CLI-Referenz: olivares

Business

Audit-Export (GET /v1/audit/export, olivares audit export), Verzeichnisarchive und die Prüfung externer Archive erfordern Business. Community behält das signierte Ledger, olivares audit verify und olivares dr backup; Export liefert HTTP 501 oder Exit-Code 9. Audit-Weiterleitung und DDIL-Transfers mit Audit-Segmenten erfordern ebenfalls Business.

Editionen und Genehmigungen (0.1)

Community behält die Genehmigungsengine, mindestens zwei verschiedene Personen für CRITICAL-Aktionen, die doppelte Kontrolle des Kill-Switch und Richtlinien, die für eine Aktion eine Prüfung verlangen. Genehmigungsrichtlinien, die die Risikostufe oder die Zahl der erforderlichen Genehmigungen ändern, und der Notfallzugriff per Break-glass gehören zur Business-Basis. Gespeicherte Richtlinien, die die Risikostufe oder die Zahl der Genehmigungen erhöhen, gelten weiter; gespeicherte Richtlinien zur Senkung und Notfallzugriffe bleiben lesbar und exportierbar, dürfen aber weder Community-Standardwerte senken noch Notfallzugriffe erlauben. olivares governance breakglass — Business.

Red-Team-Ausführung, Budgeterstellung und FinOps-Analyse erfordern Business. Community setzt gespeicherte Budgets bei aktiviertem FinOps weiterhin durch und erlaubt das Lesen und Entfernen. Evals und Sandbox-Ausführung bleiben in Community.

Olivares AI wird als ein einziges statisches Go-Binary namens olivares ausgeliefert. Dasselbe Artefakt ist die Engine, die eingebettete Web-UI (vom selben Origin wie die API ausgeliefert) und der Edge-Collector — die Rolle wird durch den ausgeführten Subcommand ausgewählt. Diese Seite dokumentiert die Befehlsschnittstelle des Community-Builds (AGPL). Die folgenden Abschnitte erläutern die Befehle, denen Sie zuerst begegnen; die am Ende aus dem Binary generierte vollständige Befehlsreferenz deckt jeden Befehl dieses Builds ab. Die Schnittstelle ist noch in Bewegung (siehe Stabilität am Ende).

Wie Sie das Binary beziehen und ausführen, steht unter Self-Hosting. Für Konfiguration, die in Umgebungsvariablen statt in Flags lebt, siehe Konfiguration.

Übersicht

olivares <subcommand> [flags]

Der Root-Befehl sortiert seine Subcommands in die Abschnitte, die olivares --help ausgibt: Setup und Konfiguration, Betrieb, Governance, Beobachtung und Diagnose, Sicherheit sowie Release und Upgrade.

Die folgenden Abschnitte erklären die Befehle, denen Sie zuerst begegnen — was sie mit Ihrer Installation tun und was sicher exponiert werden kann. Die erschöpfende Liste steht in der am Seitenende aus dem Binary generierten vollständigen Befehlsreferenz, einschließlich Flags, Exit-Codes und Output-Vertrag. Der Generator durchläuft den Befehlsbaum des Community-Binarys (TestCLIRefDump) und schreibt dieses Ergebnis in den markierten Bereich. Push-Gate und CI führen diese Prüfung über lint:public-counts aus, das scripts/check-cli-ref-docs.sh aufruft: das Skript leitet Flags, Defaults, Exit-Codes und Output-Verträge aus dem Binary neu ab und schlägt fehl, wenn diese Seite oder eine der sechs Locale-Kopien vom Binary abweicht. Eine separate Prüfung, lint:cli-coverage, verifiziert nur, dass im Quellcode deklarierte Befehlsnamen irgendwo in dieser Referenz erwähnt werden; sie leitet Flags nicht neu ab. Befehlsnamen, Flag-Namen, Hilfetexte, Defaults und Bedeutungen der Exit-Codes in dem generierten Bereich sind die originalen englischen Zeichenketten des Binarys — auch auf den Locale-Kopien dieser Seite, wo dieser Block keine menschliche Übersetzung ist. Wenn ein eingesetztes Binary und diese Seite widersprechen, ist olivares <subcommand> --help auf diesem Binary maßgeblich.

Ein Binary, mehrere Rollen

Es gibt keinen separaten “Server”- und “Agent”-Download. olivares serve ist die Engine; olivares collector ist der Data-Plane-Collector für die verteilte Topologie. Beide laden dieselben Source-Connectors auf dieselbe Weise — nur wohin die Beobachtungen gehen, unterscheidet sich. Siehe Architektur.

olivares version

Gibt Version, Commit, Build-Datum, OS/Arch und die Go-Runtime-Version auf stdout aus.

olivares version

Der Versionsstring wird zur Build-Zeit injiziert. Ein Build aus einem Working Tree, der nicht von einem getaggten Release erzeugt wurde, meldet eine Entwicklungsversion (zum Beispiel dev), behandeln Sie den Versionsstring also nicht als Provenienzgarantie — verifizieren Sie Releases stattdessen mit den signierten Artefakten. Siehe Ein Release verifizieren.

olivares serve

Betreibt die Control Plane: den HTTP-Server (REST API plus die eingebettete Web-UI auf demselben Origin) und den gRPC-Server. TLS ist standardmäßig an, die Listener binden standardmäßig auf allen Schnittstellen, und es gibt keine Default-Credentials.

olivares serve [flags]

Sichere Defaults

Dies sind Eigenschaften von serve, keine Opt-ins:

• TLS ist standardmäßig an. Wird kein Zertifikat bereitgestellt, generiert die Engine ein selbstsigniertes Zertifikat im Datenverzeichnis und protokolliert sowohl dessen SHA-256-Zertifikatsfingerprint als auch, als pin_sha256, den SPKI-Pin des Leaf-Zertifikats; Clients vertrauen entweder dem Zertifikat oder übergeben diesen pin_sha256-Wert an --pin-sha256. Es sind zwei verschiedene Hashes verschiedener Bytes — der Zertifikatsfingerprint ist KEIN Pin. Der gRPC-Server schlägt fehl-geschlossen (fail closed) fehl: außerhalb von --insecure startet er nicht im Klartext.
• Standardmäßig jede Schnittstelle. Sowohl der HTTP- als auch der gRPC-Listener binden standardmäßig auf die Wildcard — --listen :8443 und --grpc-listen :8444, also 0.0.0.0 und, wo der Kernel IPv6 hat, :: —, weil die Konsole ein Server ist; quickstart teilt diesen Standard. Die bewusste Änderung ist die Beschränkung auf diesen Host: --listen 127.0.0.1:8443 --grpc-listen 127.0.0.1:8444 oder OLIVARES_BIND=127.0.0.1 für den Compose-Stack. Die Schutzmechanismen wandern nicht mit dem Bind: TLS bleibt an, die Ersteinrichtung bleibt hinter dem einmaligen Token, --insecure wird außerhalb des Hosts weiterhin verweigert, sofern nicht --insecure-allow-public-bind eine vorgeschaltete TLS-Terminierung erklärt, und --seed-demo bleibt auf Loopback beschränkt.
• Keine Default-Credentials. Bei einer frischen Installation ohne Nutzer prägt die Engine ein einmaliges, single-use Setup-Token (Präfix olst_) und gibt es nur auf stdout aus (nie in die Logs). Sie erstellen den ersten Administrator, indem Sie dieses Token an den Setup-Endpunkt posten, und melden sich dann an. Siehe First-Boot-Setup.

Flags

Jedes Flag von serve mit Typ und Default steht im generierten Abschnitt olivares serve unten. Dieser Abschnitt behandelt nur die vier, die verändern, was die Installation exponiert: --listen und --grpc-listen (Bind-Adresse), --insecure (verschlüsselter oder unverschlüsselter Transport) und --seed-demo (echte oder synthetische Daten).

Der Default-Store ist SQLite (pure-Go, Single-Node, geeignet für air-gapped Installationen). postgres auszuwählen ist das, was Sie für Multi-Tenant- oder Scale-out-Deployments tun, wo Row-Level Security die Tenant-Absicherung liefert. Siehe Konfiguration und Self-Hosting.

--insecure ist nur für localhost-Entwicklung

--insecure stellt Klartext-HTTP und -gRPC bereit. Bearer-Token reisen auf einem Klartext-Transport im Klartext, verwenden Sie dieses Flag also nie auf einer Adresse, die über den lokalen Host hinaus erreichbar ist. Außerhalb von --insecure weigert sich der gRPC-Server, ohne TLS zu starten, statt stillschweigend herabzustufen.

--seed-demo ist nur für Demos und verweigert Nicht-Loopback

--seed-demo provisioniert eine synthetische, fabrizierte Estate zusammen mit einem Demo-Administrator, dessen Passwort öffentlich ist (es liegt im Quellbaum). Es existiert allein dazu, die Web-UI und End-to-End-Tests gegen live-geformte Daten rendern zu lassen.

Da die Demo-Credential öffentlich ist, weigert sich serve, mit --seed-demo auf irgendeinem Nicht-Loopback-Bind zu starten und beendet sich mit einem Fehler, der Sie anweist, auf 127.0.0.1 zu binden oder eine echte Installation ohne das Flag auszuführen. Behandeln Sie --seed-demo als Wegwerf-Sache: verwenden Sie ein verfügbares Datenverzeichnis und richten Sie es nie auf Daten, die Ihnen wichtig sind.

Führen Sie --seed-demo niemals als echte Installation aus

Der Demo-Administrator hat ein öffentlich bekanntes Passwort. Eine echte Installation ist serve ohne --seed-demo, wobei die Engine ein einmaliges Setup-Token prägt und Sie Ihren eigenen Administrator erstellen. Mischen Sie die beiden nicht: ein Demo-Datenverzeichnis ist kein Produktions-Datenverzeichnis.

First-Boot-Setup

Beim ersten Boot einer Installation, die keine Nutzer hat, gibt serve einen Block auf stdout aus, der das einmalige Setup-Token (Präfix olst_) und den Request enthält, den Sie zum Bootstrappen des ersten Administrators benötigen. Der Ablauf ist:

1. Lesen Sie das olst_-Token aus dem stdout der Engine (beim Container-Deployment lesen Sie es aus den Container-Logs).
2. Erstellen Sie den ersten Administrator, indem Sie das Token, eine E-Mail und ein Passwort an den Setup-Endpunkt posten (POST /v1/setup).
3. Melden Sie sich an (POST /v1/auth/login), um ein Session-Token (Präfix olvs_) zu erhalten.

Das Setup-Token wird einmal angezeigt und ist single-use; sobald ein Nutzer existiert, wird kein Token mehr geprägt. Olivares AI verwendet opake Bearer-Token (keine JWTs); API-Keys tragen das Präfix olvk_. Für den vollständigen Authentifizierungsvertrag und die Regeln zur Tenant-Auflösung siehe das Security-Modell und die API-Referenz.

Ausführen

# Bauen, dann ausführen (es gibt kein "task serve" / "task run"-Target).
task build
./bin/olivares serve
# Lesen Sie das einmalige olst_-Setup-Token aus dem stdout dieses Prozesses.

Oder führen Sie das Container-Deployment aus und lesen Sie das Setup-Token aus den Logs; siehe Self-Hosting.

olivares collector

Führt das Binary als Edge-Collector für die verteilte Topologie aus. Ein Collector lädt die in Ihrer Sources-Konfiguration benannten Source-Connectors lokal und pusht deren Beobachtungen über gRPC an einen entfernten Core. Er öffnet keinen eingehenden Listener — der Collector ist die secure-default Data Plane: er wählt aus, er akzeptiert keine Verbindungen.

Der Collector ist ein Business-Feature. Ein Community-Build blendet den Befehl aus und beantwortet ihn mit Exit-Code 9.

olivares collector --core-addr host:port [flags]

Der Collector authentifiziert sich gegenüber dem Core in zwei Schichten: einem Bearer-Token, das ein Ingest-Principal hält, und — wenn der Core mutual TLS erzwingt — einem Collector-Client-Zertifikat. So läuft die Data Plane auf Kundeninfrastruktur, während ein zentraler Core aggregiert: ein ausfallender Collector sitzt nie im Datenpfad irgendeines Agenten.

Welche Sources ein Collector lädt

Sowohl serve als auch collector verdrahten ihre Source-Connectors aus derselben Konfiguration, die vor dem Start der Runtime aus der Umgebung gelesen wird. Eine unkonfigurierte oder leere Source warnt ehrlich, statt den Prozess fehlschlagen zu lassen. Das Konfigurieren von Sources wird in Eine Quelle anbinden und Claude Code anbinden behandelt; der Konfigurationsmechanismus steht in Konfiguration.

Der collector-Subcommand ist der Mechanismus für den verteilten Pfad. Das Packaging drumherum (eine Flotte von Collectors, signierte Charts, OCI-Images) ist Teil der Deployment-Story und nicht dieser CLI-Seite — siehe Architektur und Self-Hosting.

olivares openapi

Gibt das OpenAPI-3.1-Dokument der Engine auf stdout aus, ohne dass ein laufender Server nötig ist.

olivares openapi > openapi.json              # stabiler Kernvertrag
olivares openapi --beta > openapi.beta.json  # Beta-Dokument der Modulrouten

Ohne Flag gibt der Befehl denselben stabilen Kernvertrag aus, den die Engine unter GET /openapi.json ausliefert, deterministisch eingerückt für saubere Diffs; er ist die Quelle der Wahrheit für die API-Referenz und die typisierte Codegenerierung des Web-Clients. --beta gibt das Beta-Dokument der Modulrouten (/v1/m/<ns>/…) aus, das unter GET /openapi.beta.json bereitsteht und in der Modulrouten-Referenz gerendert wird. Die feldgenauen Formen bleiben als typisierte Interfaces ausgedrückt (siehe auch Modul-Übersicht).

Die generierte Referenz bleibt Englisch

Der folgende technische Block wird — einschließlich der Marker — aus demselben Dump des Binarys regeneriert wie die englische Seite, und das Gate vergleicht ihn bei jedem Push. Die Befehlsnamen, Help-Beschreibungen, Flags, Exit-Codes und Output-Verträge bleiben absichtlich auf Englisch, weil genau diese Strings das Binary ausgibt; das ist keine menschliche Übersetzung. Die redaktionelle Anleitung darum ist lokalisiert.

Complete command reference

This section is generated from the command tree of the community (AGPL) build of the olivares binary at this commit. It covers 964 command nodes — the root command and 963 subcommands, of which 202 are groups that carry subcommands and 40 are hidden diagnostics — together with the 3782 flags they declare. It is regenerated from the binary rather than kept by hand, so a command or flag added without a documentation change fails the push gate.

Nothing here is a stability promise: see Stability below for what may still change.

Exit codes

Every command in the tree exits with one of these codes. Scripts and CI pipelines branch on them, so an existing code is never renumbered — only appended to.

Code	Name	Meaning
0	OK	the command succeeded.
1	Err	generic failure with no more specific classification.
2	Usage	the invocation itself is wrong (unknown flag, bad arguments).
3	Auth	the control plane rejected the caller (401/403).
4	NotFound	the addressed entity does not exist (404).
5	Conflict	the request contradicts current state (409).
6	Server	a required control plane, service, or store failed or could not be accessed. db check --strict also uses this code when connection or authentication failure prevents a role verdict. Resolve the reported dependency failure before retrying; a proven role refusal uses code 1.
7	Degraded	the command succeeded but reports a degraded condition (status when the engine is not fully ok; security check on an affected version).
8	Indeterminate	the command could not reach a verdict because an input it needs is UNKNOWN, as distinct from a verdict of “fine” (0) or “bad” (7) and from a failure to run (1). security check returns it when the build declares no usable version, so no advisory range can be evaluated against it: a clean answer there would be an artifact, not a measurement. A fleet sweep must treat this as “not yet answered”, never as “clean”.
9	Edition	the capability asked for is a Business feature that this build or this engine does not have. It is not a failure of the request or of the engine; the answer names where the capability is described.

Flags every command accepts

-h, --help prints the command’s own help and exits 0. The flags below are declared on the root command and inherited by every command in the tree.

Flag	Type	Default	Description
-o, --output	string	text	inherited. global output format: text or json (report commands keep json unless -o is given)

Command groups declare further flags that their own subcommands inherit. A flag marked inherited in any table below is declared there and taken by everything under it, so it is listed once, at the command that declares it, rather than repeated on each of its subcommands.

Command index

All 964 commands, in alphabetical order.

