cmd/

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

Links

Open Source Insights

README ¶

Commands

Each subdirectory builds one Eshu executable. This directory is a navigation root, not a Go package — each child has its own rich README.md and AGENTS.md.

The public CLI command is eshu. The service binaries use ESHU-prefixed names when installed for local runtime work, such as eshu-api, eshu-mcp-server, eshu-ingester, eshu-reducer, and eshu-webhook-listener. Use scripts/install-local-binaries.sh from the repository root when you need that exact binary set on PATH.

Binary-to-runtime map

Binary	Subdirectory	Lifecycle
`eshu` (CLI)	`eshu/`	One-shot CLI commands plus subcommand dispatch
`eshu-api`	`api/`	Long-running HTTP API
`eshu-mcp-server`	`mcp-server/`	Long-running MCP tool server
`eshu-ingester`	`ingester/`	Long-running git sync + parse + fact emission
`eshu-projector`	`projector/`	Long-running source-local projection (local profiles)
`eshu-reducer`	`reducer/`	Long-running cross-domain materialization
`eshu-bootstrap-index`	`bootstrap-index/`	One-shot multi-phase orchestration
`eshu-bootstrap-data-plane`	`bootstrap-data-plane/`	One-shot data-plane setup
`eshu-collector-git`	`collector-git/`	Local git-collector helper
`eshu-collector-confluence`	`collector-confluence/`	Long-running Confluence documentation collector
`eshu-collector-terraform-state`	`collector-terraform-state/`	Long-running Terraform-state collector
`eshu-collector-component-extension`	`collector-component-extension/`	Long-running process-backed component extension collector
`eshu-collector-package-registry`	`collector-package-registry/`	Long-running package-registry collector
`eshu-collector-sbom-attestation`	`collector-sbom-attestation/`	Long-running hosted SBOM and attestation collector
`eshu-collector-security-alerts`	`collector-security-alerts/`	Long-running hosted provider security-alert collector
`eshu-collector-cicd-run`	`collector-cicd-run/`	Long-running hosted GitHub Actions CI/CD run collector
`eshu-collector-pagerduty`	`collector-pagerduty/`	Long-running PagerDuty incident-context collector
`eshu-collector-jira`	`collector-jira/`	Long-running Jira work-item evidence collector
`eshu-collector-grafana`	`collector-grafana/`	Long-running live Grafana metadata collector
`eshu-collector-prometheus-mimir`	`collector-prometheus-mimir/`	Long-running live Prometheus and Mimir metadata collector
`eshu-collector-loki`	`collector-loki/`	Long-running live Loki log-signal metadata collector
`eshu-collector-tempo`	`collector-tempo/`	Long-running live Tempo trace-signal metadata collector
`eshu-scanner-worker`	`scanner-worker/`	Long-running isolated security analyzer worker
`eshu-collector-aws-cloud`	`collector-aws-cloud/`	Long-running AWS cloud collector
`eshu-collector-gcp-cloud`	`collector-gcp-cloud/`	Long-running GCP Cloud Asset Inventory collector
`eshu-webhook-listener`	`webhook-listener/`	Long-running GitHub/GitLab webhook intake
`eshu-admin-status`	`admin-status/`	Admin/status read helper
`eshu-workflow-coordinator`	`workflow-coordinator/`	Long-running workflow coordinator
`capability-inventory`	`capability-inventory/`	Generate/verify the capability catalog artifact (dev/CI tool)
`audit-preflight`	`audit-preflight/`	Validate competitive-audit issues against the preflight contract (dev/CI tool)
`fact-envelope-adapter`	`fact-envelope-adapter/`	Generate/verify the shared fact-envelope adapter artifact (dev/CI tool)
`ifa`	`ifa/`	Run Ifá conformance Odù contract checks (dev/CI tool)

Pipeline shape

flowchart LR
  ingester[ingester] --> postgres[(postgres facts/queue)]
  projector[projector] -.local profiles.-> postgres
  postgres --> reducer[reducer]
  reducer --> graph[(graph backend)]
  bootstrap[bootstrap-index] -.one-shot.-> ingester
  bootstrap -.one-shot.-> reducer
  workflow[workflow-coordinator] --> postgres
  component[collector-component-extension] --> postgres
  tfstate[collector-terraform-state] --> postgres
  sbom[collector-sbom-attestation] --> postgres
  alerts[collector-security-alerts] --> postgres
  cicd[collector-cicd-run] --> postgres
  pagerduty[collector-pagerduty] --> postgres
  jira[collector-jira] --> postgres
  grafana[collector-grafana] --> postgres
  metrics[collector-prometheus-mimir] --> postgres
  loki[collector-loki] --> postgres
  tempo[collector-tempo] --> postgres
  aws[collector-aws-cloud] --> postgres
  gcp[collector-gcp-cloud] --> postgres
  scanner[scanner-worker] --> postgres
  webhook[webhook-listener] --> postgres
  api[api] --> graph
  api --> postgres
  mcp[mcp-server] --> api

For the full lifecycle of any one binary, open its README.md and AGENTS.md.

