The component catalogue.

The Mac and Linux front door.

The one-download installer for Mac and Linux. On a Mac it is a notarized .pkg, stapled so it installs with no network; on Debian and Ubuntu it is a .deb. Either way you double-click it, and it sets up baton, every module and the batond background service for the person installing. macOS 14+ on Apple silicon; Debian 11+ or Ubuntu 20.04+ on x86-64. The curl one-liner stays for other distributions, scripts and CI.

Download. Double-click. Done.

The signed Windows installer: one Authenticode-signed executable (subject QUANTUM ENCODING LTD, verified by Windows itself before it runs) carrying the whole payload, every binary inside individually signed and timestamped. It extracts, runs the tested installer while you watch, and holds the window open until you have seen the outcome. The front door for people; the irm one-liner stays for scripts and CI.

Desktop automation for GNOME and Wayland.

The Linux sibling, same JSON contract, so app profiles and orchestration port unchanged. It perceives over AT-SPI, captures through the ScreenCast portal, and acts two ways: element-first over D-Bus, with no pointer to aim and no focus to steal (the sturdy default on Wayland), or humanized synthetic input through kernel uinput for targets AT-SPI cannot see. Drives Chromium browsers over CDP; manages windows through a bundled GNOME Shell extension.

Playwright for the Mac desktop.

JSON-driven perceive-and-act automation for native macOS apps: read the accessibility tree, snapshot elements to stable refs, click, type, and run a whole flow in one invocation. Input is humanized, down to glide paths and typing rhythm. Acts sit behind a Secure-Enclave arm grant (the first act fires Touch ID on the physical machine) and the operator always gets a countdown card with live Pause and Cancel.

The fleet's biometric secret store.

An encrypted vault that asks for Touch ID at the moment of read, not at login, with its master key wrapped by the Secure Enclave. Store a key once; then scoped injection with secrets exec, per-agent grants, TTL leases that self-destruct, and a session broker decide who reads what, and when. Every baton flow fetches its keys from here. Install on Apple silicon: brew install --cask quantum-encoding/tap/secrets — the Developer ID signed, notarized build, which is what lets Touch ID and the Secure Enclave work.