Command	Summary
olivares	Olivares AI — self-hosted engine for enterprise AI
olivares __extract	internal: extract text from a rich document on stdin (sandboxed re-exec target) (hidden)
olivares accessmap	Query the access graph, least-privilege drift and attack paths
olivares accessmap attack-paths	Reachability, privilege-escalation and exfiltration analyses
olivares accessmap attack-paths escalation	List the privilege-escalation chains open to one agent
olivares accessmap attack-paths exfil	List the exfiltration routes out of one resource
olivares accessmap attack-paths reachability	List the resources one agent can reach
olivares accessmap attack-paths summary	Show the estate-wide attack-surface counts
olivares accessmap drift	Show permitted-vs-observed least-privilege drift
olivares accessmap graph	List the access graph as nodes and edges
olivares accessmap neighbors	List the edges touching one node
olivares account	Manage your own account
olivares account password	Change your own password and sign out your other sessions
olivares admin	Host-local repairs: give a person who lost their only passkey a way back
olivares admin recover	Remove a person’s passkeys and end their sessions so they can add a new passkey
olivares adoption	Report Claude adoption by org, team, trend and developer
olivares adoption developers	Break adoption down by developer (privileged: exposes identity)
olivares adoption discrepancy	Measure how far the two lenses disagree
olivares adoption summary	Show both adoption lenses over one window
olivares adoption teams	Break adoption down by team
olivares adoption trend	Show a per-day series for ONE lens
olivares agent	Expert settings behind sessions: profiles, registered folders, managed settings
olivares agent deploy	Find an official CLI on this host and register the profile a session launches under
olivares agent managed-settings	Render the Claude Code managed-settings.json that governs operated sessions (PEP hook)
olivares agent profile	Register and inspect provider profiles (which home an official CLI runs under)
olivares agent profile create	Register a provider profile for homes that already exist on this node
olivares agent profile get	Show one provider profile
olivares agent profile ls	List the provider profiles this tenant has registered
olivares agent profile rm	Retire a provider profile for good
olivares agent profile update	Change a profile’s label, state, authorization or session policy
olivares agent session	Manage the lifecycle of governed provider sessions (hidden)
olivares agent session attach	Stream a live session’s I/O (server-sent events) to stdout
olivares agent session cleanup	Release a stopped session (mark cleaned)
olivares agent session create	Launch a governed Claude Code session
olivares agent session events	Show a session’s lifecycle ledger
olivares agent session get	Show one session
olivares agent session input	Send one line or driver text to a live session
olivares agent session interrupt	Cancel the active provider turn without stopping the session
olivares agent session ls	List operated sessions
olivares agent session resume	Resume a stopped session
olivares agent session rm	Delete a cleaned session’s record
olivares agent session stop	Stop a running session
olivares agent tool	Install and inventory official provider CLIs (Claude Code, Codex, Grok Build)
olivares agent tool detect	Report provider CLI executables on this host: managed releases, vendor default paths and PATH
olivares agent tool install	Verify, download, probe and place one signed release of a provider CLI
olivares agent tool list	List installed provider CLI releases under the tools root and re-check their bytes
olivares agent tool plan	Resolve and verify what install would fetch and where it would place it, without changing anything
olivares agent workspace	Manage governed workspaces and their files (browse/read/write/move/delete)
olivares agent workspace add	Register a host directory as a governed workspace
olivares agent workspace approve-project-config	Approve the SHA-256 of the exact project agent configuration you reviewed
olivares agent workspace approve-setup	Approve the SHA-256 of the exact setup command you reviewed
olivares agent workspace files	List one directory level in a workspace
olivares agent workspace get	Read a file’s content to stdout (DLP-governed)
olivares agent workspace ls	List registered workspaces
olivares agent workspace mkdir	Create a directory (and parents)
olivares agent workspace mv	Move/rename a path within the workspace
olivares agent workspace project-config	List the folder’s repo-resident agent configuration that runs programs or redirects traffic
olivares agent workspace put	Write a file from –from (a local file or ‘-’ for stdin)
olivares agent workspace rm	Delete a file or (with –recursive) a directory subtree
olivares agent workspace rm-workspace	Deregister a workspace (does NOT delete host files)
olivares agent workspace setup	Read or store a folder’s setup command (empty –command clears it)
olivares agent workspace stat	Show metadata for one path
olivares audit	See recent events; verify, checkpoint and export the audit ledger
olivares audit archive	Export and verify the immutable ledger archive
olivares audit archive export	Export a tenant’s ledger as verifiable archive segments to a directory
olivares audit archive verify	Verify an exported archive directory offline (no store, no network)
olivares audit checkpoint	Write a signed checkpoint (all tenants, or one with –tenant)
olivares audit export	Export a tenant’s ledger to a SIEM format (cef|leef|syslog|otlp|otlp_envelope|otlp_log_record|ocsf)
olivares audit key-transition	Record the off-box-signed signing-key epoch boundary after keys rotate (hidden)
olivares audit ls	Show the most recent audit events, newest first
olivares audit observe-report	Summarize constrained-observe shadows for an observe→enforce promotion decision
olivares audit recover	Seal a corrupt audit tail and start a governed recovery epoch
olivares audit tree	Publish and verify C2SP Merkle checkpoints of the audit ledger
olivares audit tree checkpoint	Print the signed C2SP checkpoint of a tenant’s Merkle tree
olivares audit tree prove	Prove one event is inside a saved checkpoint (JSON proof on standard output)
olivares audit tree verify	Verify a saved checkpoint, offline, against the ledger or an inclusion proof
olivares audit verify	Verify a tenant’s chain and its signed checkpoints
olivares auth	Sign-in details: status, saved contexts, first-boot setup
olivares auth bootstrap	Redeem the one-time first-boot token: create the first organization and superadmin
olivares auth login	Sign in to an engine and keep the sign-in for the next commands
olivares auth logout	Sign out: remove the saved sign-in from this computer
olivares auth os-account	Bind a product account to an immutable native OS account
olivares auth os-account begin	Start as an administrator; the subject completes its own proof
olivares auth os-account complete	Prove native account control from the subject’s own sign-in
olivares auth os-account get	Read administrative mapping metadata
olivares auth os-account revoke	Revoke authority and retain the immutable account reservation
olivares auth status	Show the effective CLI identity and authentication context
olivares auth totp-policy	Read or set the require-TOTP-for-administrators policy (system:admin)
olivares auth totp-policy get	Read the policy
olivares auth totp-policy set	Set the policy
olivares auth use-context	Select the current CLI client context
olivares capabilities	What this estate can do: connected servers, and the tools and skills they bring
olivares capabilities servers	The MCP servers this estate talks to
olivares capabilities servers get	Show one MCP server and what it brings
olivares capabilities servers ls	List the connected MCP servers
olivares capabilities skills	The skills the connected servers contribute
olivares capabilities tools	The tools the connected servers expose, with their destructive hints
olivares capabilities wiring	Who is actually using which capability, as observed edges
olivares catalog	Admit and govern catalog entries, connectors and MCP servers
olivares catalog admit	Admit a stored CLI or MCP tool declaration
olivares catalog connector-admission	Read and set the connector supply-chain admission policy
olivares catalog connector-admission ls	List recorded connector admission verdicts
olivares catalog connector-admission policy	Read or replace the connector admission policy
olivares catalog connector-admission policy get	Show the connector admission policy
olivares catalog connector-admission policy set	Replace the connector admission policy
olivares catalog entries	Author, review and admit catalog entries
olivares catalog entries admit	Verify a supply-chain attestation for an entry
olivares catalog entries approve	Approve a submitted entry, hashing and signing it
olivares catalog entries create	Author a draft catalog entry
olivares catalog entries deprecate	Retire an approved entry
olivares catalog entries get	Show one catalog entry
olivares catalog entries instantiate	Request an instance from an approved entry
olivares catalog entries ls	List catalog entries
olivares catalog entries rm	Delete a catalog entry
olivares catalog entries set	Replace a draft entry’s authored fields
olivares catalog entries submit	Submit a draft entry for review
olivares catalog entries verify	Recompute an entry’s hash and check its signature
olivares catalog instances	Review and decide self-service instantiation requests
olivares catalog instances get	Show one instantiation request
olivares catalog instances ls	List instantiation requests
olivares catalog instances transition	Decide an instance request or apply its deployment
olivares catalog mcp-admission	Read and set the MCP server supply-chain admission policy
olivares catalog mcp-admission ls	List recorded MCP server admission verdicts
olivares catalog mcp-admission policy	Read or replace the MCP server admission policy
olivares catalog mcp-admission policy get	Show the MCP server admission policy
olivares catalog mcp-admission policy set	Replace the MCP server admission policy
olivares catalog pubkey	Show the public key catalog approvals are signed with
olivares claude-agents	Read a managed agent session’s thread events and answer its tool confirmations
olivares claude-agents sessions	Inspect and answer one managed agent session
olivares claude-agents sessions events	List one managed session’s thread events
olivares claude-agents sessions tool-confirmation	Answer a managed agent’s pending tool use (allow or deny)
olivares claude-hook	Governed PEP hook client: forward a Claude Code hook to the engine and relay the decision (deny-closed) (hidden)
olivares claude-policy	Validate and dry-run the managed policy files of Claude Code, Codex, Grok Build, OpenCode and Gemini CLI (publishing and tracking require Business)
olivares claude-policy artifact	Fetch the signed artifact a distribution agent would pull (requires Business)
olivares claude-policy checkin	Report an agent’s applied artifact and observed config (exit 7 when unverified) (requires Business)
olivares claude-policy distribution	Show published vs signed vs observed, scope by scope (requires Business)
olivares claude-policy dry-run	Resolve a document against observed hosts without writing anything
olivares claude-policy publish	Publish a new revision and, when a distributor is wired, sign it (requires Business)
olivares claude-policy pull	Pull a surface’s signed artifact, verify it, write the file and attest it (exit 7 when it does not verify) (requires Business)
olivares claude-policy validate	Validate a policy document server-side (exit 7 when it has errors)
olivares claude-policy versions	List and read published revisions of a surface (requires Business)
olivares claude-policy versions get	Show one revision with its document content (requires Business)
olivares claude-policy versions ls	List a surface’s published revisions (requires Business)
olivares codex	Author OpenAI Codex governance artifacts (managed config)
olivares codex managed-config	Render the Codex requirements.toml + managed_config.toml from a governance Policy JSON
olivares codex-hook	Governed PEP hook client for Codex: forward a Codex hook to the engine and relay the decision (deny-closed) (hidden)
olivares collector	Run as an edge collector: push local source observations to a remote core over gRPC+mTLS (hidden)
olivares commands	Print the full command tree of this binary (diagnostic) (hidden)
olivares completion	Generate shell autocompletion scripts
olivares completion bash	Generate bash autocompletion script
olivares completion fish	Generate fish autocompletion script
olivares completion powershell	Generate PowerShell autocompletion script
olivares completion zsh	Generate zsh autocompletion script
olivares compliance	Operate legal holds, GDPR erasure and regulatory artifacts
olivares compliance aims	Inspect ISO/IEC 42001 AIMS certification-readiness packs
olivares compliance aims ls	List ISO/IEC 42001 AIMS packs
olivares compliance calendar	Show the regulatory calendar and watchlist
olivares compliance depth	Inspect compliance-depth packs and control monitoring
olivares compliance depth drift	List detected control drift
olivares compliance depth fedramp	List FedRAMP 20x KSI packs
olivares compliance depth sector	List sector overlay packs
olivares compliance depth snapshots	List CCM control snapshots
olivares compliance depth us-law	List US state-law packs
olivares compliance dora	Inspect DORA registers and classified incidents
olivares compliance dora export	Export one DORA Register of Information
olivares compliance dora incidents	List classified DORA incidents
olivares compliance dora registers	List DORA registers of information
olivares compliance erasure	Register, execute and evidence GDPR erasure requests (hidden)
olivares compliance erasure custody	Show an erasure’s append-only chain of custody
olivares compliance erasure execute	Execute an erasure (IRREVERSIBLE, dual-control)
olivares compliance erasure get	Show one erasure request
olivares compliance erasure ls	List erasure requests
olivares compliance erasure receipt	Show the sealed, ledger-anchored erasure receipt
olivares compliance erasure request	Register an erasure request (destroys nothing)
olivares compliance holds	Place, inspect and release legal holds (hidden)
olivares compliance holds check	Ask whether any active hold already covers a subject or class
olivares compliance holds custody	Show a hold’s append-only chain of custody
olivares compliance holds get	Show one legal hold
olivares compliance holds ls	List legal holds
olivares compliance holds place	Place a legal hold (takes effect immediately)
olivares compliance holds release	Release a legal hold (dual-control, no break-glass)
olivares compliance oscal	Inspect ingested OSCAL profiles and SSPs
olivares compliance oscal get	Show one ingested OSCAL profile or SSP
olivares compliance oscal ls	List registered OSCAL documents
olivares compliance risk	Classify agents and read the governed risk register
olivares compliance risk classify	Record a risk suggestion from observed signals and declared intent
olivares compliance risk ls	Read retained risk classifications and their evidence
olivares compliance subject	Answer a data subject’s erasure request by subject id (hidden)
olivares compliance subject erase	Register and execute an erasure for one subject (IRREVERSIBLE)
olivares compliance subject status	Show erasure status for one data subject
olivares config	Generate validated engine configuration (the non-interactive setup)
olivares config effective	Print configured OLIVARES_* values with secrets redacted
olivares config generate	Compose a validated /etc/olivares/olivares.env (or k8s snippet) from flags
olivares config session-idle	Read or change optional idle session stops
olivares config session-idle get	Read the saved instance idle-stop setting
olivares config session-idle set	Save the idle-stop window; 0 turns it off
olivares config tracing	Read or change saved tracing settings without restarting the engine
olivares config tracing get	Read saved and effective tracing choices and environment overrides
olivares config tracing set	Save tracing choices and apply them now
olivares config validate	Validate configured OLIVARES_* environment keys
olivares connector	Scaffold out-of-tree connector projects
olivares connector init	Generate a connector repository from an archetype template
olivares consoleviews	Manage saved console views (filter and parameter sets)
olivares consoleviews create	Save a new view
olivares consoleviews get	Show one saved view in full
olivares consoleviews ls	List the views you can see
olivares consoleviews rm	Delete your own saved view
olivares consoleviews update	Replace the writable fields of your own view
olivares db	Prepare and verify the database before serving (Postgres roles, RLS posture)
olivares db activate-directory-writer	Activate the User authority writer protocol on a stopped store (reopen required)
olivares db check	Probe a DSN’s role posture and report whether the engine will accept it (read-only)
olivares db init	Provision the least-privilege Postgres roles + database idempotently (no psql by hand)
olivares db pg-service-file	Write a private PostgreSQL service file for the internal client bridge (hidden)
olivares ddil	Air-gap DDIL bundles: export, verify and import governance state across a disconnected gap (hidden)
olivares ddil export	Assemble and sign a DDIL bundle from the local governance store
olivares ddil import	Verify, reconcile and apply a DDIL courier bundle fail-closed
olivares ddil keygen	Generate an Ed25519 DDIL transport keypair
olivares ddil verify	Verify and inspect a DDIL courier bundle without applying it
olivares deploy	Declare, plan, apply, retire and roll back governed agent deployments (hidden)
olivares deploy apply	Actuate the current version through the approval gate (two-phase)
olivares deploy definitions	Declare and version deployment definitions
olivares deploy definitions create	Declare a deployment definition from a JSON spec
olivares deploy definitions get	Show one definition with its current spec and real state
olivares deploy definitions ls	List deployment definitions with their drift
olivares deploy definitions revisions	List a definition’s revision history
olivares deploy definitions rm	Delete a definition and its revisions (destructive; needs –yes when unattended)
olivares deploy definitions update	Publish a new revision of a definition (PUT)
olivares deploy operations	List the append-only ledger of plan/apply/retire/rollback operations
olivares deploy plan	Compute the change set an apply WOULD make (nothing is actuated)
olivares deploy retire	Take a live deployment down (destructive POST; needs –yes when unattended)
olivares deploy rollback	Revert a definition to an earlier version (destructive POST; needs –yes when unattended)
olivares deploy verify	Check the real deployment against its declared spec
olivares deploy wirings	List what each deployment is wired to, and how that was attributed
olivares doctor	Check this host’s installation and say what to fix
olivares dr	Disaster recovery: ledger-continuity-safe backup and restore
olivares dr backup	Write a ledger-continuity-safe DR bundle
olivares dr drill	Drill synthetic-ledger continuity and print measured RTO
olivares dr inspect	Print a DR bundle’s manifest (no KEK needed; no secrets shown)
olivares dr ls	List DR bundles (local, or –offsite for the S3/R2 mirror)
olivares dr pull	Download a DR bundle from the offsite S3/R2 target
olivares dr push	Upload an existing DR bundle to the offsite S3/R2 target
olivares dr restore	Restore a DR bundle and verify ledger continuity (non-zero exit if not safe)
olivares dr restore-status	Read the destination’s restore controls without opening the engine
olivares dr verify	Test a DR bundle WITHOUT touching the live data dir (the DR drill)
olivares evals	Eval methodology tools: the CI regression gate and the judge-calibration labeler
olivares evals gate	Run the CI regression gate (exit 0 pass/warn, 1 fail) or re-check one after a governed override
olivares evals label	Guided human-labeling session for the judge↔human calibration set
olivares eventing	Manage the eventing platform (webhook event subscriptions, deliveries, event log)
olivares eventing dead-letters	Inspect and redeliver dead-lettered deliveries
olivares eventing dead-letters ls	List dead-lettered deliveries (status=dead)
olivares eventing dead-letters redeliver	Requeue a dead-lettered delivery for retry
olivares eventing deliveries	Inspect delivery state (ls)
olivares eventing deliveries ls	List deliveries (optionally filtered by –subscription, –status)
olivares eventing egress	Inspect and actuate the egress destination control’s rollout
olivares eventing egress actuate	Apply a deliberate rollout decision for the egress destination control
olivares eventing egress status	Report the rollout disposition and what enforcing would block
olivares eventing events	Inspect the captured event log
olivares eventing events ls	List captured events (optionally from a seq cursor, filtered by –type)
olivares eventing fence	Inspect, arm and verify the cross-version egress writer fence
olivares eventing fence arm	Require every writer to prove it carries the egress gate
olivares eventing fence status	Report the writer fence’s posture and whether the database enforces it
olivares eventing fence verify	Fail unless the database is actually enforcing an armed writer fence
olivares eventing subscriptions	Manage event subscriptions (ls, get, create, update, rotate-secret, rm, test)
olivares eventing subscriptions create	Create a new event subscription
olivares eventing subscriptions get	Show one event subscription in full
olivares eventing subscriptions ls	List event subscriptions for a tenant
olivares eventing subscriptions rm	Delete an event subscription
olivares eventing subscriptions rotate-secret	Reissue the signing secret for one subscription (breaks delivery until the receiver is updated)
olivares eventing subscriptions test	Send a test delivery to a subscription’s endpoint
olivares eventing subscriptions update	Edit one event subscription in place (never reissues the secret)
olivares exit-codes	What the exit codes of olivares mean (hidden)
olivares findings	Export governed security findings
olivares findings export	Export all matching findings as SARIF 2.1.0
olivares finops	Report AI spend and value, and govern budgets, rates and cost centers (hidden)
olivares finops admission	Reserve spend before an effect, settle it, and reconcile the holds
olivares finops admission commit	Commit a hold at its measured cost
olivares finops admission reconcile	Run admission recovery and file a finding on drift
olivares finops admission reconciliation	Read the holds against their settlements
olivares finops admission release	Release a hold whose effect did not run
olivares finops admission reserve	Reserve estimated spend before an effect
olivares finops alerts	List budget threshold alerts
olivares finops budgets	Govern spend budgets and read their status
olivares finops budgets create	Create a budget
olivares finops budgets get	Show one budget
olivares finops budgets ls	List budgets
olivares finops budgets rm	Delete a budget
olivares finops budgets status	Show one budget’s live status against its cap
olivares finops budgets update	Replace a budget
olivares finops comparison	Compare what a workload would cost on other models
olivares finops cost	Record an observed cost sample
olivares finops cost ingest	Record one observed cost sample
olivares finops cost-centers	Govern cost centers and the rules that map spend to them
olivares finops cost-centers create	Create a cost center
olivares finops cost-centers get	Show one cost center
olivares finops cost-centers ls	List cost centers
olivares finops cost-centers mappings	Govern the rules that map spend onto one cost center
olivares finops cost-centers mappings add	Add a mapping rule to a cost center
olivares finops cost-centers mappings ls	List one cost centre’s mapping rules
olivares finops cost-centers mappings rm	Remove a mapping rule from a cost center
olivares finops cost-centers rm	Delete a cost center
olivares finops cost-centers update	Replace a cost center
olivares finops forecast	Forecast spend from the observed history
olivares finops outcomes	Record and read business outcomes attributed to AI work
olivares finops outcomes ingest	Record one business outcome
olivares finops outcomes ls	List recorded outcomes
olivares finops rates	Govern the model rate catalog used to price usage
olivares finops rates create	Add a model rate
olivares finops rates get	Show one model rate
olivares finops rates ls	List model rates
olivares finops rates rm	Delete a model rate
olivares finops rates update	Replace a model rate
olivares finops recommendations	Show cost-reduction recommendations
olivares finops seats	Record seat counts and read seat utilization
olivares finops seats ingest	Record a provider’s seat counts for a day
olivares finops seats utilization	Show seat utilization
olivares finops spend	Report observed AI spend over a window
olivares finops spend allocation	Show how spend allocates to cost centers
olivares finops spend export	Export spend in the FOCUS interchange format
olivares finops spend ls	Show the spend series for a window
olivares finops spend reconciliation	Compare observed spend against provider-reported cost
olivares finops spend summary	Show the spend summary for a window
olivares finops spend trend	Show the spend trend over a window
olivares finops spend unified	Show the unified cross-source spend view
olivares finops statements	Generate, read and export per-cost-center statements
olivares finops statements export	Export one statement
olivares finops statements generate	Generate statements for a period
olivares finops statements get	Show one statement with its lines
olivares finops statements ls	List generated statements
olivares finops team-summary	Show the per-team spend summary
olivares finops value	Report the value side of the unit economics
olivares finops value ls	Show the value series for a window
olivares finops value summary	Show the value summary and cost-per-outcome
olivares first-boot	Show this installation’s console address and the state of first setup
olivares firstparty-bins	List the first-party connector plugins embedded in this binary (diagnostic) (hidden)
olivares gitpublish	Publish through governed git targets: push, pull request, merge
olivares gitpublish intents	Follow, reconcile and close publication requests
olivares gitpublish intents abandon	Take responsibility for an intent that cannot resolve
olivares gitpublish intents get	Show one publication intent
olivares gitpublish intents ls	List the publication intents of one target
olivares gitpublish intents observations	List every observation of one publication intent
olivares gitpublish intents reconcile	Read the host again for one uncertain intent
olivares gitpublish merge	Merge a pull request whose head is still the reviewed sha
olivares gitpublish pull-request	Open a pull request from a prefixed branch into a merge base
olivares gitpublish push	Push one exact commit to a branch under the target’s prefix
olivares gitpublish targets	Read publication targets
olivares gitpublish targets get	Show one publication target
olivares gitpublish targets ls	List publication targets
olivares governance	Inspect the governance plane: what is stopped, and why
olivares governance approvals	The approval queue: what is waiting on a human, and who decided what
olivares governance approvals approve	Approve a request that waits for a person
olivares governance approvals decisions	Who voted which way on one approval, and why
olivares governance approvals get	Show one approval
olivares governance approvals ls	List approvals, pending and decided
olivares governance approvals reject	Reject a request that waits for a person
olivares governance breakglass	Break-glass grants (requires Business edition) (hidden)
olivares governance breakglass get	Show a break-glass grant (requires Business edition)
olivares governance breakglass ls	List break-glass grants (requires Business edition)
olivares governance breakglass uses	Show actions under a break-glass grant (requires Business edition)
olivares governance guardian	The rules that act on findings without a human, and what they have done
olivares governance guardian actions	What guardian actually did, rule by rule
olivares governance guardian rules	List the guardian rules and whether each is armed
olivares governance killswitch	The estate-wide and per-scope stops that deny work while they are active
olivares governance killswitch ls	List kill switches, active and historical
olivares governance killswitch state	Whether the estate is stopped, and every kill switch active right now
olivares governance nhi	Agent identity lifecycle requires Business Identity & Scale (hidden)
olivares governance pdp	The policy decision point: which revision is actually deciding, and is it in force
olivares governance pdp active	Which policy this process is deciding with, and whether it is fully in force
olivares governance pdp get-version	One stored revision, with the policy document itself
olivares governance pdp tests	The stored test results for a policy revision
olivares governance pdp versions	Every stored policy revision, both surfaces, metadata only
olivares governance rbac	Who can do what: the grant vocabulary, the custom roles and the scoped grants
olivares governance rbac catalog	The vocabulary a grant can be built from
olivares governance rbac delegation-authority	What the calling principal may delegate, and where
olivares governance rbac filters	Inheritance filters: where rights from above a node stop applying
olivares governance rbac filters get	One inheritance filter
olivares governance rbac filters ls	List every inheritance filter
olivares governance rbac filters rm	Remove an inheritance filter
olivares governance rbac filters set	Stop rights from above a node for one resource class
olivares governance rbac grants	The scoped grants in force: who holds what, where
olivares governance rbac grants get	One scoped grant
olivares governance rbac grants ls	List every scoped grant
olivares governance rbac permission-groups	Named bundles of permissions that roles reuse
olivares governance rbac permission-groups get	One permission group, with its members
olivares governance rbac permission-groups ls	List the permission groups
olivares governance rbac rights	Which trustee rights a subject holds at a node, and the node’s path
olivares governance rbac roles	Custom roles: what each one grants, and what it takes away
olivares governance rbac roles get	One custom role, with its full permission set
olivares governance rbac roles ls	List the custom roles
olivares grok	Author Grok Build governance artifacts (managed requirements)
olivares grok managed-config	Render /etc/grok/requirements.toml from a governance Policy JSON
olivares grok-hook	Governed PEP hook client for Grok Build: forward a Grok hook to the engine and relay the decision (deny-closed) (hidden)
olivares health	Watch subject health, incidents, SLA and dependencies
olivares health checks	Declare, inspect, probe and retire health checks
olivares health checks create	Declare a new monitored subject
olivares health checks get	Show one check
olivares health checks ls	List declared checks
olivares health checks report	Post a probe result against a check
olivares health checks rm	Delete a check (admin-tier)
olivares health checks update	Change a check’s configuration
olivares health dependencies	Show the observed dependency graph
olivares health events	List the append-only reliability transition ledger
olivares health incidents	List, open and resolve health incidents
olivares health incidents get	Show one incident
olivares health incidents ls	List health incidents
olivares health incidents resolve	Declare an incident resolved
olivares health sla	Report observed uptime for one subject against its target
olivares health status	Show the current health of every monitored subject
olivares health watch	Follow health changes as they happen (one JSON object per line)
olivares help	Help about any command
olivares hookpep	Author and inspect PDP policy through the engine
olivares hookpep dry-run	Evaluate a request against a candidate policy without publishing it
olivares hookpep explain	Explain a request decision against a candidate policy without publishing it
olivares hookpep publish	Compile, publish, and activate an authored policy revision
olivares hookpep rollback	Re-activate a prior immutable policy revision
olivares hookpep tests	Show the stored compile-validation artifact for a policy revision
olivares hookpep validate	Compile and validate a candidate policy without publishing it
olivares hookpep versions	List immutable authored policy revisions
olivares hooks	Hooks-hardening add-on: fleet deployed-verified attestation + conformance cert (Business: AI Runtime Security) (hidden)
olivares hooks attest	Attest a fleet’s deployed managed-settings against the canonical PEP-hook bundle (deployed-verified)
olivares hooks conform	Certify conformance of the managed-settings + PEP hook against the real claude binary
olivares identity	Read identity connection state
olivares identity external-keys	External key inventory requires Business Identity & Scale (hidden)
olivares identity residency	Residency posture requires Business Identity & Scale (hidden)
olivares identity sso	Report the SSO connection state
olivares identity wif	Workload identity federation requires Business Identity & Scale (hidden)
olivares inference-proxy	Govern the inference gateway: gates, DLP rules and device grants
olivares inference-proxy config	Read and replace the gateway’s gate configuration
olivares inference-proxy config get	Show the gateway’s effective gate configuration
olivares inference-proxy config set	Replace the gateway’s gate configuration
olivares inference-proxy device	Approve or deny a pending device grant
olivares inference-proxy device approve	Resolve a pending device grant by its user code
olivares inference-proxy dlp	Govern the per-class DLP rules applied to inference egress
olivares inference-proxy dlp ls	List the effective DLP rules
olivares inference-proxy dlp rm	Remove a DLP override and restore its secure default
olivares inference-proxy dlp set	Set the action for one DLP class
olivares inference-proxy firewall	Read the Messages proxy’s startup content-inspector attachment
olivares inference-proxy firewall status	Show the Messages proxy’s startup content-inspector attachment state
olivares inventory	List the observed entity catalog and its coverage summary
olivares inventory entities	List and open catalog entities
olivares inventory entities get	Show one catalog entity and the core entity it overlays
olivares inventory entities ls	List catalog entities
olivares inventory summary	Count catalog entities by kind and by signal source
olivares keys	Inspect signing-key custody
olivares keys status	Show the key-custody posture (declared vs configured, envelopes, FIPS mode)
olivares knowledge	Govern knowledge bases, data products, memory and DLP
olivares knowledge context-policies	Read and set context/compaction policies
olivares knowledge context-policies ls	List context policies
olivares knowledge context-policies put	Create or replace a context policy
olivares knowledge data-products	Govern data products and their versioned contracts
olivares knowledge data-products archive	Archive a data product
olivares knowledge data-products contracts	Read and add a data product’s versioned contracts
olivares knowledge data-products contracts active	Show the contract version currently in force
olivares knowledge data-products contracts add	Add a new contract version to a data product
olivares knowledge data-products contracts get	Show one contract version
olivares knowledge data-products contracts ls	List a data product’s contract versions
olivares knowledge data-products create	Declare a data product
olivares knowledge data-products deprecate	Deprecate a data product
olivares knowledge data-products events	List a data product’s enforcement events
olivares knowledge data-products get	Show one data product
olivares knowledge data-products health	Report a data product’s freshness and quality
olivares knowledge data-products ls	List data products
olivares knowledge data-products publish	Publish a data product so its contract governs the corpus
olivares knowledge data-products rm	Delete a data product
olivares knowledge data-products set	Update a data product’s authored fields
olivares knowledge data-products validate	Validate a payload against the product’s active contract
olivares knowledge dlp	Read and set the DLP egress rules
olivares knowledge dlp ls	List the DLP egress rules
olivares knowledge dlp put	Create or replace one DLP rule
olivares knowledge dlp rm	Delete one DLP rule
olivares knowledge documents	Inspect an individual knowledge document
olivares knowledge documents get	Show one knowledge document
olivares knowledge kbs	Declare, inspect and operate knowledge bases
olivares knowledge kbs create	Declare a knowledge base
olivares knowledge kbs documents	List a knowledge base’s documents
olivares knowledge kbs get	Show one knowledge base
olivares knowledge kbs ingest	Ingest documents into a knowledge base
olivares knowledge kbs ls	List the tenant’s knowledge bases
olivares knowledge kbs query	Run a governed retrieval against a knowledge base
olivares knowledge kbs reindex	Embed and index the knowledge base’s pending chunks
olivares knowledge kbs rm	Delete a knowledge base and cascade its documents
olivares knowledge kbs scan	Run PII discovery over a knowledge base
olivares knowledge kbs set	Replace a knowledge base’s authored fields
olivares knowledge kbs sync	Delta-sync a knowledge base from its content source
olivares knowledge labels	Read the sensitivity labels PII discovery wrote
olivares knowledge labels ls	List sensitivity labels
olivares knowledge lineage	Read the append-only retrieval lineage
olivares knowledge lineage get	Show one lineage record
olivares knowledge lineage ls	List retrieval lineage records
olivares knowledge memory	Govern agent memory: read, write, verify, export and purge
olivares knowledge memory all	List every memory entry (admin-tier cross-scope view)
olivares knowledge memory export	Export a signed, portable memory bundle
olivares knowledge memory get	Show one memory entry
olivares knowledge memory import	Import a signed portability bundle
olivares knowledge memory ls	List memory entries visible in the declared scope
olivares knowledge memory purge	Purge expired memory entries
olivares knowledge memory put	Write one governed memory entry
olivares knowledge memory rm	Delete one memory entry
olivares knowledge memory verify	Verify memory integrity against the ledger anchor
olivares knowledge prompts	Manage the versioned prompt registry
olivares knowledge prompts create	Register a prompt and its first revision
olivares knowledge prompts get	Show one prompt
olivares knowledge prompts ls	List registered prompts
olivares knowledge prompts revisions	List, read and append immutable prompt revisions
olivares knowledge prompts revisions add	Append an immutable revision to a prompt
olivares knowledge prompts revisions get	Show one prompt revision
olivares knowledge prompts revisions ls	List a prompt’s revisions
olivares knowledge prompts rollback	Point a prompt at an earlier revision
olivares knowledge scans	Read the append-only PII scan evidence
olivares knowledge scans ls	List PII scan runs
olivares knowledge sources	Run discovery over a registered content source
olivares knowledge sources scan	Scan a content source for personal data without ingesting
olivares license	See, install and remove the license (Business)
olivares license connect	Bind this deployment to its purchase with an owner-approved key, and refresh, rotate, recover or deactivate it
olivares license connect abandon	Discard the pending connect operation of this data directory
olivares license connect apt-refresh	Obtain this cycle’s APT download credential by proof of possession and hand it to the appliance helper
olivares license connect deactivate	Deactivate a deployment by proof of possession, or with the owner’s approval
olivares license connect dnf-refresh	Obtain this cycle’s DNF download credential by proof of possession and hand it to the appliance helper
olivares license connect reactivate	Reactivate an explicitly deactivated deployment with a new key and the owner’s approval
olivares license connect recover	Bind a new key to an existing deployment whose key is lost, with the owner’s approval
olivares license connect refresh	Refresh the installed credential and download token by proof of possession
olivares license connect rotate-key	Replace this deployment’s key, proving possession of both the bound and the new key
olivares license connect start	Request owner approval for this deployment’s key and complete the binding once approved
olivares license connect status	Show this data directory’s connected identity, binding, pending operation and last credential
olivares license install	Install a license into the data dir (verify + persist; apply live with SIGHUP / runtime reload)
olivares license keygen	Generate one Ed25519 keypair for a license or OTA trust domain
olivares license sign	Sign a license (requires –key in a release build; uses the dev key only in dev/test builds)
olivares license status	Show the installed license and its status (offline; resolves –license > env > data-dir)
olivares license trust	Show or change which license signing keys this deployment trusts (current, verify-only, revoked, epoch fence)
olivares license trust fence	Set the minimum key_epoch this deployment accepts in license credentials
olivares license trust set	Add a license public key or change a trusted key’s state, epoch or retirement window
olivares license trust status	Show the effective license trust keyring of a data directory
olivares license uninstall	Remove the installed license from the data dir (the offline half of DELETE /v1/console/license)
olivares license verify	Verify a license against a public key (default: embedded key), with profile/grace and optional CRL status
olivares login	Sign in to an engine and keep the sign-in for the next commands
olivares logout	Sign out: remove the saved sign-in from this computer
olivares mcp	MCP servers that sessions can use
olivares mcp add	Add an MCP server (off until you enable it) and list its tools
olivares mcp assign	Give an MCP server only to the sessions under a workspace, folder, template, group, agent or session
olivares mcp disable	Turn an MCP server off; sessions stop using it
olivares mcp enable	Turn an MCP server on, so sessions can use its tools
olivares mcp ls	List the MCP servers, whether each is on, and the tools its last test found
olivares mcp pins	List and manage approved MCP tool fingerprints (hidden)
olivares mcp pins approve	Approve an explicit or currently drifted tool fingerprint
olivares mcp pins ls	List approved MCP tool fingerprints and current drift
olivares mcp pins rm	Remove an approved MCP tool fingerprint
olivares mcp rm	Remove an MCP server
olivares mcp secret	Store a credential for MCP servers, referenced as store:mcp/<name>
olivares mcp sessions	Let sessions use the MCP servers that are on, or stop them (off by default)
olivares mcp test	Start an MCP server and list its tools without calling any
olivares mcp unassign	Remove a target from an MCP server
olivares members	People in an organization and their roles
olivares members grant	Grant an existing account a role in a tenant
olivares members invites	List and revoke the tenant’s pending invitations
olivares members invites ls	List the tenant’s pending, unexpired invitations
olivares members invites revoke	Revoke a pending invitation
olivares members ls	List the resolved tenant’s member roster
olivares message	Exchange exact-session messages through governed channels (hidden)
olivares message ack	Acknowledge this exact session’s delivery
olivares message decision	Answer decision requests attached to work
olivares message decision respond	Resolve a decision request with one offered choice
olivares message get	Read this exact session’s delivery
olivares message handoff	Offer and respond to exact-session work handoffs
olivares message handoff get	Read protected handoff context by carrier delivery
olivares message handoff inbox	List this exact session’s incoming handoffs
olivares message handoff offer	Offer owned work to one exact canonical session SID
olivares message handoff respond	Accept or reject this exact session’s incoming handoff
olivares message inbox	Read this authenticated session’s inbox
olivares message send	Send plain-text content to one canonical session SID
olivares migrate	Inspect migration state or explicitly apply the PostgreSQL schema
olivares migrate apply	Apply the PostgreSQL schema and stop WITHOUT serving (migrate → grant → serve)
olivares migrate manifest	Print this binary’s registered schema manifest (deterministic; the Community≡Business parity oracle)
olivares migrate status	List applied schema migrations and their expand/contract phase (read-only)
olivares models	Govern the model estate, routing, registry and model access
olivares models access	Author model-access grants (who may use which model)
olivares models access create	Create a model-access grant
olivares models access ls	List model-access grants
olivares models access rm	Delete a model-access grant
olivares models access update	Replace a model-access grant
olivares models admission	Govern the signed-model admission trust root and read its verdicts
olivares models admission ls	List recorded admission verdicts
olivares models admission policy	Show the admission trust root
olivares models admission set-policy	Replace the admission trust root
olivares models agent-artifacts	Govern the agent-artifact supply chain
olivares models agent-artifacts aibom	Generate the agent-supply-chain BOM
olivares models agent-artifacts create	Register an agent artifact
olivares models agent-artifacts ls	List governed agent artifacts
olivares models agent-artifacts rm	Remove an agent artifact
olivares models agent-artifacts seal	Seal the agent-supply-chain BOM to the ledger
olivares models agent-artifacts seals	List agent-supply-chain BOM seals
olivares models aibom	Generate, seal and list AI bills of materials
olivares models aibom card	Render the model card for one owned model
olivares models aibom get	Generate the AIBOM for one owned model
olivares models aibom ls	List AIBOM seals
olivares models aibom seal	Seal the current AIBOM to the ledger as evidence
olivares models availability	Show available models by provider and account
olivares models catalog	Show the declared reference catalog (capabilities and list pricing)
olivares models data-governance	Show the context-management / memory / ZDR matrix
olivares models datasets	Govern dataset lineage components
olivares models datasets create	Register a dataset
olivares models datasets ls	List governed datasets
olivares models datasets rm	Remove a dataset
olivares models deployments	Govern local inference deployments
olivares models deployments create	Register an inference deployment
olivares models deployments ls	List inference deployments
olivares models deployments rm	Remove an inference deployment
olivares models deployments update	Replace an inference deployment
olivares models entitlements	Attest provider entitlement state for restricted access tiers
olivares models entitlements ls	List access-tier entitlement attestations
olivares models entitlements set	Attest the entitlement state of one access tier
olivares models features	Show which model families declare each API capability
olivares models finetune	Record fine-tune jobs and their outcome
olivares models finetune create	Record a fine-tune job
olivares models finetune get	Show one fine-tune job record
olivares models finetune ls	List fine-tune job records
olivares models finetune update	Replace a fine-tune job record
olivares models get	Show one governed model
olivares models gpai	Attest per-provider GPAI compliance posture
olivares models gpai attest	Attest one provider’s GPAI posture
olivares models gpai ls	List attested GPAI posture per provider
olivares models groups	Author named model groups
olivares models groups create	Create a model group
olivares models groups get	Show one model group
olivares models groups ls	List model groups
olivares models groups rm	Delete a model group
olivares models groups update	Replace a model group
olivares models keys	Govern provider API-key and workspace references
olivares models keys create	Register a provider key or workspace reference
olivares models keys ls	List provider key and workspace references
olivares models keys rm	Remove a key or workspace reference
olivares models keys update	Replace a key or workspace reference
olivares models ls	List the governed model estate
olivares models owned	Govern the own-model registry
olivares models owned create	Register an owned model
olivares models owned get	Show one owned model
olivares models owned ls	List owned models
olivares models owned rm	Remove an owned model from the registry
olivares models owned update	Replace an owned-model entry
olivares models platforms	Show the deployment-surface matrix and per-platform lifecycle
olivares models rate-limits	Show the provider rate-limit inventory a gateway must mirror
olivares models residency	Govern per-workspace inference-geo residency
olivares models residency ls	List per-workspace residency records
olivares models residency set	Declare a workspace’s permitted inference geographies
olivares models routing	Author routing policies and resolve or execute them
olivares models routing create	Create a routing policy
olivares models routing execute	Execute a routing policy through the governed executor (SPENDS)
olivares models routing get	Show one routing policy
olivares models routing ls	List routing policies
olivares models routing resolve	Resolve a policy to the routing decision it would produce
olivares models routing rm	Delete a routing policy
olivares models routing update	Replace a routing policy in place
olivares models tool-types	Show the dated tool-type catalog and its cost cross-walk
olivares models versions	Govern owned-model versions and their signed admission
olivares models versions admit	Run the signed-model admission ceremony against a version
olivares models versions create	Register an owned-model version
olivares models versions ls	List owned-model versions
olivares models versions rm	Remove an owned-model version
olivares modules	List, turn on and turn off optional modules
olivares modules ls	List selected and running modules
olivares modules off	Turn off a module in the saved selection
olivares modules on	Turn on a module in the saved selection
olivares notify	Author notification routes and inspect deliveries and the outbox
olivares notify deliveries	List the append-only delivery ledger
olivares notify destinations	List the destinations THIS tenant may address
olivares notify evaluate	Ask which routes a signal WOULD select, delivering nothing
olivares notify match-types	List the event types a route may match
olivares notify outbox	Inspect the durable outbox and requeue terminal rows
olivares notify outbox ls	List durable outbox rows
olivares notify outbox redeliver	Requeue a terminal outbox row for another delivery attempt (admin-tier)
olivares notify routes	Author, inspect, test and roll back notification routes
olivares notify routes create	Declare a notification route
olivares notify routes get	Show one route’s full predicate
olivares notify routes ls	List notification routes
olivares notify routes restore	Put a route back to an earlier revision
olivares notify routes revisions	List a route’s revision ledger
olivares notify routes rm	Delete a route (admin-tier)
olivares notify routes test	Send a REAL test notification through a route (admin-tier)
olivares notify routes update	Replace a route’s predicate
olivares observability	Inspect ingestion health, ledger traces and binary attestation
olivares observability attestation	Show the measured attestation of the running binary
olivares observability ingestion-health	Report per-standard and per-source telemetry ingestion
olivares observability traces	List and open ledger-derived traces
olivares observability traces get	Show one trace’s spans
olivares observability traces ls	List correlated traces
olivares openapi	Print an OpenAPI 3.1 document (stable core, or –beta module routes) for client codegen
olivares orchestration	Orchestration requires Business Identity & Scale (hidden)
olivares policy	Reconstruct historical policy decisions from the evidence ledger
olivares policy replay	Replay a past authorization from the ledger, never from the live policy
olivares provider	API-key accounts sessions can use instead of a tool’s own sign-in
olivares provider account	Create, list, read, edit and adopt the named provider accounts sessions launch under
olivares provider account add	Create a provider account and the home it launches under — exit 5 when the name is taken, 6 when this node builds no homes
olivares provider account adopt	Make an existing provider profile a named account — exit 4 for an unknown profile, 5 when it is already an account or the name is taken
olivares provider account edit	Rename an account or edit its label and color without changing its home
olivares provider account get	Show one provider account — exit 4 when no account has that reference
olivares provider account ls	List the named provider accounts — exit 3 when the caller may not read them
olivares provider add	Register a provider credential with the engine
olivares provider bind	Make a provider profile launch with this credential
olivares provider get	Show one registered provider
olivares provider ls	List the registered provider credentials
olivares provider rm	Withdraw a provider credential for good
olivares provider rotate	Replace a provider’s credential in place
olivares provider set	Choose the default model for new sessions on this provider
olivares provider test	Ask the provider which models it serves, with the registered credential — exit 7 when the provider REFUSES it, 8 when the endpoint is unreachable
olivares quickstart	Start the engine for the first time and open the console
olivares quickstart governed-rag	Prepare live governed data for Claude Code (S3/Drive -> semantic KB -> MCP retrieval)
olivares readyz	Probe this host’s local engine readiness without curl
olivares recording	Read the session-recording trail, verify its chain and set the recording policy (hidden)
olivares recording ack	Acknowledge the recording notice for this caller
olivares recording config	Read and replace the tenant’s recording policy
olivares recording config get	Show the tenant’s recording policy
olivares recording config set	Replace the tenant’s recording policy (PUT — the whole policy)
olivares recording notice	Show what is recorded for this caller, and whether consent is required
olivares recording sessions	List, verify, export and seal recorded sessions
olivares recording sessions export	Export one session as evidence (json or summary)
olivares recording sessions get	Show one recorded session
olivares recording sessions ls	List recorded sessions
olivares recording sessions replay	Reconstruct one session’s frames and ledger window
olivares recording sessions seal	Close one active session explicitly
olivares recording sessions summarize	Produce the derived reviewer summary of a sealed session
olivares recording sessions unified	Show one session’s frames and audit timeline merged
olivares recording sessions verify	Verify a session’s hash chain — exit 7 when it does not verify
olivares recording sweep	Seal every idle active session (the lazy-seal safety net)
olivares redteam	Run the consent-gated adversarial battery against your own agents (hidden)
olivares redteam catalog	List the probe battery and its OWASP/ATLAS coverage
olivares redteam runs	Launch and inspect scored red-team runs
olivares redteam runs get	Show one run’s scorecard
olivares redteam runs launch	Run the battery against an authorized target
olivares redteam runs ls	List red-team runs and their scores
olivares redteam runs results	List one run’s per-probe results
olivares redteam targets	Register agents as red-team targets and grant or withdraw consent
olivares redteam targets authorize	Consent to red-teaming this target (confirmed; needs –yes when unattended)
olivares redteam targets get	Show one target and its consent record
olivares redteam targets ls	List registered red-team targets and their consent state
olivares redteam targets register	Register an agent from your inventory as a red-team target
olivares redteam targets revoke	Withdraw consent to red-team this target
olivares release	Release/OTA tooling (manifest generation) — ops use (hidden)
olivares release export-mirror	Export an offline mirror (requires Enterprise) (hidden)
olivares release manifest	Build (and optionally sign) a per-channel OTA update manifest from a release directory
olivares release sign-manifest	Sign an existing OTA manifest during the off-box release ceremony
olivares release verify-channel-advance	Refuse a channel publication that would not move the LIVE channel forward
olivares release verify-manifest	Cross-check an OTA manifest against the cosign-verified checksums.txt (and, with –dir, the published bytes)
olivares reporting	Generate reports and manage schedules, branding and templates
olivares reporting branding	Read and set the tenant’s report branding (hidden)
olivares reporting branding get	Show the tenant’s report branding
olivares reporting branding set	Replace the tenant’s report branding
olivares reporting enterprise	Read the Business posture, risk and evidence-bundle reports (hidden)
olivares reporting enterprise bundle	Business evidence bundle
olivares reporting enterprise posture	Business governance posture report
olivares reporting enterprise risk	Business risk report
olivares reporting reports	List the report catalog and generate a report
olivares reporting reports get	Generate one report and write it to a file
olivares reporting reports ls	List the reports this build can generate
olivares reporting schedules	Manage scheduled reports and read their runs (hidden)
olivares reporting schedules create	Schedule a report on a cron cadence
olivares reporting schedules ls	List report schedules
olivares reporting schedules rm	Delete a report schedule
olivares reporting schedules run	Fetch one run’s stored report artifact
olivares reporting schedules runs	List a schedule’s executions
olivares reporting signing	Manage evidence bundle signing in the engine (hidden)
olivares reporting signing disable	Turn off evidence bundle signing
olivares reporting signing enable	Turn on evidence bundle signing
olivares reporting signing status	Show evidence bundle signing and its public key
olivares reporting templates	Read, store and remove custom report templates (hidden)
olivares reporting templates get	Fetch the custom template stored for one report type
olivares reporting templates rm	Remove the custom template for one report type
olivares reporting templates set	Store a custom HTML template for one report type
olivares sandbox	Run agents against synthetic scenarios and compare two variants
olivares sandbox compare	Run the same scenario as two variants and record the verdict
olivares sandbox comparisons	Inspect the append-only A/B comparison ledger
olivares sandbox comparisons get	Show one comparison
olivares sandbox comparisons ls	List recorded comparisons
olivares sandbox generate	Generate reproducible scenario inputs from a local template
olivares sandbox replay	Deterministically re-execute a recorded session against supplied mocks
olivares sandbox runs	Inspect sandbox runs, their outputs and their live stream
olivares sandbox runs get	Show one run
olivares sandbox runs ls	List sandbox runs
olivares sandbox runs outputs	List one run’s per-step outputs
olivares sandbox runs stream	Follow a live run as NDJSON (one object per event)
olivares sandbox scenarios	Author, inspect, run and archive sandbox scenarios
olivares sandbox scenarios archive	Archive a scenario (destructive; needs –yes when unattended)
olivares sandbox scenarios create	Author a scenario from JSON step and mock files
olivares sandbox scenarios get	Show one scenario with its steps and mocks
olivares sandbox scenarios ls	List the tenant’s scenarios
olivares sandbox scenarios run	Run a scenario against the isolated runner (synchronous)
olivares secrets	Manage the runtime secret store (sealed; referenced from configs as store:<name>)
olivares secrets ls	List stored secrets (names and non-secret hints; never the value)
olivares secrets put	Create or update a secret (seals the value at rest)
olivares secrets rm	Delete a secret (a reference to it then fails closed)
olivares secrets rotate	Replace a secret’s value (a new value is required)
olivares security	Security self-checks (advisory feed verification and affected-version reporting)
olivares security advisories	Build and sign an OSV advisory feed the product self-checks — PSIRT use (hidden)
olivares security check	Check a product version against a signed advisories feed
olivares security drill	Timed end-to-end PSIRT advisory-pipeline drill
olivares security rulepack	Author/verify signed hot-reload security rule-packs (deny-lists, MCP blocks, patterns)
olivares security rulepack sign	Build and sign a rule-pack from a draft (writes <out> + <out>.sig) (hidden)
olivares security rulepack verify	Verify a signed rule-pack against a trusted key and print its summary
olivares serve	Run the engine (REST + gRPC + embedded console), TLS-on-by-default
olivares session	Start, follow, send to, stop and resume agent sessions
olivares session archive	Archive a session, or unarchive it with –undo
olivares session done	Mark a session done in your list
olivares session events	Show a session’s lifecycle record (start, stop, failures)
olivares session follow	Show a session’s output as it happens
olivares session handoff	Continue a session in another tool or account as a new, linked session
olivares session interrupt	Cancel the current turn and keep the session running
olivares session ls	List sessions, pinned first, then newest first
olivares session messages	List, search and find messages of a session
olivares session move	Move a stopped session to another account of the same tool
olivares session peers	Choose which sessions a session may message
olivares session pin	Pin a session to the top of your list
olivares session rename	Rename a session
olivares session resume	Resume a stopped session
olivares session rm	Remove a stopped session
olivares session send	Send a message to a session and show the reply
olivares session show	Show one session
olivares session snooze	Hide a session from your list until a moment
olivares session start	Start an agent session in a folder, optionally with a first prompt
olivares session stop	Stop a session
olivares session unpin	Unpin a session
olivares setup	Guided, validated first-run configuration (profiles, Postgres onboarding, no SQL by hand)
olivares skills	Install and manage immutable skills in the catalog
olivares skills assign	Pin a catalog revision for new conversations
olivares skills assignments	List pinned bindings on an authorized target or of one pack
olivares skills diff	Show what changed between two revisions of a pack
olivares skills disable	Disable skills pinned to a workspace, profile, folder, template, group, agent or session
olivares skills enable	Enable skills on a workspace, profile, folder, template, group, agent or session
olivares skills get	Show catalog provenance and immutable revisions
olivares skills install	Publish a reviewed immutable catalog revision
olivares skills ls	List installed catalog packs
olivares skills pin	Move every pin of a pack to one revision (update or roll back)
olivares skills rm	Retire an unused catalog pack and retain its provenance
olivares skills selection	Show the skills a new session will get, before it starts
olivares skills unassign	Remove future inheritance; recorded conversations retain their snapshot
olivares skills update	Publish a reviewed immutable catalog revision
olivares sources	Manage the durable source roster (connectors the engine ingests from)
olivares sources get	Show one source’s definition, including the config ls cannot render
olivares sources ls	List the source roster (name, kind, tenant, mode, poll, enabled)
olivares sources plan	Show what a sources set with these flags WOULD change — no source is written or opened
olivares sources rm	Delete a source from the roster
olivares sources set	Create or update a source (only the flags you pass are changed on an existing source)
olivares sources test	Open the source for real to prove it answers, then close it — nothing is wired or written
olivares sources validate	Check a source definition is coherent by itself — offline, no network, no writes
olivares sourcescope	Decide which sources a workspace or agent may reach
olivares sourcescope assignments	Assign global connectors to workspaces
olivares sourcescope assignments create	Assign a connector to a workspace
olivares sourcescope assignments get	Show one assignment
olivares sourcescope assignments ls	List connector-to-workspace assignments
olivares sourcescope assignments rm	Delete an assignment
olivares sourcescope assignments set	Replace an assignment
olivares sourcescope bindings	Confine a source to a workspace or agent group
olivares sourcescope bindings create	Bind a source to a scope
olivares sourcescope bindings get	Show one binding
olivares sourcescope bindings ls	List source-to-scope bindings
olivares sourcescope bindings rm	Delete a binding
olivares sourcescope bindings set	Replace a binding
olivares sourcescope guard-postures	Read and set the retrieval guard posture
olivares sourcescope guard-postures ls	List explicit guard-posture overrides
olivares sourcescope guard-postures set	Set the guard posture of one source
olivares sourcescope posture-requests	Review the dual-control queue of proposed relaxations
olivares sourcescope posture-requests approve	Approve a pending relaxation and apply it
olivares sourcescope posture-requests get	Show one posture-change request
olivares sourcescope posture-requests ls	List posture-change requests
olivares sourcescope posture-requests reject	Reject a pending relaxation, changing nothing
olivares sourcescope resolve	Preview what one actor would resolve for one source
olivares sourcescope resources	Navigate the tenant’s resource tree
olivares sourcescope resources ls	List resources, by children or by subtree
olivares sourcescope sources	Source-wide posture operations
olivares sourcescope sources disable-scoping	Propose removing ALL scoping from a source
olivares sourcescope workspace-connectors	Manage connectors that belong to one workspace
olivares sourcescope workspace-connectors create	Declare a workspace connector
olivares sourcescope workspace-connectors get	Show one workspace connector
olivares sourcescope workspace-connectors ls	List workspace connectors
olivares sourcescope workspace-connectors rm	Delete a workspace connector
olivares sourcescope workspace-connectors set	Replace a workspace connector
olivares status	Show whether the engine is up and which parts are configured
olivares superadmin	Enable/disable internal superadmin accounts (never deletes)
olivares superadmin disable	Disable an internal superadmin (marks it inactive and revokes its sessions and tokens; never deletes)
olivares superadmin enable	Re-enable a previously disabled internal superadmin
olivares superadmin status	List internal superadmin accounts and their active/inactive status
olivares support	Collect redacted diagnostics for support and incident response
olivares support bundle	Build a redacted diagnostic tarball with an integrity manifest
olivares tenants	Organization management requires Enterprise (hidden)
olivares threatintel	Manage the AI threat-intel catalog and its signed catalog releases (Business) (hidden)
olivares threatintel apply	Verify and apply a signed catalog release (fail-closed, anti-rollback); persists it for the engine
olivares threatintel pull	Pull the catalog release from the configured endpoint, then verify and apply it (fail-closed)
olivares threatintel sign	Sign an unsigned catalog envelope (publisher side; key minted with olivares license keygen)
olivares threatintel status	Show the active catalog release (versions, expiry, channels) and the governance crosswalk summary
olivares threatintel verify	Verify a signed catalog release (signature + expiry + schema); does not apply it
olivares tokens	API tokens for scripts: issue, list, rotate, revoke
olivares tokens issue	Issue an API token and print its secret ONCE
olivares tokens ls	List the API tokens the caller may see
olivares tokens revoke	Revoke an API token
olivares tokens rotate	Rotate an API token: issue a replacement with the same spec and revoke the old one
olivares tool	Install and sign in the agent tools sessions run (Claude Code, Codex, Grok Build, OpenCode, Gemini CLI)
olivares tool install	Install an official or catalog-admitted tool on the engine’s host
olivares tool login	Sign an agent tool in with its own login (Claude, ChatGPT, xAI, Google or OpenCode account)
olivares tool ls	List the agent tools on the engine’s host and whether each is signed in
olivares tool pin	Select a session tool version for a workspace or agent
olivares tool providers	Show each tool’s own login: email, plan, usage windows and models
olivares tool pull	Download an Ollama or public Hugging Face GGUF model on the engine’s host
olivares tool rm	Remove an installed tool version when no session uses it
olivares tool start	Start Ollama, llama.cpp or vLLM on the engine’s host as the engine’s own service
olivares tool stop	Stop Ollama, llama.cpp or vLLM, the engine’s own service
olivares tool update	Update an agent tool from its verified official release
olivares ui	Open the interactive main menu on a terminal
olivares ui session	Follow, message, interrupt and stop one session on a terminal
olivares uninstall	Plan or remove a local installation without crossing its signed-release layout
olivares upgrade	Upgrade this binary in place to a newer signed release (verified, atomic, reversible)
olivares users	User accounts: list, create, disable, enable
olivares users create	Create a global user account (superadmin)
olivares users disable	Disable a superadmin account (reversible)
olivares users enable	Re-enable a disabled superadmin account
olivares users ls	List the global user accounts
olivares users superadmins	List the superadmin accounts and whether each is active
olivares users totp	Show an account’s TOTP second factor (non-secret)
olivares users totp-reset	Reset an account’s TOTP factor (destructive)
olivares vault	Your personal vault: logins, notes and authenticator codes only you can read back
olivares vault export	Write every item of your vault to a file, to move it or keep a copy
olivares vault generate	Print a random password
olivares vault get	Print one part of an item of your vault
olivares vault import	Add the items of another password manager’s export to your vault
olivares vault ls	List your vault items (names and kinds; never a value)
olivares vault put	Add or replace an item of your vault
olivares vault rm	Delete an item of your vault
olivares vault totp	Print the current authenticator code of an item
olivares version	Print the olivares version, build metadata and FIPS 140-3 mode
olivares voice	Inspect governed voice sessions and set the per-agent voice policy
olivares voice decisions	List the append-only voice decision ledger for the tenant
olivares voice policies	Read and replace the per-agent voice policy
olivares voice policies ls	List the voice policies in force
olivares voice policies set	Replace one agent’s voice policy (PUT — the whole policy)
olivares voice sessions	List, follow and open governed voice sessions
olivares voice sessions decisions	List one session’s governance decisions
olivares voice sessions get	Show one voice session
olivares voice sessions ls	List voice sessions with their derived state
olivares voice sessions open	Open a governed voice session through the approval gate (two-phase)
olivares voice sessions stream	Follow one live voice session as NDJSON (one object per event)
olivares webui-files	List the web UI assets embedded in this binary (diagnostic) (hidden)
olivares wiki	Initialize a folder wiki and run its ingest, query or lint skill
olivares wiki ingest	Run the wiki ingest skill in a governed session and return its ID
olivares wiki init	Create a wiki and assign its bundled skill without replacing files
olivares wiki lint	Run the wiki lint skill in a governed session and return its ID
olivares wiki query	Run the wiki query skill in a governed session and return its ID
olivares work	Manage durable cross-session work, leases, decisions, and acceptance
olivares work apply	Apply one validated work command idempotently
olivares work get	Get one durable work item, decision, or lease
olivares work list	List durable work items, decisions, or leases with keyset pagination
olivares work plan	Plan one work command and its expected durable effects without writing
olivares work protocol-binding	Compose and reconcile durable A2A and MCP protocol bindings
olivares work protocol-binding binding	Inspect and reconcile durable protocol bindings
olivares work protocol-binding binding get	Get one durable protocol binding generation
olivares work protocol-binding binding list	List durable protocol bindings in one workspace
olivares work protocol-binding binding reconcile	Validate, plan, test, or apply one exact-generation remote observation
olivares work protocol-binding spec	Manage immutable protocol binding specifications
olivares work protocol-binding spec activate	Activate one protocol binding spec generation
olivares work protocol-binding spec create	Validate, plan, or create one draft protocol binding spec
olivares work protocol-binding spec disable	Disable one protocol binding spec generation
olivares work protocol-binding spec get	Get one immutable protocol binding spec generation
olivares work protocol-binding spec list	List protocol binding spec generations in one workspace
olivares work replay	Replay a dead-lettered durable work event
olivares work replay event	Requeue one dead-lettered WorkEvent under its stable event ID
olivares work validate	Validate one work command without writing
olivares work watch	Watch the durable work-event stream from a resumable cursor
olivares workspaces	Workspaces: list, show
olivares workspaces get	Show one workspace and what it holds
olivares workspaces ls	List the workspaces of the tenant

