -a 256 -c elixir-v0.3.3-alpha.tar.gz.sha256

Both print elixir-v0.3.3-alpha.tar.gz: OK. Anything else means the file you have is not the file that was published — stop, and download it again. v0.3.3-alpha should hash to f15a0f08c0e96fbfc256f24a10fc3119ac99fe24a18576b62b087b8c8a11b2aa.

Unpack, and install the pinned dependenciesbash

tar -xzf elixir-v0.3.3-alpha.tar.gz
cd elixir-v0.3.3-alpha
npm ci

The archive extracts into exactly one directory — elixir-v0.3.3-alpha/ — so nothing lands loose in the directory you ran it from.

npm ci rather than npm install: it installs exactly the dependency versions pinned by the certified lockfile, which is the point of shipping one. Elixir has three runtime dependencies.

Guided path

GIVE THE DOWNLOAD TO HERMES OR OPENCLAW

If an orchestrator already manages the machine where your agents run, it can perform the mechanical installation and registration work for you. You still choose the agents.

If the file is on your computer

Upload both the archive and its .sha256 file to the agent VM first. Use the Step 1 Option B commands above, then tell the orchestrator the exact VM directory, normally /root/elixir-handoff when operating as root.

Instruction to give Hermestext

Install the Elixir release in /root/elixir-handoff.

1. Verify the .tar.gz against the adjacent .sha256 file before extracting it. Stop on any mismatch.
2. Install the pinned dependencies with npm ci and run npm run bootstrap.
3. Configure the Hermes runtime for this host without placing credentials in fleet.yaml.
4. Show me the profiles Hermes can see and ask me which exact profiles I want registered. Do not select all agents and do not infer my choice.
5. Register only the profiles I name, create or use the organization I approve, and preview npm run setup -- --organization ORG_ID --agents SELECTED_PROFILES --json.
6. Show me that preview and wait for my approval before running the same command with --apply.
7. Run npm run doctor and report every PASS, FAIL, UNKNOWN and INERT row. Do not grant production authority, install supervision, or start paid executor work unless I separately approve it.

Instruction to give OpenClaw or another capable orchestratortext

On the agent VM, install the Elixir release bundle located at /root/elixir-handoff.

Follow the release manifest and install guide exactly. Verify the checksum first and stop on mismatch. Configure the runtime adapter that matches the fleet you can actually observe. Enumerate the available agents or profiles, then ask me to select the exact ones Elixir should register.

Do not use an all-agents shortcut, invent agents, store credentials in fleet.yaml, grant treatment authority, or apply an enrollment plan without showing me the JSON preview first. After I approve the named selection, register only those agents, apply that reviewed plan, run npm run doctor, and return its complete verdict.

Distribution

WHY ELIXIR SHIPS AS A CERTIFIED ARTIFACT

You receive what was tested, rather than the working tree it was built from.

Every release artifact is

Built from the release candidate
One command, from a known commit.
Tested inside the package
The shipped suite runs in the artifact, not in the repository that produced it.
Validated inside the package
The shipped validator runs there too.
Checked for documented-command drift
A document naming a command the artifact does not have cannot ship.
Checked for licence and version consistency
The metadata, the lockfile and the LICENSE have to agree.
Clean-room installable
Proven by installing it outside the checkout that built it.

The pathtext

Private development repository
        ↓  packaging build
Certified build — suite and validator run INSIDE it
        ↓
Versioned release artifact  (v0.3.3-alpha)
        ↓
Alpha access / public download
        ↓
npm ci → npm run bootstrap → npm run doctor

Step 3

BOOTSTRAP

Ask the install what it still needs from a person, before you give it anything.

npm run bootstrap

It marks each finding BLOCKING (genuinely cannot function), AWAITING_HUMAN (working as designed, waiting on a decision only a person may make) or UNKNOWN (could not be determined — never upgraded to OK for lack of evidence). A verdict of CORRECTLY INERT means nothing is broken and nothing will happen until you decide something.

