Install: IRIN.app
The product is one macOS DMG containing IRIN.app. No source checkout, no build tools, and no Docker are needed for the core product.
Download
Get IRIN_<version>_aarch64.dmg from GitHub Releases. macOS on Apple silicon only; Intel Macs are not supported.
Verify
Check the download against the HASHES.txt file attached to the same release before opening it.
Open IRIN.app
Drag the app to Applications and open it. The app starts and owns its own local Council on 127.0.0.1; no terminal command is involved.
Discover, then deliberate
Open Discover to see which provider transports are detected — names only, never key values, no billable call — then convene a cabinet in War Room's Deliberate view.
Contributors can still build and run everything from source; the repository README documents that path (make setup, make warroom). It is no longer how you install the product.
Everyday: War Room deliberation
IRIN is structured multi-model deliberation on macOS and Ubuntu. War Room is the product face. Direct provider transport is the default; Gateway is explicit per-seat opt-in.
Discover transports
Open Discover in War Room. It reports which provider paths are detected — API-key variable names only (never values), local CLI binaries, local model runtimes — with no billable inference call. A detected CLI is not proof its login is still valid.
Convene a cabinet
Pick a cabinet whose required transports match what Discover found. Seats stream arguments across rounds; you can intervene; factual claims can be checked; a chair ruling is filed. Sessions run on the operator's clock.
Direct by default
Council calls the provider API or authenticated local CLI itself. Select Governed via Gateway for a seat (or set COUNCIL_VIA_GATEWAY=1) only when you want metering, budget limits, and a signed audit-ledger record for that call. Gateway never silently substitutes a provider.
Gateway is a visible, reversible control
IRIN.app keeps Gateway off until you turn it on. Settings → Enable Gateway starts an app-owned local pack (irin-desktop-gateway; requires Docker Desktop). It stores the Council client key in the macOS Keychain and switches on governed proceedings only after authenticated readiness. Disable reverses to Direct. The core app needs no Docker.
No Outbox from ordinary deliberation
An ordinary War Room / Council run does not create a signed Outbox directive. Nothing executes without you — IRIN does not ship an autonomous operator-ready Worker.
Separate lane: Sentinel → signed Outbox
This lane is disarmed by default. Loading a Sentinel is not arming. Product guidance ends at a signed directive.
Sentinel fires
A deterministic watcher (file inbox, ledger delta, queue depth, anomaly, silence, health, and more) crosses its threshold. No LLM in the observe/interesting decision. Fire decision stays inside a ~100 ms envelope. The fire is written to the per-tenant watch_fires table, which is hash-chained so tampering with prior rows becomes detectable. The event becomes an Escalation carrying evidence only.
Producer promotes (armed only)
The hardware ceremony arms the Gateway Watch producer — not the Sentinel itself. On IRIN.app the ceremony runs from Settings, beside the Gateway control: enroll Touch ID, rehearse, then arm with a biometric tap. No terminal command is required. Enabling a Sentinel, enabling the dispatcher, and completing the producer arm ceremony are distinct controls. A boot env path can start watchers but cannot claim, spend, or sign a new directive without a hardware-attested arm.
Gateway routes triage
Subject to policy and budget, Gateway routes the escalation for Council triage. Gateway meters, guards, and signs on this path. It never supplies semantic judgment. Closed-loop triage is bounded at ≤120 s by default.
Council deliberates
Council produces a bounded Directive naming job, scope, stop condition, and return expectation. Council speaks; it does not act and does not hold keys.
Gateway signs into outbox
Gateway canonicalizes the Directive with RFC 8785 JCS, signs the canonical bytes with its Ed25519 key, and appends the canonical JSON plus signature to directive_outbox. The hash chain lives on watch_fires; each outbox row is individually signed; the governed audit ledger is a separate signed surface. Not every action is recorded or executed.
The surfaces
Strict separation. Watch is cheap. Thought is rare. The signed record is the endpoint.
Council · War Room
DELIBERATIONSpeaks, never acts. Parallel seats, precedent, convergence, evidence checks. Interactive sessions on operator clock. Direct transport default.
Gateway
OPT-IN · METER · SIGNExplicit per-seat governance for supported routes. Hosts the watch plane. Ed25519 + JCS over directives before the outbox write. Budget gates and structural guards on governed paths.
Sentinel · Watch · Outbox
OFF BY DEFAULTDeterministic observation; producer arm is a hardware ceremony. Product path ends at a signed Outbox row. No autonomous operator-ready Worker; no tenant librarian as a current product primitive.
The three proof tiers
Confirm the signed-directive path with zero keys. Confirm deliberation with live models. Cross into real observation-to-directive only after ceremony.
No-key signed-directive proof
Engineering lane, from a source checkout: run make verify at the IRIN repo root. Isolated compose; zero provider keys; no hardware arm. Seeds a row in watch_fires, routes through a local no-spend Council stub, signs with Ed25519 over JCS, writes to directive_outbox. Tear down with make verify-down.
Live deliberation
On IRIN.app: open War Room, select a cabinet, Convene — this needs a usable provider transport for real deliberation. From a source checkout, make warroom runs the same browser path on macOS or Ubuntu. Sessions can be paused; synthesis inspected in History. Neither path requires WATCH_PRODUCER_ENABLED and neither creates a signed Outbox directive by itself.
Armed Watch producer
Only after the arming ceremony. Real sentinel fires can be promoted toward live Council triage and a signed outbox row. The interactive path is a hardware ceremony — Touch ID from the app's Settings on the installed DMG, Secure Enclave / FIDO2 from the CLI on a source checkout. A boot env path is an audited config flip: it can start watchers but cannot claim, spend, or sign a new directive without a hardware-attested arm. Producer and dispatcher are off by default.
The ≤120 s budget is the closed-loop triage envelope only. War Room and bare CLI sessions are operator-timed.