Command detail

Command: olivares

Olivares AI — self-hosted engine for enterprise AI

olivares

Flag	Type	Default	Description
-o, --output	string	text	inherited. global output format: text or json (report commands keep json unless -o is given)

Command: olivares __extract

Hidden diagnostic: it does not appear in --help output and is not part of the supported surface.

internal: extract text from a rich document on stdin (sandboxed re-exec target)

olivares __extract

Flag	Type	Default	Description
--kind	string	—	rich-document kind (ooxml)

Command: olivares accessmap

Query the access graph, least-privilege drift and attack paths

olivares accessmap

Aliases: access-map

Flag	Type	Default	Description
--allow-cleartext	bool	false	inherited, hidden. allow sending the credential to a non-loopback host over plain HTTP (DANGEROUS: it travels readable)
--ca-cert	string	—	inherited, hidden. PEM file containing an additional trusted root CA (default: current context)
--insecure	bool	false	inherited, hidden. skip TLS certificate verification (DANGEROUS; development only)
--pin-sha256	stringArray	[]	inherited, hidden. trusted leaf SPKI SHA-256 pin, base64 or hex, repeatable — the engine prints it as pin_sha256 on the line reporting its certificate (default: current context)
--server	string	—	inherited, hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	inherited, hidden. tenant id (default $OLIVARES_TENANT, then current context)
--timeout	duration	10s	inherited, hidden. request timeout
--token	string	—	inherited, hidden. API bearer token (prefer –token-file: this form is visible in the process table and in shell history; default $OLIVARES_TOKEN, then current context)
--token-file	string	—	inherited, hidden. read the API bearer token from a file, or - for stdin

Command: olivares accessmap attack-paths

Reachability, privilege-escalation and exfiltration analyses

olivares accessmap attack-paths

Aliases: attackpaths

Declares no flags of its own; it takes those of olivares accessmap and the root command.

Command: olivares accessmap attack-paths escalation

List the privilege-escalation chains open to one agent

olivares accessmap attack-paths escalation

Flag	Type	Default	Description
--agent-id	string	—	the agent to analyze (required)

Command: olivares accessmap attack-paths exfil

List the exfiltration routes out of one resource

olivares accessmap attack-paths exfil

Flag	Type	Default	Description
--resource-id	string	—	the resource to analyze (required)

Command: olivares accessmap attack-paths reachability

List the resources one agent can reach

olivares accessmap attack-paths reachability

Flag	Type	Default	Description
--agent-id	string	—	the agent to analyze (required)

Command: olivares accessmap attack-paths summary

Show the estate-wide attack-surface counts

olivares accessmap attack-paths summary

Declares no flags of its own; it takes those of olivares accessmap attack-paths and the root command.

Command: olivares accessmap drift

Show permitted-vs-observed least-privilege drift

olivares accessmap drift

Flag	Type	Default	Description
--confidence	string	—	filter by attribution confidence
--cursor	string	—	hidden, deprecated: drift reconciles the whole window, so the engine reads no paging; the flag has no effect. continue from the cursor printed by the previous page
--limit	int	0	hidden, deprecated: drift reconciles the whole window, so the engine reads no paging; the flag has no effect. maximum rows to return in one page (left out: the engine’s default)
--mode	string	—	filter by access mode (read, write, readwrite, unknown); r, w and rw are accepted aliases
--origin-id	string	—	filter by origin id
--origin-kind	string	—	filter by origin kind (agent, session, identity)
--resource-id	string	—	filter by resource id
--signal-source	string	—	filter by the signal that produced the edge

Command: olivares accessmap graph

List the access graph as nodes and edges

olivares accessmap graph

Flag	Type	Default	Description
--confidence	string	—	filter by attribution confidence
--cursor	string	—	continue from the cursor printed by the previous page
--limit	int	0	maximum rows to return in one page (left out: the engine’s default)
--mode	string	—	filter by access mode (read, write, readwrite, unknown); r, w and rw are accepted aliases
--origin-id	string	—	filter by origin id
--origin-kind	string	—	filter by origin kind (agent, session, identity)
--resource-id	string	—	filter by resource id
--signal-source	string	—	filter by the signal that produced the edge

Command: olivares accessmap neighbors

List the edges touching one node

olivares accessmap neighbors

Flag	Type	Default	Description
--direction	string	—	outgoing, incoming or both (default both)
--id	string	—	node id to expand (required)
--kind	string	—	node kind, when the id alone is ambiguous

Command: olivares account

Manage your own account

olivares account

Flag	Type	Default	Description
--allow-cleartext	bool	false	inherited, hidden. allow sending the credential to a non-loopback host over plain HTTP (DANGEROUS: it travels readable)
--ca-cert	string	—	inherited, hidden. PEM file containing an additional trusted root CA (default: current context)
--insecure	bool	false	inherited, hidden. skip TLS certificate verification (DANGEROUS; development only)
--pin-sha256	stringArray	[]	inherited, hidden. trusted leaf SPKI SHA-256 pin, base64 or hex, repeatable — the engine prints it as pin_sha256 on the line reporting its certificate (default: current context)
--server	string	—	inherited, hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	inherited, hidden. tenant id (default $OLIVARES_TENANT, then current context)
--timeout	duration	10s	inherited, hidden. request timeout
--token	string	—	inherited, hidden. API bearer token (prefer –token-file: this form is visible in the process table and in shell history; default $OLIVARES_TOKEN, then current context)
--token-file	string	—	inherited, hidden. read the API bearer token from a file, or - for stdin

Command: olivares account password

Change your own password and sign out your other sessions

olivares account password

Flag	Type	Default	Description
--current-password-file	string	—	read your current password from a file, or - for stdin
--password-file	string	—	read your new password from a file, or - for stdin

Command: olivares admin

Host-local repairs: give a person who lost their only passkey a way back

olivares admin

Flag	Type	Default	Description
--format	string	text	inherited. deprecated alias for -o/–output on this command (text or json) — NOT the export-format flag of ‘audit export’ / ‘findings export’

Command: olivares admin recover

Remove a person’s passkeys and end their sessions so they can add a new passkey

olivares admin recover

Flag	Type	Default	Description
--actor	string	—	REQUIRED: who is performing this privileged operation (an operator or service identity; recorded in the audit ledger)
--data-dir	string	—	data directory (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--dsn	string	—	store DSN (default a SQLite file in the data dir)
--email	string	—	REQUIRED: the email of the person who lost their passkey
--engine	string	sqlite	store engine: sqlite or postgres
--reason	string	—	REQUIRED: why this privileged operation is being performed (recorded in the audit ledger)
--yes	bool	false	confirm removing that person’s passkeys and ending their sessions

Command: olivares adoption

Report Claude adoption by org, team, trend and developer

olivares adoption

Flag	Type	Default	Description
--allow-cleartext	bool	false	inherited, hidden. allow sending the credential to a non-loopback host over plain HTTP (DANGEROUS: it travels readable)
--ca-cert	string	—	inherited, hidden. PEM file containing an additional trusted root CA (default: current context)
--insecure	bool	false	inherited, hidden. skip TLS certificate verification (DANGEROUS; development only)
--pin-sha256	stringArray	[]	inherited, hidden. trusted leaf SPKI SHA-256 pin, base64 or hex, repeatable — the engine prints it as pin_sha256 on the line reporting its certificate (default: current context)
--server	string	—	inherited, hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	inherited, hidden. tenant id (default $OLIVARES_TENANT, then current context)
--timeout	duration	10s	inherited, hidden. request timeout
--token	string	—	inherited, hidden. API bearer token (prefer –token-file: this form is visible in the process table and in shell history; default $OLIVARES_TOKEN, then current context)
--token-file	string	—	inherited, hidden. read the API bearer token from a file, or - for stdin

Command: olivares adoption developers

Break adoption down by developer (privileged: exposes identity)

olivares adoption developers

Flag	Type	Default	Description
--limit	int	0	top-N rows (left out: the engine’s default of 100 for this route). NOT a page size: this namespace has no cursor
--since	string	—	window start, RFC3339 (default: the engine’s window)
--until	string	—	window end, RFC3339 (default: now)

Command: olivares adoption discrepancy

Measure how far the two lenses disagree

olivares adoption discrepancy

Aliases: discrepancies

Flag	Type	Default	Description
--since	string	—	window start, RFC3339 (default: the engine’s window)
--until	string	—	window end, RFC3339 (default: now)

Command: olivares adoption summary

Show both adoption lenses over one window

olivares adoption summary

Flag	Type	Default	Description
--limit	int	0	top-N rows (left out: the engine’s default of 10 for this route). NOT a page size: this namespace has no cursor
--since	string	—	window start, RFC3339 (default: the engine’s window)
--until	string	—	window end, RFC3339 (default: now)

Command: olivares adoption teams

Break adoption down by team

olivares adoption teams

Flag	Type	Default	Description
--since	string	—	window start, RFC3339 (default: the engine’s window)
--until	string	—	window end, RFC3339 (default: now)

Command: olivares adoption trend

Show a per-day series for ONE lens

olivares adoption trend

Flag	Type	Default	Description
--lens	string	—	analytics or telemetry (default analytics)
--since	string	—	window start, RFC3339 (default: the engine’s window)
--until	string	—	window end, RFC3339 (default: now)

Command: olivares agent

Expert settings behind sessions: profiles, registered folders, managed settings

olivares agent

Declares no flags of its own; it takes those of olivares and the root command.

Command: olivares agent deploy

Find an official CLI on this host and register the profile a session launches under

olivares agent deploy <claude|codex|grok|opencode>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--config-home	string	—	the CLI’s configuration home (default: the engine makes and keeps it)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--install	bool	false	install the official CLI from its signed release when none is found
--name	string	—	label for the profile (default: the driver’s name)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--provider	string	—	registered provider to bind; without it the host’s own credential variables decide
--root	string	—	absolute directory that owns installed tools (default <data-dir>/tools, with data-dir from $OLIVARES_DATA_DIR or the installation default)
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin
--user-home	string	—	the child’s user home (default: the engine makes and keeps it; with –config-home, $HOME)
--yes	bool	false	with –install, approve the installation plan without a second prompt

Command: olivares agent managed-settings

Render the Claude Code managed-settings.json that governs operated sessions (PEP hook)

olivares agent managed-settings

Flag	Type	Default	Description
--gateway-base-url	string	—	managed ANTHROPIC_BASE_URL pin for the governed Olivares inference gateway
--matcher	string	—	tool-name matcher for the PEP hook (“” = all tools)
--no-hook	bool	false	render env/telemetry only, no PEP hook
--otel-endpoint	string	—	managed OTEL collector endpoint (enables the sanctioned telemetry env)
--out	string	-	output path (‘-’ = stdout)
--pep-command	string	olivares claude-hook	the managed PEP-client command (explicit custom commands are preserved)
--pin-hook-events	bool	false	pin each hook’s event; for longer approvals use –pep-command ‘olivares claude-hook –timeout 120s’ –timeout 180
--redact	bool	true	also install the paired PostToolUse output-redaction hook
--timeout	int	5	outer hook timeout in seconds (explicit: published 5s client shortened if needed)

Command: olivares agent profile

Register and inspect provider profiles (which home an official CLI runs under)

olivares agent profile

Declares no flags of its own; it takes those of olivares agent and the root command.

Command: olivares agent profile create

Register a provider profile for homes that already exist on this node

olivares agent profile create

Flag	Type	Default	Description
--auth-source	string	—	provider_account_home (the login saved in the homes) or managed_injection (a credential the engine supplies)
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--config-home	string	—	required. absolute path of the CLI’s configuration home on the engine host
--driver	string	—	required. official CLI this profile launches: claude, codex, grok or opencode
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--json	bool	false	hidden. deprecated alias for -o json
--name	string	—	your own label for this profile
--permission-mode	string	—	permission mode those sessions run under: default | acceptEdits | plan | auto | dontAsk | bypassPermissions
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--provider	string	—	registered provider reference to bind in the same call (needs –auth-source managed_injection)
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin
--tools	stringSlice	[]	the built-in tools sessions under this profile may use (repeatable or comma-separated; –tools “” declares NONE). Undeclared launches the tool’s default set
--user-home	string	—	required. absolute path of the child’s user home on the engine host

Command: olivares agent profile get

Show one provider profile

olivares agent profile get <profile-ref>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--json	bool	false	hidden. deprecated alias for -o json
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares agent profile ls

List the provider profiles this tenant has registered

olivares agent profile ls

Aliases: list

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--json	bool	false	hidden. deprecated alias for -o json
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--state	string	—	only profiles in this state (active, disabled or retired)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares agent profile rm

Retire a provider profile for good

olivares agent profile rm <profile-ref>

Aliases: retire

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--json	bool	false	hidden. deprecated alias for -o json
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin
--yes	bool	false	confirm the irreversible retirement

Command: olivares agent profile update

Change a profile’s label, state, authorization or session policy

olivares agent profile update <profile-ref>

Flag	Type	Default	Description
--auth-source	string	—	provider_account_home, managed_injection, or “” to withdraw the authorization
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--egress-host	stringSlice	[]	a host those sessions may reach beside their provider, such as github.com (repeatable or comma-separated; –egress-host “” withdraws them all; needs tenant administration)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--json	bool	false	hidden. deprecated alias for -o json
--name	string	—	your own label for this profile
--npm-registry	stringArray	[]	an npm registry those sessions install from: url=<https URL>[,scope=@name][,secret=env/<vault secret>] (repeatable; –npm-registry “” withdraws them all)
--permission-mode	string	—	permission mode those sessions run under, or “” to withdraw the declaration
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--program	stringSlice	[]	an installed program put first on those sessions’ PATH (repeatable; –program “” withdraws them all)
--provider	string	—	registered provider reference this profile’s managed launches use
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--state	string	—	active or disabled (a disabled profile refuses new launches; running children keep theirs)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin
--tools	stringSlice	[]	the built-in tools sessions under this profile may use (repeatable or comma-separated; –tools “” declares NONE)
--unbind-provider	bool	false	clear the bound provider record only (the auth source stays; provider bind –unbind also returns the profile to the tool’s own sign-in)

Command: olivares agent session

Hidden diagnostic: it does not appear in --help output and is not part of the supported surface.

Manage the lifecycle of governed provider sessions

olivares agent session

Declares no flags of its own; it takes those of olivares agent and the root command.

Command: olivares agent session attach

Stream a live session’s I/O (server-sent events) to stdout

olivares agent session attach <run-ref>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--from	int64	0	replay from this output sequence number
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares agent session cleanup

Release a stopped session (mark cleaned)

olivares agent session cleanup <run-ref>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares agent session create

Launch a governed Claude Code session

olivares agent session create

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--effort	string	—	low|medium|high|xhigh|max
--env-allow	stringSlice	[]	host env var NAMES to forward to the session (allowlist; nothing else is inherited)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--isolation	string	native	native (a governed host process) | container (podman or Docker on this server) | sandbox — a value the node cannot run is refused before launch with HTTP 422
--json	bool	false	hidden. deprecated alias for -o json
--model	string	—	model alias (opus) or id (claude-opus-4-8)
--name	string	—	display name for the session
--permission-mode	string	default	default|acceptEdits|plan|auto|dontAsk|bypassPermissions
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--provider-profile	string	—	provider profile reference to launch under (default: the profile the engine resolves for Claude Code, for a caller who may write profiles)
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin
--transport	string	stream-json	transport: stream-json (governed) | remote-control (lifecycle-only)
--workspace	string	—	workspace reference (the session’s working directory)

Command: olivares agent session events

Show a session’s lifecycle ledger

olivares agent session events <run-ref>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares agent session get

Show one session

olivares agent session get <run-ref>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares agent session input

Send one line or driver text to a live session

olivares agent session input <run-ref>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--line	string	—	raw NDJSON line (empty or ‘-’ reads stdin; mutually exclusive with –text)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--text	string	—	driver text (use ‘-’ to read stdin; mutually exclusive with –line)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin
--work-lease-fence	int64	0	positive work-lease fence; omitted from the request when unset

Command: olivares agent session interrupt

Cancel the active provider turn without stopping the session

olivares agent session interrupt <run-ref>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin
--work-lease-fence	int64	0	positive work-lease fence; omitted from the request when unset

Command: olivares agent session ls

List operated sessions

olivares agent session ls

Aliases: list

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--json	bool	false	hidden. deprecated alias for -o json
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--state	string	—	filter by state (pending|running|idle|stopped|failed|cleaned)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares agent session resume

Resume a stopped session

olivares agent session resume <run-ref>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares agent session rm

Delete a cleaned session’s record

olivares agent session rm <run-ref>

Aliases: delete, remove

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares agent session stop

Stop a running session

olivares agent session stop <run-ref>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares agent tool

Install and inventory official provider CLIs (Claude Code, Codex, Grok Build)

olivares agent tool

Declares no flags of its own; it takes those of olivares agent and the root command.

Command: olivares agent tool detect

Report provider CLI executables on this host: managed releases, vendor default paths and PATH

olivares agent tool detect

Flag	Type	Default	Description
--driver	string	claude	provider tool to look for
--manifest	string	—	a vendor release manifest to corroborate candidates against (verified with –manifest-sig under the pinned key)
--manifest-sig	string	—	the detached OpenPGP signature of –manifest
--probe	bool	false	run ‘–version’ for registered and manifest-corroborated candidates only, from an empty temporary home (an observed path is not permission to run it)
--probe-path	stringArray	[]	exact absolute path of one candidate to run ‘–version’ on (repeatable); required for unregistered-observed paths; damaged releases are never run
--root	string	—	absolute directory that owns installed tools (default <data-dir>/tools, with data-dir from $OLIVARES_DATA_DIR or the installation default)

Command: olivares agent tool install

Verify, download, probe and place one signed release of a provider CLI

olivares agent tool install

Flag	Type	Default	Description
--driver	string	claude	provider tool to install: claude, codex, grok, opencode, gemini-cli or ollama
--plan	string	—	execute this plan file written by ‘plan –out’; it is the approval, so no prompt is shown
--platform	string	—	target platform key: linux-x64, linux-arm64, linux-x64-musl, linux-arm64-musl (default: this host)
--root	string	—	absolute directory that owns installed tools (default <data-dir>/tools, with data-dir from $OLIVARES_DATA_DIR or the installation default)
--source	string	—	http(s) base URL of a mirror carrying the vendor’s release layout (default: the official origin); the pinned signing key is required either way
--version	string	latest	exact version (X.Y.Z) or the vendor pointer latest or stable
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares agent tool list

List installed provider CLI releases under the tools root and re-check their bytes

olivares agent tool list

Aliases: ls

Flag	Type	Default	Description
--root	string	—	absolute directory that owns installed tools (default <data-dir>/tools, with data-dir from $OLIVARES_DATA_DIR or the installation default)

Command: olivares agent tool plan

Resolve and verify what install would fetch and where it would place it, without changing anything

olivares agent tool plan

Flag	Type	Default	Description
--driver	string	claude	provider tool to install: claude, codex, grok, opencode, gemini-cli or ollama
--out	string	—	write the plan JSON (with its digest) to this new file for a later ‘install –plan’
--platform	string	—	target platform key: linux-x64, linux-arm64, linux-x64-musl, linux-arm64-musl (default: this host)
--root	string	—	absolute directory that owns installed tools (default <data-dir>/tools, with data-dir from $OLIVARES_DATA_DIR or the installation default)
--source	string	—	http(s) base URL of a mirror carrying the vendor’s release layout (default: the official origin); the pinned signing key is required either way
--version	string	latest	exact version (X.Y.Z) or the vendor pointer latest or stable

Command: olivares agent workspace

Manage governed workspaces and their files (browse/read/write/move/delete)

olivares agent workspace [ref]

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--read-only-folder	stringArray	[]	additional server folder for native sessions (repeatable; replaces the list; empty clears it)
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares agent workspace add

Register a host directory as a governed workspace

olivares agent workspace add <root-path>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--dlp	string	label	DLP posture on reads: label|deny|off
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--json	bool	false	hidden. deprecated alias for -o json
--max-read	int64	0	per-read size cap in bytes (0 = default 5 MiB)
--mode	string	rw	mount mode: rw|ro|write_no_delete (write_no_delete: sessions create and change files but cannot delete, rename or move them)
--name	string	—	display name
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--subpath	stringSlice	[]	restrict the file API to these relative subpaths (repeatable)
--target	string	/workspace	container mount target path
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares agent workspace approve-project-config

Approve the SHA-256 of the exact project agent configuration you reviewed

olivares agent workspace approve-project-config <ref>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--sha256	string	—	required. SHA-256 of the exact configuration reviewed (shown by workspace project-config)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares agent workspace approve-setup

Approve the SHA-256 of the exact setup command you reviewed

olivares agent workspace approve-setup <ref>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--sha256	string	—	required. SHA-256 of the exact command text reviewed (shown by workspace setup)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares agent workspace files

List one directory level in a workspace

olivares agent workspace files <ref>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--json	bool	false	hidden. deprecated alias for -o json
--path	string	—	relative directory path (default: workspace root)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares agent workspace get

Read a file’s content to stdout (DLP-governed)

olivares agent workspace get <ref> <path>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares agent workspace ls

List registered workspaces

olivares agent workspace ls

Aliases: list

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--json	bool	false	hidden. deprecated alias for -o json
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares agent workspace mkdir

Create a directory (and parents)

olivares agent workspace mkdir <ref> <path>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares agent workspace mv

Move/rename a path within the workspace

olivares agent workspace mv <ref> <from> <to>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares agent workspace project-config

List the folder’s repo-resident agent configuration that runs programs or redirects traffic

olivares agent workspace project-config <ref>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares agent workspace put

Write a file from –from (a local file or ‘-’ for stdin)

olivares agent workspace put <ref> <path>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--from	string	-	source: a local file path, or ‘-’ for stdin
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares agent workspace rm

Delete a file or (with –recursive) a directory subtree

olivares agent workspace rm <ref> <path>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--recursive	bool	false	delete a directory and its contents
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares agent workspace rm-workspace

Deregister a workspace (does NOT delete host files)

olivares agent workspace rm-workspace <ref>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares agent workspace setup

Read or store a folder’s setup command (empty –command clears it)

olivares agent workspace setup <ref>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--command	string	—	store this exact setup command; does not approve or execute it
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares agent workspace stat

Show metadata for one path

olivares agent workspace stat <ref> <path>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares audit

See recent events; verify, checkpoint and export the audit ledger

olivares audit

Declares no flags of its own; it takes those of olivares and the root command.

Command: olivares audit archive

Export and verify the immutable ledger archive

olivares audit archive

Declares no flags of its own; it takes those of olivares audit and the root command.

