Install PRISM in one line

Four channels, one result: the harness that disciplines your agent and cuts its token bill — installed where you want it. The one-liner below is the recommended path.

curl -fsSL https://git.sovereign-society.org/prism/prism-harness/raw/branch/main/install.sh | sh

1. curl | sh — the meta-installer

Pulls the sovereign repos under git.sovereign-society.org/prism, installs the global harness (the layer that shapes every agent in all your projects), then offers to scaffold one working repo with the doctrine. Repo-aware by default: inside a git repo it asks to scaffold that repo (default yes); with no repo it offers git init — default no, so non-developers can just take the global assistant layer.

curl -fsSL https://git.sovereign-society.org/prism/prism-harness/raw/branch/main/install.sh | sh

For automation — note the sh -s --: a bare | sh --yes is a shell option-parse error; the flags must reach the script as positional arguments. --yes follows the same repo-aware defaults (scaffold in a repo, no new repo creation — use --target PATH to force):

curl -fsSL https://git.sovereign-society.org/prism/prism-harness/raw/branch/main/install.sh \
  | sh -s -- --yes --global --target ~/projects/my-new-thing

Or via env vars, which work with any pipe form:

PRISM_YES=1 curl -fsSL https://git.sovereign-society.org/prism/prism-harness/raw/branch/main/install.sh | sh
PRISM_YES=1 PRISM_TARGET=~/projects/my-new-thing curl -fsSL ... | sh

Auditable variant:

curl -fsSL https://git.sovereign-society.org/prism/prism-harness/raw/branch/main/install.sh -o install.sh
chmod +x install.sh
./install.sh --yes

Flags

--global            Install all PRISM components globally (bun add -g)
--no-global         Skip the global install
--target PATH       Scaffold into PATH instead of the detected repo/cwd
                    (PATH is git-initialized if it is not inside a repo)
--no-target         Skip the target scaffold
--with-route        Include prism-route (KDL profiles + rotation + ~/.secrets/ auth)  [priority]
--no-route          Exclude prism-route
--with-loops        Include prism-loop (overnight-loop memory plugin)
--no-sober          Exclude prism-sober (Sober-Raccoon steering plugin)
--no-proxy          Exclude prism-proxy (audit + compression plugin)
--with-chat         Include prism-chat (terminal + PWA chat client)
--no-chat           Exclude prism-chat
--identity          Forge the agent's identity canon after install
--no-identity       Skip the identity forge
--identity-home PATH  Where the identity canon lives (default: ~/.prism/identity)
--mode team|solo    PRISM operating mode for the target scaffold (auto-detect
                    by default)
--yes               Non-interactive (auto-accepts the four Y/n prompts).
                    Note: --identity is NOT forced by --yes — interactive by design.
--no-color          Disable colored output

Choose your operating mode

The installer asks Team-mode (prism for all) or lonely-wolf mode (prism for me)? — this decides how PRISM governs the target project:

In both modes the harness writes a root AGENTS.md reference, so the doctrine is actually loaded by whatever AI coding agent (Claude Code, Codex, OpenCode, Cursor) visits the repo — not just dropped in a folder nobody reads. Team mode is for shared codebases; lonely-wolf mode is for individual developers who want PRISM's edge without publishing their rules.

curl -fsSL https://git.sovereign-society.org/prism/prism-harness/raw/branch/main/install.sh \
  | sh -s -- --yes --mode solo --target ~/projects/my-thing    # lonely wolf
curl -fsSL https://git.sovereign-society.org/prism/prism-harness/raw/branch/main/install.sh \
  | sh -s -- --yes --mode team --target ~/projects/our-thing   # team

2. bun add -g @prism/* — sovereign npm registry

The six components live on the sovereign Forgejo npm registry at git.sovereign-society.org/api/packages/prism/npm/. Point bun at it via a scoped mapping in ~/.bunfig.toml:

[install.scopes]
"@prism" = "https://git.sovereign-society.org/api/packages/prism/npm/"

Then:

bun add -g @prism/harness @prism/loop @prism/sober @prism/route @prism/proxy @prism/chat

All six components share one Bun runtime. The small bundles (dist/*.js) are tiny — the whole suite is ~280 KB, and bun resolves everything at install time.