Per-package documentation convention

Every Go package directory under go/cmd/ carries three files:

doc.go — godoc contract.
README.md — architectural and operational lens with mermaid flow diagrams and runbook-shape operational notes.
AGENTS.md — guidance for LLM assistants editing the binary.

Dependencies

Each cmd/ subdirectory wires together internal packages into a binary; see the per-binary main.go for the exact set. Shared process wiring lives in internal/runtime and internal/app.

Telemetry

Process-level telemetry bootstrap (service namespace, OTEL exporter, log sinks) is configured by internal/runtime and internal/telemetry. Each binary inherits that contract; packages do not register their own meter providers.

docs/public/deployment/service-runtimes.md
docs/public/reference/cli-reference.md
docs/public/reference/local-testing.md

Directories ¶

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL

Path	Synopsis
admin-status Package main runs the admin-status binary, which renders the shared Eshu status report from Postgres for local CLI inspection.	Package main runs the admin-status binary, which renders the shared Eshu status report from Postgres for local CLI inspection.
api Package main runs the eshu-api binary, which serves the Eshu HTTP query and admin surface backed by the configured graph backend and Postgres content store.	Package main runs the eshu-api binary, which serves the Eshu HTTP query and admin surface backed by the configured graph backend and Postgres content store.
audit-preflight Command audit-preflight validates a competitive-audit issue body against the Eshu preflight contract.	Command audit-preflight validates a competitive-audit issue body against the Eshu preflight contract.
bootstrap-data-plane Package main runs the eshu-bootstrap-data-plane binary, which applies the Eshu Postgres and graph-backend schema DDL and exits.	Package main runs the eshu-bootstrap-data-plane binary, which applies the Eshu Postgres and graph-backend schema DDL and exits.
bootstrap-index Package main runs the eshu-bootstrap-index binary, which performs a one-shot end-to-end indexing pass: collection, source-local projection, relationship-evidence backfill, IaC reachability materialization, deployment-mapping reopen, and config_state_drift intent enqueue (Phase 3.5 trigger for the reducer's Terraform drift handler).	Package main runs the eshu-bootstrap-index binary, which performs a one-shot end-to-end indexing pass: collection, source-local projection, relationship-evidence backfill, IaC reachability materialization, deployment-mapping reopen, and config_state_drift intent enqueue (Phase 3.5 trigger for the reducer's Terraform drift handler).
capability-inventory Command capability-inventory generates and verifies the reconciled Eshu capability catalog artifact.	Command capability-inventory generates and verifies the reconciled Eshu capability catalog artifact.
ci-gates Command ci-gates is the CLI for the CI gate registry (#4213).	Command ci-gates is the CLI for the CI gate registry (#4213).
collector-aws-cloud Command collector-aws-cloud runs the AWS cloud collector.	Command collector-aws-cloud runs the AWS cloud collector.
collector-azure-cloud Command collector-azure-cloud runs the Azure cloud collector runtime in either fixture or claimed-live mode.	Command collector-azure-cloud runs the Azure cloud collector runtime in either fixture or claimed-live mode.
collector-cicd-run Package main provides the hosted CI/CD run collector command.	Package main provides the hosted CI/CD run collector command.
collector-component-extension Package main wires the component extension collector worker.	Package main wires the component extension collector worker.
collector-confluence Package main wires the Confluence documentation collector binary.	Package main wires the Confluence documentation collector binary.
collector-gcp-cloud Command collector-gcp-cloud runs the GCP Cloud Asset Inventory collector.	Command collector-gcp-cloud runs the GCP Cloud Asset Inventory collector.
collector-git Package main runs the collector-git binary, the local verification runtime for native Go repository selection, sync, snapshot collection, content shaping, and fact commit into Postgres.	Package main runs the collector-git binary, the local verification runtime for native Go repository selection, sync, snapshot collection, content shaping, and fact commit into Postgres.
collector-grafana Command collector-grafana runs the claim-driven live Grafana metadata collector.	Command collector-grafana runs the claim-driven live Grafana metadata collector.
collector-jira Command collector-jira runs the claim-driven Jira work-item evidence collector.	Command collector-jira runs the claim-driven Jira work-item evidence collector.
collector-kubernetes-live Package main wires the Kubernetes live collector binary.	Package main wires the Kubernetes live collector binary.
collector-loki Command collector-loki runs the claim-driven live Loki metadata collector.	Command collector-loki runs the claim-driven live Loki metadata collector.
collector-oci-registry Package main wires the OCI registry collector binary.	Package main wires the OCI registry collector binary.