Command: olivares audit archive export

Export a tenant’s ledger as verifiable archive segments to a directory

olivares audit archive export

Flag	Type	Default	Description
--data-dir	string	—	data directory (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--dsn	string	—	store DSN (default a SQLite file in the data dir)
--engine	string	sqlite	store engine: sqlite or postgres
--from-seq	int64	1	first sequence number to export (resume an earlier export at its last to_seq+1)
--out	string	—	required. output directory (files are written read-only; WORM when the substrate is)
--segment-events	int	10000	maximum events per segment
--tenant	string	—	tenant id to export (default $OLIVARES_TENANT)

Command: olivares audit archive verify

Verify an exported archive directory offline (no store, no network)

olivares audit archive verify

Flag	Type	Default	Description
--dir	string	—	required. archive directory to verify (the export’s –out)
--event-pubkey	stringArray	[]	per-event Ed25519 public key pin, repeatable (raw base64), optionally epoch-FENCED as “<base64>@<last_seq>” (retired generation, valid only up to that sequence) or “<base64>@<lo>:<hi>” (explicit window); a bare key is the current generation. Pins REPLACE the archive’s advisory keys.json — pin EVERY generation with its boundary (the audit.key.rotation marker’s prior_last_seq) for the attacker-resistant fenced check; without a boundary a retired key is trusted for every sequence
--pubkey	stringArray	[]	checkpoint public key pin, repeatable: raw base64 Ed25519, or “<alg>:<base64 DER SPKI>” for an off-box key. Pins REPLACE the archive’s advisory keys.json (docs/SECURITY-HARDENING.md §5)
--pubkey-alg	string	—	algorithm of a SINGLE bare –pubkey (compat form, as in ‘audit verify’)
--strict	bool	false	exit non-zero if the archive fails to verify; for on-call cron/CI. The default exits 0 and reports status only in the JSON

Command: olivares audit checkpoint

Write a signed checkpoint (all tenants, or one with –tenant)

olivares audit checkpoint

Flag	Type	Default	Description
--data-dir	string	—	data directory (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--dsn	string	—	store DSN (default a SQLite file in the data dir)
--engine	string	sqlite	store engine: sqlite or postgres
--tenant	string	—	tenant id (empty = all tenants)

Command: olivares audit export

Export a tenant’s ledger to a SIEM format (cef|leef|syslog|otlp|otlp_envelope|otlp_log_record|ocsf)

olivares audit export

Flag	Type	Default	Description
--data-dir	string	—	data directory (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--dsn	string	—	store DSN (default a SQLite file in the data dir)
--engine	string	sqlite	store engine: sqlite or postgres
--format	string	cef	export format: cef|leef|syslog|otlp|otlp_envelope|otlp_log_record|ocsf (this selects the SIEM export format and is fully supported — it is not the deprecated -o/–output alias other commands spell the same way)
--tenant	string	—	tenant id to export (default $OLIVARES_TENANT)

Command: olivares audit key-transition

Hidden diagnostic: it does not appear in --help output and is not part of the supported surface.

Record the off-box-signed signing-key epoch boundary after keys rotate

olivares audit key-transition

Flag	Type	Default	Description
--admin-dsn	string	—	Postgres only: DSN of the dedicated NOSUPERUSER BYPASSRLS role used for the cross-tenant org enumeration. Without it the default (every tenant) sweep CANNOT enumerate the estate and this command fails closed rather than fencing a short list; –tenant needs no enumeration and so needs no admin pool
--data-dir	string	—	data directory (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--dsn	string	—	store DSN (default a SQLite file in the data dir)
--engine	string	sqlite	store engine: sqlite or postgres
--prior-pubkey	string	—	retired key (raw base64 Ed25519); default: the most recent prior generation in the sealed envelope
--tenant	string	—	record only this tenant’s boundary (default: every tenant + the system chain)
--yes	bool	false	skip the confirmation prompt

Command: olivares audit ls

Show the most recent audit events, newest first

olivares audit ls

Aliases: list, recent

Flag	Type	Default	Description
--all	bool	false	include the ledger’s own read events (audit.read)
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--limit	int	20	how many events (1 to 200)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--system	bool	false	the system ledger (installs, sign-ins, deployment-wide actions)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares audit observe-report

Summarize constrained-observe shadows for an observe→enforce promotion decision

olivares audit observe-report

Flag	Type	Default	Description
--data-dir	string	—	data directory (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--dsn	string	—	store DSN (default a SQLite file in the data dir)
--engine	string	sqlite	store engine: sqlite or postgres
--from	int64	1	first ledger sequence to include (a recovered epoch begins at its recover_seq)
--json	bool	false	emit the report as JSON instead of a human summary
--strict	bool	false	exit non-zero if the report is INCOMPLETE (chain break, declared gap, or malformed rows) — use to gate an observe→enforce promotion in CI
--tenant	string	—	tenant id to report on (default $OLIVARES_TENANT)

Command: olivares audit recover

Seal a corrupt audit tail and start a governed recovery epoch

olivares audit recover

Flag	Type	Default	Description
--archive-dir	string	—	optional off-box archive directory that must verify and cover the trusted prefix
--data-dir	string	—	data directory (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--dry-run	bool	true	run every deny-closed check and print the plan without appending the recovery marker
--dsn	string	—	store DSN (default a SQLite file in the data dir)
--engine	string	sqlite	store engine: sqlite or postgres
--pubkey	stringArray	[]	required. required pinned off-box checkpoint public key, repeatable: raw base64 Ed25519 or “<alg>:<base64 DER SPKI>”
--pubkey-alg	string	—	algorithm of a SINGLE bare –pubkey (compat form, as in ‘audit verify’)
--reason	string	—	operator reason recorded in the signed recovery evidence
--requested-by	string	—	non-secret requester identity recorded in the signed recovery evidence
--tenant	string	—	tenant id whose corrupt audit tail will be sealed (default $OLIVARES_TENANT)

Command: olivares audit tree

Publish and verify C2SP Merkle checkpoints of the audit ledger

olivares audit tree

Declares no flags of its own; it takes those of olivares audit and the root command.

Command: olivares audit tree checkpoint

Print the signed C2SP checkpoint of a tenant’s Merkle tree

olivares audit tree checkpoint

Flag	Type	Default	Description
--data-dir	string	—	data directory (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--dsn	string	—	store DSN (default a SQLite file in the data dir)
--engine	string	sqlite	store engine: sqlite or postgres
--owner-dsn	string	—	Postgres: the owner role, required in a split-role deployment (the app role has no schema CREATE)
--tenant	string	—	tenant id

Command: olivares audit tree prove

Prove one event is inside a saved checkpoint (JSON proof on standard output)

olivares audit tree prove

Flag	Type	Default	Description
--checkpoint	string	—	saved checkpoint file (- for stdin)
--data-dir	string	—	data directory (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--dsn	string	—	store DSN (default a SQLite file in the data dir)
--engine	string	sqlite	store engine: sqlite or postgres
--owner-dsn	string	—	PostgreSQL owner DSN, when the application role cannot read the ledger
--pubkey	string	—	base64 Ed25519 public key that signed the checkpoint
--seq	int64	0	audit sequence number of the event
--tenant	string	—	tenant id

Command: olivares audit tree verify

Verify a saved checkpoint, offline, against the ledger or an inclusion proof

olivares audit tree verify

Flag	Type	Default	Description
--checkpoint	string	—	saved checkpoint file (- for stdin)
--data-dir	string	—	data directory (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--dsn	string	—	store DSN (default a SQLite file in the data dir)
--engine	string	sqlite	store engine: sqlite or postgres
--owner-dsn	string	—	PostgreSQL owner DSN, when the application role cannot read the ledger
--proof	string	—	inclusion proof file from ‘tree prove’ (offline; no ledger is read)
--pubkey	string	—	base64 Ed25519 public key that signed the checkpoint
--tenant	string	—	tenant id

Command: olivares audit verify

Verify a tenant’s chain and its signed checkpoints

olivares audit verify

Flag	Type	Default	Description
--data-dir	string	—	data directory (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--dsn	string	—	store DSN (default a SQLite file in the data dir)
--engine	string	sqlite	store engine: sqlite or postgres
--event-pubkey	stringArray	[]	per-event Ed25519 public key pin, repeatable (raw base64), optionally epoch-FENCED as “<base64>@<last_seq>” (retired generation, valid only up to that sequence) or “<base64>@<lo>:<hi>” (explicit window); a bare key is the current key. Pins REPLACE the advisory defaults — pin EVERY generation with its boundary (‘keys status’ lists prior_public_keys; the boundary is the audit.key.rotation marker’s prior_last_seq). Without a boundary a retired key is trusted for every sequence
--from	int64	1	first sequence of the structural walk (a recovered epoch begins at its recover_seq; genesis remains the default)
--owner-dsn	string	—	Postgres owner-role DSN for topology verification (accepts file:/env: references; never runs DDL)
--pubkey	stringArray	[]	checkpoint public key pin, repeatable (key rotation): raw base64 Ed25519, or “<alg>:<base64 DER SPKI>” for an off-box key (default: the engine’s own keys — advisory only; pin OFF-BOX keys for an attacker-resistant check, docs/SECURITY-HARDENING.md §5)
--pubkey-alg	string	—	algorithm of a SINGLE bare –pubkey (compat form): ed25519 (raw, default) | ecdsa-p256-sha256 | ecdsa-p384-sha384 | rsa-pkcs1-sha256 | rsa-pss-sha256 (DER SubjectPublicKeyInfo); with multiple –pubkey use the “<alg>:<base64>” form
--strict	bool	false	exit non-zero if any integrity check fails (chain/checkpoints/event_sigs); for on-call cron/CI. The default exits 0 and reports status only in the JSON
--tenant	string	—	tenant id to verify (default $OLIVARES_TENANT)

Command: olivares auth

Sign-in details: status, saved contexts, first-boot setup

olivares auth

Declares no flags of its own; it takes those of olivares and the root command.

Command: olivares auth bootstrap

Redeem the one-time first-boot token: create the first organization and superadmin

olivares auth bootstrap

Flag	Type	Default	Description
--allow-cleartext	bool	false	hidden. allow sending the credential to a non-loopback host over plain HTTP (DANGEROUS: it travels readable)
--ca-cert	string	—	hidden. PEM file containing an additional trusted root CA (default: current context)
--context	string	—	context name to create or update with –save-context (default: server hostname)
--email	string	—	email address of the first superadmin (required)
--insecure	bool	false	hidden. skip TLS certificate verification (DANGEROUS; development only)
--organization	string	—	name of the first organization (default: “Default Organization”)
--password	string	—	password of the first superadmin (prefer –password-file)
--password-file	string	—	read the first superadmin’s password from a file, or - for stdin
--pin-sha256	stringArray	[]	hidden. trusted leaf SPKI SHA-256 pin, base64 or hex, repeatable — the engine prints it as pin_sha256 on the line reporting its certificate (default: current context)
--save-context	bool	false	log in as the new superadmin and save the session in a client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--setup-token	string	—	the one-time first-boot token (prefer –setup-token-file: this form is visible in the process table)
--setup-token-file	string	—	read the one-time first-boot token from a file, or - for stdin
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT, then current context)
--timeout	duration	10s	hidden. request timeout
--token	string	—	hidden. API bearer token (prefer –token-file: this form is visible in the process table and in shell history; default $OLIVARES_TOKEN, then current context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares auth login

Sign in to an engine and keep the sign-in for the next commands

olivares auth login

Flag	Type	Default	Description
--allow-cleartext	bool	false	allow sending the credential to a non-loopback host over plain HTTP (DANGEROUS: it travels readable)
--ca-cert	string	—	PEM file containing an additional trusted root CA (default: current context)
--context	string	—	context name to create or update (default: server hostname)
--email	string	—	sign in with this account’s password instead of a bearer token
--insecure	bool	false	skip TLS certificate verification (DANGEROUS; development only)
--password	string	—	password for –email (prefer –password-file: this form is visible in the process table)
--password-file	string	—	read the password for –email from a file, or - for stdin
--pin-sha256	stringArray	[]	trusted leaf SPKI SHA-256 pin, base64 or hex, repeatable — the engine prints it as pin_sha256 on the line reporting its certificate (default: current context)
--server	string	—	the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	tenant id (default $OLIVARES_TENANT, then current context)
--timeout	duration	10s	request timeout
--token	string	—	hidden. API bearer token (prefer –token-file: this form is visible in the process table and in shell history; default $OLIVARES_TOKEN, then current context)
--token-file	string	—	read the API bearer token from a file, or - for stdin

Command: olivares auth logout

Sign out: remove the saved sign-in from this computer

olivares auth logout

Flag	Type	Default	Description
--context	string	—	context to log out (default: current context)
--purge	bool	false	delete the entire context instead of only its token

Command: olivares auth os-account

Bind a product account to an immutable native OS account

olivares auth os-account

Flag	Type	Default	Description
--allow-cleartext	bool	false	inherited, hidden. allow sending the credential to a non-loopback host over plain HTTP (DANGEROUS: it travels readable)
--ca-cert	string	—	inherited, hidden. PEM file containing an additional trusted root CA (default: current context)
--insecure	bool	false	inherited, hidden. skip TLS certificate verification (DANGEROUS; development only)
--pin-sha256	stringArray	[]	inherited, hidden. trusted leaf SPKI SHA-256 pin, base64 or hex, repeatable — the engine prints it as pin_sha256 on the line reporting its certificate (default: current context)
--server	string	—	inherited, hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	inherited, hidden. tenant id (default $OLIVARES_TENANT, then current context)
--timeout	duration	10s	inherited, hidden. request timeout
--token	string	—	inherited, hidden. API bearer token (prefer –token-file: this form is visible in the process table and in shell history; default $OLIVARES_TOKEN, then current context)
--token-file	string	—	inherited, hidden. read the API bearer token from a file, or - for stdin

Command: olivares auth os-account begin

Start as an administrator; the subject completes its own proof

olivares auth os-account begin <user-id> <os-account>

Declares no flags of its own; it takes those of olivares auth os-account and the root command.

Command: olivares auth os-account complete

Prove native account control from the subject’s own sign-in

olivares auth os-account complete <ceremony-id>

Flag	Type	Default	Description
--password-file	string	—	read the native password from a file, or - for stdin

Command: olivares auth os-account get

Read administrative mapping metadata

olivares auth os-account get <user-id>

Declares no flags of its own; it takes those of olivares auth os-account and the root command.

Command: olivares auth os-account revoke

Revoke authority and retain the immutable account reservation

olivares auth os-account revoke <user-id>

Flag	Type	Default	Description
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares auth status

Show the effective CLI identity and authentication context

olivares auth status

Flag	Type	Default	Description
--allow-cleartext	bool	false	hidden. allow sending the credential to a non-loopback host over plain HTTP (DANGEROUS: it travels readable)
--ca-cert	string	—	hidden. PEM file containing an additional trusted root CA (default: current context)
--insecure	bool	false	hidden. skip TLS certificate verification (DANGEROUS; development only)
--pin-sha256	stringArray	[]	hidden. trusted leaf SPKI SHA-256 pin, base64 or hex, repeatable — the engine prints it as pin_sha256 on the line reporting its certificate (default: current context)
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT, then current context)
--timeout	duration	10s	hidden. request timeout
--token	string	—	hidden. API bearer token (prefer –token-file: this form is visible in the process table and in shell history; default $OLIVARES_TOKEN, then current context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares auth totp-policy

Read or set the require-TOTP-for-administrators policy (system:admin)

olivares auth totp-policy

Flag	Type	Default	Description
--allow-cleartext	bool	false	inherited, hidden. allow sending the credential to a non-loopback host over plain HTTP (DANGEROUS: it travels readable)
--ca-cert	string	—	inherited, hidden. PEM file containing an additional trusted root CA (default: current context)
--insecure	bool	false	inherited, hidden. skip TLS certificate verification (DANGEROUS; development only)
--pin-sha256	stringArray	[]	inherited, hidden. trusted leaf SPKI SHA-256 pin, base64 or hex, repeatable — the engine prints it as pin_sha256 on the line reporting its certificate (default: current context)
--server	string	—	inherited, hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	inherited, hidden. tenant id (default $OLIVARES_TENANT, then current context)
--timeout	duration	10s	inherited, hidden. request timeout
--token	string	—	inherited, hidden. API bearer token (prefer –token-file: this form is visible in the process table and in shell history; default $OLIVARES_TOKEN, then current context)
--token-file	string	—	inherited, hidden. read the API bearer token from a file, or - for stdin

Command: olivares auth totp-policy get

Read the policy

olivares auth totp-policy get

Declares no flags of its own; it takes those of olivares auth totp-policy and the root command.

Command: olivares auth totp-policy set

Set the policy

olivares auth totp-policy set

Flag	Type	Default	Description
--require-for-admins	bool	false	administrators must hold a TOTP factor to finish a password login

Command: olivares auth use-context

Select the current CLI client context

olivares auth use-context <name>

Declares no flags of its own; it takes those of olivares auth and the root command.

Command: olivares capabilities

What this estate can do: connected servers, and the tools and skills they bring

olivares capabilities

Flag	Type	Default	Description
--allow-cleartext	bool	false	inherited, hidden. allow sending the credential to a non-loopback host over plain HTTP (DANGEROUS: it travels readable)
--ca-cert	string	—	inherited, hidden. PEM file containing an additional trusted root CA (default: current context)
--insecure	bool	false	inherited, hidden. skip TLS certificate verification (DANGEROUS; development only)
--pin-sha256	stringArray	[]	inherited, hidden. trusted leaf SPKI SHA-256 pin, base64 or hex, repeatable — the engine prints it as pin_sha256 on the line reporting its certificate (default: current context)
--server	string	—	inherited, hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	inherited, hidden. tenant id (default $OLIVARES_TENANT, then current context)
--timeout	duration	10s	inherited, hidden. request timeout
--token	string	—	inherited, hidden. API bearer token (prefer –token-file: this form is visible in the process table and in shell history; default $OLIVARES_TOKEN, then current context)
--token-file	string	—	inherited, hidden. read the API bearer token from a file, or - for stdin

Command: olivares capabilities servers

The MCP servers this estate talks to

olivares capabilities servers

Declares no flags of its own; it takes those of olivares capabilities and the root command.

Command: olivares capabilities servers get

Show one MCP server and what it brings

olivares capabilities servers get <server-id>

Declares no flags of its own; it takes those of olivares capabilities servers and the root command.

Command: olivares capabilities servers ls

List the connected MCP servers

olivares capabilities servers ls

Aliases: list

Flag	Type	Default	Description
--cursor	string	—	continue from the cursor printed by the previous page
--limit	int	0	maximum rows to return in one page (left out: the engine’s default)

Command: olivares capabilities skills

The skills the connected servers contribute

olivares capabilities skills

Flag	Type	Default	Description
--cursor	string	—	continue from the cursor printed by the previous page
--limit	int	0	maximum rows to return in one page (left out: the engine’s default)
--server-id	string	—	only skills from this MCP server

Command: olivares capabilities tools

The tools the connected servers expose, with their destructive hints

olivares capabilities tools

Flag	Type	Default	Description
--cursor	string	—	continue from the cursor printed by the previous page
--limit	int	0	maximum rows to return in one page (left out: the engine’s default)
--server-id	string	—	only tools from this MCP server

Command: olivares capabilities wiring

Who is actually using which capability, as observed edges

olivares capabilities wiring

Flag	Type	Default	Description
--capability-kind	string	—	only edges to this kind of capability
--capability-ref	string	—	only edges to this capability
--origin-kind	string	—	only edges from this kind of origin
--origin-ref	string	—	only edges from this origin

Command: olivares catalog

Admit and govern catalog entries, connectors and MCP servers

olivares catalog

Flag	Type	Default	Description
--allow-cleartext	bool	false	inherited, hidden. allow sending the credential to a non-loopback host over plain HTTP (DANGEROUS: it travels readable)
--ca-cert	string	—	inherited, hidden. PEM file containing an additional trusted root CA (default: current context)
--insecure	bool	false	inherited, hidden. skip TLS certificate verification (DANGEROUS; development only)
--pin-sha256	stringArray	[]	inherited, hidden. trusted leaf SPKI SHA-256 pin, base64 or hex, repeatable — the engine prints it as pin_sha256 on the line reporting its certificate (default: current context)
--server	string	—	inherited, hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	inherited, hidden. tenant id (default $OLIVARES_TENANT, then current context)
--timeout	duration	10s	inherited, hidden. request timeout
--token	string	—	inherited, hidden. API bearer token (prefer –token-file: this form is visible in the process table and in shell history; default $OLIVARES_TOKEN, then current context)
--token-file	string	—	inherited, hidden. read the API bearer token from a file, or - for stdin

Command: olivares catalog admit

Admit a stored CLI or MCP tool declaration

olivares catalog admit <entry-id>

Declares no flags of its own; it takes those of olivares catalog and the root command.

Command: olivares catalog connector-admission

Read and set the connector supply-chain admission policy

olivares catalog connector-admission

Declares no flags of its own; it takes those of olivares catalog and the root command.

Command: olivares catalog connector-admission ls

List recorded connector admission verdicts

olivares catalog connector-admission ls

Aliases: list

Flag	Type	Default	Description
--cursor	string	—	opaque cursor from a previous page’s has_more result
--entry-ref	string	—	only verdicts for this entry
--limit	int	0	maximum rows per page (server default when unset)
--verified	bool	false	only verdicts that verified

Command: olivares catalog connector-admission policy

Read or replace the connector admission policy

olivares catalog connector-admission policy

Declares no flags of its own; it takes those of olivares catalog connector-admission and the root command.

Command: olivares catalog connector-admission policy get

Show the connector admission policy

olivares catalog connector-admission policy get

Declares no flags of its own; it takes those of olivares catalog connector-admission policy and the root command.

Command: olivares catalog connector-admission policy set

Replace the connector admission policy

olivares catalog connector-admission policy set

Flag	Type	Default	Description
--allowed-identity	stringArray	[]	trusted keyless identity, repeatable
--allowed-issuer	stringArray	[]	trusted OIDC issuer, repeatable
--allowed-predicate	stringArray	[]	accepted attestation predicate type, repeatable
--note	string	—	note recorded with the policy
--replace	bool	false	accept that every field not passed is RESET to its server default (this endpoint replaces, it does not patch)
--require-signed	bool	false	refuse artifacts without a verifying signature
--require-subject-digest	bool	false	require the attestation to cover the subject digest
--trusted-key	stringArray	[]	trusted PUBLIC key, repeatable
--trusted-root	stringArray	[]	trusted root certificate, repeatable
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares catalog entries

Author, review and admit catalog entries

olivares catalog entries

Declares no flags of its own; it takes those of olivares catalog and the root command.

Command: olivares catalog entries admit

Verify a supply-chain attestation for an entry

olivares catalog entries admit <entry-id>

Flag	Type	Default	Description
--bundle	string	—	attestation bundle as JSON
--bundle-file	string	—	file holding the JSON attestation bundle (- for stdin)
--expected-digest	string	—	subject digest the attestation must cover
--note	string	—	note recorded with the verdict
--predicate-type	stringArray	[]	predicate type to accept, repeatable

Command: olivares catalog entries approve

Approve a submitted entry, hashing and signing it

olivares catalog entries approve <entry-id>

Declares no flags of its own; it takes those of olivares catalog entries and the root command.

Command: olivares catalog entries create

Author a draft catalog entry

olivares catalog entries create

Flag	Type	Default	Description
--kind	string	—	agent, mcp, skill, template, model or connector
--name	string	—	entry name
--owner-ref	string	—	owning team or principal
--slug	string	—	lowercase identifier (a-z, 0-9, - and _)
--spec	string	—	entry specification as a JSON object
--spec-file	string	—	file holding the JSON specification (- for stdin)
--summary	string	—	one-line summary
--version	string	—	semantic version, e.g. 1.2.3

Command: olivares catalog entries deprecate

Retire an approved entry

olivares catalog entries deprecate <entry-id>

Flag	Type	Default	Description
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares catalog entries get

Show one catalog entry

olivares catalog entries get <entry-id>

Declares no flags of its own; it takes those of olivares catalog entries and the root command.

Command: olivares catalog entries instantiate

Request an instance from an approved entry

olivares catalog entries instantiate <entry-id>

Flag	Type	Default	Description
--name	string	—	name for the requested instance
--note	string	—	note recorded with the request
--target-ref	string	—	where the instance is meant to land

Command: olivares catalog entries ls

List catalog entries

olivares catalog entries ls

Aliases: list

Flag	Type	Default	Description
--cursor	string	—	opaque cursor from a previous page’s has_more result
--kind	string	—	only entries of this kind
--limit	int	0	maximum rows per page (server default when unset)
--slug	string	—	only entries with this slug
--status	string	—	only entries in this status

Command: olivares catalog entries rm

Delete a catalog entry

olivares catalog entries rm <entry-id>

Aliases: delete

Flag	Type	Default	Description
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares catalog entries set

Replace a draft entry’s authored fields

olivares catalog entries set <entry-id>

Flag	Type	Default	Description
--kind	string	—	agent, mcp, skill, template, model or connector
--name	string	—	entry name
--owner-ref	string	—	owning team or principal
--replace	bool	false	accept that every field not passed is RESET to its server default (this endpoint replaces, it does not patch)
--slug	string	—	lowercase identifier (a-z, 0-9, - and _)
--spec	string	—	entry specification as a JSON object
--spec-file	string	—	file holding the JSON specification (- for stdin)
--summary	string	—	one-line summary
--version	string	—	semantic version, e.g. 1.2.3

Command: olivares catalog entries submit

Submit a draft entry for review

olivares catalog entries submit <entry-id>

Declares no flags of its own; it takes those of olivares catalog entries and the root command.

Command: olivares catalog entries verify

Recompute an entry’s hash and check its signature

olivares catalog entries verify <entry-id>

Declares no flags of its own; it takes those of olivares catalog entries and the root command.

Command: olivares catalog instances

Review and decide self-service instantiation requests

olivares catalog instances

Declares no flags of its own; it takes those of olivares catalog and the root command.

Command: olivares catalog instances get

Show one instantiation request

olivares catalog instances get <instance-id>

Declares no flags of its own; it takes those of olivares catalog instances and the root command.

Command: olivares catalog instances ls

List instantiation requests

olivares catalog instances ls

Aliases: list

Flag	Type	Default	Description
--cursor	string	—	opaque cursor from a previous page’s has_more result
--entry-id	string	—	only instances of this catalog entry
--limit	int	0	maximum rows per page (server default when unset)
--status	string	—	only instances in this status

Command: olivares catalog instances transition

Decide an instance request or apply its deployment

olivares catalog instances transition <instance-id>

Flag	Type	Default	Description
--approval-ref	string	—	governance approval returned by the activation proposal
--note	string	—	note recorded with the decision
--status	string	—	approved, rejected or active
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares catalog mcp-admission

Read and set the MCP server supply-chain admission policy

olivares catalog mcp-admission

Declares no flags of its own; it takes those of olivares catalog and the root command.

Command: olivares catalog mcp-admission ls

List recorded MCP server admission verdicts

olivares catalog mcp-admission ls

Aliases: list

Flag	Type	Default	Description
--cursor	string	—	opaque cursor from a previous page’s has_more result
--entry-ref	string	—	only verdicts for this entry
--limit	int	0	maximum rows per page (server default when unset)
--verified	bool	false	only verdicts that verified

Command: olivares catalog mcp-admission policy

Read or replace the MCP server admission policy

olivares catalog mcp-admission policy

Declares no flags of its own; it takes those of olivares catalog mcp-admission and the root command.

Command: olivares catalog mcp-admission policy get

Show the MCP server admission policy

olivares catalog mcp-admission policy get

Declares no flags of its own; it takes those of olivares catalog mcp-admission policy and the root command.

Command: olivares catalog mcp-admission policy set

Replace the MCP server admission policy

olivares catalog mcp-admission policy set

Flag	Type	Default	Description
--allowed-identity	stringArray	[]	trusted keyless identity, repeatable
--allowed-issuer	stringArray	[]	trusted OIDC issuer, repeatable
--allowed-predicate	stringArray	[]	accepted attestation predicate type, repeatable
--note	string	—	note recorded with the policy
--replace	bool	false	accept that every field not passed is RESET to its server default (this endpoint replaces, it does not patch)
--require-signed	bool	false	refuse artifacts without a verifying signature
--require-subject-digest	bool	false	require the attestation to cover the subject digest
--trusted-key	stringArray	[]	trusted PUBLIC key, repeatable
--trusted-root	stringArray	[]	trusted root certificate, repeatable
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares catalog pubkey

Show the public key catalog approvals are signed with

olivares catalog pubkey

Declares no flags of its own; it takes those of olivares catalog and the root command.

Command: olivares claude-agents

Read a managed agent session’s thread events and answer its tool confirmations

olivares claude-agents

Flag	Type	Default	Description
--allow-cleartext	bool	false	inherited, hidden. allow sending the credential to a non-loopback host over plain HTTP (DANGEROUS: it travels readable)
--ca-cert	string	—	inherited, hidden. PEM file containing an additional trusted root CA (default: current context)
--insecure	bool	false	inherited, hidden. skip TLS certificate verification (DANGEROUS; development only)
--pin-sha256	stringArray	[]	inherited, hidden. trusted leaf SPKI SHA-256 pin, base64 or hex, repeatable — the engine prints it as pin_sha256 on the line reporting its certificate (default: current context)
--server	string	—	inherited, hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	inherited, hidden. tenant id (default $OLIVARES_TENANT, then current context)
--timeout	duration	10s	inherited, hidden. request timeout
--token	string	—	inherited, hidden. API bearer token (prefer –token-file: this form is visible in the process table and in shell history; default $OLIVARES_TOKEN, then current context)
--token-file	string	—	inherited, hidden. read the API bearer token from a file, or - for stdin

Command: olivares claude-agents sessions

Inspect and answer one managed agent session

olivares claude-agents sessions

Declares no flags of its own; it takes those of olivares claude-agents and the root command.

Command: olivares claude-agents sessions events

List one managed session’s thread events

olivares claude-agents sessions events <session-id>

Declares no flags of its own; it takes those of olivares claude-agents sessions and the root command.

Command: olivares claude-agents sessions tool-confirmation

Answer a managed agent’s pending tool use (allow or deny)

olivares claude-agents sessions tool-confirmation <session-id>

Flag	Type	Default	Description
--deny-message	string	—	why the tool was denied, shown to the agent
--result	string	—	required. allow or deny (required)
--tool-use-id	string	—	required. the pending tool use to answer (required)

Command: olivares claude-hook

Hidden diagnostic: it does not appear in --help output and is not part of the supported surface.

Governed PEP hook client: forward a Claude Code hook to the engine and relay the decision (deny-closed)

olivares claude-hook

Flag	Type	Default	Description
--account	string	—	account identity hint (default $OLIVARES_HOOK_PEP_ACCOUNT)
--agent	string	—	agent identity hint (default $OLIVARES_HOOK_PEP_AGENT)
--endpoint	string	—	governed PEP URL (default $OLIVARES_HOOK_PEP_URL); –server is the canonical spelling
--hook-event	string	—	invoking event pinned by managed settings for deadline refusals
--org	string	—	org identity hint (default $OLIVARES_HOOK_PEP_ORG)
--server	string	—	engine address (default $OLIVARES_SERVER_URL; the canonical spelling of –endpoint)
--tenant	string	—	the tenant the agent acts in (default $OLIVARES_HOOK_PEP_TENANT)
--timeout	duration	5s	whole hook deadline, including stdin and filesystem resolution
--token	string	—	the agent’s PEP bearer credential (default $OLIVARES_HOOK_PEP_TOKEN)

Command: olivares claude-policy

Validate and dry-run the managed policy files of Claude Code, Codex, Grok Build, OpenCode and Gemini CLI (publishing and tracking require Business)

olivares claude-policy

Flag	Type	Default	Description
--allow-cleartext	bool	false	inherited, hidden. allow sending the credential to a non-loopback host over plain HTTP (DANGEROUS: it travels readable)
--ca-cert	string	—	inherited, hidden. PEM file containing an additional trusted root CA (default: current context)
--insecure	bool	false	inherited, hidden. skip TLS certificate verification (DANGEROUS; development only)
--pin-sha256	stringArray	[]	inherited, hidden. trusted leaf SPKI SHA-256 pin, base64 or hex, repeatable — the engine prints it as pin_sha256 on the line reporting its certificate (default: current context)
--server	string	—	inherited, hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	inherited, hidden. tenant id (default $OLIVARES_TENANT, then current context)
--timeout	duration	10s	inherited, hidden. request timeout
--token	string	—	inherited, hidden. API bearer token (prefer –token-file: this form is visible in the process table and in shell history; default $OLIVARES_TOKEN, then current context)
--token-file	string	—	inherited, hidden. read the API bearer token from a file, or - for stdin

Command: olivares claude-policy artifact

Fetch the signed artifact a distribution agent would pull (requires Business)

olivares claude-policy artifact <surface>

Flag	Type	Default	Description
--revision	int64	0	a specific revision (0 uses the newest)

Command: olivares claude-policy checkin

Report an agent’s applied artifact and observed config (exit 7 when unverified) (requires Business)

olivares claude-policy checkin <surface>

Flag	Type	Default	Description
--artifact-sha256	string	—	the artifact hash the agent verified
--key-fingerprint	string	—	the signing key fingerprint the agent verified against
--observed-file	string	—	the config observed on the host, ‘-’ for stdin
--revision	int64	0	the revision the agent applied
--scope	string	—	required. the host id / distribution name this check-in reports for (required)

Command: olivares claude-policy distribution

Show published vs signed vs observed, scope by scope (requires Business)

olivares claude-policy distribution <surface>

Declares no flags of its own; it takes those of olivares claude-policy and the root command.

Command: olivares claude-policy dry-run

Resolve a document against observed hosts without writing anything

olivares claude-policy dry-run <surface>

Flag	Type	Default	Description
--content-file	string	—	required. the policy document, ‘-’ for stdin (required)

Command: olivares claude-policy publish

Publish a new revision and, when a distributor is wired, sign it (requires Business)

olivares claude-policy publish <surface>

Flag	Type	Default	Description
--content-file	string	—	required. the policy document, ‘-’ for stdin (required)
--note	string	—	why this revision exists (recorded on the revision)

Command: olivares claude-policy pull

Pull a surface’s signed artifact, verify it, write the file and attest it (exit 7 when it does not verify) (requires Business)

olivares claude-policy pull <surface>

Flag	Type	Default	Description
--out	string	—	required. the file to write (required)
--pin-key-fingerprint	string	—	required. the signing key fingerprint ‘publish’ printed, pinned out of band (required)
--revision	int64	0	a specific revision (0 uses the newest); one older than the plane’s latest is written and then exits 7, because the host now drifts from the latest
--scope	string	—	required. the host id / distribution name this workstation reports as (required)

Command: olivares claude-policy validate

Validate a policy document server-side (exit 7 when it has errors)

olivares claude-policy validate <surface>

Flag	Type	Default	Description
--content-file	string	—	required. the policy document, ‘-’ for stdin (required)

Command: olivares claude-policy versions

List and read published revisions of a surface (requires Business)

olivares claude-policy versions

Declares no flags of its own; it takes those of olivares claude-policy and the root command.

