Everything between your
code and the device.

ArdaForm is four pieces that only make sense together: a package format, a runtime, a control plane and a provisioning path. This page walks the whole loop — from the repository on your laptop to a terminal on a counter three hundred miles away, and back.

01 / Composition

Four pieces,
one loop.

Each part is useful on its own. Together they close the gap between "the demo works on my desk" and "two hundred of them work in customer sites".

The package

A single signed, encrypted .arda file containing your entire application and its manifest.

Format →Working

The runtime

ArdaPlayer — one Go binary that renders your interface through WebKit and bridges it to the hardware.

Runtime →Working

The control plane

Releases, channels, the device registry, telemetry and the operator surface for remote access.

CLI →In progress

Provisioning

A Debian-based installer that turns bare hardware into a registered appliance in one boot.

Deploy →Planned

02 / The outbound path

How a release
reaches a device.

Nothing pushes into a customer's network. Every device holds one authenticated outbound connection, and every instruction rides down it.

A / Build

</>

arda push

Your build output is bundled, signed with your pack key and encrypted.

B / Release

r-241●

Immutable release

Stored by SHA-256, tagged, promoted between channels — never rewritten.

C / Rollout

Waves & targets

The control plane names the URL and hash on each device's control channel.

D / Apply

Verify, stage, swap

Each device downloads, checks the hash, decrypts, stages and reports back.

Outbound only Hash verified per device Status reported back

03 / Data

Offline is the
normal case.

Shop Wi-Fi drops. A router reboots. Somebody unplugs the wrong thing. A device that stops taking payments because a DNS lookup failed is not a product — it's an incident.

ArdaForm treats the network as an optimisation. The application reads and writes a local encrypted store; anything destined for the server goes into a durable queue that survives power loss and replays on reconnect with at-least-once delivery. The server acknowledges each item by ID, so duplicates are cheap to dedupe and nothing quietly disappears.

01
Local firstReads and writes hit the on-device store. No round trip in the hot path.
02
Durable queueOutbound records persist to encrypted storage before the promise resolves.
03
Replay on reconnectThe full queue is re-sent until the server acknowledges each ID.
04
Pull profilesCatalogues, pricing and configuration arrive as versioned deltas, cached on disk.

sync.js offline-first

// Nothing here needs the network to be up
const db = await arda.db('orders')

await db.put(order.id, order)

// Durable: persisted before this resolves
await arda.sync.push({
  type: 'order',
  ...order,
})

// Cached profile — served from disk when offline
const menu = await arda.sync.get('menu', {
  since: db.meta().lastSync,
})

arda.net.on('online', () => {
  ui.badge('synced')
})

04 / The inbound path

What the fleet
tells you back.

Support is where device businesses lose money. Everything below exists so that "it's frozen again" can be answered without a two-hour drive.

Presence

Online state and last-seen timestamps maintained by the control channel's own heartbeat, not by guesswork.

Hardware snapshot

Distribution, kernel, architecture, CPU, memory, disk, GPU, network interfaces and attached USB devices, reported on every connect.

Application logs

Console output streamed on demand, with level and timestamp, so you can watch the failure as it happens.

Screen capture

Ask a device what it is currently showing — a single frame, or a low-rate stream that updates when the screen changes.

Live evaluation

Run JavaScript inside the running page to inspect state, or read the DOM, without restarting the application.

Secure shell

An operator-initiated reverse tunnel gives a real shell on a device behind NAT, multiplexed over its existing outbound socket.

What the control plane runs on The broker devices dial into, and the API behind it, are supervised by APM — a single-binary Linux process manager we built alongside this. Same instinct, different layer: rolling restarts without dropping a device's control socket, and a proxy that keeps persistent WebSockets alive through a deploy.

Access is a privilege, not a default Remote console, evaluation and shell access are powerful enough to be dangerous. They are operator-initiated, short-lived and auditable — never a standing door into a customer's device.

05 / Honesty

What works today.

ArdaForm is under active development. Some of it is running on deployed hardware right now; some of it is a design we haven't finished. Here is the split.

Capability	Status	Notes
ArdaPlayer runtime	Working	Go binary, WebKit surface, kiosk mode, running on deployed devices.
Encrypted packages	Working	Signed and AES-GCM encrypted bundles, verified at load.
Control channel	Working	Persistent outbound WebSocket with reconnect and heartbeat.
Local encrypted store	Working	Hardware-bound key/value database with a durable outbound queue.
Remote console & shell	Working	Console capture, eval, DOM read, screenshot, reverse SSH tunnel.
Device telemetry	Working	OS, CPU, memory, disk, network and USB inventory on every connect.
Package & binary updates	Working	Hash-verified download, signature check, staging and re-exec.
Printer APIs	In progress	USB thermal printing works; discovery and status reporting are being generalised.
GPIO APIs	In progress	Design settled, board coverage expanding — Raspberry Pi first.
Camera & QR	In progress	Capture and scanning under development; on-device face matching after that.
arda CLI	In progress	Command surface is being finalised alongside the portal. Names may still change.
Public portal	In progress	The control panel exists internally. Public sign-up is not open yet.
USB installer image	Planned	Debian-based whole-device provisioning.
Device simulator	Planned	Develop against a fake device on your workstation.

Look inside
the runtime.

ArdaPlayer is the part that actually meets the hardware — a single Go binary, a WebKit surface and a deliberately narrow bridge between them.

Explore ArdaPlayer Browse the APIs

Everything between yourcode and the device.

Four pieces,one loop.