collector-package-registry Command collector-package-registry runs the claim-aware package-registry collector.	Command collector-package-registry runs the claim-aware package-registry collector.
collector-pagerduty Command collector-pagerduty runs the hosted PagerDuty incident-context and optional live-configuration collector through workflow claims.	Command collector-pagerduty runs the hosted PagerDuty incident-context and optional live-configuration collector through workflow claims.
collector-prometheus-mimir Command collector-prometheus-mimir runs the claim-driven live Prometheus and Mimir metadata collector.	Command collector-prometheus-mimir runs the claim-driven live Prometheus and Mimir metadata collector.
collector-sbom-attestation Command collector-sbom-attestation runs the hosted SBOM and attestation collector as a claim-driven service.	Command collector-sbom-attestation runs the hosted SBOM and attestation collector as a claim-driven service.
collector-security-alerts Command collector-security-alerts runs the hosted provider security-alert collector through workflow claims and records bounded commit-failure dead-letter evidence for operator replay status.	Command collector-security-alerts runs the hosted provider security-alert collector through workflow claims and records bounded commit-failure dead-letter evidence for operator replay status.
collector-tempo Command collector-tempo runs the claim-driven live Tempo metadata collector.	Command collector-tempo runs the claim-driven live Tempo metadata collector.
collector-terraform-state Package main hosts the Terraform-state collector runtime.	Package main hosts the Terraform-state collector runtime.
collector-vault-live Command collector-vault-live runs the read-only, metadata-only Vault collector for the secrets/IAM posture lane (#25, #1356).	Command collector-vault-live runs the read-only, metadata-only Vault collector for the secrets/IAM posture lane (#25, #1356).
collector-vulnerability-intelligence Command collector-vulnerability-intelligence runs the hosted vulnerability intelligence collector.	Command collector-vulnerability-intelligence runs the hosted vulnerability intelligence collector.
docs-cli-env-refs Package main implements the public documentation CLI and environment reference verifier.	Package main implements the public documentation CLI and environment reference verifier.
eshu Package main runs the eshu binary, the unified Cobra-based CLI and MCP/API launcher for Eshu.	Package main runs the eshu binary, the unified Cobra-based CLI and MCP/API launcher for Eshu.
fact-envelope-adapter Command fact-envelope-adapter generates the shared fact-envelope adapter.	Command fact-envelope-adapter generates the shared fact-envelope adapter.
fact-kind-registry Command fact-kind-registry generates the core fact-kind registry contract.	Command fact-kind-registry generates the core fact-kind registry contract.
factschema-diff Command factschema-diff is the contracts schema-diff breaking-change gate (Contract System v1 §6 enforcement gate 1).	Command factschema-diff is the contracts schema-diff breaking-change gate (Contract System v1 §6 enforcement gate 1).
golden-corpus-gate Command golden-corpus-gate is the typed assertion step of the B-7 golden end-to-end corpus gate (issue #3800).	Command golden-corpus-gate is the typed assertion step of the B-7 golden end-to-end corpus gate (issue #3800).
heredoc-budget Command heredoc-budget is a static lint gate that flags oversized shell heredoc bodies before they can deadlock a developer's `make pre-pr` run.	Command heredoc-budget is a static lint gate that flags oversized shell heredoc bodies before they can deadlock a developer's `make pre-pr` run.
ifa Command ifa is the CLI entry point for Eshu's Ifá conformance platform.	Command ifa is the CLI entry point for Eshu's Ifá conformance platform.
ingester Package main runs the eshu-ingester binary, the long-running runtime that owns repository sync, parsing, fact emission, and source-local projection into the configured graph backend.	Package main runs the eshu-ingester binary, the long-running runtime that owns repository sync, parsing, fact emission, and source-local projection into the configured graph backend.
mcp-server Package main runs the eshu-mcp-server binary, which serves the Eshu MCP tool transport over stdio or HTTP backed by the same query and content stores as the HTTP API.	Package main runs the eshu-mcp-server binary, which serves the Eshu MCP tool transport over stdio or HTTP backed by the same query and content stores as the HTTP API.
mock-github Package main runs the mock-github binary, a minimal, self-contained stand-in for github.com's OAuth2 web-application-flow and REST identity endpoints, used only by the F-9 (issue #5170) auth-mcp E2E stack to prove Eshu's go/internal/githublogin connector end-to-end without depending on a live GitHub App or GitHub Enterprise Server instance.	Package main runs the mock-github binary, a minimal, self-contained stand-in for github.com's OAuth2 web-application-flow and REST identity endpoints, used only by the F-9 (issue #5170) auth-mcp E2E stack to prove Eshu's go/internal/githublogin connector end-to-end without depending on a live GitHub App or GitHub Enterprise Server instance.