Command: olivares claude-policy versions get

Show one revision with its document content (requires Business)

olivares claude-policy versions get <surface> <revision>

Declares no flags of its own; it takes those of olivares claude-policy versions and the root command.

Command: olivares claude-policy versions ls

List a surface’s published revisions (requires Business)

olivares claude-policy versions ls <surface>

Declares no flags of its own; it takes those of olivares claude-policy versions and the root command.

Command: olivares codex

Author OpenAI Codex governance artifacts (managed config)

olivares codex

Declares no flags of its own; it takes those of olivares and the root command.

Command: olivares codex managed-config

Render the Codex requirements.toml + managed_config.toml from a governance Policy JSON

olivares codex managed-config

Flag	Type	Default	Description
--managed-config-out	string	-	output path for managed_config.toml (‘-’ = stdout)
--policy	string	-	path to the governance Policy JSON (‘-’ = stdin)
--requirements-out	string	-	output path for requirements.toml (‘-’ = stdout, prefixed with a header when both files go to stdout)
--validate	bool	false	validate the policy renders to valid TOML, but write nothing

Command: olivares codex-hook

Hidden diagnostic: it does not appear in --help output and is not part of the supported surface.

Governed PEP hook client for Codex: forward a Codex hook to the engine and relay the decision (deny-closed)

olivares codex-hook

Flag	Type	Default	Description
--account	string	—	account identity hint (default $OLIVARES_CODEX_HOOK_ACCOUNT)
--agent	string	—	agent identity hint (default $OLIVARES_CODEX_HOOK_AGENT)
--endpoint	string	—	governed PEP URL (default $OLIVARES_CODEX_HOOK_URL); –server is the canonical spelling
--org	string	—	org identity hint (default $OLIVARES_CODEX_HOOK_ORG)
--server	string	—	engine address (default $OLIVARES_SERVER_URL; the canonical spelling of –endpoint)
--tenant	string	—	the tenant the agent acts in (default $OLIVARES_CODEX_HOOK_TENANT)
--timeout	duration	5s	PEP request timeout
--token	string	—	the agent’s PEP bearer credential (default $OLIVARES_CODEX_HOOK_TOKEN)

Command: olivares collector

Hidden diagnostic: it does not appear in --help output and is not part of the supported surface.

Run as an edge collector: push local source observations to a remote core over gRPC+mTLS

olivares collector

Flag	Type	Default	Description
--ca	string	—	PEM of the CA that signed the core’s server certificate (pins a self-signed core cert; empty uses system roots)
--client-cert	string	—	collector client certificate PEM (required when the core enforces mutual TLS)
--client-key	string	—	collector client private key PEM
--core-addr	string	—	required. host:port of the remote core’s gRPC ingest endpoint (required)
--insecure	bool	false	push over plaintext (DANGEROUS; localhost dev only)
--server-name	string	—	override the core’s TLS verification name (when dialing by IP)
--token-file	string	—	file holding the bearer token of an ingest:write principal (or set OLIVARES_INGEST_TOKEN)

Command: olivares commands

Hidden diagnostic: it does not appear in --help output and is not part of the supported surface.

Print the full command tree of this binary (diagnostic)

olivares commands

Declares no flags of its own; it takes those of olivares and the root command.

Command: olivares completion

Generate shell autocompletion scripts

olivares completion

Declares no flags of its own; it takes those of olivares and the root command.

Command: olivares completion bash

Generate bash autocompletion script

olivares completion bash

Declares no flags of its own; it takes those of olivares completion and the root command.

Command: olivares completion fish

Generate fish autocompletion script

olivares completion fish

Declares no flags of its own; it takes those of olivares completion and the root command.

Command: olivares completion powershell

Generate PowerShell autocompletion script

olivares completion powershell

Declares no flags of its own; it takes those of olivares completion and the root command.

Command: olivares completion zsh

Generate zsh autocompletion script

olivares completion zsh

Declares no flags of its own; it takes those of olivares completion and the root command.

Command: olivares compliance

Operate legal holds, GDPR erasure and regulatory artifacts

olivares compliance

Flag	Type	Default	Description
--allow-cleartext	bool	false	inherited, hidden. allow sending the credential to a non-loopback host over plain HTTP (DANGEROUS: it travels readable)
--ca-cert	string	—	inherited, hidden. PEM file containing an additional trusted root CA (default: current context)
--insecure	bool	false	inherited, hidden. skip TLS certificate verification (DANGEROUS; development only)
--pin-sha256	stringArray	[]	inherited, hidden. trusted leaf SPKI SHA-256 pin, base64 or hex, repeatable — the engine prints it as pin_sha256 on the line reporting its certificate (default: current context)
--server	string	—	inherited, hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	inherited, hidden. tenant id (default $OLIVARES_TENANT, then current context)
--timeout	duration	10s	inherited, hidden. request timeout
--token	string	—	inherited, hidden. API bearer token (prefer –token-file: this form is visible in the process table and in shell history; default $OLIVARES_TOKEN, then current context)
--token-file	string	—	inherited, hidden. read the API bearer token from a file, or - for stdin

Command: olivares compliance aims

Inspect ISO/IEC 42001 AIMS certification-readiness packs

olivares compliance aims

Declares no flags of its own; it takes those of olivares compliance and the root command.

Command: olivares compliance aims ls

List ISO/IEC 42001 AIMS packs

olivares compliance aims ls

Aliases: list

Declares no flags of its own; it takes those of olivares compliance aims and the root command.

Command: olivares compliance calendar

Show the regulatory calendar and watchlist

olivares compliance calendar

Flag	Type	Default	Description
--framework	string	—	filter to one framework id

Command: olivares compliance depth

Inspect compliance-depth packs and control monitoring

olivares compliance depth

Declares no flags of its own; it takes those of olivares compliance and the root command.

Command: olivares compliance depth drift

List detected control drift

olivares compliance depth drift

Aliases: list

Declares no flags of its own; it takes those of olivares compliance depth and the root command.

Command: olivares compliance depth fedramp

List FedRAMP 20x KSI packs

olivares compliance depth fedramp

Aliases: list

Declares no flags of its own; it takes those of olivares compliance depth and the root command.

Command: olivares compliance depth sector

List sector overlay packs

olivares compliance depth sector

Aliases: list

Declares no flags of its own; it takes those of olivares compliance depth and the root command.

Command: olivares compliance depth snapshots

List CCM control snapshots

olivares compliance depth snapshots

Aliases: list

Declares no flags of its own; it takes those of olivares compliance depth and the root command.

Command: olivares compliance depth us-law

List US state-law packs

olivares compliance depth us-law

Aliases: list

Declares no flags of its own; it takes those of olivares compliance depth and the root command.

Command: olivares compliance dora

Inspect DORA registers and classified incidents

olivares compliance dora

Declares no flags of its own; it takes those of olivares compliance and the root command.

Command: olivares compliance dora export

Export one DORA Register of Information

olivares compliance dora export <register-id>

Declares no flags of its own; it takes those of olivares compliance dora and the root command.

Command: olivares compliance dora incidents

List classified DORA incidents

olivares compliance dora incidents

Aliases: list

Declares no flags of its own; it takes those of olivares compliance dora and the root command.

Command: olivares compliance dora registers

List DORA registers of information

olivares compliance dora registers

Aliases: list

Declares no flags of its own; it takes those of olivares compliance dora and the root command.

Command: olivares compliance erasure

Hidden diagnostic: it does not appear in --help output and is not part of the supported surface.

Register, execute and evidence GDPR erasure requests

olivares compliance erasure

Declares no flags of its own; it takes those of olivares compliance and the root command.

Command: olivares compliance erasure custody

Show an erasure’s append-only chain of custody

olivares compliance erasure custody <erasure-id>

Declares no flags of its own; it takes those of olivares compliance erasure and the root command.

Command: olivares compliance erasure execute

Execute an erasure (IRREVERSIBLE, dual-control)

olivares compliance erasure execute <erasure-id>

Flag	Type	Default	Description
--provider-user-id	stringArray	[]	provider-side user id to erase, repeatable
--reason	string	—	why this erasure is being executed
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares compliance erasure get

Show one erasure request

olivares compliance erasure get <erasure-id>

Declares no flags of its own; it takes those of olivares compliance erasure and the root command.

Command: olivares compliance erasure ls

List erasure requests

olivares compliance erasure ls

Aliases: list

Flag	Type	Default	Description
--status	string	—	filter by status (received, pending_approval, completed, …)

Command: olivares compliance erasure receipt

Show the sealed, ledger-anchored erasure receipt

olivares compliance erasure receipt <erasure-id>

Declares no flags of its own; it takes those of olivares compliance erasure and the root command.

Command: olivares compliance erasure request

Register an erasure request (destroys nothing)

olivares compliance erasure request

Flag	Type	Default	Description
--alias	stringArray	[]	additional identifier for the same person, repeatable
--case-ref	string	—	required. your DSAR case reference (required)
--data-class	stringArray	[]	narrow to these registered data classes, repeatable
--reason	string	—	why this request exists
--subject-kind	string	user	subject kind
--subject-ref	string	—	required. subject reference (required)

Command: olivares compliance holds

Hidden diagnostic: it does not appear in --help output and is not part of the supported surface.

Place, inspect and release legal holds

olivares compliance holds

Declares no flags of its own; it takes those of olivares compliance and the root command.

Command: olivares compliance holds check

Ask whether any active hold already covers a subject or class

olivares compliance holds check

Flag	Type	Default	Description
--data-class	string	—	registered data class id
--subject-kind	string	—	subject kind (e.g. user)
--subject-ref	string	—	subject reference

Command: olivares compliance holds custody

Show a hold’s append-only chain of custody

olivares compliance holds custody <hold-id>

Declares no flags of its own; it takes those of olivares compliance holds and the root command.

Command: olivares compliance holds get

Show one legal hold

olivares compliance holds get <hold-id>

Declares no flags of its own; it takes those of olivares compliance holds and the root command.

Command: olivares compliance holds ls

List legal holds

olivares compliance holds ls

Aliases: list

Flag	Type	Default	Description
--status	string	—	filter by status (active, released)

Command: olivares compliance holds place

Place a legal hold (takes effect immediately)

olivares compliance holds place

Flag	Type	Default	Description
--data-class	string	—	registered data class id (scope=data_class)
--matter	string	—	required. matter or case reference (required)
--on-behalf-of	string	—	the person this order is placed for
--reason	string	—	required. why this hold exists (required; recorded in custody)
--scope	string	subject	scope: tenant, data_class or subject
--subject-kind	string	—	subject kind (scope=subject)
--subject-ref	string	—	subject reference (scope=subject)
--title	string	—	human-readable title

Command: olivares compliance holds release

Release a legal hold (dual-control, no break-glass)

olivares compliance holds release <hold-id>

Flag	Type	Default	Description
--on-behalf-of	string	—	the person this release is made for
--reason	string	—	why the hold is being released (recorded in custody)
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares compliance oscal

Inspect ingested OSCAL profiles and SSPs

olivares compliance oscal

Declares no flags of its own; it takes those of olivares compliance and the root command.

Command: olivares compliance oscal get

Show one ingested OSCAL profile or SSP

olivares compliance oscal get <profile-id>

Declares no flags of its own; it takes those of olivares compliance oscal and the root command.

Command: olivares compliance oscal ls

List registered OSCAL documents

olivares compliance oscal ls

Aliases: list

Declares no flags of its own; it takes those of olivares compliance oscal and the root command.

Command: olivares compliance risk

Classify agents and read the governed risk register

olivares compliance risk

Declares no flags of its own; it takes those of olivares compliance and the root command.

Command: olivares compliance risk classify

Record a risk suggestion from observed signals and declared intent

olivares compliance risk classify SUBJECT-REF

Flag	Type	Default	Description
--agent-id	string	—	explicit native agent ID when the subject reference differs
--subject-kind	string	agent	native subject kind

Command: olivares compliance risk ls

Read retained risk classifications and their evidence

olivares compliance risk ls

Aliases: list

Declares no flags of its own; it takes those of olivares compliance risk and the root command.

Command: olivares compliance subject

Hidden diagnostic: it does not appear in --help output and is not part of the supported surface.

Answer a data subject’s erasure request by subject id

olivares compliance subject

Declares no flags of its own; it takes those of olivares compliance and the root command.

Command: olivares compliance subject erase

Register and execute an erasure for one subject (IRREVERSIBLE)

olivares compliance subject erase <subject-id>

Flag	Type	Default	Description
--alias	stringArray	[]	additional identifier for the same person, repeatable
--case-ref	string	—	your DSAR case reference
--data-class	stringArray	[]	narrow to these registered data classes, repeatable
--provider-user-id	stringArray	[]	provider-side user id to erase, repeatable
--reason	string	—	why this erasure is being executed
--subject-kind	string	—	subject kind (default: user)
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares compliance subject status

Show erasure status for one data subject

olivares compliance subject status <subject-id>

Flag	Type	Default	Description
--subject-kind	string	—	subject kind (default: user)

Command: olivares config

Generate validated engine configuration (the non-interactive setup)

olivares config

Declares no flags of its own; it takes those of olivares and the root command.

Command: olivares config effective

Print configured OLIVARES_* values with secrets redacted

olivares config effective

Flag	Type	Default	Description
--format	string	text	deprecated alias for -o/–output on this command (text or json) — NOT the export-format flag of ‘audit export’ / ‘findings export’
--strict	bool	false	fail if any unrecognized OLIVARES_* environment key is present

Command: olivares config generate

Compose a validated /etc/olivares/olivares.env (or k8s snippet) from flags

olivares config generate

Flag	Type	Default	Description
--admin-dsn	string	—	cross-tenant admin-role DSN or reference
--allow-privileged-db-role	bool	false	permit a superuser/BYPASSRLS Postgres role (DANGEROUS; disables the RLS backstop)
--audit-signing-key-file	string	—	operator-provisioned Ed25519 audit signing key file (required external BYOK custody for postgres-prod)
--checkpoint-interval	string	—	audit checkpoint cadence override (e.g. 30m; default 1h)
--data-dir	string	—	data directory override (default the unit’s /var/lib/olivares)
--dsn	string	—	store DSN or a file:/env: reference (required for postgres)
--engine	string	—	store engine override: sqlite or postgres (profile default: postgres for postgres-prod, sqlite otherwise)
--force	bool	false	overwrite –out if it already exists
--grpc-client-ca	string	—	PEM bundle of CAs for collector mTLS
--grpc-listen	string	:8444	gRPC listen address; the default is every interface, bind 127.0.0.1:8444 to restrict it
--insecure	bool	false	serve plaintext (loopback dev only)
--known-regions	stringSlice	[]	deployment-wide region codes (comma-separated; home region added implicitly)
--license	string	—	path to a commercial license file
--listen	string	:8443	HTTP (REST + console) listen address; the default is every interface (0.0.0.0), bind 127.0.0.1:8443 to restrict it
--max-conns	int	0	OLIVARES_DB_MAX_CONNS — Postgres app-pool cap per node (0 = engine default)
--out	string	-	output path (default - = stdout); for systemd use /etc/olivares/olivares.env
--owner-dsn	string	—	owner-role DSN or reference (enables the least-privilege owner/app split)
--profile	string	single-node-prod	install profile: eval | single-node-prod | postgres-prod | k8s
--region	string	—	data-residency home region of this instance (e.g. eu)
--tls-cert	string	—	TLS certificate PEM path (with –tls-key)
--tls-key	string	—	TLS private key PEM path (with –tls-cert)

Command: olivares config session-idle

Read or change optional idle session stops

olivares config session-idle

Flag	Type	Default	Description
--allow-cleartext	bool	false	inherited, hidden. allow sending the credential to a non-loopback host over plain HTTP (DANGEROUS: it travels readable)
--ca-cert	string	—	inherited, hidden. PEM file containing an additional trusted root CA (default: current context)
--insecure	bool	false	inherited, hidden. skip TLS certificate verification (DANGEROUS; development only)
--pin-sha256	stringArray	[]	inherited, hidden. trusted leaf SPKI SHA-256 pin, base64 or hex, repeatable — the engine prints it as pin_sha256 on the line reporting its certificate (default: current context)
--server	string	—	inherited, hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	inherited, hidden. tenant id (default $OLIVARES_TENANT, then current context)
--timeout	duration	10s	inherited, hidden. request timeout
--token	string	—	inherited, hidden. API bearer token (prefer –token-file: this form is visible in the process table and in shell history; default $OLIVARES_TOKEN, then current context)
--token-file	string	—	inherited, hidden. read the API bearer token from a file, or - for stdin

Command: olivares config session-idle get

Read the saved instance idle-stop setting

olivares config session-idle get

Declares no flags of its own; it takes those of olivares config session-idle and the root command.

Command: olivares config session-idle set

Save the idle-stop window; 0 turns it off

olivares config session-idle set

Flag	Type	Default	Description
--minutes	int	0	minutes in idle before stopping (0 is off; enabled: 6–10080)

Command: olivares config tracing

Read or change saved tracing settings without restarting the engine

olivares config tracing

Flag	Type	Default	Description
--allow-cleartext	bool	false	inherited, hidden. allow sending the credential to a non-loopback host over plain HTTP (DANGEROUS: it travels readable)
--ca-cert	string	—	inherited, hidden. PEM file containing an additional trusted root CA (default: current context)
--insecure	bool	false	inherited, hidden. skip TLS certificate verification (DANGEROUS; development only)
--pin-sha256	stringArray	[]	inherited, hidden. trusted leaf SPKI SHA-256 pin, base64 or hex, repeatable — the engine prints it as pin_sha256 on the line reporting its certificate (default: current context)
--server	string	—	inherited, hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	inherited, hidden. tenant id (default $OLIVARES_TENANT, then current context)
--timeout	duration	10s	inherited, hidden. request timeout
--token	string	—	inherited, hidden. API bearer token (prefer –token-file: this form is visible in the process table and in shell history; default $OLIVARES_TOKEN, then current context)
--token-file	string	—	inherited, hidden. read the API bearer token from a file, or - for stdin

Command: olivares config tracing get

Read saved and effective tracing choices and environment overrides

olivares config tracing get

Declares no flags of its own; it takes those of olivares config tracing and the root command.

Command: olivares config tracing set

Save tracing choices and apply them now

olivares config tracing set

Flag	Type	Default	Description
--collector-insecure	bool	false	allow a plaintext collector on a trusted network
--enabled	bool	false	record and export tracing
--endpoint	string	—	OTLP collector host or HTTP(S) URL (no credentials)
--genai-compat	bool	false	also emit legacy GenAI attributes
--protocol	string	grpc	grpc or http/protobuf
--sample-ratio	float64	1	root trace sampling ratio from 0 to 1
--service-name	string	olivares	service name reported to the collector

Command: olivares config validate

Validate configured OLIVARES_* environment keys

olivares config validate

Declares no flags of its own; it takes those of olivares config and the root command.

Command: olivares connector

Scaffold out-of-tree connector projects

olivares connector

Declares no flags of its own; it takes those of olivares and the root command.

Command: olivares connector init

Generate a connector repository from an archetype template

olivares connector init <name>

Flag	Type	Default	Description
--dir	string	—	target directory (default ./<connector part>; non-empty dirs are refused)
--module	string	—	required. Go module path of the generated repository
--plugin	bool	true	emit cmd/<vendor-connector>/main.go and the sdk/plugin dependency
--sdk-path	string	—	DEV: path to a local checkout of the upstream repo’s sdk/ for replace directives
--template	string	—	required. archetype template: content-source | access-edge-source | output-sink | agent-surface | model-provider

Command: olivares consoleviews

Manage saved console views (filter and parameter sets)

olivares consoleviews

Aliases: views

Flag	Type	Default	Description
--allow-cleartext	bool	false	inherited, hidden. allow sending the credential to a non-loopback host over plain HTTP (DANGEROUS: it travels readable)
--ca-cert	string	—	inherited, hidden. PEM file containing an additional trusted root CA (default: current context)
--insecure	bool	false	inherited, hidden. skip TLS certificate verification (DANGEROUS; development only)
--pin-sha256	stringArray	[]	inherited, hidden. trusted leaf SPKI SHA-256 pin, base64 or hex, repeatable — the engine prints it as pin_sha256 on the line reporting its certificate (default: current context)
--server	string	—	inherited, hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	inherited, hidden. tenant id (default $OLIVARES_TENANT, then current context)
--timeout	duration	10s	inherited, hidden. request timeout
--token	string	—	inherited, hidden. API bearer token (prefer –token-file: this form is visible in the process table and in shell history; default $OLIVARES_TOKEN, then current context)
--token-file	string	—	inherited, hidden. read the API bearer token from a file, or - for stdin

Command: olivares consoleviews create

Save a new view

olivares consoleviews create

Flag	Type	Default	Description
--description	string	—	an optional description
--feature-id	string	—	the console feature this view belongs to (lowercase slug, required)
--name	string	—	the view’s name, unique per feature and owner (required)
--params	string	—	the view’s parameters as a JSON object
--params-file	string	—	read the parameters JSON from a file; ‘-’ reads stdin
--shared	bool	false	make the view visible to the whole tenant (only you can still change it)

Command: olivares consoleviews get

Show one saved view in full

olivares consoleviews get <view-id>

Declares no flags of its own; it takes those of olivares consoleviews and the root command.

Command: olivares consoleviews ls

List the views you can see

olivares consoleviews ls

Aliases: list

Flag	Type	Default	Description
--feature-id	string	—	only views belonging to this console feature

Command: olivares consoleviews rm

Delete your own saved view

olivares consoleviews rm <view-id>

Aliases: delete, remove

Flag	Type	Default	Description
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares consoleviews update

Replace the writable fields of your own view

olivares consoleviews update <view-id>

Flag	Type	Default	Description
--description	string	—	the description; omitting it CLEARS the stored one
--name	string	—	the view’s name (required: this is a replace, not a patch)
--params	string	—	the view’s parameters as a JSON object
--params-file	string	—	read the parameters JSON from a file; ‘-’ reads stdin
--shared	bool	false	share with the tenant; omitting it makes the view private again

Command: olivares db

Prepare and verify the database before serving (Postgres roles, RLS posture)

olivares db

Flag	Type	Default	Description
--format	string	text	inherited. deprecated alias for -o/–output on this command (text or json) — NOT the export-format flag of ‘audit export’ / ‘findings export’

Command: olivares db activate-directory-writer

Activate the User authority writer protocol on a stopped store (reopen required)

olivares db activate-directory-writer

Flag	Type	Default	Description
--actor	string	—	who performs the ceremony (recorded in the engine log); explicit, never taken from the environment
--admin-dsn	string	—	Postgres only: separate BYPASSRLS read-only admin DSN; without it, the attested closed directory inventory routine must be installed (accepts a file:/env: reference)
--data-dir	string	—	data directory (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--dsn	string	—	store DSN (default a SQLite file in the data dir)
--engine	string	sqlite	store engine: sqlite or postgres
--expected-generation	int64	0	the predecessor generation (1 on a fresh estate); activates staged or enforced legacy to target generation+1, or verifies that exact completed retry
--owner-dsn	string	—	Postgres only: owner-role DSN used at boot (accepts a file:/env: reference); leave empty for the single-role setup
--reason	string	—	why the rollout is complete (recorded in the engine log)
--writers-drained	bool	false	assert that NO old writer transaction is in flight (every engine on this store is stopped)
--writers-upgraded	bool	false	assert that EVERY writer process runs a binary carrying the directory writer wrapper

Command: olivares db check

Probe a DSN’s role posture and report whether the engine will accept it (read-only)

olivares db check

Flag	Type	Default	Description
--admin-dsn	string	—	cross-tenant admin-role DSN to probe (must be BYPASSRLS, NOT a superuser). Accepts a file:/env: reference
--dsn	string	—	application-role DSN to probe (must be NOSUPERUSER NOBYPASSRLS). Accepts a file:/env: reference
--engine	string	postgres	store engine the DSNs target: postgres or sqlite
--owner-dsn	string	—	owner-role DSN to probe (must be NOSUPERUSER NOBYPASSRLS). Accepts a file:/env: reference
--strict	bool	false	exit 1 for a proven boot refusal, or 6 when store access prevents a verdict

Command: olivares db init

Provision the least-privilege Postgres roles + database idempotently (no psql by hand)

olivares db init

Flag	Type	Default	Description
--admin-password	string	—	admin role password (prefer –admin-password-file)
--admin-password-file	string	—	read the admin role password from a file, or - for stdin
--admin-role	string	—	cross-tenant admin role for –admin-dsn (NOSUPERUSER BYPASSRLS). Empty = not provisioned; with –data-dir on a new installation a name is generated when the superuser DSN can create it
--app-password	string	—	application role password (prefer –app-password-file)
--app-password-file	string	—	read the application role password from a file, or - for stdin
--app-role	string	—	application role (runtime traffic; NOSUPERUSER NOBYPASSRLS; default olivares_app; with –data-dir, generated)
--data-dir	string	—	prepare quickstart’s PostgreSQL for this installation data directory: names generated for it, private DSN files saved under it (without –data-dir, db init keeps the classic result: database olivares, role olivares_app, nothing saved)
--database	string	—	application database name to create/own (default olivares; with –data-dir, generated for that installation)
--install-directory-inventory	bool	false	install ONLY (no provisioning, no grants): install and attest the closed tenant inventory on a database the engine has already migrated, so retention, legal hold and audit checkpoints cover every tenant without –admin-dsn; the database and role names come from –data-dir’s saved configuration unless named
--owner-password	string	—	owner role password (prefer –owner-password-file)
--owner-password-file	string	—	read the owner role password from a file, or - for stdin
--owner-role	string	—	SEPARATE owner role that owns the schema and runs DDL (enables the least-privilege split). Empty = the app role owns the schema; with –data-dir a separate owner is generated unless this is passed empty. Use on a FRESH database; adopting the split on an existing single-role db needs a manual REASSIGN OWNED first (see deploy/postgres/README.md)
--print-sql	bool	false	print the provisioning SQL (passwords redacted) and exit, without connecting
--sslmode	string	—	libpq sslmode (default verify-full for the printed DSN hints; with –data-dir, prefer for local hosts/sockets and verify-full for remote hosts; preserves an explicit DSN mode)
--superuser-dsn	string	—	superuser / maintenance DSN used ONLY to provision (e.g. postgres://postgres@host:5432/postgres). Accepts a file:/env: reference

Command: olivares db pg-service-file

Hidden diagnostic: it does not appear in --help output and is not part of the supported surface.

Write a private PostgreSQL service file for the internal client bridge

olivares db pg-service-file <file>

Flag	Type	Default	Description
--dsn	string	—	required. connection reference for the internal PostgreSQL client bridge

Command: olivares ddil

Hidden diagnostic: it does not appear in --help output and is not part of the supported surface.

Air-gap DDIL bundles: export, verify and import governance state across a disconnected gap

olivares ddil

Declares no flags of its own; it takes those of olivares and the root command.

Command: olivares ddil export

Assemble and sign a DDIL bundle from the local governance store

olivares ddil export

Flag	Type	Default	Description
--data-dir	string	—	data directory (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--dsn	string	—	store DSN (default a SQLite file in the data dir)
--engine	string	sqlite	store engine: sqlite or postgres
--evidence	stringArray	[]	evidence file as name=path (repeatable)
--expires	duration	0s	bundle lifetime from creation (zero means no expiry)
--from-seq	int64	1	first ledger sequence number to include
--max-staleness	duration	0s	per-tenant policy freshness bound carried with the snapshot
--no-policy	bool	false	omit the active policy snapshot plane
--notes	string	—	optional bundle notes
--out	string	—	required. output DDIL bundle file
--segment-events	int	10000	maximum events per audit segment
--sign-key	string	—	required. Ed25519 private key (base64 key/seed, or @file)
--tenant	string	—	tenant id to export (default $OLIVARES_TENANT)

Command: olivares ddil import

Verify, reconcile and apply a DDIL courier bundle fail-closed

olivares ddil import

Flag	Type	Default	Description
--audit-out	string	—	local WORM archive directory for carried audit segments
--bundle	string	—	required. DDIL courier bundle file
--checkpoint-pubkey	stringArray	[]	checkpoint public key pin for staged archive verification (repeatable; raw Ed25519 or <alg>:<base64 DER SPKI>)
--data-dir	string	—	data directory (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--dsn	string	—	store DSN (default a SQLite file in the data dir)
--engine	string	sqlite	store engine: sqlite or postgres
--event-pubkey	stringArray	[]	per-event Ed25519 public key pin for staged archive verification (repeatable), optionally epoch-FENCED as “<base64>@<last_seq>” or “<base64>@<lo>:<hi>”; a bare key is the current generation (pin every retired generation with its boundary to fence it)
--evidence-out	string	—	directory under which carried evidence is extracted read-only
--json	bool	false	hidden. deprecated alias for -o json
--pubkey	string	—	required. pinned raw Ed25519 bundle public key (base64, or @file)
--tenant	string	—	tenant that is allowed to receive the bundle (default $OLIVARES_TENANT)

Command: olivares ddil keygen

Generate an Ed25519 DDIL transport keypair

olivares ddil keygen

Flag	Type	Default	Description
--out	string	—	write the base64 private seed to this 0600 file

Command: olivares ddil verify

Verify and inspect a DDIL courier bundle without applying it

olivares ddil verify

Flag	Type	Default	Description
--bundle	string	—	required. DDIL courier bundle file
--json	bool	false	hidden. deprecated alias for -o json
--pubkey	string	—	required. pinned raw Ed25519 public key (base64, or @file)

Command: olivares deploy

Hidden diagnostic: it does not appear in --help output and is not part of the supported surface.

Declare, plan, apply, retire and roll back governed agent deployments

olivares deploy

Flag	Type	Default	Description
--allow-cleartext	bool	false	inherited, hidden. allow sending the credential to a non-loopback host over plain HTTP (DANGEROUS: it travels readable)
--ca-cert	string	—	inherited, hidden. PEM file containing an additional trusted root CA (default: current context)
--insecure	bool	false	inherited, hidden. skip TLS certificate verification (DANGEROUS; development only)
--pin-sha256	stringArray	[]	inherited, hidden. trusted leaf SPKI SHA-256 pin, base64 or hex, repeatable — the engine prints it as pin_sha256 on the line reporting its certificate (default: current context)
--server	string	—	inherited, hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	inherited, hidden. tenant id (default $OLIVARES_TENANT, then current context)
--timeout	duration	10s	inherited, hidden. request timeout
--token	string	—	inherited, hidden. API bearer token (prefer –token-file: this form is visible in the process table and in shell history; default $OLIVARES_TOKEN, then current context)
--token-file	string	—	inherited, hidden. read the API bearer token from a file, or - for stdin

Command: olivares deploy apply

Actuate the current version through the approval gate (two-phase)

olivares deploy apply <id>

Flag	Type	Default	Description
--approval-ref	string	—	phase 2: the approval that authorizes this apply

Command: olivares deploy definitions

Declare and version deployment definitions

olivares deploy definitions

Declares no flags of its own; it takes those of olivares deploy and the root command.

Command: olivares deploy definitions create

Declare a deployment definition from a JSON spec

olivares deploy definitions create

Flag	Type	Default	Description
--environment	string	—	required. target environment (required)
--name	string	—	required. deployment name (required)
--runtime	string	—	required. the runtime kind (required)
--source-ref	string	—	provenance reference for the spec, e.g. a commit
--spec-file	string	—	required. JSON spec object, ‘-’ for stdin (required)
--subject-kind	string	agent	what is being deployed
--subject-ref	string	—	required. the subject’s reference (required)
--target	string	—	required. the runtime target this deploys onto (required)

Command: olivares deploy definitions get

Show one definition with its current spec and real state

olivares deploy definitions get <id>

Declares no flags of its own; it takes those of olivares deploy definitions and the root command.

Command: olivares deploy definitions ls

List deployment definitions with their drift

olivares deploy definitions ls

Flag	Type	Default	Description
--cursor	string	—	continue from the cursor a previous page reported
--limit	int	0	page size (left out: the engine’s default)

Command: olivares deploy definitions revisions

List a definition’s revision history

olivares deploy definitions revisions <id>

Declares no flags of its own; it takes those of olivares deploy definitions and the root command.

Command: olivares deploy definitions rm

Delete a definition and its revisions (destructive; needs –yes when unattended)

olivares deploy definitions rm <id>

Flag	Type	Default	Description
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares deploy definitions update

Publish a new revision of a definition (PUT)

olivares deploy definitions update <id>

Flag	Type	Default	Description
--note	string	—	why this revision exists (recorded on the revision)
--source-ref	string	—	provenance reference for this revision
--spec-file	string	—	required. JSON spec object, ‘-’ for stdin (required)
--target	string	—	retarget the deployment

Command: olivares deploy operations

List the append-only ledger of plan/apply/retire/rollback operations

olivares deploy operations

Flag	Type	Default	Description
--cursor	string	—	continue from the cursor a previous page reported
--definition-id	string	—	only operations on this definition
--limit	int	0	page size (left out: the engine’s default)
--op	string	—	only operations of this kind
--status	string	—	only operations in this status

Command: olivares deploy plan

Compute the change set an apply WOULD make (nothing is actuated)

olivares deploy plan <id>

Declares no flags of its own; it takes those of olivares deploy and the root command.

Command: olivares deploy retire

Take a live deployment down (destructive POST; needs –yes when unattended)

olivares deploy retire <id>

Flag	Type	Default	Description
--approval-ref	string	—	phase 2: the approval that authorizes this retire
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares deploy rollback

Revert a definition to an earlier version (destructive POST; needs –yes when unattended)

olivares deploy rollback <id>

Flag	Type	Default	Description
--note	string	—	why the rollback happened (recorded on the revision)
--to-version	int64	0	required. the revision number to restore (required)
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares deploy verify

Check the real deployment against its declared spec

olivares deploy verify <id>

Declares no flags of its own; it takes those of olivares deploy and the root command.

