cmd/

Command afk-evidence creates and validates bounded direct-main evidence logs.

Command agent-spec-backfill-controller validates one explicit controller declaration.

Command dev-role is the deliberately minimal local composition image for the API, worker, and codec roles before their product implementations land.

docs-publication-verify checks a deployed public documentation site against the checked-in route manifest.

Command egress-proxy runs a finite allowlisted HTTP and HTTPS CONNECT proxy.

Command firecracker-direct-preflight validates an operator-owned Linux/KVM boundary before a direct Firecracker smoke run.

Command firecracker-e2e records whether this host can run the protected Linux/KVM lane.

firecracker-fixture-preflight validates a locally assembled candidate through the exact fixture provisioning boundary used by the protected smoke runner.

firecracker-release-preflight checks the local, reviewable inputs for the one later publication of an M4 fixture release.

Command firecracker-runner-preflight validates the static bootstrap contract required before a protected Firecracker KVM workflow can mint smoke evidence.

Command firecracker-smoke runs the protected no-NIC Firecracker smoke path only after its exact runner, fixture, and Jailer inputs are present.

Command generate-requirement-manifest renders canonical evidence metadata.

Command generate-runtime-openapi derives private server and SDK route tables from the public OpenAPI authority.

Command ledger-report validates a machine-readable weighted evidence ledger.

Command milestone-notify retains and sends a bounded milestone completion report.

Command no-real-wait verifies owned Go source has no real-time wait primitive.

Command release-readiness writes the immutable release hand-off for the current clean main checkout.

Command research-dossier-evidence records and validates the bounded report produced only after the Research Dossier public E2E has passed.

Command runtime composes one validated Agent Runtime process role.

Command runtime-operations-direct-lab records an explicitly authorized, disposable local or home-lab operations exercise.

Command runtime-operations-drill records one protected operational drill.

Command runtime-operations-rehearsal exercises the protected drill checks against disposable local services.

Command sandbox-host-bootstrap reconciles one mounted local/CI host identity into the sandbox-control PostgreSQL ledger.

Command stackctl renders and inspects reviewed declarative Stack documents.

Command subscription-model-canary validates a protected subscription-model canary contract.