Fallback

When the registry is unreachable, install.sh automatically falls back to per-component git-URL installs. To suppress the probe (e.g. on a closed-network machine), set PRISM_USE_REGISTRY=0.

3. Arch / CachyOS — local-repo install (AUR deprecated)

The Arch User Repository is currently closed to new submissions after the AI-malware-package incident. The PRISM meta-package is now installed as a local-repo recipe; the PKGBUILD lives at aur/prism-harness-suite/PKGBUILD and builds cleanly with makepkg -f.

# One-time setup on the operator's machine:
git clone https://git.sovereign-society.org/prism/prism-harness.git
cd prism-harness/aur/prism-harness-suite
makepkg -f
sudo install -d -m 0755 /var/lib/pacman/sync/prism-local
sudo cp *.pkg.tar.zst /var/lib/pacman/sync/prism-local/
sudo repo-add /var/lib/pacman/sync/prism-local/prism-local.db.tar.gz \
              /var/lib/pacman/sync/prism-local/*.pkg.tar.zst
# Add the [prism-local] section to /etc/pacman.conf.
# Then:
sudo pacman -Syu prism-harness-suite

After install:

prism-harness --help
prism-harness identity init    # forge the agent's eight-file canon

4. Container — one-in-all Debian image

One image, all six components pinned from the sovereign registry, built from debian:bookworm-slim with full agent tooling (git, build-essential, python3, gnupg, apt-get). Prebuilt images are served from R2 at pkg.getharness.app — no public registry, no build required. Three modes through one entrypoint:

Download (recommended)

Immutable versioned tarballs plus a moving latest pointer, with a sha256 manifest. Current release: v1.0.0-beta.7.

# 1. Fetch the manifest and the image:
curl -fsSL https://pkg.getharness.app/SHA256SUMS -o SHA256SUMS
curl -fsSL https://pkg.getharness.app/prism-prism_latest_linux_amd64.tar.gz -o prism.tar.gz

# 2. Verify, then load:
sha256sum -c SHA256SUMS 2>/dev/null || sha256sum prism.tar.gz   # compare against the manifest
podman load -i prism.tar.gz

# 3. Talk to it:
podman run --rm localhost/prism:v1.0.0-beta.7 prism harness --help

Pin a version instead of latest: https://pkg.getharness.app/prism-prism_v1.0.0-beta.7_linux_amd64.tar.gz. Downloads are counted at the edge; the sovereign VPS sees zero public traffic.

Quadlet deployment

Run it as a systemd service via Podman quadlets (systemd ≥ 254). The release repo prism-image ships a toggle pair — sandboxed (loopback-only, read-only rootfs, dropped capabilities, read-only secrets) and loose for interactive work:

git clone https://git.sovereign-society.org/prism/prism-image.git
cd prism-image/quadlet

# Sandboxed control plane (the sovereign default):
sed 's|%%VERSION%%|v1.0.0-beta.7|' prism-sandboxed.container \
  > ~/.config/containers/systemd/prism-sandboxed.container
systemctl --user daemon-reload
systemctl --user enable --now prism-sandboxed

For the always-on VPS pattern (gateway + heartbeat timer), the units live in prism-suite/containers/quadlet/:

sudo install -m 0644 prism-gateway.container prism-heartbeat.container \
                    prism-heartbeat.timer /etc/containers/systemd/
sudo systemctl daemon-reload
sudo systemctl enable --now prism-gateway.service prism-heartbeat.timer

Build it yourself (publisher flow)

Maintainers build from the prism-image repo and publish to R2; end users download above. The image pins @prism/* from the sovereign Forgejo npm registry:

git clone https://git.sovereign-society.org/prism/prism-image.git
cd prism-image
./build.sh v1.0.0-beta.7 1.0.0-beta.7    # image tag + harness registry pin
./publish.sh v1.0.0-beta.7               # podman save → gzip → R2 + SHA256SUMS

After install — identity forge

All four channels put you in the same place: a working prism-harness identity init. Run it once and the agent wakes up with a soul, a purpose, a memory, and a heartbeat. Re-running never clobbers your answer: if the eight canon files already exist, init offers to keep them (Enter keeps); only --force overwrites.

prism-harness identity init    # interactive questionnaire
prism-harness identity status  # report remaining {{PLACEHOLDER}}s