Command: olivares deploy wirings

List what each deployment is wired to, and how that was attributed

olivares deploy wirings

Flag	Type	Default	Description
--cursor	string	—	continue from the cursor a previous page reported
--definition-id	string	—	only wirings of this definition
--limit	int	0	page size (left out: the engine’s default)
--status	string	—	only wirings in this status

Command: olivares doctor

Check this host’s installation and say what to fix

olivares doctor

Flag	Type	Default	Description
--audit-tenant	string	—	also run strict local audit verification for this tenant
--binary	string	—	installed olivares binary (default: this executable)
--ca-cert	string	—	PEM trust anchor (default <data-dir>/tls.crt)
--check-updates	bool	false	also run the signed channel check (network; may record fresh CRL observations)
--config	string	—	service env file (default follows –mode)
--data-dir	string	—	service data directory (default $OLIVARES_DATA_DIR, else follows –mode)
--init	string	auto	init adapter: auto | systemd | openrc | launchd
--mode	string	auto	service scope: auto | user | system
--server	string	https://127.0.0.1:8443	local engine origin (default: the bind the running engine recorded in <data-dir>/console.json, else https://127.0.0.1:8443). Passing it wins over the recording and must be an https origin
--timeout	duration	10s	deadline for each init/network subprocess
--unit	string	—	service unit/plist path (default follows –mode and –init)

Command: olivares dr

Disaster recovery: ledger-continuity-safe backup and restore

olivares dr

Declares no flags of its own; it takes those of olivares and the root command.

Command: olivares dr backup

Write a ledger-continuity-safe DR bundle

olivares dr backup

Flag	Type	Default	Description
--admin-dsn	string	—	Postgres only: NOSUPERUSER BYPASSRLS role DSN. REQUIRED to run pg_dump directly (it keeps row_security=off and ABORTS as the application role under FORCE RLS); also used for the cross-tenant org list, without which a backup may MISS tenants — see deploy/postgres/01-app-role.sql
--allow-unverified	bool	false	capture even if a tenant chain fails verification at backup time (NOT recommended)
--data-dir	string	—	data directory (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--dsn	string	—	store DSN (default a SQLite file in the data dir)
--engine	string	sqlite	store engine: sqlite or postgres
--gfs-daily	int	0	GFS retention: keep the newest bundle of each of the last N days (0 = tier off)
--gfs-keep-last	int	0	GFS retention: always keep the N newest bundles regardless of period
--gfs-monthly	int	0	GFS retention: keep the newest bundle of each of the last N months
--gfs-weekly	int	0	GFS retention: keep the newest bundle of each of the last N ISO weeks
--gfs-yearly	int	0	GFS retention: keep the newest bundle of each of the last N years
--kek-key-file	string	—	file holding a raw/base64 32-byte key-encryption key (the KMS-unwrapped path); or $OLIVARES_DR_KEK_FILE
--notes	string	—	free-form operator note recorded in the manifest (no secrets)
--offsite-access-key-id-file	string	—	file holding the offsite access key id (credential by reference; falls back to $AWS_ACCESS_KEY_ID)
--offsite-bucket	string	—	offsite bucket for DR bundles (set to enable offsite replication)
--offsite-endpoint	string	—	S3-compatible endpoint for offsite replication (R2/MinIO/Wasabi); empty = AWS S3 from –offsite-region
--offsite-path-style	bool	false	force path-style S3 addressing (implied by a custom –offsite-endpoint)
--offsite-prefix	string	—	key prefix within the offsite bucket
--offsite-region	string	—	offsite region (default us-east-1; Cloudflare R2 uses ‘auto’)
--offsite-secret-access-key-file	string	—	file holding the offsite secret access key (credential by reference; falls back to $AWS_SECRET_ACCESS_KEY)
--offsite-session-token-file	string	—	optional file holding an STS session token (falls back to $AWS_SESSION_TOKEN)
--out	string	—	required. path to write the DR bundle to (required)
--owner-dsn	string	—	Postgres: the owner role, required in a split-role deployment (the app role has no schema CREATE). It runs the migrations AND is the pg_restore target, so the restored objects are owned by the owner exactly as the source’s are. Accepts a file:/env: reference
--passphrase-file	string	—	file holding the backup passphrase (Argon2id-derived KEK); or $OLIVARES_DR_PASSPHRASE_FILE
--pg-dump	string	pg_dump	pg_dump executable (Postgres engine only)
--pitr-ref	string	—	Postgres only: build a keys+manifest companion bundle for a point-in-time-recovery archive (no store bytes); the value is a human pointer to the WAL archive
--retain-days	int	0	after a successful write, prune sibling *.drbundle files older than N days in the –out directory (0 = keep all). The offsite mirror keeps longer (3-2-1)
--snapshot-file	string	—	Postgres only: use this pre-made dump as the store snapshot instead of running pg_dump (e.g. produced by a postgres-client sidecar)

Command: olivares dr drill

Drill synthetic-ledger continuity and print measured RTO

olivares dr drill

Flag	Type	Default	Description
--events	int	500	ledger events to seed in the ephemeral estate
--keep-artifacts	bool	false	keep the scratch dir instead of removing it (debugging)

Command: olivares dr inspect

Print a DR bundle’s manifest (no KEK needed; no secrets shown)

olivares dr inspect

Flag	Type	Default	Description
--in	string	—	required. DR bundle to inspect (required)

Command: olivares dr ls

List DR bundles (local, or –offsite for the S3/R2 mirror)

olivares dr ls

Aliases: list

Flag	Type	Default	Description
--dir	string	—	local backup directory (default <data-dir>/backups)
--offsite	bool	false	list the offsite mirror instead of the local directory
--offsite-access-key-id-file	string	—	file holding the offsite access key id (credential by reference; falls back to $AWS_ACCESS_KEY_ID)
--offsite-bucket	string	—	offsite bucket for DR bundles (set to enable offsite replication)
--offsite-endpoint	string	—	S3-compatible endpoint for offsite replication (R2/MinIO/Wasabi); empty = AWS S3 from –offsite-region
--offsite-path-style	bool	false	force path-style S3 addressing (implied by a custom –offsite-endpoint)
--offsite-prefix	string	—	key prefix within the offsite bucket
--offsite-region	string	—	offsite region (default us-east-1; Cloudflare R2 uses ‘auto’)
--offsite-secret-access-key-file	string	—	file holding the offsite secret access key (credential by reference; falls back to $AWS_SECRET_ACCESS_KEY)
--offsite-session-token-file	string	—	optional file holding an STS session token (falls back to $AWS_SESSION_TOKEN)

Command: olivares dr pull

Download a DR bundle from the offsite S3/R2 target

olivares dr pull

Flag	Type	Default	Description
--name	string	—	required. offsite bundle name to download (required)
--offsite-access-key-id-file	string	—	file holding the offsite access key id (credential by reference; falls back to $AWS_ACCESS_KEY_ID)
--offsite-bucket	string	—	offsite bucket for DR bundles (set to enable offsite replication)
--offsite-endpoint	string	—	S3-compatible endpoint for offsite replication (R2/MinIO/Wasabi); empty = AWS S3 from –offsite-region
--offsite-path-style	bool	false	force path-style S3 addressing (implied by a custom –offsite-endpoint)
--offsite-prefix	string	—	key prefix within the offsite bucket
--offsite-region	string	—	offsite region (default us-east-1; Cloudflare R2 uses ‘auto’)
--offsite-secret-access-key-file	string	—	file holding the offsite secret access key (credential by reference; falls back to $AWS_SECRET_ACCESS_KEY)
--offsite-session-token-file	string	—	optional file holding an STS session token (falls back to $AWS_SESSION_TOKEN)
--out	string	—	required. local path to write the bundle to (required)

Command: olivares dr push

Upload an existing DR bundle to the offsite S3/R2 target

olivares dr push

Flag	Type	Default	Description
--in	string	—	required. local DR bundle to upload (required)
--offsite-access-key-id-file	string	—	file holding the offsite access key id (credential by reference; falls back to $AWS_ACCESS_KEY_ID)
--offsite-bucket	string	—	offsite bucket for DR bundles (set to enable offsite replication)
--offsite-endpoint	string	—	S3-compatible endpoint for offsite replication (R2/MinIO/Wasabi); empty = AWS S3 from –offsite-region
--offsite-path-style	bool	false	force path-style S3 addressing (implied by a custom –offsite-endpoint)
--offsite-prefix	string	—	key prefix within the offsite bucket
--offsite-region	string	—	offsite region (default us-east-1; Cloudflare R2 uses ‘auto’)
--offsite-secret-access-key-file	string	—	file holding the offsite secret access key (credential by reference; falls back to $AWS_SECRET_ACCESS_KEY)
--offsite-session-token-file	string	—	optional file holding an STS session token (falls back to $AWS_SESSION_TOKEN)

Command: olivares dr restore

Restore a DR bundle and verify ledger continuity (non-zero exit if not safe)

olivares dr restore

Flag	Type	Default	Description
--admin-dsn	string	—	Postgres only: NOSUPERUSER BYPASSRLS role DSN. REQUIRED to run pg_dump directly (it keeps row_security=off and ABORTS as the application role under FORCE RLS); also used for the cross-tenant org list, without which a backup may MISS tenants — see deploy/postgres/01-app-role.sql
--allow-legacy-unsigned	bool	false	accept a separately authenticated pre-v26.9 bundle without the keyed manifest signature (migration exception)
--data-dir	string	—	data directory (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--dsn	string	—	store DSN (default a SQLite file in the data dir)
--engine	string	sqlite	store engine: sqlite or postgres
--force	bool	false	overwrite existing keys / store file in the data dir
--in	string	—	required. DR bundle to restore (required)
--in-place	bool	false	replace a LIVE data dir safely: stage + verify BEFORE promoting, auto-preserving the current store/keys as *.pre-restore-<ts> (sqlite only)
--kek-key-file	string	—	file holding a raw/base64 32-byte key-encryption key (the KMS-unwrapped path); or $OLIVARES_DR_KEK_FILE
--operator	string	—	who is performing this restore (required when the restore REPLACES an existing estate; recorded in the restored ledger). A declaration, not an authentication: the console’s dual-control gate does not reach this path
--owner-dsn	string	—	Postgres: the owner role, required in a split-role deployment (the app role has no schema CREATE). It runs the migrations AND is the pg_restore target, so the restored objects are owned by the owner exactly as the source’s are. Accepts a file:/env: reference
--passphrase-file	string	—	file holding the backup passphrase (Argon2id-derived KEK); or $OLIVARES_DR_PASSPHRASE_FILE
--pg-restore	string	pg_restore	pg_restore executable (Postgres engine only)
--reason	string	—	why this restore is being performed — an incident id or change reference (required when the restore REPLACES an existing estate; recorded in the restored ledger)
--superuser-dsn	string	—	Postgres logical restore only: explicit DBA connection to the target database, used solely to restore isolated directory inventory authority; accepts a file:/env: reference

Command: olivares dr restore-status

Read the destination’s restore controls without opening the engine

olivares dr restore-status

Flag	Type	Default	Description
--admin-dsn	string	—	Postgres only: NOSUPERUSER BYPASSRLS role DSN. REQUIRED to run pg_dump directly (it keeps row_security=off and ABORTS as the application role under FORCE RLS); also used for the cross-tenant org list, without which a backup may MISS tenants — see deploy/postgres/01-app-role.sql
--data-dir	string	—	data directory (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--dsn	string	—	store DSN (default a SQLite file in the data dir)
--engine	string	sqlite	store engine: sqlite or postgres
--owner-dsn	string	—	Postgres: the owner role, required in a split-role deployment (the app role has no schema CREATE). It runs the migrations AND is the pg_restore target, so the restored objects are owned by the owner exactly as the source’s are. Accepts a file:/env: reference

Command: olivares dr verify

Test a DR bundle WITHOUT touching the live data dir (the DR drill)

olivares dr verify

Flag	Type	Default	Description
--allow-legacy-unsigned	bool	false	accept a separately authenticated pre-v26.9 bundle without the keyed manifest signature (migration exception)
--in	string	—	required. DR bundle to verify (required)
--kek-key-file	string	—	file holding a raw/base64 32-byte key-encryption key (the KMS-unwrapped path); or $OLIVARES_DR_KEK_FILE
--passphrase-file	string	—	file holding the backup passphrase (Argon2id-derived KEK); or $OLIVARES_DR_PASSPHRASE_FILE

Command: olivares evals

Eval methodology tools: the CI regression gate and the judge-calibration labeler

olivares evals

Declares no flags of its own; it takes those of olivares and the root command.

Command: olivares evals gate

Run the CI regression gate (exit 0 pass/warn, 1 fail) or re-check one after a governed override

olivares evals gate

Flag	Type	Default	Description
--baseline	string	—	explicit baseline run id (default: pinned baseline or latest prior run)
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--check-id	string	—	re-check an existing gate id (after a governed override)
--comparison-mode	string	same_candidate	comparison v1: same_candidate or candidate_change (requires –baseline)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--json	bool	false	hidden. deprecated alias for -o json
--model	string	—	declared candidate model (distinct from the suite judge)
--outputs	string	—	JSON file mapping case_key → candidate output (‘-’ = stdin)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--sample-size	int	0	judge at most N cases (deterministic subset; 0 = all)
--seed	string	—	deterministic sample seed (default: derived from the suite version)
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--subject	string	—	subject ref (e.g. the agent/model under test)
--subject-kind	string	—	subject kind (defaults to the suite’s)
--suite	string	—	suite id to gate against
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	10m0s	hidden. request timeout (a judged gate can take a while)
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin
--variant	string	—	declared candidate prompt variant

Command: olivares evals label

Guided human-labeling session for the judge↔human calibration set

olivares evals label

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--criterion	string	—	default criterion for items that carry none
--in	string	—	JSONL file of candidate items to label
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--set	string	default	calibration set name
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	10m0s	hidden. request timeout (a judged gate can take a while)
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares eventing

Manage the eventing platform (webhook event subscriptions, deliveries, event log)

olivares eventing

Flag	Type	Default	Description
--format	string	text	inherited. deprecated alias for -o/–output on this command (text or json) — NOT the export-format flag of ‘audit export’ / ‘findings export’

Command: olivares eventing dead-letters

Inspect and redeliver dead-lettered deliveries

olivares eventing dead-letters

Declares no flags of its own; it takes those of olivares eventing and the root command.

Command: olivares eventing dead-letters ls

List dead-lettered deliveries (status=dead)

olivares eventing dead-letters ls

Flag	Type	Default	Description
--data-dir	string	—	data directory (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--dsn	string	—	store DSN (default a SQLite file in the data dir)
--engine	string	sqlite	store engine: sqlite or postgres
--subscription	string	—	filter by subscription id
--tenant	string	—	tenant id (default $OLIVARES_TENANT)

Command: olivares eventing dead-letters redeliver

Requeue a dead-lettered delivery for retry

olivares eventing dead-letters redeliver

Flag	Type	Default	Description
--data-dir	string	—	data directory (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--dsn	string	—	store DSN (default a SQLite file in the data dir)
--engine	string	sqlite	store engine: sqlite or postgres
--id	string	—	required. delivery id to redeliver
--tenant	string	—	tenant id (default $OLIVARES_TENANT)

Command: olivares eventing deliveries

Inspect delivery state (ls)

olivares eventing deliveries

Declares no flags of its own; it takes those of olivares eventing and the root command.

Command: olivares eventing deliveries ls

List deliveries (optionally filtered by –subscription, –status)

olivares eventing deliveries ls

Flag	Type	Default	Description
--data-dir	string	—	data directory (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--dsn	string	—	store DSN (default a SQLite file in the data dir)
--engine	string	sqlite	store engine: sqlite or postgres
--status	string	—	filter by status (queued|delivering|delivered|dead|denied)
--subscription	string	—	filter by subscription id
--tenant	string	—	tenant id (default $OLIVARES_TENANT)

Command: olivares eventing egress

Inspect and actuate the egress destination control’s rollout

olivares eventing egress

Declares no flags of its own; it takes those of olivares eventing and the root command.

Command: olivares eventing egress actuate

Apply a deliberate rollout decision for the egress destination control

olivares eventing egress actuate

Flag	Type	Default	Description
--accept-blocked	bool	false	proceed even though listed destinations stop delivering
--accept-unfenced	bool	false	proceed with the egress writer fence dormant, so nothing enforces –assert-writers-upgraded
--actor	string	—	who is deciding (default: $OLIVARES_ACTOR or the OS user)
--admin-dsn	string	—	Postgres: the dedicated BYPASSRLS role, required to enumerate every tenant
--assert-writers-upgraded	bool	false	assert that every node able to author a subscription runs a binary carrying this control — required
--data-dir	string	—	data directory (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--dsn	string	—	store DSN (default a SQLite file in the data dir)
--engine	string	sqlite	store engine: sqlite or postgres
--mode	string	—	enforced | policy_optional
--owner-dsn	string	—	Postgres: the owner role, required in a split-role deployment (the app role has no schema CREATE)
--reason	string	—	why (a change ticket reference belongs here) — required

Command: olivares eventing egress status

Report the rollout disposition and what enforcing would block

olivares eventing egress status

Flag	Type	Default	Description
--admin-dsn	string	—	Postgres: the dedicated BYPASSRLS role, required to enumerate every tenant
--data-dir	string	—	data directory (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--dsn	string	—	store DSN (default a SQLite file in the data dir)
--engine	string	sqlite	store engine: sqlite or postgres
--json	bool	false	hidden. deprecated alias for -o json
--owner-dsn	string	—	Postgres: the owner role, required in a split-role deployment (the app role has no schema CREATE)

Command: olivares eventing events

Inspect the captured event log

olivares eventing events

Declares no flags of its own; it takes those of olivares eventing and the root command.

Command: olivares eventing events ls

List captured events (optionally from a seq cursor, filtered by –type)

olivares eventing events ls

Flag	Type	Default	Description
--data-dir	string	—	data directory (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--dsn	string	—	store DSN (default a SQLite file in the data dir)
--engine	string	sqlite	store engine: sqlite or postgres
--since-seq	int64	0	list events with seq >= this value
--tenant	string	—	tenant id (default $OLIVARES_TENANT)
--type	string	—	filter by event type

Command: olivares eventing fence

Inspect, arm and verify the cross-version egress writer fence

olivares eventing fence

Declares no flags of its own; it takes those of olivares eventing and the root command.

Command: olivares eventing fence arm

Require every writer to prove it carries the egress gate

olivares eventing fence arm

Flag	Type	Default	Description
--actor	string	—	who is deciding (default: $OLIVARES_ACTOR or the OS user)
--admin-dsn	string	—	Postgres: the dedicated BYPASSRLS role
--assert-writers-upgraded	bool	false	acknowledge that arming makes an un-upgraded authoring node fail — required
--data-dir	string	—	data directory (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--dsn	string	—	store DSN (default a SQLite file in the data dir)
--engine	string	sqlite	store engine: sqlite or postgres
--owner-dsn	string	—	Postgres: the owner role, required in a split-role deployment (the app role has no schema CREATE)
--reason	string	—	why (a change ticket reference belongs here) — required

Command: olivares eventing fence status

Report the writer fence’s posture and whether the database enforces it

olivares eventing fence status

Flag	Type	Default	Description
--admin-dsn	string	—	Postgres: the dedicated BYPASSRLS role
--data-dir	string	—	data directory (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--dsn	string	—	store DSN (default a SQLite file in the data dir)
--engine	string	sqlite	store engine: sqlite or postgres
--json	bool	false	emit JSON
--owner-dsn	string	—	Postgres: the owner role, required in a split-role deployment (the app role has no schema CREATE)

Command: olivares eventing fence verify

Fail unless the database is actually enforcing an armed writer fence

olivares eventing fence verify

Flag	Type	Default	Description
--admin-dsn	string	—	Postgres: the dedicated BYPASSRLS role
--data-dir	string	—	data directory (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--dsn	string	—	store DSN (default a SQLite file in the data dir)
--engine	string	sqlite	store engine: sqlite or postgres
--owner-dsn	string	—	Postgres: the owner role, required in a split-role deployment (the app role has no schema CREATE)

Command: olivares eventing subscriptions

Manage event subscriptions (ls, get, create, update, rotate-secret, rm, test)

olivares eventing subscriptions

Declares no flags of its own; it takes those of olivares eventing and the root command.

Command: olivares eventing subscriptions create

Create a new event subscription

olivares eventing subscriptions create

Flag	Type	Default	Description
--auth-header-name	string	—	custom header name (required when –auth-type=header)
--auth-type	string	none	additional auth header type: none|bearer|basic|header
--data-dir	string	—	data directory (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--description	string	—	optional description
--dsn	string	—	store DSN (default a SQLite file in the data dir)
--endpoint	string	—	required. webhook endpoint URL (https required)
--engine	string	sqlite	store engine: sqlite or postgres
--event-types	stringSlice	[]	required. event types to subscribe to (comma-separated)
--initial-interval	int64	0	initial retry interval in seconds (0 = module default)
--max-attempts	int64	0	max delivery attempts (0 = module default)
--name	string	—	required. subscription name
--role	string	viewer	authorization role for the per-event RBAC filter (viewer|editor|admin|owner)
--tenant	string	—	tenant id (default $OLIVARES_TENANT)

Command: olivares eventing subscriptions get

Show one event subscription in full

olivares eventing subscriptions get

Aliases: show

Flag	Type	Default	Description
--data-dir	string	—	data directory (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--dsn	string	—	store DSN (default a SQLite file in the data dir)
--engine	string	sqlite	store engine: sqlite or postgres
--id	string	—	required. subscription id
--tenant	string	—	tenant id (default $OLIVARES_TENANT)

Command: olivares eventing subscriptions ls

List event subscriptions for a tenant

olivares eventing subscriptions ls

Flag	Type	Default	Description
--data-dir	string	—	data directory (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--dsn	string	—	store DSN (default a SQLite file in the data dir)
--engine	string	sqlite	store engine: sqlite or postgres
--tenant	string	—	tenant id (default $OLIVARES_TENANT)

Command: olivares eventing subscriptions rm

Delete an event subscription

olivares eventing subscriptions rm

Aliases: delete, remove

Flag	Type	Default	Description
--data-dir	string	—	data directory (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--dsn	string	—	store DSN (default a SQLite file in the data dir)
--engine	string	sqlite	store engine: sqlite or postgres
--id	string	—	required. subscription id
--tenant	string	—	tenant id (default $OLIVARES_TENANT)
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares eventing subscriptions rotate-secret

Reissue the signing secret for one subscription (breaks delivery until the receiver is updated)

olivares eventing subscriptions rotate-secret

Aliases: rotate

Flag	Type	Default	Description
--data-dir	string	—	data directory (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--dsn	string	—	store DSN (default a SQLite file in the data dir)
--engine	string	sqlite	store engine: sqlite or postgres
--id	string	—	subscription id
--tenant	string	—	tenant id (default $OLIVARES_TENANT)
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares eventing subscriptions test

Send a test delivery to a subscription’s endpoint

olivares eventing subscriptions test

Flag	Type	Default	Description
--data-dir	string	—	data directory (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--dsn	string	—	store DSN (default a SQLite file in the data dir)
--engine	string	sqlite	store engine: sqlite or postgres
--id	string	—	required. subscription id to test
--tenant	string	—	tenant id (default $OLIVARES_TENANT)

Command: olivares eventing subscriptions update

Edit one event subscription in place (never reissues the secret)

olivares eventing subscriptions update

Aliases: edit, set

Flag	Type	Default	Description
--auth-header-name	string	—	new auth header name
--auth-type	string	—	new auth type
--data-dir	string	—	data directory (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--description	string	—	new description
--dsn	string	—	store DSN (default a SQLite file in the data dir)
--enabled	bool	true	enable or disable delivery (–enabled=false to pause)
--endpoint	string	—	new https endpoint (the signing secret is NOT reissued)
--engine	string	sqlite	store engine: sqlite or postgres
--event-types	stringSlice	[]	replacement event type list
--id	string	—	subscription id
--initial-interval	int64	0	new initial retry interval in seconds
--max-attempts	int64	0	new maximum delivery attempts
--name	string	—	new subscription name
--role	string	—	new delivery role
--tenant	string	—	tenant id (default $OLIVARES_TENANT)

Command: olivares exit-codes

Hidden diagnostic: it does not appear in --help output and is not part of the supported surface.

What the exit codes of olivares mean

olivares exit-codes

Declares no flags of its own; it takes those of olivares and the root command.

Command: olivares findings

Export governed security findings

olivares findings

Flag	Type	Default	Description
--allow-cleartext	bool	false	inherited, hidden. allow sending the credential to a non-loopback host over plain HTTP (DANGEROUS: it travels readable)
--ca-cert	string	—	inherited, hidden. PEM file containing an additional trusted root CA (default: current context)
--insecure	bool	false	inherited, hidden. skip TLS certificate verification (DANGEROUS; development only)
--pin-sha256	stringArray	[]	inherited, hidden. trusted leaf SPKI SHA-256 pin, base64 or hex, repeatable — the engine prints it as pin_sha256 on the line reporting its certificate (default: current context)
--server	string	—	inherited, hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	inherited, hidden. tenant id (default $OLIVARES_TENANT, then current context)
--timeout	duration	10s	inherited, hidden. request timeout
--token	string	—	inherited, hidden. API bearer token (prefer –token-file: this form is visible in the process table and in shell history; default $OLIVARES_TOKEN, then current context)
--token-file	string	—	inherited, hidden. read the API bearer token from a file, or - for stdin

Command: olivares findings export

Export all matching findings as SARIF 2.1.0

olivares findings export

Flag	Type	Default	Description
--format	string	sarif	export format: sarif (this selects the EXPORT format and is fully supported — it is not the deprecated -o/–output alias other commands spell the same way)
--out	string	—	output file (default: stdout)

Command: olivares finops

Hidden diagnostic: it does not appear in --help output and is not part of the supported surface.

Report AI spend and value, and govern budgets, rates and cost centers

olivares finops

Flag	Type	Default	Description
--allow-cleartext	bool	false	inherited, hidden. allow sending the credential to a non-loopback host over plain HTTP (DANGEROUS: it travels readable)
--ca-cert	string	—	inherited, hidden. PEM file containing an additional trusted root CA (default: current context)
--insecure	bool	false	inherited, hidden. skip TLS certificate verification (DANGEROUS; development only)
--pin-sha256	stringArray	[]	inherited, hidden. trusted leaf SPKI SHA-256 pin, base64 or hex, repeatable — the engine prints it as pin_sha256 on the line reporting its certificate (default: current context)
--server	string	—	inherited, hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	inherited, hidden. tenant id (default $OLIVARES_TENANT, then current context)
--timeout	duration	10s	inherited, hidden. request timeout
--token	string	—	inherited, hidden. API bearer token (prefer –token-file: this form is visible in the process table and in shell history; default $OLIVARES_TOKEN, then current context)
--token-file	string	—	inherited, hidden. read the API bearer token from a file, or - for stdin

Command: olivares finops admission

Reserve spend before an effect, settle it, and reconcile the holds

olivares finops admission

Declares no flags of its own; it takes those of olivares finops and the root command.

Command: olivares finops admission commit

Commit a hold at its measured cost

olivares finops admission commit

Flag	Type	Default	Description
--data	string	—	request document: inline JSON, @FILE, or - for stdin

Command: olivares finops admission reconcile

Run admission recovery and file a finding on drift

olivares finops admission reconcile

Declares no flags of its own; it takes those of olivares finops admission and the root command.

Command: olivares finops admission reconciliation

Read the holds against their settlements

olivares finops admission reconciliation

Declares no flags of its own; it takes those of olivares finops admission and the root command.

Command: olivares finops admission release

Release a hold whose effect did not run

olivares finops admission release

Flag	Type	Default	Description
--data	string	—	request document: inline JSON, @FILE, or - for stdin

Command: olivares finops admission reserve

Reserve estimated spend before an effect

olivares finops admission reserve

Flag	Type	Default	Description
--data	string	—	request document: inline JSON, @FILE, or - for stdin

Command: olivares finops alerts

List budget threshold alerts

olivares finops alerts

Flag	Type	Default	Description
--all	bool	false	follow the cursor to the end and emit one merged page (json output carries has_more:false and no cursor)
--budget-id	string	—	only alerts raised by this budget
--cursor	string	—	opaque cursor from a previous page’s cursor field
--limit	int	0	page size to request (left out: the engine’s default)

Command: olivares finops budgets

Govern spend budgets and read their status

olivares finops budgets

Declares no flags of its own; it takes those of olivares finops and the root command.

Command: olivares finops budgets create

Create a budget

olivares finops budgets create

Flag	Type	Default	Description
--data	string	—	request document: inline JSON, @FILE, or - for stdin

Command: olivares finops budgets get

Show one budget

olivares finops budgets get <budget-id>

Declares no flags of its own; it takes those of olivares finops budgets and the root command.

Command: olivares finops budgets ls

List budgets

olivares finops budgets ls

Aliases: list

Flag	Type	Default	Description
--all	bool	false	follow the cursor to the end and emit one merged page (json output carries has_more:false and no cursor)
--cursor	string	—	opaque cursor from a previous page’s cursor field
--limit	int	0	page size to request (left out: the engine’s default)

Command: olivares finops budgets rm

Delete a budget

olivares finops budgets rm <budget-id>

Aliases: delete

Flag	Type	Default	Description
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares finops budgets status

Show one budget’s live status against its cap

olivares finops budgets status <budget-id>

Declares no flags of its own; it takes those of olivares finops budgets and the root command.

Command: olivares finops budgets update

Replace a budget

olivares finops budgets update <budget-id>

Flag	Type	Default	Description
--data	string	—	request document: inline JSON, @FILE, or - for stdin

Command: olivares finops comparison

Compare what a workload would cost on other models

olivares finops comparison

Flag	Type	Default	Description
--dim-key	string	—	restrict the comparison to this key within the dimension
--dimension	string	—	restrict the comparison to this dimension
--forecast-period	string	—	period to project the saving over
--since	string	—	start of the window, RFC3339 (e.g. 2026-08-01T00:00:00Z)
--source-model	string	—	the model the observed workload ran on
--target-models	string	—	candidate models to price the same workload against
--until	string	—	end of the window, RFC3339
--window-days	string	—	days of history to compare over

Command: olivares finops cost

Record an observed cost sample

olivares finops cost

Declares no flags of its own; it takes those of olivares finops and the root command.

Command: olivares finops cost ingest

Record one observed cost sample

olivares finops cost ingest

Flag	Type	Default	Description
--data	string	—	request document: inline JSON, @FILE, or - for stdin

Command: olivares finops cost-centers

Govern cost centers and the rules that map spend to them

olivares finops cost-centers

Aliases: cost-centres

Declares no flags of its own; it takes those of olivares finops and the root command.

Command: olivares finops cost-centers create

Create a cost center

olivares finops cost-centers create

Flag	Type	Default	Description
--data	string	—	request document: inline JSON, @FILE, or - for stdin

Command: olivares finops cost-centers get

Show one cost center

olivares finops cost-centers get <cost-center-id>

Declares no flags of its own; it takes those of olivares finops cost-centers and the root command.

Command: olivares finops cost-centers ls

List cost centers

olivares finops cost-centers ls

Aliases: list

Flag	Type	Default	Description
--all	bool	false	follow the cursor to the end and emit one merged page (json output carries has_more:false and no cursor)
--cursor	string	—	opaque cursor from a previous page’s cursor field
--limit	int	0	page size to request (left out: the engine’s default)
--status	string	—	only cost centers in this status

Command: olivares finops cost-centers mappings

Govern the rules that map spend onto one cost center

olivares finops cost-centers mappings

Declares no flags of its own; it takes those of olivares finops cost-centers and the root command.

Command: olivares finops cost-centers mappings add

Add a mapping rule to a cost center

olivares finops cost-centers mappings add <cost-center-id>

Flag	Type	Default	Description
--data	string	—	request document: inline JSON, @FILE, or - for stdin

Command: olivares finops cost-centers mappings ls

List one cost centre’s mapping rules

olivares finops cost-centers mappings ls <cost-center-id>

Aliases: list

Declares no flags of its own; it takes those of olivares finops cost-centers mappings and the root command.

Command: olivares finops cost-centers mappings rm

Remove a mapping rule from a cost center

olivares finops cost-centers mappings rm <cost-center-id> <mapping-id>

Aliases: delete

Flag	Type	Default	Description
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares finops cost-centers rm

Delete a cost center

olivares finops cost-centers rm <cost-center-id>

Aliases: delete

Flag	Type	Default	Description
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares finops cost-centers update

Replace a cost center

olivares finops cost-centers update <cost-center-id>

Flag	Type	Default	Description
--data	string	—	request document: inline JSON, @FILE, or - for stdin

Command: olivares finops forecast

Forecast spend from the observed history

olivares finops forecast

Flag	Type	Default	Description
--dimension	string	—	forecast per this dimension
--period	string	—	forecast period (e.g. monthly)
--window-days	string	—	days of history the projection is built from

Command: olivares finops outcomes

Record and read business outcomes attributed to AI work

olivares finops outcomes

Declares no flags of its own; it takes those of olivares finops and the root command.

Command: olivares finops outcomes ingest

Record one business outcome

olivares finops outcomes ingest

Flag	Type	Default	Description
--data	string	—	request document: inline JSON, @FILE, or - for stdin

Command: olivares finops outcomes ls

List recorded outcomes

olivares finops outcomes ls

Aliases: list

Flag	Type	Default	Description
--all	bool	false	follow the cursor to the end and emit one merged page (json output carries has_more:false and no cursor)
--cursor	string	—	opaque cursor from a previous page’s cursor field
--limit	int	0	page size to request (left out: the engine’s default)
--subject-kind	string	—	only outcomes whose subject is of this kind
--subject-ref	string	—	only outcomes for this subject reference

Command: olivares finops rates

Govern the model rate catalog used to price usage

olivares finops rates

Aliases: model-rates

Declares no flags of its own; it takes those of olivares finops and the root command.

Command: olivares finops rates create

Add a model rate

olivares finops rates create

Flag	Type	Default	Description
--data	string	—	request document: inline JSON, @FILE, or - for stdin

Command: olivares finops rates get

Show one model rate

olivares finops rates get <rate-id>

Declares no flags of its own; it takes those of olivares finops rates and the root command.