Step 4

CONFIGURE

A new install has default deny, an empty grant list, an empty registry and no identities. That is not an incomplete installation — it is one that has not been given any authority yet.

Give the install a shape

mkdir -p ~/.workforce-accelerator/secrets
( umask 077 && openssl rand -hex 32 > ~/.workforce-accelerator/secrets/internal.key )

cp deployments/example/*.yaml workforce/
cp workforce/fleet.yaml.example workforce/fleet.yaml

The internal principal is Elixir submitting results back through its own authenticated path. It is deliberately not a registry worker: a worker must never be able to author the result that judges its own request.

The copied files give workforce/ a legal starting shape — an empty registry, an empty grant list, a default of deny. Empty is correct. A registry with workers already in it would be a fleet you did not create.

Declare your fleet

workforce/fleet.yamlyaml

runtime:
  # How Elixir OBSERVES your fleet. Read-only.
  adapter: supervisord

executor:
  # WHICH reasoning provider runs a session. No default, nothing inferred.
  adapter: claude-code
  # Where a session runs. 'local' means this machine.
  host: local

# Optional — only where something really does sweep the queue continuously.
# expect_continuous: true

There is no built-in default for any of these, on purpose: a tool that guesses which fleet to connect to is a tool that connects to someone else’s. An unset value is a refusal that names this file. The real file is gitignored for the same reason.

Hermes on this same VM — no editor requiredbash

sed -i \
  -e 's/id: workforce-host/id: orgo-desktop/' \
  -e 's/address: 100\.64\.0\.1/address: 127.0.0.1/' \
  -e 's#ssh_target: root@workforce-host#ssh_target: root@127.0.0.1#' \
  -e 's/adapter: supervisord/adapter: hermes/' \
  workforce/fleet.yaml

Replace orgo-desktop if your host has another name. Loopback is correct only when Elixir and Hermes run on this same VM.

Create an organization and a durable Agent ID

npm run agents:migrate -- --new-organization --name "Acme" --apply

npm run agents:migrate -- --new-agent --organization org_… --display-name "Theo" \
                          --worker theo --environment production --apply

An Agent ID is agt_ followed by 32 hex characters, minted once and never derived from a host, a process, a repository, a provider or a display name. A worker name such as theo is not an agent id and cannot become one.

Issue an API key

npm run api:key -- --issue --name "support fleet" --scopes incidents:create,incidents:read

npm run api:key -- --list
npm run api:key -- --revoke <id>

Keys are elx_ prefixed. No issuable scope grants approval or treatment authority — that is enforced at issue time, not by convention.

Step 5

RUN THE DOCTOR

Asked before anything is paid for. Every check is cheap, none of them spends, and the expensive discovery happens first.

npm run doctor

Example outputtext

Runtime adapter        supervisord      PASS
Executor adapter       claude-code      PASS
Executor auth          AUTHENTICATED    PASS
Queue liveness         idle             PASS
Evidence policy        enforced         PASS
Production authority   none issued      INERT

READY FOR DIAGNOSIS

Reading the states

PASS
The check succeeded.
FAIL
Genuinely broken. Fix it — the doctor reports and never repairs.
INERT
Not broken. Working as designed, waiting on a decision only a person may make. An install with no production authority is correct, and a doctor that called it a failure would be teaching operators to fix a thing that is right.
UNKNOWN
Could not be determined. Never upgraded to PASS for lack of evidence.

Run it again after every configuration change. READY FOR DIAGNOSIS is the verdict you are looking for.

Fresh install: initialize the empty request storebash

npm run api
# Wait for the listening message, then press Ctrl+C.
npm run doctor

Before the API has ever started, queue liveness may be UNKNOWNbecause no request store exists yet. That is different from a configured API and executor reading different data directories.

Walkthrough

INSTALL ON A VIRTUAL MACHINE

The reference deployment is a Linux VM running supervisord. Every step below is a real command; nothing here restarts or mutates a running service. The VM fetches the artifact itself — no account, no repository access, no source checkout.

