Self-host PatentChecker
PatentChecker runs inside your environment as a deterministic, verifiable evidence pipeline. The default install path is now the public standalone runtime bundle.
PatentChecker is proprietary software. Real evaluations are issued as 2-weekhandoffs with seeded tenant material, and ongoing production access remains key-gated.
Choose your path
Self-hosting is the path for teams ready to run PatentChecker locally or inside their own infrastructure. If you only want public proof artifacts, start with the buyer path or the demos first.
- 1Verify and unpack the standalone runtime bundle before you touch live watchlists or trial inputs.
- 2Run a watchlist locally and verify the emitted run directory offline so you know the artifact loop end to end.
- 3Use the container path only when you need production-like deployment or digest-pinned execution.
- 4Move to the platform quickstart when scheduling, webhook handling, or control-plane operations become the real problem.
Start with public runtime assets and verify-only artifacts if you have not yet proven the workflow internally.
Jump straight to the portable runtime path for Linux or macOS if you want the fastest self-hosted start.
Use the keyless signature flow before any regulated or audit-grade deployment.
Switch to the platform quickstart when you need runners, scheduling, retention, or operational workflows.
Use the demo hub when the question is modality-specific: viral vectors, LNP delivery, regular mRNA sequences, or offline proof bundles.
What you get
- Portable standalone runtime bundles for Linux x64 and macOS universal
- A signed runner container image (immutable digest) for containerized deployments
- Deterministic run outputs (manifests, evidence packets, state, digests)
- SBOM + provenance attestations (per release)
- Release receipts for audit trails (per release)
Requirements
- A PatentChecker trial key or production key
- Linux x64 or macOS for the public standalone runtime bundle
- curl + tar + sha256sum/shasum for bundle verification
- Docker + cosign only if you want the signed container path
Install the public runtime bundle
The public mirror ships a portable Linux bundle with the runtime, CLI, schemas, docs, and launchers.
BASE=https://omnisgenomics.com/patent-checker/downloads/v0.1.52 curl -L "$BASE/patentchecker-linux-x64.tar.gz" -o patentchecker-linux-x64.tar.gz curl -L "$BASE/patentchecker-linux-x64.tar.gz.sha256" -o patentchecker-linux-x64.tar.gz.sha256 sha256sum -c patentchecker-linux-x64.tar.gz.sha256 tar -xzf patentchecker-linux-x64.tar.gz ./patentchecker/patentchecker info
Use the universal macOS bundle if you want the same release path without pulling from GHCR first.
BASE=https://omnisgenomics.com/patent-checker/downloads/v0.1.52 curl -L "$BASE/patentchecker-macos-universal.tar.gz" -o patentchecker-macos-universal.tar.gz curl -L "$BASE/patentchecker-macos-universal.tar.gz.sha256" -o patentchecker-macos-universal.tar.gz.sha256 shasum -a 256 -c patentchecker-macos-universal.tar.gz.sha256 tar -xzf patentchecker-macos-universal.tar.gz ./patentchecker/patentchecker info
Current public release: v0.1.52. For the 2-week trial, we ship the same runtime inside a buyer-ready handoff with issued artifacts and a seeded tenant workspace.
- • You should be able to run ./patentchecker/patentchecker info from the unpacked folder and see the public release metadata.
- • That confirms the standalone runtime is usable before you point it at a real watchlist or issued trial material.
- • If the checksum fails, re-download the archive and verify you are using the Linux or macOS pair that matches your host.
- • If the launcher will not start, confirm the archive extracted completely and that you are inside the unpacked patentchecker directory.
Run with the standalone runtime
Use the shipped launchers for watchlist runs and offline verification. This is the path we recommend first for technical buyers.
# Watchlist paths are resolved relative to the watchlist file. mkdir -p out ./patentchecker/patentchecker-watchlist-run \ --watchlist ./watchlist.v0.1.json \ --out-dir ./out ./patentchecker/patentchecker-verify-run \ ./out/runs/<watchlist_id>/<run_id>
- • A successful first run creates out/runs/<watchlist_id>/<run_id> plus a run digest, manifest, and structured evidence outputs.
- • Running the verify step immediately after should confirm the emitted run folder is internally consistent.
- • If the run command fails, check the watchlist path first; adapter file references are resolved relative to the watchlist file.
- • If verification fails right after a run, treat that as a hard stop and inspect the fresh run directory before reusing the outputs.
Container path (optional)
If you prefer a containerized deployment, the signed runner image is still available. For audit-grade runs, pin by digest.
Current public release: v0.1.52 (image digest sha256:1b3e02309d2...)
# Authenticate to GHCR (if required by your license / package visibility) echo "$GH_TOKEN" | docker login ghcr.io -u <github_user> --password-stdin # Pull by tag (convenient) docker pull ghcr.io/omniscoder/patentchecker:<tag> # Prefer pinning by digest for production/audit docker pull ghcr.io/omniscoder/patentchecker@sha256:<digest>
If the package is private, your issued trial key or production key should include read access to the registry.
Verify container signatures before running
Images are signed. Verify the exact digest you plan to run.
# Keyless verification (OIDC) # Receipt is the source of truth for digest + signing identity. # (Use the values from runner_receipt.v0.1.json for the release you are running.) export DIGEST="sha256:<64>" export IDENTITY="https://github.com/omniscoder/patentchecker/.github/workflows/release.yml@refs/<ref>" export IMG=ghcr.io/omniscoder/patentchecker@"$DIGEST" DOCKER_CONFIG=/tmp/emptydocker cosign verify \ --certificate-identity "$IDENTITY" \ --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \ "$IMG"
For air-gapped verification, we provide per-release bundles (receipt + signature bundle) for offline verification.
Run in your container
The container entrypoint runs the watchlist runner. Provide a watchlist JSON and an output directory.
# Directory layout (paths in watchlist are resolved relative to the watchlist file) mkdir -p out inputs # watchlist.json references inputs/... for adapter file mode docker run --rm \ -v "$PWD/watchlist.json:/work/watchlist.json:ro" \ -v "$PWD/inputs:/work/inputs:ro" \ -v "$PWD/out:/work/out" \ ghcr.io/omniscoder/patentchecker:<tag> \ --watchlist /work/watchlist.json \ --out-dir /work/out
Use --entrypoint to run other built-in commands inside the same image.
# Print contract metadata (version/hash) docker run --rm --entrypoint node ghcr.io/omniscoder/patentchecker:<tag> \ dist/src/cli/patentchecker.js info # Verify a run directory (offline) docker run --rm -v "$PWD/out:/out:ro" --entrypoint node ghcr.io/omniscoder/patentchecker:<tag> \ dist/src/cli/patentchecker.js artifacts verify /out/runs/<watchlist_id>/<run_id>
Outputs are deterministic: evidence packets, manifests, digests, and state are written under your output directory and can be verified offline.
Want a 7-day pilot?
The fastest path is a one-time snapshot drift posture report on a single program: you provide a watchlist and two corpus snapshots, and we return report.md + alerts_summary.json with forced interpretation guardrails.