PRISM / sovereign agent harness

Install

Four channels, one result: the sovereign agent harness, installed where you want it.

1. curl | sh — the meta-installer

Pulls the sovereign repos under git.sovereign-society.org/prism, prompts component selection (model+services first, plugins after), does bun add -g, and scaffolds the target repo. Interactive by default.

curl -fsSL https://git.sovereign-society.org/prism/prism-harness/raw/branch/main/install.sh | sh

For automation:

curl -fsSL https://git.sovereign-society.org/prism/prism-harness/raw/branch/main/install.sh \
  | sh -s -- --yes --global --target ~/projects/my-new-thing

Auditable variant:

curl -fsSL https://git.sovereign-society.org/prism/prism-harness/raw/branch/main/install.sh -o install.sh
chmod +x install.sh
./install.sh --yes

Flags

--global            Install all PRISM components globally (bun add -g)
--no-global         Skip the global install
--target PATH       Scaffold into PATH instead of cwd
--no-target         Skip the target scaffold
--with-route        Include prism-route (KDL profiles + rotation + ~/.secrets/ auth)  [priority]
--no-route          Exclude prism-route
--with-loops        Include prism-loop (overnight-loop memory plugin)
--no-sober          Exclude prism-sober (Sober-Raccoon steering plugin)
--no-proxy          Exclude prism-proxy (audit + compression plugin)
--identity          Forge the agent's identity canon after install
--no-identity       Skip the identity forge
--identity-home PATH  Where the identity canon lives (default: ~/.prism/identity)
--yes               Non-interactive (auto-accepts the four Y/n prompts).
                    Note: --identity is NOT forced by --yes — interactive by design.
--no-color          Disable colored output

2. bun add -g @prism/* — sovereign npm registry

The five components live on the sovereign Forgejo npm registry at git.sovereign-society.org/api/packages/prism/npm/. Point bun at it via a scoped mapping in ~/.bunfig.toml:

[install.scopes]
"@prism" = "https://git.sovereign-society.org/api/packages/prism/npm/"

Then:

bun add -g @prism/harness @prism/loop @prism/sober @prism/route @prism/proxy

All five components share one Bun runtime. The small bundles (dist/*.js) are tiny — the whole suite is ~250 KB, and bun resolves everything at install time.

Fallback

When the registry is unreachable, install.sh automatically falls back to per-component git-URL installs. To suppress the probe (e.g. on a closed-network machine), set PRISM_USE_REGISTRY=0.

3. AUR — yay -S prism-harness-suite

The meta-package ships all five small bundles, the install helper, the identity canon templates, and the container build scripts. One Bun runtime, wrappers in /usr/bin.

yay -S prism-harness-suite      # or paru -S prism-harness-suite

After install:

prism-harness --help
prism-harness identity init    # forge the agent's eight-file canon

4. Container — one-in-all Debian image

Built from debian:bookworm-slim with full agent tooling (git, build-essential, python3, gnupg, apt-get). Three modes through one entrypoint:

Mode	What it runs
prism gateway (default)	prism-route serve + prism-proxy — always-on model gateway.
prism heartbeat	CRON.md wake loop: reads the mounted identity canon, picks the topmost open slice in SLICES.md, executes it, marks DONE.
prism harness ... / prism identity-init	Passthrough to the matching CLI. Use podman run -it for interactive flows.

Build

# In each component repo, build the small bundles first:
for c in prism-harness prism-loop prism-sober prism-route prism-proxy; do
  (cd PRISM/$c && bun run build)
done

# Then build the image (default tag: v1.0.0-rc.4):
./scripts/build-container.sh

Push to the sovereign forge registry

Distribution never touches public registries. Image lands at git.sovereign-society.org/prism/prism:<tag> via an SSH tunnel to the forge registry:

# ~/.config/prism/forge-auth.env (NOT a Forgejo API token — registry-push creds)
echo 'SOVEREIGN_FORGE_REGISTRY_USER=...'  > ~/.config/prism/forge-auth.env
echo 'SOVEREIGN_FORGE_REGISTRY_PASSWORD=...' >> ~/.config/prism/forge-auth.env
chmod 600 ~/.config/prism/forge-auth.env

ssh -L 5000:127.0.0.1:5000 -p 30022 root@178.105.157.200 -N &
TUNNEL=$!; trap "kill $TUNNEL" EXIT
./scripts/push-container.sh v1.0.0-rc.4

Quadlet deployment

Mirror SOBER's pattern (SOBER/.agents/ops/sovereign-forge-2/). Units in PRISM/containers/quadlet/:

# VPS
sudo install -m 0644 PRISM/containers/quadlet/prism-gateway.container \
                    /etc/containers/systemd/
sudo install -m 0644 PRISM/containers/quadlet/prism-heartbeat.container \
                    /etc/containers/systemd/
sudo install -m 0644 PRISM/containers/quadlet/prism-heartbeat.timer \
                    /etc/containers/systemd/

sudo systemctl daemon-reload
sudo systemctl enable --now prism-gateway.service
sudo systemctl enable --now prism-heartbeat.timer

# Workstation (rootless podman, drop the sudo, add ~/.config/containers/systemd/)
systemctl --user daemon-reload
systemctl --user enable --now prism-gateway.service
systemctl --user enable --now prism-heartbeat.timer

After install — identity forge

All four channels put you in the same place: a working prism-harness identity init. Run it once and the agent wakes up with a soul, a purpose, a memory, and a heartbeat.

prism-harness identity init    # interactive questionnaire
prism-harness identity status  # report remaining {{PLACEHOLDER}}s

How the identity canon works →