Connect to the VM
ssh into the host where your agents actually run.
Install prerequisites
Node.js 20 or newer, npm, and the CLI for whichever executor you plan to use.
Download the certified artifact and its checksum
curl -LO https://github.com/bdjones0545/elixir-releases/releases/download/v0.3.3-alpha/elixir-v0.3.3-alpha.tar.gz and the .sha256 beside it — on the VM itself. No GitHub account, repository access or source checkout is needed.
Verify the checksum before extracting
sha256sum -c elixir-v0.3.3-alpha.tar.gz.sha256 — refuse to install on any mismatch.
Unpack it and change into it
tar -xzf elixir-v0.3.3-alpha.tar.gz && cd elixir-v0.3.3-alpha
Install dependencies
npm ci — exactly the certified lockfile
Copy example configuration
cp deployments/example/*.yaml workforce/ and cp workforce/fleet.yaml.example workforce/fleet.yaml
Create the internal principal key
openssl rand -hex 32 into ~/.workforce-accelerator/secrets/internal.key, mode 600.
Create an organization
npm run agents:migrate -- --new-organization --name "…" --apply
Mint a durable Agent ID
npm run agents:migrate -- --new-agent --organization org_… --apply
Select a runtime adapter
runtime.adapter in workforce/fleet.yaml — supervisord is the live-proven one.
Select an executor
executor.adapter — claude-code or codex are the proven paths.
Supply credentials
Through the environment or your secrets manager. Never in fleet.yaml.
Run the doctor
npm run doctor — and read INERT as "not yet decided", not "broken".
Start the API
npm run api
Optionally start MCP
npm run mcp
Report a synthetic incident
See "Your first incident" below. Use a harmless example.
Verify the result
GET the incident, its result and its evidence.

Important distinction

AGENTS WHOSE CODE LIVES IN GITHUB

GitHub is your source-control boundary. It is usually not the host your agent runs on — and that difference is central to how Elixir treats evidence.

GitHub repository
       │
       │ source / code
       ▼
Agent runtime / VM
       │
       ├── Agent
       └── Elixir

Install Elixir on the machine or runtime that executes the agent. A repository binding can point at the agent’s source, and that is useful — but runtime observation needs access to the environment the agent is actually running in.

Your GitHub

Your AI agent’s source may live in GitHub, and Elixir can use approved repository bindings as part of a diagnosis.

Our GitHub

The Elixir development repository is private, and it is not the installation boundary. Elixir is distributed as a certified artifact, so getting Elixir never involves cloning ours.

Topology

SELF-HOSTED AGENT SERVER

A VPS, a cloud VM, a dedicated box, an internal Linux server — the shape is the same.

Host
├── AI agents
├── Elixir
├── Runtime adapter   (observation)
└── Executor adapter  (reasoning)

Deploy Elixir close enough to obtain approved runtime observation, and no further. It deliberately does not take an arbitrary remote host as a parameter: a tool that can be pointed at any machine at call time is a tool whose blast radius is decided by whoever makes the call.

SUPERVISORD

Proven

The live-proven runtime adapter. Verified read-only against a real host — 33 supervised programs — reading supervisorctl status.

workforce/fleet.yamlyaml

runtime:
  adapter: supervisord

What it observes

Running programs
Reported as observed state.
Exited and stopped programs
Distinguished, not flattened into “down”.
Absent programs
A program the supervisor does not know about is a real, reportable state.
Read-only
There is no restart, no start and no stop in this adapter.

SYSTEMD

Proven

Live-verified on a disposable Ubuntu 26.04 systemd-managed VM, with read-only observation of running, exited and absent services. It reads systemctl show for services and timers, distinguishes a running service from a completed active/exited oneshot, reports an absent unit as absent, and holds read_only throughout.

What was observed

PID 1                        /usr/lib/systemd/systemd
systemctl is-system-running  running
systemd version              259
services under management    24
long-running observed         5   cron, dbus, ssh, chrony, systemd-journald
nonexistent unit             reported ABSENT, not invented
commands issued               2   both `systemctl show`
read_only                    true throughout

Check systemctl is-system-running, never systemctl --version. A host can have the package installed, report a version, and not be run by systemd at all — which is exactly the case that kept this adapter unproven for as long as it was.

workforce/fleet.yamlyaml

runtime:
  adapter: systemd

Then confirm what Elixir can actually see on your host with npm run doctor before relying on it.