Command: olivares finops rates ls

List model rates

olivares finops rates ls

Aliases: list

Flag	Type	Default	Description
--all	bool	false	follow the cursor to the end and emit one merged page (json output carries has_more:false and no cursor)
--cursor	string	—	opaque cursor from a previous page’s cursor field
--limit	int	0	page size to request (left out: the engine’s default)
--model	string	—	only rates for this model reference
--provider	string	—	only rates for this provider

Command: olivares finops rates rm

Delete a model rate

olivares finops rates rm <rate-id>

Aliases: delete

Flag	Type	Default	Description
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares finops rates update

Replace a model rate

olivares finops rates update <rate-id>

Flag	Type	Default	Description
--data	string	—	request document: inline JSON, @FILE, or - for stdin

Command: olivares finops recommendations

Show cost-reduction recommendations

olivares finops recommendations

Declares no flags of its own; it takes those of olivares finops and the root command.

Command: olivares finops seats

Record seat counts and read seat utilization

olivares finops seats

Declares no flags of its own; it takes those of olivares finops and the root command.

Command: olivares finops seats ingest

Record a provider’s seat counts for a day

olivares finops seats ingest

Flag	Type	Default	Description
--data	string	—	request document: inline JSON, @FILE, or - for stdin

Command: olivares finops seats utilization

Show seat utilization

olivares finops seats utilization

Flag	Type	Default	Description
--from	string	—	first day, YYYY-MM-DD (UTC; default 30 days ago, counting today)
--provider	string	—	provider whose seats to compare, as recorded by ‘seats ingest’ (for example anthropic)
--to	string	—	last day, YYYY-MM-DD (UTC; default today)

Command: olivares finops spend

Report observed AI spend over a window

olivares finops spend

Declares no flags of its own; it takes those of olivares finops and the root command.

Command: olivares finops spend allocation

Show how spend allocates to cost centers

olivares finops spend allocation

Flag	Type	Default	Description
--since	string	—	start of the window, RFC3339 (e.g. 2026-08-01T00:00:00Z)
--until	string	—	end of the window, RFC3339

Command: olivares finops spend export

Export spend in the FOCUS interchange format

olivares finops spend export

Flag	Type	Default	Description
--format	string	—	export format the module publishes (e.g. focus)
--provenance	string	—	restrict to rows of this provenance
--since	string	—	start of the window, RFC3339 (e.g. 2026-08-01T00:00:00Z)
--until	string	—	end of the window, RFC3339

Command: olivares finops spend ls

Show the spend series for a window

olivares finops spend ls

Flag	Type	Default	Description
--dimension	string	—	group by this dimension (e.g. provider, model, workspace)
--since	string	—	start of the window, RFC3339 (e.g. 2026-08-01T00:00:00Z)
--until	string	—	end of the window, RFC3339

Command: olivares finops spend reconciliation

Compare observed spend against provider-reported cost

olivares finops spend reconciliation

Flag	Type	Default	Description
--since	string	—	start of the window, RFC3339 (e.g. 2026-08-01T00:00:00Z)
--until	string	—	end of the window, RFC3339

Command: olivares finops spend summary

Show the spend summary for a window

olivares finops spend summary

Flag	Type	Default	Description
--since	string	—	start of the window, RFC3339 (e.g. 2026-08-01T00:00:00Z)
--until	string	—	end of the window, RFC3339

Command: olivares finops spend trend

Show the spend trend over a window

olivares finops spend trend

Flag	Type	Default	Description
--since	string	—	start of the window, RFC3339 (e.g. 2026-08-01T00:00:00Z)
--until	string	—	end of the window, RFC3339

Command: olivares finops spend unified

Show the unified cross-source spend view

olivares finops spend unified

Flag	Type	Default	Description
--since	string	—	start of the window, RFC3339 (e.g. 2026-08-01T00:00:00Z)
--until	string	—	end of the window, RFC3339

Command: olivares finops statements

Generate, read and export per-cost-center statements

olivares finops statements

Declares no flags of its own; it takes those of olivares finops and the root command.

Command: olivares finops statements export

Export one statement

olivares finops statements export <statement-id>

Declares no flags of its own; it takes those of olivares finops statements and the root command.

Command: olivares finops statements generate

Generate statements for a period

olivares finops statements generate

Flag	Type	Default	Description
--data	string	—	request document: inline JSON, @FILE, or - for stdin

Command: olivares finops statements get

Show one statement with its lines

olivares finops statements get <statement-id>

Declares no flags of its own; it takes those of olivares finops statements and the root command.

Command: olivares finops statements ls

List generated statements

olivares finops statements ls

Aliases: list

Flag	Type	Default	Description
--all	bool	false	follow the cursor to the end and emit one merged page (json output carries has_more:false and no cursor)
--cost-center-id	string	—	only statements for this cost center
--cursor	string	—	opaque cursor from a previous page’s cursor field
--limit	int	0	page size to request (left out: the engine’s default)
--period	string	—	only statements of this period kind (monthly or weekly)
--status	string	—	only statements in this status

Command: olivares finops team-summary

Show the per-team spend summary

olivares finops team-summary

Flag	Type	Default	Description
--period	string	—	summary period (e.g. monthly)

Command: olivares finops value

Report the value side of the unit economics

olivares finops value

Declares no flags of its own; it takes those of olivares finops and the root command.

Command: olivares finops value ls

Show the value series for a window

olivares finops value ls

Flag	Type	Default	Description
--dimension	string	—	group by this dimension (e.g. provider, model, workspace)
--since	string	—	start of the window, RFC3339 (e.g. 2026-08-01T00:00:00Z)
--until	string	—	end of the window, RFC3339

Command: olivares finops value summary

Show the value summary and cost-per-outcome

olivares finops value summary

Flag	Type	Default	Description
--dimension	string	—	group by this dimension (e.g. provider, model, workspace)
--since	string	—	start of the window, RFC3339 (e.g. 2026-08-01T00:00:00Z)
--until	string	—	end of the window, RFC3339

Command: olivares first-boot

Show this installation’s console address and the state of first setup

olivares first-boot

Flag	Type	Default	Description
--data-dir	string	—	data directory (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--new-token	bool	false	mint a replacement one-time setup token and print it once; refused after an administrator exists

Command: olivares firstparty-bins

Hidden diagnostic: it does not appear in --help output and is not part of the supported surface.

List the first-party connector plugins embedded in this binary (diagnostic)

olivares firstparty-bins

Flag	Type	Default	Description
--require	stringSlice	[]	comma-separated plugin binary names that MUST be embedded (exit non-zero otherwise)

Command: olivares gitpublish

Publish through governed git targets: push, pull request, merge

olivares gitpublish

Flag	Type	Default	Description
--allow-cleartext	bool	false	inherited, hidden. allow sending the credential to a non-loopback host over plain HTTP (DANGEROUS: it travels readable)
--ca-cert	string	—	inherited, hidden. PEM file containing an additional trusted root CA (default: current context)
--insecure	bool	false	inherited, hidden. skip TLS certificate verification (DANGEROUS; development only)
--pin-sha256	stringArray	[]	inherited, hidden. trusted leaf SPKI SHA-256 pin, base64 or hex, repeatable — the engine prints it as pin_sha256 on the line reporting its certificate (default: current context)
--server	string	—	inherited, hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	inherited, hidden. tenant id (default $OLIVARES_TENANT, then current context)
--timeout	duration	4m15s	inherited, hidden. request timeout (covers the engine’s full publication budget: admission, the 2m dispatch deadline, settle and release)
--token	string	—	inherited, hidden. API bearer token (prefer –token-file: this form is visible in the process table and in shell history; default $OLIVARES_TOKEN, then current context)
--token-file	string	—	inherited, hidden. read the API bearer token from a file, or - for stdin

Command: olivares gitpublish intents

Follow, reconcile and close publication requests

olivares gitpublish intents

Declares no flags of its own; it takes those of olivares gitpublish and the root command.

Command: olivares gitpublish intents abandon

Take responsibility for an intent that cannot resolve

olivares gitpublish intents abandon <intent-id>

Flag	Type	Default	Description
--reason	string	—	bounded note (256 bytes) recorded with the abandonment

Command: olivares gitpublish intents get

Show one publication intent

olivares gitpublish intents get <intent-id>

Aliases: status

Declares no flags of its own; it takes those of olivares gitpublish intents and the root command.

Command: olivares gitpublish intents ls

List the publication intents of one target

olivares gitpublish intents ls

Aliases: list

Flag	Type	Default	Description
--target	string	—	the target whose intents to list

Command: olivares gitpublish intents observations

List every observation of one publication intent

olivares gitpublish intents observations <intent-id>

Declares no flags of its own; it takes those of olivares gitpublish intents and the root command.

Command: olivares gitpublish intents reconcile

Read the host again for one uncertain intent

olivares gitpublish intents reconcile <intent-id>

Declares no flags of its own; it takes those of olivares gitpublish intents and the root command.

Command: olivares gitpublish merge

Merge a pull request whose head is still the reviewed sha

olivares gitpublish merge <target-id>

Flag	Type	Default	Description
--acknowledge-intent	string	—	id of an abandoned intent that holds this scope (target administration at AAL3)
--expected-head	string	—	the reviewed head sha; a moved head refuses the merge
--method	string	—	merge method: merge, squash or rebase (rebase is refused on GitLab)
--number	int	0	the pull request number on the host
--operation-id	string	—	caller-chosen id of this publication request; the same id re-sent returns the recorded intent

Command: olivares gitpublish pull-request

Open a pull request from a prefixed branch into a merge base

olivares gitpublish pull-request <target-id>

Flag	Type	Default	Description
--acknowledge-intent	string	—	id of an abandoned intent that holds this scope (target administration at AAL3)
--base	string	—	merge base to publish into (one of the target’s merge bases)
--body	string	—	pull request description
--commit	string	—	the head commit sha the request is framed on
--draft	bool	false	open as a draft
--head-ref	string	—	branch under the target’s push prefix to publish from
--operation-id	string	—	caller-chosen id of this publication request; the same id re-sent returns the recorded intent
--title	string	—	pull request title

Command: olivares gitpublish push

Push one exact commit to a branch under the target’s prefix

olivares gitpublish push <target-id>

Flag	Type	Default	Description
--acknowledge-intent	string	—	id of an abandoned intent that holds this scope (target administration at AAL3)
--commit	string	—	exact commit sha to publish
--expected-old	string	—	the branch’s expected current sha; empty leases an absent branch
--operation-id	string	—	caller-chosen id of this publication request; the same id re-sent returns the recorded intent
--ref	string	—	full ref to push, refs/heads/<branch> under the target’s push prefix
--tree	string	—	the commit’s tree sha, checked in the server repository

Command: olivares gitpublish targets

Read publication targets

olivares gitpublish targets

Declares no flags of its own; it takes those of olivares gitpublish and the root command.

Command: olivares gitpublish targets get

Show one publication target

olivares gitpublish targets get <target-id>

Declares no flags of its own; it takes those of olivares gitpublish targets and the root command.

Command: olivares gitpublish targets ls

List publication targets

olivares gitpublish targets ls

Aliases: list

Declares no flags of its own; it takes those of olivares gitpublish targets and the root command.

Command: olivares governance

Inspect the governance plane: what is stopped, and why

olivares governance

Flag	Type	Default	Description
--allow-cleartext	bool	false	inherited, hidden. allow sending the credential to a non-loopback host over plain HTTP (DANGEROUS: it travels readable)
--ca-cert	string	—	inherited, hidden. PEM file containing an additional trusted root CA (default: current context)
--insecure	bool	false	inherited, hidden. skip TLS certificate verification (DANGEROUS; development only)
--pin-sha256	stringArray	[]	inherited, hidden. trusted leaf SPKI SHA-256 pin, base64 or hex, repeatable — the engine prints it as pin_sha256 on the line reporting its certificate (default: current context)
--server	string	—	inherited, hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	inherited, hidden. tenant id (default $OLIVARES_TENANT, then current context)
--timeout	duration	10s	inherited, hidden. request timeout
--token	string	—	inherited, hidden. API bearer token (prefer –token-file: this form is visible in the process table and in shell history; default $OLIVARES_TOKEN, then current context)
--token-file	string	—	inherited, hidden. read the API bearer token from a file, or - for stdin

Command: olivares governance approvals

The approval queue: what is waiting on a human, and who decided what

olivares governance approvals

Declares no flags of its own; it takes those of olivares governance and the root command.

Command: olivares governance approvals approve

Approve a request that waits for a person

olivares governance approvals approve <approval-id>

Flag	Type	Default	Description
--note	string	—	why you decided (kept with your vote)
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares governance approvals decisions

Who voted which way on one approval, and why

olivares governance approvals decisions <approval-id>

Declares no flags of its own; it takes those of olivares governance approvals and the root command.

Command: olivares governance approvals get

Show one approval

olivares governance approvals get <approval-id>

Declares no flags of its own; it takes those of olivares governance approvals and the root command.

Command: olivares governance approvals ls

List approvals, pending and decided

olivares governance approvals ls

Aliases: list

Flag	Type	Default	Description
--action	string	—	only approvals gating this action
--cursor	string	—	continue from the cursor printed by the previous page
--limit	int	0	maximum rows to return in one page (left out: the engine’s default)
--status	string	—	only approvals in this status (e.g. pending)

Command: olivares governance approvals reject

Reject a request that waits for a person

olivares governance approvals reject <approval-id>

Flag	Type	Default	Description
--note	string	—	why you decided (kept with your vote)
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares governance breakglass

Hidden diagnostic: it does not appear in --help output and is not part of the supported surface.

Break-glass grants (requires Business edition)

olivares governance breakglass

Declares no flags of its own; it takes those of olivares governance and the root command.

Command: olivares governance breakglass get

Show a break-glass grant (requires Business edition)

olivares governance breakglass get <grant-id>

Declares no flags of its own; it takes those of olivares governance breakglass and the root command.

Command: olivares governance breakglass ls

List break-glass grants (requires Business edition)

olivares governance breakglass ls

Aliases: list

Flag	Type	Default	Description
--cursor	string	—	continue from the cursor printed by the previous page
--limit	int	0	maximum rows to return in one page (left out: the engine’s default)
--status	string	—	filter by status

Command: olivares governance breakglass uses

Show actions under a break-glass grant (requires Business edition)

olivares governance breakglass uses <grant-id>

Declares no flags of its own; it takes those of olivares governance breakglass and the root command.

Command: olivares governance guardian

The rules that act on findings without a human, and what they have done

olivares governance guardian

Declares no flags of its own; it takes those of olivares governance and the root command.

Command: olivares governance guardian actions

What guardian actually did, rule by rule

olivares governance guardian actions

Flag	Type	Default	Description
--cursor	string	—	continue from the cursor printed by the previous page
--limit	int	0	maximum rows to return in one page (left out: the engine’s default)
--status	string	—	only actions in this status (e.g. executed)

Command: olivares governance guardian rules

List the guardian rules and whether each is armed

olivares governance guardian rules

Flag	Type	Default	Description
--cursor	string	—	continue from the cursor printed by the previous page
--limit	int	0	maximum rows to return in one page (left out: the engine’s default)

Command: olivares governance killswitch

The estate-wide and per-scope stops that deny work while they are active

olivares governance killswitch

Declares no flags of its own; it takes those of olivares governance and the root command.

Command: olivares governance killswitch ls

List kill switches, active and historical

olivares governance killswitch ls

Aliases: list

Flag	Type	Default	Description
--cursor	string	—	continue from the cursor printed by the previous page
--limit	int	0	maximum rows to return in one page (left out: the engine’s default)
--status	string	—	only switches in this status (e.g. active)

Command: olivares governance killswitch state

Whether the estate is stopped, and every kill switch active right now

olivares governance killswitch state

Declares no flags of its own; it takes those of olivares governance killswitch and the root command.

Command: olivares governance nhi

Hidden diagnostic: it does not appear in --help output and is not part of the supported surface.

Agent identity lifecycle requires Business Identity & Scale

olivares governance nhi

Declares no flags of its own; it takes those of olivares governance and the root command.

Command: olivares governance pdp

The policy decision point: which revision is actually deciding, and is it in force

olivares governance pdp

Declares no flags of its own; it takes those of olivares governance and the root command.

Command: olivares governance pdp active

Which policy this process is deciding with, and whether it is fully in force

olivares governance pdp active

Flag	Type	Default	Description
--engine	string	—	required. policy surface to read (required; the engine states which are legal)

Command: olivares governance pdp get-version

One stored revision, with the policy document itself

olivares governance pdp get-version <revision>

Flag	Type	Default	Description
--engine	string	—	required. policy surface to read (required; the engine states which are legal)

Command: olivares governance pdp tests

The stored test results for a policy revision

olivares governance pdp tests

Flag	Type	Default	Description
--engine	string	—	required. policy surface to read (required; the engine states which are legal)
--revision	int64	0	a specific revision (default: the newest with a stored artifact)

Command: olivares governance pdp versions

Every stored policy revision, both surfaces, metadata only

olivares governance pdp versions

Declares no flags of its own; it takes those of olivares governance pdp and the root command.

Command: olivares governance rbac

Who can do what: the grant vocabulary, the custom roles and the scoped grants

olivares governance rbac

Declares no flags of its own; it takes those of olivares governance and the root command.

Command: olivares governance rbac catalog

The vocabulary a grant can be built from

olivares governance rbac catalog

Declares no flags of its own; it takes those of olivares governance rbac and the root command.

Command: olivares governance rbac delegation-authority

What the calling principal may delegate, and where

olivares governance rbac delegation-authority

Declares no flags of its own; it takes those of olivares governance rbac and the root command.

Command: olivares governance rbac filters

Inheritance filters: where rights from above a node stop applying

olivares governance rbac filters

Declares no flags of its own; it takes those of olivares governance rbac and the root command.

Command: olivares governance rbac filters get

One inheritance filter

olivares governance rbac filters get <filter-id>

Declares no flags of its own; it takes those of olivares governance rbac filters and the root command.

Command: olivares governance rbac filters ls

List every inheritance filter

olivares governance rbac filters ls

Declares no flags of its own; it takes those of olivares governance rbac filters and the root command.

Command: olivares governance rbac filters rm

Remove an inheritance filter

olivares governance rbac filters rm <filter-id>

Aliases: delete, remove

Flag	Type	Default	Description
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares governance rbac filters set

Stop rights from above a node for one resource class

olivares governance rbac filters set <workspace|agent_group|folder> <ref> --class <kind>

Flag	Type	Default	Description
--class	string	—	required. the resource class the filter stops (a scope-tree kind)

Command: olivares governance rbac grants

The scoped grants in force: who holds what, where

olivares governance rbac grants

Declares no flags of its own; it takes those of olivares governance rbac and the root command.

Command: olivares governance rbac grants get

One scoped grant

olivares governance rbac grants get <id>

Declares no flags of its own; it takes those of olivares governance rbac grants and the root command.

Command: olivares governance rbac grants ls

List every scoped grant

olivares governance rbac grants ls

Declares no flags of its own; it takes those of olivares governance rbac grants and the root command.

Command: olivares governance rbac permission-groups

Named bundles of permissions that roles reuse

olivares governance rbac permission-groups

Declares no flags of its own; it takes those of olivares governance rbac and the root command.

Command: olivares governance rbac permission-groups get

One permission group, with its members

olivares governance rbac permission-groups get <name>

Declares no flags of its own; it takes those of olivares governance rbac permission-groups and the root command.

Command: olivares governance rbac permission-groups ls

List the permission groups

olivares governance rbac permission-groups ls

Declares no flags of its own; it takes those of olivares governance rbac permission-groups and the root command.

Command: olivares governance rbac rights

Which trustee rights a subject holds at a node, and the node’s path

olivares governance rbac rights <agent|session|resource> <id>

Flag	Type	Default	Description
--subject	string	—	required. the id of the user or token whose rights to read
--subject-type	string	user	user or token

Command: olivares governance rbac roles

Custom roles: what each one grants, and what it takes away

olivares governance rbac roles

Declares no flags of its own; it takes those of olivares governance rbac and the root command.

Command: olivares governance rbac roles get

One custom role, with its full permission set

olivares governance rbac roles get <name>

Declares no flags of its own; it takes those of olivares governance rbac roles and the root command.

Command: olivares governance rbac roles ls

List the custom roles

olivares governance rbac roles ls

Declares no flags of its own; it takes those of olivares governance rbac roles and the root command.

Command: olivares grok

Author Grok Build governance artifacts (managed requirements)

olivares grok

Declares no flags of its own; it takes those of olivares and the root command.

Command: olivares grok managed-config

Render /etc/grok/requirements.toml from a governance Policy JSON

olivares grok managed-config

Flag	Type	Default	Description
--policy	string	-	path to the governance Policy JSON (‘-’ = stdin)
--requirements-out	string	-	output path for requirements.toml (‘-’ = stdout)
--validate	bool	false	validate the policy renders to valid TOML, but write nothing

Command: olivares grok-hook

Hidden diagnostic: it does not appear in --help output and is not part of the supported surface.

Governed PEP hook client for Grok Build: forward a Grok hook to the engine and relay the decision (deny-closed)

olivares grok-hook

Flag	Type	Default	Description
--account	string	—	account identity hint (default $OLIVARES_GROK_HOOK_ACCOUNT)
--agent	string	—	agent identity hint (default $OLIVARES_GROK_HOOK_AGENT)
--endpoint	string	—	governed PEP URL (default $OLIVARES_GROK_HOOK_URL); –server is the canonical alias
--org	string	—	org identity hint (default $OLIVARES_GROK_HOOK_ORG)
--server	string	—	engine address (default $OLIVARES_SERVER_URL; the canonical spelling of –endpoint)
--tenant	string	—	the tenant the agent acts in (default $OLIVARES_GROK_HOOK_TENANT)
--timeout	duration	5s	PEP request timeout
--token	string	—	the agent’s PEP bearer credential (default $OLIVARES_GROK_HOOK_TOKEN)

Command: olivares health

Watch subject health, incidents, SLA and dependencies

olivares health

Flag	Type	Default	Description
--allow-cleartext	bool	false	inherited, hidden. allow sending the credential to a non-loopback host over plain HTTP (DANGEROUS: it travels readable)
--ca-cert	string	—	inherited, hidden. PEM file containing an additional trusted root CA (default: current context)
--insecure	bool	false	inherited, hidden. skip TLS certificate verification (DANGEROUS; development only)
--pin-sha256	stringArray	[]	inherited, hidden. trusted leaf SPKI SHA-256 pin, base64 or hex, repeatable — the engine prints it as pin_sha256 on the line reporting its certificate (default: current context)
--server	string	—	inherited, hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	inherited, hidden. tenant id (default $OLIVARES_TENANT, then current context)
--timeout	duration	10s	inherited, hidden. request timeout
--token	string	—	inherited, hidden. API bearer token (prefer –token-file: this form is visible in the process table and in shell history; default $OLIVARES_TOKEN, then current context)
--token-file	string	—	inherited, hidden. read the API bearer token from a file, or - for stdin

Command: olivares health checks

Declare, inspect, probe and retire health checks

olivares health checks

Aliases: check

Declares no flags of its own; it takes those of olivares health and the root command.

Command: olivares health checks create

Declare a new monitored subject

olivares health checks create

Flag	Type	Default	Description
--desired-status	string	—	lifecycle status: active, paused or retired
--grace	int64	0	multiplier on the interval before silence reads as unknown
--interval	int64	0	expected seconds between probes (required, positive)
--name	string	—	a human name for the check
--sla-target-ppm	int64	0	uptime target in parts per million (999000 = 99.9%)
--subject-kind	string	—	the subject’s kind: agent or mcp (required)
--subject-ref	string	—	the subject’s reference (required)

Command: olivares health checks get

Show one check

olivares health checks get <check-id>

Declares no flags of its own; it takes those of olivares health checks and the root command.

Command: olivares health checks ls

List declared checks

olivares health checks ls

Aliases: list

Flag	Type	Default	Description
--cursor	string	—	continue from the cursor printed by the previous page
--desired-status	string	—	filter by lifecycle status (active, paused, retired)
--limit	int	0	maximum rows to return in one page (left out: the engine’s default)
--subject-kind	string	—	filter by subject kind (agent, mcp)

Command: olivares health checks report

Post a probe result against a check

olivares health checks report <check-id>

Flag	Type	Default	Description
--detail	string	—	a short, non-sensitive note (the engine stores only its hash)
--latency	int64	0	observed latency in milliseconds
--state	string	—	the observed state: healthy, degraded or down (required)

Command: olivares health checks rm

Delete a check (admin-tier)

olivares health checks rm <check-id>

Aliases: delete, remove

Flag	Type	Default	Description
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares health checks update

Change a check’s configuration

olivares health checks update <check-id>

Flag	Type	Default	Description
--desired-status	string	—	lifecycle status: active, paused or retired
--grace	int64	0	multiplier on the interval before silence reads as unknown
--interval	int64	0	expected seconds between probes
--name	string	—	a human name for the check
--sla-target-ppm	int64	0	uptime target in parts per million; SENT ONLY IF PASSED, so omitting it keeps the stored target

Command: olivares health dependencies

Show the observed dependency graph

olivares health dependencies

Aliases: deps

Flag	Type	Default	Description
--cursor	string	—	continue from the cursor printed by the previous page
--limit	int	0	maximum rows to return in one page (left out: the engine’s default)

Command: olivares health events

List the append-only reliability transition ledger

olivares health events

Aliases: transitions

Flag	Type	Default	Description
--cursor	string	—	continue from the cursor printed by the previous page
--limit	int	0	maximum rows to return in one page (left out: the engine’s default)
--subject-kind	string	—	filter by subject kind (agent, mcp)
--subject-ref	string	—	filter by subject reference

Command: olivares health incidents

List, open and resolve health incidents

olivares health incidents

Aliases: incident

Declares no flags of its own; it takes those of olivares health and the root command.

Command: olivares health incidents get

Show one incident

olivares health incidents get <incident-id>

Declares no flags of its own; it takes those of olivares health incidents and the root command.

Command: olivares health incidents ls

List health incidents

olivares health incidents ls

Aliases: list

Flag	Type	Default	Description
--cursor	string	—	continue from the cursor printed by the previous page
--limit	int	0	maximum rows to return in one page (left out: the engine’s default)
--state	string	—	filter by state (open, resolved)
--subject-kind	string	—	filter by subject kind (agent, mcp)
--subject-ref	string	—	filter by subject reference

Command: olivares health incidents resolve

Declare an incident resolved

olivares health incidents resolve <incident-id>

Declares no flags of its own; it takes those of olivares health incidents and the root command.

Command: olivares health sla

Report observed uptime for one subject against its target

olivares health sla

Flag	Type	Default	Description
--strict	bool	true	exit 8 (indeterminate) when no observation exists in the window; –strict=false exits 0 instead
--subject-kind	string	—	the subject’s kind: agent or mcp (required)
--subject-ref	string	—	the subject’s reference (required)
--window	int64	0	window in seconds (0 = the engine’s default)

Command: olivares health status

Show the current health of every monitored subject

olivares health status

Flag	Type	Default	Description
--cursor	string	—	continue from the cursor printed by the previous page
--limit	int	0	maximum rows to return in one page (left out: the engine’s default)
--state	string	—	filter by state (healthy, degraded, down, unknown)
--subject-kind	string	—	filter by subject kind (agent, mcp)

Command: olivares health watch

Follow health changes as they happen (one JSON object per line)

olivares health watch

Aliases: stream

Flag	Type	Default	Description
--subject-ref	string	—	follow one subject instead of every subject in the tenant

Command: olivares help

Help about any command

olivares help [command]

Declares no flags of its own; it takes those of olivares and the root command.

Command: olivares hookpep

Author and inspect PDP policy through the engine

olivares hookpep

Flag	Type	Default	Description
--ca-cert	string	—	inherited. PEM CA bundle used to verify the engine
--format	string	text	inherited. deprecated alias for -o/–output on this command (text or json) — NOT the export-format flag of ‘audit export’ / ‘findings export’
--insecure	bool	false	inherited. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	inherited. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate
--server	string	—	inherited. engine address (default $OLIVARES_SERVER_URL; the canonical spelling of –url)
--timeout	duration	30s	inherited. request timeout
--token	string	—	inherited. API bearer token (default $OLIVARES_HOOK_PEP_TOKEN)
--url	string	—	inherited. engine address (default $OLIVARES_HOOK_PEP_URL); –server is the canonical spelling

Command: olivares hookpep dry-run

Evaluate a request against a candidate policy without publishing it

olivares hookpep dry-run

Flag	Type	Default	Description
--engine	string	cedar	policy engine: cedar or opa
--file	string	—	policy source file (‘-’ reads stdin)
--request	string	—	inline example-request JSON: principal{kind,id}, permission, resource{kind,id,sensitivity}, optional tenant
--request-file	string	—	file with the example-request JSON: principal{kind,id}, permission, resource{kind,id,sensitivity}, optional tenant (‘-’ reads stdin)
--source	string	—	inline policy source

Command: olivares hookpep explain

Explain a request decision against a candidate policy without publishing it

olivares hookpep explain

Flag	Type	Default	Description
--engine	string	cedar	policy engine: cedar or opa
--file	string	—	policy source file (‘-’ reads stdin)
--request	string	—	inline example-request JSON: principal{kind,id}, permission, resource{kind,id,sensitivity}, optional tenant
--request-file	string	—	file with the example-request JSON: principal{kind,id}, permission, resource{kind,id,sensitivity}, optional tenant (‘-’ reads stdin)
--source	string	—	inline policy source

Command: olivares hookpep publish

Compile, publish, and activate an authored policy revision

olivares hookpep publish

Flag	Type	Default	Description
--engine	string	opa	policy engine: opa
--file	string	—	policy source file (‘-’ reads stdin)
--note	string	—	optional publication note
--source	string	—	inline policy source

Command: olivares hookpep rollback

Re-activate a prior immutable policy revision

olivares hookpep rollback

Flag	Type	Default	Description
--engine	string	opa	policy engine: opa
--revision	int64	0	immutable policy revision to re-activate

Command: olivares hookpep tests

Show the stored compile-validation artifact for a policy revision

olivares hookpep tests

Flag	Type	Default	Description
--engine	string	—	required. policy engine: cedar or opa
--revision	int64	0	immutable policy revision (default newest)

Command: olivares hookpep validate

Compile and validate a candidate policy without publishing it

olivares hookpep validate

Flag	Type	Default	Description
--engine	string	cedar	policy engine: cedar or opa
--file	string	—	policy source file (‘-’ reads stdin)
--source	string	—	inline policy source

Command: olivares hookpep versions

List immutable authored policy revisions

olivares hookpep versions

Declares no flags of its own; it takes those of olivares hookpep and the root command.

Command: olivares hooks

Hidden diagnostic: it does not appear in --help output and is not part of the supported surface.

Hooks-hardening add-on: fleet deployed-verified attestation + conformance cert (Business: AI Runtime Security)

olivares hooks

Declares no flags of its own; it takes those of olivares and the root command.

Command: olivares hooks attest

Attest a fleet’s deployed managed-settings against the canonical PEP-hook bundle (deployed-verified)

olivares hooks attest

Flag	Type	Default	Description
--matcher	string	—	tool-name matcher for the PEP hook (“” = all tools)
--nodes	string	—	JSON file: an array of node reports to attest
--pep-command	string	olivares claude-hook	the managed PreToolUse PEP-client command
--policy-file	string	—	load a full managed-settings Policy JSON instead of building one from the flags above
--redact	bool	true	also install the paired PostToolUse output-redaction hook
--signature-out	string	—	write the signed blob to this file (default: print to stderr when signed)
--signing-key-file	string	—	file holding the base64 ed25519 private key to sign the attestation (optional)
--timeout	int	5	PEP hook timeout in seconds
--version	string	—	a label for the canonical bundle version

Command: olivares hooks conform

Certify conformance of the managed-settings + PEP hook against the real claude binary

olivares hooks conform

Flag	Type	Default	Description
--behavioral	bool	false	also run the behavioral hook-deny e2e against a mock model (drives the real binary twice; no creds needed)
--matcher	string	—	tool-name matcher for the PEP hook (“” = all tools)
--pep-command	string	olivares claude-hook	the managed PreToolUse PEP-client command
--policy-file	string	—	load a full managed-settings Policy JSON instead of building one from the flags above
--redact	bool	true	also install the paired PostToolUse output-redaction hook
--signature-out	string	—	write the signed cert blob to this file (default: print to stderr when signed)
--signing-key-file	string	—	file holding the base64 ed25519 private key to sign the certificate (optional)
--timeout	int	5	PEP hook timeout in seconds

Command: olivares identity

Read identity connection state

olivares identity

Flag	Type	Default	Description
--allow-cleartext	bool	false	inherited, hidden. allow sending the credential to a non-loopback host over plain HTTP (DANGEROUS: it travels readable)
--ca-cert	string	—	inherited, hidden. PEM file containing an additional trusted root CA (default: current context)
--insecure	bool	false	inherited, hidden. skip TLS certificate verification (DANGEROUS; development only)
--pin-sha256	stringArray	[]	inherited, hidden. trusted leaf SPKI SHA-256 pin, base64 or hex, repeatable — the engine prints it as pin_sha256 on the line reporting its certificate (default: current context)
--server	string	—	inherited, hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	inherited, hidden. tenant id (default $OLIVARES_TENANT, then current context)
--timeout	duration	10s	inherited, hidden. request timeout
--token	string	—	inherited, hidden. API bearer token (prefer –token-file: this form is visible in the process table and in shell history; default $OLIVARES_TOKEN, then current context)
--token-file	string	—	inherited, hidden. read the API bearer token from a file, or - for stdin

Command: olivares identity external-keys

Hidden diagnostic: it does not appear in --help output and is not part of the supported surface.

External key inventory requires Business Identity & Scale

olivares identity external-keys

Aliases: cmek

Declares no flags of its own; it takes those of olivares identity and the root command.

Command: olivares identity residency

Hidden diagnostic: it does not appear in --help output and is not part of the supported surface.

Residency posture requires Business Identity & Scale

olivares identity residency

Declares no flags of its own; it takes those of olivares identity and the root command.