mock-oidc-idp Package main runs the mock-oidc-idp binary, a minimal, self-contained OpenID Connect Authorization Code identity provider used only by local and CI browser-auth E2E suites (issue #4971, epic #4962) to prove Eshu's SSO login flow against a real OIDC counterparty without depending on a live third-party IdP.	Package main runs the mock-oidc-idp binary, a minimal, self-contained OpenID Connect Authorization Code identity provider used only by local and CI browser-auth E2E suites (issue #4971, epic #4962) to prove Eshu's SSO login flow against a real OIDC counterparty without depending on a live third-party IdP.
mock-openai-compatible Command mock-openai-compatible serves the closed, credential-free provider fixture used to prove the deployed Ask Eshu tool loop in the B-7 gate.	Command mock-openai-compatible serves the closed, credential-free provider fixture used to prove the deployed Ask Eshu tool loop in the B-7 gate.
mock-prometheus-mimir Package main runs a credential-free Prometheus/Mimir query-range fixture for deployed golden-corpus validation.	Package main runs a credential-free Prometheus/Mimir query-range fixture for deployed golden-corpus validation.
payload-usage-manifest Command payload-usage-manifest implements Contract System v1 §6 enforcement gate 2 (docs/internal/design/contract-system-v1.md#6-enforcement-gates): a machine-readable manifest of which payload fields each typed-decoded fact kind's handlers actually read, derived from typed factschema.Decode* seams across reducer, projector, query, loader, relationships, and replay surfaces.	Command payload-usage-manifest implements Contract System v1 §6 enforcement gate 2 (docs/internal/design/contract-system-v1.md#6-enforcement-gates): a machine-readable manifest of which payload fields each typed-decoded fact kind's handlers actually read, derived from typed factschema.Decode* seams across reducer, projector, query, loader, relationships, and replay surfaces.
projector Package main runs the projector binary, the local verification runtime for source-local projection: it claims projector queue items from Postgres, projects facts into canonical graph state, and writes content rows.	Package main runs the projector binary, the local verification runtime for source-local projection: it claims projector queue items from Postgres, projects facts into canonical graph state, and writes content rows.
proof-of-value Command proof-of-value measures whether an agent answers IaC reachability questions more accurately with Eshu than with plain text search ("grep").	Command proof-of-value measures whether an agent answers IaC reachability questions more accurately with Eshu than with plain text search ("grep").
reducer Package main runs the eshu-reducer binary, the long-running runtime that drains the reducer fact-work queue, executes domain handlers, materializes cross-domain truth, and writes shared edges into the configured graph backend.	Package main runs the eshu-reducer binary, the long-running runtime that drains the reducer fact-work queue, executes domain handlers, materializes cross-domain truth, and writes shared edges into the configured graph backend.
replay-coverage-gate Command replay-coverage-gate is the C-1/C-8/C-9/C-10/C-13 replay coverage manifest + lockstep gate (issues #4173, #4187, #4188, #4189, and #4366, epic #4172).	Command replay-coverage-gate is the C-1/C-8/C-9/C-10/C-13 replay coverage manifest + lockstep gate (issues #4173, #4187, #4188, #4189, and #4366, epic #4172).
scanner-worker Command scanner-worker runs isolated scanner-worker claims for CPU-heavy or memory-heavy security analyzers.	Command scanner-worker runs isolated scanner-worker claims for CPU-heavy or memory-heavy security analyzers.
search-bench Command search-bench runs the design-430 search-lane benchmark over a live Eshu content corpus.	Command search-bench runs the design-430 search-lane benchmark over a live Eshu content corpus.
skillgen Command skillgen generates and verifies the per-host skill-file roundtrip baseline that the Eshu skillgen epic ships.	Command skillgen generates and verifies the per-host skill-file roundtrip baseline that the Eshu skillgen epic ships.
webhook-listener Package main runs the eshu-webhook-listener binary, the public webhook intake runtime for GitHub, GitLab, Bitbucket, AWS freshness triggers, GCP freshness triggers, PagerDuty, and Jira.	Package main runs the eshu-webhook-listener binary, the public webhook intake runtime for GitHub, GitLab, Bitbucket, AWS freshness triggers, GCP freshness triggers, PagerDuty, and Jira.
workflow-coordinator Package main runs the eshu-workflow-coordinator binary, the long-running runtime that reconciles declarative collector instance state and, in active mode, plans supported collector work, hands off webhook freshness triggers, reaps expired claims, and recomputes workflow-run completeness.	Package main runs the eshu-workflow-coordinator binary, the long-running runtime that reconciles declarative collector instance state and, in active mode, plans supported collector work, hands off webhook freshness triggers, reaps expired claims, and recomputes workflow-run completeness.