HERMES PROFILES

Proven

For fleets managed as Hermes profiles. Live against 16 workers of recorded output held as evidence in the repository, read over ssh by a probe that ships with the tool.

workforce/fleet.yamlyaml

runtime:
  adapter: hermes

hermes profile list

# Repeat only for profiles you intend to make eligible for selection:
npm run onboard -- --worker <profile> --apply

npm run agents:migrate -- --new-organization --name "Your Organization" --apply

# Replace org_… and the names. This preview changes nothing:
npm run setup -- --organization org_… --agents profile1,profile2 --json

# Run only after a human confirms the exact preview:
npm run setup -- --organization org_… --agents profile1,profile2 --apply --json
npm run doctor

Step 6

EXECUTOR CONFIGURATION

Which provider does the reasoning. If the one you configured is unavailable, Elixir refuses — it does not quietly use whichever one happens to be installed.

Choose only an installed managed runtimebash

command -v claude && claude --version
command -v codex && codex --version

# Select one that succeeds, then verify its real authenticated session:
npm run doctor

Claude Code

Proven

Install and authenticate the claude CLI.
Set executor.adapter: claude-code.
Run npm run doctor and confirm Executor auth is AUTHENTICATED.

Shell, a named-command allowlist, and the only adapter that reports cost in dollars. Requires the claude CLI, authenticated; an expired session presents as an auth failure rather than a silent fallback.

command -v claude && claude --version
# workforce/fleet.yaml: executor.adapter: claude-code
npm run doctor

Codex

Proven

Install and authenticate the codex CLI.
Set executor.adapter: codex.
Run npm run doctor and confirm Executor auth is AUTHENTICATED.

Sandboxes by workspace rather than by named commands, and reports tokens rather than money — so cost_usd is null and the reservation stands as the charge. Requires the codex CLI, authenticated.

command -v codex && codex --version
# workforce/fleet.yaml: executor.adapter: codex
npm run doctor

Model runtime adapters

Elixir drives the loop directly. The credential goes in the environment, never in fleet.yaml — the config file names an adapter, and nothing in it is a secret.

Anthropic API

Certification pending

# workforce/fleet.yaml
executor:
  adapter: anthropic-api
  model: <anthropic-model-id>

export ELIXIR_ANTHROPIC_API_KEY=…

# Keep credentials out of fleet.yaml, then verify:
npm run doctor

OpenAI API

Certification pending

# workforce/fleet.yaml
executor:
  adapter: openai-api
  model: <openai-model-id>

export ELIXIR_OPENAI_API_KEY=…
# optional: export ELIXIR_OPENAI_ORG=…

# Keep credentials out of fleet.yaml, then verify:
npm run doctor

Gemini

Certification pending

# workforce/fleet.yaml
executor:
  adapter: gemini
  model: <gemini-model-id>

export ELIXIR_GEMINI_API_KEY=…

# Keep credentials out of fleet.yaml, then verify:
npm run doctor

OpenAI-compatible / local

Certification pending

# workforce/fleet.yaml
executor:
  adapter: openai-compatible
  endpoint: <ollama-vllm-or-lm-studio-endpoint>
  model: <model-id>

export ELIXIR_OPENAI_COMPATIBLE_API_KEY=…
# For a genuinely unauthenticated server, use instead:
# export ELIXIR_OPENAI_COMPATIBLE_NO_AUTH=true
# Assert only after proving tool calls work:
# export ELIXIR_OPENAI_COMPATIBLE_TOOL_CALLING=true

# Keep credentials out of fleet.yaml, then verify:
npm run doctor

AWS Bedrock

Certification pending

# workforce/fleet.yaml
executor:
  adapter: bedrock
  model: <bedrock-model-id>
  settings:
    region: <aws-region>

export AWS_ACCESS_KEY_ID=…
export AWS_SECRET_ACCESS_KEY=…
# Role sessions also require AWS_SESSION_TOKEN.

# Keep credentials out of fleet.yaml, then verify:
npm run doctor

Azure OpenAI

Certification pending

# workforce/fleet.yaml
executor:
  adapter: azure-openai
  endpoint: <azure-resource-endpoint>
  model: <deployment-name>

export ELIXIR_AZURE_OPENAI_API_VERSION=…
export ELIXIR_AZURE_OPENAI_API_KEY=…
# Or use ELIXIR_AZURE_OPENAI_TOKEN, never both.

# Keep credentials out of fleet.yaml, then verify:
npm run doctor

Vertex AI

Certification pending

# workforce/fleet.yaml
executor:
  adapter: vertex-ai
  model: <vertex-model-id>
  settings:
    project: <gcp-project>
    location: <gcp-region>

export ELIXIR_VERTEX_ACCESS_TOKEN=…
# Or set GOOGLE_APPLICATION_CREDENTIALS to a service-account JSON file.

# Keep credentials out of fleet.yaml, then verify:
npm run doctor

Enterprise gateway

Certification pending

# workforce/fleet.yaml
executor:
  adapter: enterprise-gateway
  endpoint: <gateway-endpoint>
  model: <model-id>
  settings:
    protocol: openai-chat # or anthropic-messages

export ELIXIR_GATEWAY_TOKEN=…
# For a genuinely unauthenticated gateway, use instead:
# export ELIXIR_GATEWAY_NO_AUTH=true

# Keep credentials out of fleet.yaml, then verify:
npm run doctor

Step 7

MCP SETUP

So a compatible AI client can report its own incident and read back the verified outcome.

MCP client configurationjson

{
  "mcpServers": {
    "elixir": {
      "command": "node",
      "args": ["/absolute/path/to/elixir/mcp/server.mjs"],
      "env": {
        "ELIXIR_API_KEY": "elx_…",
        "ELIXIR_API_URL": "http://127.0.0.1:8790"
      }
    }
  }
}

Replace the path with your install and the key with one you issued. The placeholder above is not a key and will not authenticate.

Run it directlybash

npm run mcp
npm run mcp:test

Environment

MCP server environment variables
Variable	Notes
ELIXIR_API_KEY	Required. The server refuses to start without one — a server that connects, advertises six tools and then fails every one of them is worse than one that does not start.
ELIXIR_API_URL	Default http://127.0.0.1:8790
ELIXIR_API_TIMEOUT_MS	Default 30000, bounded [1000, 300000]

The six tools

elixir_list_agents
elixir_get_agent
elixir_report_incident
elixir_get_incident
elixir_get_result
elixir_get_evidence

MCP access is not approval authority. There is no tool that approves, executes, deploys, restarts or opens a shell, and none can be added by configuration.

Step 8

YOUR FIRST INCIDENT

Verify the whole path without touching production. This example is deliberately harmless — nothing here asks you to break anything.

Install → configure → doctor → mint an Agent ID → issue an API key
   → start the API → submit a synthetic incident → read the result → inspect the evidence

Submitbash

npm run api   # in one terminal

curl -X POST http://127.0.0.1:8790/v1/incidents \
  -H "Authorization: Bearer $ELIXIR_API_KEY" \
  -H "Idempotency-Key: first-check-0001" \
  -H "Content-Type: application/json" \
  -d '{
    "agent_id": "agt_…",
    "summary": "Synthetic check: confirming the incident path works end to end.",
    "observed": "This is a test incident submitted during installation.",
    "expected": "Elixir accepts it, queues it, and returns an incident id.",
    "requested_outcome": "Confirm the reporting path is wired correctly. No repair is expected.",
    "severity": "low",
    "category": "observability",
    "environment": "staging"
  }'

202 Acceptedjson

{
  "incident_id": "inc_…",
  "agent_id": "agt_…",
  "organization_id": "org_…",
  "status": "queued",
  "risk": "R3",
  "terminal": false,
  "result_available": false
}

Read it backbash

curl -H "Authorization: Bearer $ELIXIR_API_KEY" \
  http://127.0.0.1:8790/v1/incidents/inc_…

curl -H "Authorization: Bearer $ELIXIR_API_KEY" \
  http://127.0.0.1:8790/v1/incidents/inc_…/result

curl -H "Authorization: Bearer $ELIXIR_API_KEY" \
  http://127.0.0.1:8790/v1/incidents/inc_…/evidence

Nothing starts the executor for you

Elixir ships no supervisor unit and no timer. A queued incident stays queued until something works it, and starting that is an act rather than a side effect of installing a file — because it means sessions run, spend money and close requests unattended.

npm run executor -- --list          # what is queued and eligible
npm run executor -- --once          # work the oldest, submit nothing
npm run liveness                    # is anything actually working the queue?
npm run escalations                 # what needs a person

Paid plans

ACTIVATE AFTER CHECKOUT

Developer needs no activation. A paid Checkout returns one command that binds the subscription to this installation.

Before Checkout, copy the durable organization ID:

npm run billing

After payment, enter that org_… ID on the return page. The checkout and organization can each be claimed only once.

Run the one-time command shown on the return page:

npm run billing -- activate --token adm_live_…
npm run billing -- remote-sync

The token is stored owner-only in Elixir’s data directory. It authorizes only reading this organization’s commercial entitlement; it cannot charge, refund, approve treatment or reach an executor.

Before production

SECURITY CHECKLIST

Keep executor credentials in the environment
Or in your secrets manager. Never in a config file.
Never commit an API key
Keys are elx_ prefixed and easy to grep for. Rotate anything that has ever been in a repository.
Do not expose the internal gateway
It is loopback-only by design and has no outbound path to any worker.
Use durable Agent IDs
Not hostnames, not process names, not display names.
Keep observation read-only
Unless treatment is explicitly authorized by a grant a human wrote.

API access is not approval authority
No issuable scope can approve anything.
MCP access is not approval authority
The approving tools do not exist.
Expect no silent provider fallback
A missing provider is a refusal, not a substitution.
Test in a sandbox first
Send a synthetic incident before a real one.
Run the doctor after every change
Configuration drift is one of the failure classes Elixir exists to catch.

Read the security architecture Browse the docs

INSTALL ELIXIR WHERE YOUR AGENTS LIVE.

What the alpha is

Self-hosted

Bring your own model

Apache-2.0

Developer tier is free

How access works

Guided setup

Developer setup

Node.js 20 or newer

npm

A way to unpack what you receive

Linux or macOS

One supported executor

A runtime adapter

v0.3.3-alpha

Install the artifact we tested

If the file is on your computer

Built from the release candidate

Tested inside the package

Validated inside the package

Checked for documented-command drift

Checked for licence and version consistency

Clean-room installable

Give the install a shape

Declare your fleet

Create an organization and a durable Agent ID

Issue an API key

PASS

FAIL

INERT

UNKNOWN

Connect to the VM

Install prerequisites

Download the certified artifact and its checksum

Verify the checksum before extracting

Unpack it and change into it

Install dependencies

Copy example configuration

Create the internal principal key

Create an organization

Mint a durable Agent ID

Select a runtime adapter

Select an executor

Supply credentials

Run the doctor

Start the API

Optionally start MCP

Report a synthetic incident

Verify the result

SUPERVISORD

Running programs

Exited and stopped programs

Absent programs

Read-only

SYSTEMD

HERMES PROFILES

Claude Code

Codex

Model runtime adapters

Anthropic API

OpenAI API

Gemini

OpenAI-compatible / local

AWS Bedrock

Azure OpenAI

Vertex AI

Enterprise gateway

Keep executor credentials in the environment

Never commit an API key

Do not expose the internal gateway

Use durable Agent IDs

Keep observation read-only

API access is not approval authority

MCP access is not approval authority

Expect no silent provider fallback

Test in a sandbox first

Run the doctor after every change