Command: olivares identity sso

Report the SSO connection state

olivares identity sso

Flag	Type	Default	Description
--strict	bool	true	exit 8 (indeterminate) when the engine reports it could not establish this posture; –strict=false exits 0 instead

Command: olivares identity wif

Hidden diagnostic: it does not appear in --help output and is not part of the supported surface.

Workload identity federation requires Business Identity & Scale

olivares identity wif

Aliases: federation

Declares no flags of its own; it takes those of olivares identity and the root command.

Command: olivares inference-proxy

Govern the inference gateway: gates, DLP rules and device grants

olivares inference-proxy

Aliases: inferenceproxy

Flag	Type	Default	Description
--allow-cleartext	bool	false	inherited, hidden. allow sending the credential to a non-loopback host over plain HTTP (DANGEROUS: it travels readable)
--ca-cert	string	—	inherited, hidden. PEM file containing an additional trusted root CA (default: current context)
--insecure	bool	false	inherited, hidden. skip TLS certificate verification (DANGEROUS; development only)
--pin-sha256	stringArray	[]	inherited, hidden. trusted leaf SPKI SHA-256 pin, base64 or hex, repeatable — the engine prints it as pin_sha256 on the line reporting its certificate (default: current context)
--server	string	—	inherited, hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	inherited, hidden. tenant id (default $OLIVARES_TENANT, then current context)
--timeout	duration	10s	inherited, hidden. request timeout
--token	string	—	inherited, hidden. API bearer token (prefer –token-file: this form is visible in the process table and in shell history; default $OLIVARES_TOKEN, then current context)
--token-file	string	—	inherited, hidden. read the API bearer token from a file, or - for stdin

Command: olivares inference-proxy config

Read and replace the gateway’s gate configuration

olivares inference-proxy config

Declares no flags of its own; it takes those of olivares inference-proxy and the root command.

Command: olivares inference-proxy config get

Show the gateway’s effective gate configuration

olivares inference-proxy config get

Declares no flags of its own; it takes those of olivares inference-proxy config and the root command.

Command: olivares inference-proxy config set

Replace the gateway’s gate configuration

olivares inference-proxy config set

Flag	Type	Default	Description
--data	string	—	request document: inline JSON, @FILE, or - for stdin

Command: olivares inference-proxy device

Approve or deny a pending device grant

olivares inference-proxy device

Declares no flags of its own; it takes those of olivares inference-proxy and the root command.

Command: olivares inference-proxy device approve

Resolve a pending device grant by its user code

olivares inference-proxy device approve

Flag	Type	Default	Description
--deny	bool	false	refuse the grant instead of approving it
--user-code	string	—	the user code the waiting device displayed
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares inference-proxy dlp

Govern the per-class DLP rules applied to inference egress

olivares inference-proxy dlp

Declares no flags of its own; it takes those of olivares inference-proxy and the root command.

Command: olivares inference-proxy dlp ls

List the effective DLP rules

olivares inference-proxy dlp ls

Aliases: list

Flag	Type	Default	Description
--all	bool	false	follow the cursor to the end and emit one merged page (json output carries has_more:false and no cursor)
--cursor	string	—	opaque cursor from a previous page’s cursor field
--limit	int	0	page size to request (left out: the engine’s default)

Command: olivares inference-proxy dlp rm

Remove a DLP override and restore its secure default

olivares inference-proxy dlp rm <rule-id>

Aliases: delete

Flag	Type	Default	Description
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares inference-proxy dlp set

Set the action for one DLP class

olivares inference-proxy dlp set

Flag	Type	Default	Description
--data	string	—	request document: inline JSON, @FILE, or - for stdin

Command: olivares inference-proxy firewall

Read the Messages proxy’s startup content-inspector attachment

olivares inference-proxy firewall

Declares no flags of its own; it takes those of olivares inference-proxy and the root command.

Command: olivares inference-proxy firewall status

Show the Messages proxy’s startup content-inspector attachment state

olivares inference-proxy firewall status

Declares no flags of its own; it takes those of olivares inference-proxy firewall and the root command.

Command: olivares inventory

List the observed entity catalog and its coverage summary

olivares inventory

Flag	Type	Default	Description
--allow-cleartext	bool	false	inherited, hidden. allow sending the credential to a non-loopback host over plain HTTP (DANGEROUS: it travels readable)
--ca-cert	string	—	inherited, hidden. PEM file containing an additional trusted root CA (default: current context)
--insecure	bool	false	inherited, hidden. skip TLS certificate verification (DANGEROUS; development only)
--pin-sha256	stringArray	[]	inherited, hidden. trusted leaf SPKI SHA-256 pin, base64 or hex, repeatable — the engine prints it as pin_sha256 on the line reporting its certificate (default: current context)
--server	string	—	inherited, hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	inherited, hidden. tenant id (default $OLIVARES_TENANT, then current context)
--timeout	duration	10s	inherited, hidden. request timeout
--token	string	—	inherited, hidden. API bearer token (prefer –token-file: this form is visible in the process table and in shell history; default $OLIVARES_TOKEN, then current context)
--token-file	string	—	inherited, hidden. read the API bearer token from a file, or - for stdin

Command: olivares inventory entities

List and open catalog entities

olivares inventory entities

Aliases: entity

Declares no flags of its own; it takes those of olivares inventory and the root command.

Command: olivares inventory entities get

Show one catalog entity and the core entity it overlays

olivares inventory entities get <kind> <id>

Declares no flags of its own; it takes those of olivares inventory entities and the root command.

Command: olivares inventory entities ls

List catalog entities

olivares inventory entities ls

Aliases: list

Flag	Type	Default	Description
--cursor	string	—	continue from the cursor printed by the previous page
--kind	string	—	filter by entity kind (agent, tool, resource, skill, model, provider)
--limit	int	0	maximum rows to return in one page (left out: the engine’s default)
--status	string	—	filter by status (active, stale)

Command: olivares inventory summary

Count catalog entities by kind and by signal source

olivares inventory summary

Declares no flags of its own; it takes those of olivares inventory and the root command.

Command: olivares keys

Inspect signing-key custody

olivares keys

Declares no flags of its own; it takes those of olivares and the root command.

Command: olivares keys status

Show the key-custody posture (declared vs configured, envelopes, FIPS mode)

olivares keys status

Flag	Type	Default	Description
--audit-envelope	string	—	audit key envelope path (default $OLIVARES_AUDIT_SIGNING_KEY_WRAPPED_FILE)
--catalog-envelope	string	—	catalog key envelope path (default $OLIVARES_CATALOG_SIGNING_KEY_WRAPPED_FILE)
--policy-envelope	string	—	policy key envelope path (default $OLIVARES_POLICY_SIGNING_KEY_WRAPPED_FILE)
--verify-envelopes	bool	false	open each envelope under the configured KEK to PROVE its purpose, public key and rotation history are unedited (one KMS call per envelope; without it the report is parsed, not proven)

Command: olivares knowledge

Govern knowledge bases, data products, memory and DLP

olivares knowledge

Flag	Type	Default	Description
--allow-cleartext	bool	false	inherited, hidden. allow sending the credential to a non-loopback host over plain HTTP (DANGEROUS: it travels readable)
--ca-cert	string	—	inherited, hidden. PEM file containing an additional trusted root CA (default: current context)
--insecure	bool	false	inherited, hidden. skip TLS certificate verification (DANGEROUS; development only)
--pin-sha256	stringArray	[]	inherited, hidden. trusted leaf SPKI SHA-256 pin, base64 or hex, repeatable — the engine prints it as pin_sha256 on the line reporting its certificate (default: current context)
--server	string	—	inherited, hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	inherited, hidden. tenant id (default $OLIVARES_TENANT, then current context)
--timeout	duration	10s	inherited, hidden. request timeout
--token	string	—	inherited, hidden. API bearer token (prefer –token-file: this form is visible in the process table and in shell history; default $OLIVARES_TOKEN, then current context)
--token-file	string	—	inherited, hidden. read the API bearer token from a file, or - for stdin

Command: olivares knowledge context-policies

Read and set context/compaction policies

olivares knowledge context-policies

Declares no flags of its own; it takes those of olivares knowledge and the root command.

Command: olivares knowledge context-policies ls

List context policies

olivares knowledge context-policies ls

Aliases: list

Flag	Type	Default	Description
--cursor	string	—	opaque cursor from a previous page’s has_more result
--limit	int	0	maximum rows per page (server default when unset)
--scope-kind	string	—	only policies of this scope kind
--scope-ref	string	—	only policies of this scope reference

Command: olivares knowledge context-policies put

Create or replace a context policy

olivares knowledge context-policies put

Flag	Type	Default	Description
--effect	string	—	policy effect
--max-tokens	int64	0	context token budget
--redaction-required	bool	false	require redaction for this scope
--scope-kind	string	—	scope kind the policy applies to
--scope-ref	string	—	scope reference the policy applies to
--spec	string	—	extra policy specification as JSON
--spec-file	string	—	file holding the JSON specification (- for stdin)
--strategy	string	—	compaction strategy

Command: olivares knowledge data-products

Govern data products and their versioned contracts

olivares knowledge data-products

Declares no flags of its own; it takes those of olivares knowledge and the root command.

Command: olivares knowledge data-products archive

Archive a data product

olivares knowledge data-products archive <product-id>

Flag	Type	Default	Description
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares knowledge data-products contracts

Read and add a data product’s versioned contracts

olivares knowledge data-products contracts

Declares no flags of its own; it takes those of olivares knowledge data-products and the root command.

Command: olivares knowledge data-products contracts active

Show the contract version currently in force

olivares knowledge data-products contracts active <product-id>

Declares no flags of its own; it takes those of olivares knowledge data-products contracts and the root command.

Command: olivares knowledge data-products contracts add

Add a new contract version to a data product

olivares knowledge data-products contracts add <product-id>

Flag	Type	Default	Description
--completeness-threshold	int64	0	minimum completeness percentage
--freshness-override-seconds	int64	0	freshness override for this contract
--note	string	—	note recorded with the contract version
--schema	string	—	contract schema as JSON
--schema-file	string	—	file holding the JSON schema (- for stdin)
--validation-mode	string	—	validation mode the contract enforces

Command: olivares knowledge data-products contracts get

Show one contract version

olivares knowledge data-products contracts get <product-id> <version>

Declares no flags of its own; it takes those of olivares knowledge data-products contracts and the root command.

Command: olivares knowledge data-products contracts ls

List a data product’s contract versions

olivares knowledge data-products contracts ls <product-id>

Aliases: list

Flag	Type	Default	Description
--cursor	string	—	opaque cursor from a previous page’s has_more result
--limit	int	0	maximum rows per page (server default when unset)

Command: olivares knowledge data-products create

Declare a data product

olivares knowledge data-products create

Flag	Type	Default	Description
--availability-target	string	—	availability target
--description	string	—	human description
--enforcement-mode	string	—	contract enforcement mode
--freshness-sla-seconds	int64	0	freshness SLA in seconds
--kb-id	string	—	knowledge base id the product publishes
--kb-ref	string	—	knowledge base reference the product publishes
--name	string	—	data product name
--owner-ref	string	—	owning team or principal
--quality-score	int64	0	quality score override
--tags	string	—	tags as a JSON object
--tags-file	string	—	file holding the JSON tags object (- for stdin)

Command: olivares knowledge data-products deprecate

Deprecate a data product

olivares knowledge data-products deprecate <product-id>

Flag	Type	Default	Description
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares knowledge data-products events

List a data product’s enforcement events

olivares knowledge data-products events <product-id>

Flag	Type	Default	Description
--cursor	string	—	opaque cursor from a previous page’s has_more result
--event-type	string	—	only events of this type
--limit	int	0	maximum rows per page (server default when unset)

Command: olivares knowledge data-products get

Show one data product

olivares knowledge data-products get <product-id>

Declares no flags of its own; it takes those of olivares knowledge data-products and the root command.

Command: olivares knowledge data-products health

Report a data product’s freshness and quality

olivares knowledge data-products health <product-id>

Declares no flags of its own; it takes those of olivares knowledge data-products and the root command.

Command: olivares knowledge data-products ls

List data products

olivares knowledge data-products ls

Aliases: list

Flag	Type	Default	Description
--cursor	string	—	opaque cursor from a previous page’s has_more result
--kb-ref	string	—	only products backed by this knowledge base
--limit	int	0	maximum rows per page (server default when unset)
--owner-ref	string	—	only products with this owner
--status	string	—	only products in this status

Command: olivares knowledge data-products publish

Publish a data product so its contract governs the corpus

olivares knowledge data-products publish <product-id>

Declares no flags of its own; it takes those of olivares knowledge data-products and the root command.

Command: olivares knowledge data-products rm

Delete a data product

olivares knowledge data-products rm <product-id>

Aliases: delete

Flag	Type	Default	Description
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares knowledge data-products set

Update a data product’s authored fields

olivares knowledge data-products set <product-id>

Flag	Type	Default	Description
--availability-target	string	—	availability target
--description	string	—	human description
--enforcement-mode	string	—	contract enforcement mode
--freshness-sla-seconds	int64	0	freshness SLA in seconds
--kb-id	string	—	knowledge base id the product publishes
--kb-ref	string	—	knowledge base reference the product publishes
--name	string	—	data product name
--owner-ref	string	—	owning team or principal
--quality-score	int64	0	quality score override
--tags	string	—	tags as a JSON object
--tags-file	string	—	file holding the JSON tags object (- for stdin)

Command: olivares knowledge data-products validate

Validate a payload against the product’s active contract

olivares knowledge data-products validate <product-id>

Flag	Type	Default	Description
--metadata	string	—	validation metadata as a JSON object
--metadata-file	string	—	file holding the JSON metadata (- for stdin)
--payload	string	—	candidate payload as JSON
--payload-file	string	—	file holding the JSON payload (- for stdin)

Command: olivares knowledge dlp

Read and set the DLP egress rules

olivares knowledge dlp

Declares no flags of its own; it takes those of olivares knowledge and the root command.

Command: olivares knowledge dlp ls

List the DLP egress rules

olivares knowledge dlp ls

Aliases: list

Flag	Type	Default	Description
--cursor	string	—	opaque cursor from a previous page’s has_more result
--limit	int	0	maximum rows per page (server default when unset)

Command: olivares knowledge dlp put

Create or replace one DLP rule

olivares knowledge dlp put

Flag	Type	Default	Description
--action	string	—	allow or deny
--class	string	—	sensitivity class the rule governs
--note	string	—	note recorded with the rule

Command: olivares knowledge dlp rm

Delete one DLP rule

olivares knowledge dlp rm <rule-id>

Aliases: delete

Flag	Type	Default	Description
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares knowledge documents

Inspect an individual knowledge document

olivares knowledge documents

Declares no flags of its own; it takes those of olivares knowledge and the root command.

Command: olivares knowledge documents get

Show one knowledge document

olivares knowledge documents get <document-id>

Declares no flags of its own; it takes those of olivares knowledge documents and the root command.

Command: olivares knowledge kbs

Declare, inspect and operate knowledge bases

olivares knowledge kbs

Declares no flags of its own; it takes those of olivares knowledge and the root command.

Command: olivares knowledge kbs create

Declare a knowledge base

olivares knowledge kbs create

Flag	Type	Default	Description
--acl	stringArray	[]	default ACL entry granted to every document, repeatable
--classification	string	—	public, internal, confidential or secret (server default: internal)
--embed-policy	string	—	embedding egress policy, e.g. local_only or auto (server default: auto)
--name	string	—	knowledge base name
--residency-region	string	—	region the corpus is pinned to (server default: global)
--status	string	—	knowledge base status (server default: active)

Command: olivares knowledge kbs documents

List a knowledge base’s documents

olivares knowledge kbs documents <kb-id>

Flag	Type	Default	Description
--cursor	string	—	opaque cursor from a previous page’s has_more result
--limit	int	0	maximum rows per page (server default when unset)
--status	string	—	only documents in this status

Command: olivares knowledge kbs get

Show one knowledge base

olivares knowledge kbs get <kb-id>

Declares no flags of its own; it takes those of olivares knowledge kbs and the root command.

Command: olivares knowledge kbs ingest

Ingest documents into a knowledge base

olivares knowledge kbs ingest <kb-id>

Flag	Type	Default	Description
--documents	string	—	inline documents as a JSON array
--documents-file	string	—	file holding the JSON document array (- for stdin)
--source	string	—	name of a registered content source to pull from

Command: olivares knowledge kbs ls

List the tenant’s knowledge bases

olivares knowledge kbs ls

Aliases: list

Flag	Type	Default	Description
--cursor	string	—	opaque cursor from a previous page’s has_more result
--limit	int	0	maximum rows per page (server default when unset)
--status	string	—	only knowledge bases in this status

Command: olivares knowledge kbs query

Run a governed retrieval against a knowledge base

olivares knowledge kbs query <kb-id>

Flag	Type	Default	Description
--query	string	—	retrieval text
--query-file	string	—	file holding the retrieval text (- for stdin)
--session-ref	string	—	session this retrieval belongs to, recorded in lineage
--top-k	int	0	maximum chunks to return (server default when unset)

Command: olivares knowledge kbs reindex

Embed and index the knowledge base’s pending chunks

olivares knowledge kbs reindex <kb-id>

Declares no flags of its own; it takes those of olivares knowledge kbs and the root command.

Command: olivares knowledge kbs rm

Delete a knowledge base and cascade its documents

olivares knowledge kbs rm <kb-id>

Aliases: delete

Flag	Type	Default	Description
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares knowledge kbs scan

Run PII discovery over a knowledge base

olivares knowledge kbs scan <kb-id>

Declares no flags of its own; it takes those of olivares knowledge kbs and the root command.

Command: olivares knowledge kbs set

Replace a knowledge base’s authored fields

olivares knowledge kbs set <kb-id>

Flag	Type	Default	Description
--acl	stringArray	[]	default ACL entry granted to every document, repeatable
--classification	string	—	public, internal, confidential or secret (server default: internal)
--embed-policy	string	—	embedding egress policy, e.g. local_only or auto (server default: auto)
--name	string	—	knowledge base name
--replace	bool	false	accept that every field not passed is RESET to its server default (this endpoint replaces, it does not patch)
--residency-region	string	—	region the corpus is pinned to (server default: global)
--status	string	—	knowledge base status (server default: active)

Command: olivares knowledge kbs sync

Delta-sync a knowledge base from its content source

olivares knowledge kbs sync <kb-id>

Flag	Type	Default	Description
--source	string	—	name of the registered content source to sync from

Command: olivares knowledge labels

Read the sensitivity labels PII discovery wrote

olivares knowledge labels

Declares no flags of its own; it takes those of olivares knowledge and the root command.

Command: olivares knowledge labels ls

List sensitivity labels

olivares knowledge labels ls

Aliases: list

Flag	Type	Default	Description
--cursor	string	—	opaque cursor from a previous page’s has_more result
--kb-id	string	—	only labels for this knowledge base
--limit	int	0	maximum rows per page (server default when unset)
--subject-kind	string	—	only labels of this subject kind

Command: olivares knowledge lineage

Read the append-only retrieval lineage

olivares knowledge lineage

Declares no flags of its own; it takes those of olivares knowledge and the root command.

Command: olivares knowledge lineage get

Show one lineage record

olivares knowledge lineage get <lineage-id>

Declares no flags of its own; it takes those of olivares knowledge lineage and the root command.

Command: olivares knowledge lineage ls

List retrieval lineage records

olivares knowledge lineage ls

Aliases: list

Flag	Type	Default	Description
--agent-ref	string	—	only lineage for this agent
--cursor	string	—	opaque cursor from a previous page’s has_more result
--decision	string	—	allowed or denied
--kb-id	string	—	only lineage for this knowledge base
--limit	int	0	maximum rows per page (server default when unset)

Command: olivares knowledge memory

Govern agent memory: read, write, verify, export and purge

olivares knowledge memory

Declares no flags of its own; it takes those of olivares knowledge and the root command.

Command: olivares knowledge memory all

List every memory entry (admin-tier cross-scope view)

olivares knowledge memory all

Flag	Type	Default	Description
--agent-ref	string	—	only entries of this agent
--cursor	string	—	opaque cursor from a previous page’s has_more result
--limit	int	0	maximum rows per page (server default when unset)
--session-ref	string	—	only entries declared in this session scope
--user-ref	string	—	only entries declared in this user scope

Command: olivares knowledge memory export

Export a signed, portable memory bundle

olivares knowledge memory export

Flag	Type	Default	Description
--agent-ref	string	—	only entries of this agent
--out	string	—	write the bundle to this file instead of stdout
--session-ref	string	—	only entries declared in this session scope
--user-ref	string	—	only entries declared in this user scope

Command: olivares knowledge memory get

Show one memory entry

olivares knowledge memory get <entry-id>

Flag	Type	Default	Description
--agent-ref	string	—	only entries of this agent
--session-ref	string	—	only entries declared in this session scope
--user-ref	string	—	only entries declared in this user scope

Command: olivares knowledge memory import

Import a signed portability bundle

olivares knowledge memory import

Flag	Type	Default	Description
--bundle-file	string	—	file holding the exported bundle (- for stdin)

Command: olivares knowledge memory ls

List memory entries visible in the declared scope

olivares knowledge memory ls

Aliases: list

Flag	Type	Default	Description
--agent-ref	string	—	only entries of this agent
--cursor	string	—	opaque cursor from a previous page’s has_more result
--limit	int	0	maximum rows per page (server default when unset)
--session-ref	string	—	only entries declared in this session scope
--user-ref	string	—	only entries declared in this user scope

Command: olivares knowledge memory purge

Purge expired memory entries

olivares knowledge memory purge

Flag	Type	Default	Description
--agent-ref	string	—	purge only this agent’s expired entries
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares knowledge memory put

Write one governed memory entry

olivares knowledge memory put

Flag	Type	Default	Description
--agent-ref	string	—	agent the entry belongs to
--classification	string	—	entry classification
--content	string	—	entry content
--content-file	string	—	file holding the content (- for stdin)
--key	string	—	entry key within the agent’s namespace
--residency-region	string	—	region the entry is pinned to
--session-ref	string	—	declare the entry’s session scope
--ttl-seconds	int64	0	retention in seconds (0 leaves the module default)
--user-ref	string	—	declare the entry’s user scope

Command: olivares knowledge memory rm

Delete one memory entry

olivares knowledge memory rm <entry-id>

Aliases: delete

Flag	Type	Default	Description
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares knowledge memory verify

Verify memory integrity against the ledger anchor

olivares knowledge memory verify

Flag	Type	Default	Description
--agent-ref	string	—	only entries of this agent
--session-ref	string	—	only entries declared in this session scope
--user-ref	string	—	only entries declared in this user scope

Command: olivares knowledge prompts

Manage the versioned prompt registry

olivares knowledge prompts

Declares no flags of its own; it takes those of olivares knowledge and the root command.

Command: olivares knowledge prompts create

Register a prompt and its first revision

olivares knowledge prompts create

Flag	Type	Default	Description
--label	string	—	label for this revision
--name	string	—	prompt name
--note	string	—	note recorded with this revision
--template	string	—	prompt template text
--template-file	string	—	file holding the template (- for stdin)

Command: olivares knowledge prompts get

Show one prompt

olivares knowledge prompts get <prompt-id>

Declares no flags of its own; it takes those of olivares knowledge prompts and the root command.

Command: olivares knowledge prompts ls

List registered prompts

olivares knowledge prompts ls

Aliases: list

Flag	Type	Default	Description
--cursor	string	—	opaque cursor from a previous page’s has_more result
--limit	int	0	maximum rows per page (server default when unset)

Command: olivares knowledge prompts revisions

List, read and append immutable prompt revisions

olivares knowledge prompts revisions

Declares no flags of its own; it takes those of olivares knowledge prompts and the root command.

Command: olivares knowledge prompts revisions add

Append an immutable revision to a prompt

olivares knowledge prompts revisions add <prompt-id>

Flag	Type	Default	Description
--label	string	—	label for this revision
--note	string	—	note recorded with this revision
--template	string	—	revision template text
--template-file	string	—	file holding the template (- for stdin)

Command: olivares knowledge prompts revisions get

Show one prompt revision

olivares knowledge prompts revisions get <prompt-id> <rev>

Declares no flags of its own; it takes those of olivares knowledge prompts revisions and the root command.

Command: olivares knowledge prompts revisions ls

List a prompt’s revisions

olivares knowledge prompts revisions ls <prompt-id>

Aliases: list

Flag	Type	Default	Description
--cursor	string	—	opaque cursor from a previous page’s has_more result
--limit	int	0	maximum rows per page (server default when unset)

Command: olivares knowledge prompts rollback

Point a prompt at an earlier revision

olivares knowledge prompts rollback <prompt-id>

Flag	Type	Default	Description
--rev	int64	0	revision number to roll back to
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares knowledge scans

Read the append-only PII scan evidence

olivares knowledge scans

Declares no flags of its own; it takes those of olivares knowledge and the root command.

Command: olivares knowledge scans ls

List PII scan runs

olivares knowledge scans ls

Aliases: list

Flag	Type	Default	Description
--cursor	string	—	opaque cursor from a previous page’s has_more result
--limit	int	0	maximum rows per page (server default when unset)
--scope-kind	string	—	only scans of this scope kind
--scope-ref	string	—	only scans of this scope reference

Command: olivares knowledge sources

Run discovery over a registered content source

olivares knowledge sources

Declares no flags of its own; it takes those of olivares knowledge and the root command.

Command: olivares knowledge sources scan

Scan a content source for personal data without ingesting

olivares knowledge sources scan <source-name>

Declares no flags of its own; it takes those of olivares knowledge sources and the root command.

Command: olivares license

See, install and remove the license (Business)

olivares license

Declares no flags of its own; it takes those of olivares and the root command.

Command: olivares license connect

Bind this deployment to its purchase with an owner-approved key, and refresh, rotate, recover or deactivate it

olivares license connect

Declares no flags of its own; it takes those of olivares license and the root command.

Command: olivares license connect abandon

Discard the pending connect operation of this data directory

olivares license connect abandon

Flag	Type	Default	Description
--data-dir	string	—	data directory that holds this deployment’s connected identity (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--endpoint	string	—	licensing service origin (default https://licenses.olivares.ai on first use; afterwards the one recorded in the data directory)
--license	string	—	explicit license path the engine is started with; a connected credential is refused while it outranks the data directory
--timeout	duration	1m0s	overall network timeout
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares license connect apt-refresh

Obtain this cycle’s APT download credential by proof of possession and hand it to the appliance helper

olivares license connect apt-refresh

Flag	Type	Default	Description
--cycle	string	—	the appliance helper’s cycle: exactly 32 lowercase hexadecimal characters
--data-dir	string	—	data directory that holds this deployment’s connected identity (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)

Command: olivares license connect deactivate

Deactivate a deployment by proof of possession, or with the owner’s approval

olivares license connect deactivate

Flag	Type	Default	Description
--data-dir	string	—	data directory that holds this deployment’s connected identity (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--deployment	string	—	deployment id (default the one bound to this data directory)
--endpoint	string	—	licensing service origin (default https://licenses.olivares.ai on first use; afterwards the one recorded in the data directory)
--evidence	string	—	with –owner-approval: current purchase credential for a NEW request (file, or - for stdin); required, the installed license is not used
--license	string	—	explicit license path the engine is started with; a connected credential is refused while it outranks the data directory
--owner-approval	bool	false	request the owner’s approval instead of proving possession of the bound key
--timeout	duration	1m0s	overall network timeout
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares license connect dnf-refresh

Obtain this cycle’s DNF download credential by proof of possession and hand it to the appliance helper

olivares license connect dnf-refresh

Flag	Type	Default	Description
--cycle	string	—	the appliance helper’s cycle: exactly 32 lowercase hexadecimal characters
--data-dir	string	—	data directory that holds this deployment’s connected identity (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)

Command: olivares license connect reactivate

Reactivate an explicitly deactivated deployment with a new key and the owner’s approval

olivares license connect reactivate

Flag	Type	Default	Description
--binding-epoch	int64	0	binding epoch of that deployment when the data directory no longer records it
--business-id	string	—	provider business id shown in the customer portal
--channel	string	stable	release channel the credential and download token are resolved for: stable | security
--data-dir	string	—	data directory that holds this deployment’s connected identity (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--deployment	string	—	deployment id (default the one recorded in the data directory)
--endpoint	string	—	licensing service origin (default https://licenses.olivares.ai on first use; afterwards the one recorded in the data directory)
--evidence	string	—	current purchase credential for a NEW request (file, or - for stdin); required, the installed license is not used
--holder-id	string	—	holder (subscription) id shown in the customer portal
--label	string	—	optional display label (not an identity)
--license	string	—	explicit license path the engine is started with; a connected credential is refused while it outranks the data directory
--license-id	string	—	license id shown in the customer portal
--parent	string	—	staging only: the production deployment id it belongs to
--provider	string	dodo	commerce provider of the purchase
--purpose	string	production	production | staging
--timeout	duration	1m0s	overall network timeout

Command: olivares license connect recover

Bind a new key to an existing deployment whose key is lost, with the owner’s approval

olivares license connect recover

Flag	Type	Default	Description
--binding-epoch	int64	0	binding epoch of that deployment when the data directory no longer records it
--business-id	string	—	provider business id shown in the customer portal
--channel	string	stable	release channel the credential and download token are resolved for: stable | security
--data-dir	string	—	data directory that holds this deployment’s connected identity (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--deployment	string	—	deployment id (default the one recorded in the data directory)
--endpoint	string	—	licensing service origin (default https://licenses.olivares.ai on first use; afterwards the one recorded in the data directory)
--evidence	string	—	current purchase credential for a NEW request (file, or - for stdin); required, the installed license is not used
--holder-id	string	—	holder (subscription) id shown in the customer portal
--label	string	—	optional display label (not an identity)
--license	string	—	explicit license path the engine is started with; a connected credential is refused while it outranks the data directory
--license-id	string	—	license id shown in the customer portal
--parent	string	—	staging only: the production deployment id it belongs to
--provider	string	dodo	commerce provider of the purchase
--purpose	string	production	production | staging
--timeout	duration	1m0s	overall network timeout

Command: olivares license connect refresh

Refresh the installed credential and download token by proof of possession

olivares license connect refresh

Flag	Type	Default	Description
--channel	string	stable	release channel: stable | security (default the recorded channel)
--data-dir	string	—	data directory that holds this deployment’s connected identity (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--endpoint	string	—	licensing service origin (default https://licenses.olivares.ai on first use; afterwards the one recorded in the data directory)
--license	string	—	explicit license path the engine is started with; a connected credential is refused while it outranks the data directory
--timeout	duration	1m0s	overall network timeout

Command: olivares license connect rotate-key

Replace this deployment’s key, proving possession of both the bound and the new key

olivares license connect rotate-key

Flag	Type	Default	Description
--data-dir	string	—	data directory that holds this deployment’s connected identity (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--endpoint	string	—	licensing service origin (default https://licenses.olivares.ai on first use; afterwards the one recorded in the data directory)
--license	string	—	explicit license path the engine is started with; a connected credential is refused while it outranks the data directory
--timeout	duration	1m0s	overall network timeout

Command: olivares license connect start

Request owner approval for this deployment’s key and complete the binding once approved

olivares license connect start

Flag	Type	Default	Description
--business-id	string	—	provider business id shown in the customer portal
--channel	string	stable	release channel the credential and download token are resolved for: stable | security
--data-dir	string	—	data directory that holds this deployment’s connected identity (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--endpoint	string	—	licensing service origin (default https://licenses.olivares.ai on first use; afterwards the one recorded in the data directory)
--evidence	string	—	purchase credential to present (file, or - for stdin; default the installed license, which may be expired)
--holder-id	string	—	holder (subscription) id shown in the customer portal
--label	string	—	optional display label (not an identity)
--license	string	—	explicit license path the engine is started with; a connected credential is refused while it outranks the data directory
--license-id	string	—	license id shown in the customer portal
--parent	string	—	staging only: the production deployment id it belongs to
--provider	string	dodo	commerce provider of the purchase
--purpose	string	production	production | staging
--timeout	duration	1m0s	overall network timeout

Command: olivares license connect status

Show this data directory’s connected identity, binding, pending operation and last credential

olivares license connect status

Flag	Type	Default	Description
--data-dir	string	—	data directory that holds this deployment’s connected identity (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--endpoint	string	—	licensing service origin (default https://licenses.olivares.ai on first use; afterwards the one recorded in the data directory)
--license	string	—	explicit license path the engine is started with; a connected credential is refused while it outranks the data directory
--timeout	duration	1m0s	overall network timeout

Command: olivares license install

Install a license into the data dir (verify + persist; apply live with SIGHUP / runtime reload)

olivares license install <file|->

Flag	Type	Default	Description
--data-dir	string	—	data directory to install into (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--force	bool	false	install even though a –license/OLIVARES_LICENSE* override OUTRANKS the data-dir file. Without it the install is REFUSED, because it would change nothing the engine reads; with it the file is staged and the warning says so
--pubkey	string	—	base64 Ed25519 public key to verify against instead of the data directory’s license trust

Command: olivares license keygen

Generate one Ed25519 keypair for a license or OTA trust domain

olivares license keygen

Flag	Type	Default	Description
--force	bool	false	replace existing key files. Without it an existing path is REFUSED, because re-running a ceremony with the wrong path used to destroy the signing anchor in silence. With it the replacement is written to a temporary file beside the target, chmod’ed and verified, and renamed into place
--out-private	string	—	write the private key to this file (created 0600; refuses to overwrite without –force) instead of stdout
--out-public	string	—	write the public key to this file (created 0644; refuses to overwrite without –force) instead of stdout

Command: olivares license sign

Sign a license (requires –key in a release build; uses the dev key only in dev/test builds)

olivares license sign

Flag	Type	Default	Description
--expires	string	—	expiry (RFC3339). Empty signs a blob with NO expiry, which the wire format still accepts but commercial entitlements are term-only — every real license gets a date
--features	string	—	comma-separated add-on ids from the fused pricing canon (informational; never a gate)
--holder	string	—	opaque holder id
--key	string	—	base64 Ed25519 private key (default: dev key)
--licensee	string	—	the organization the exception is granted to
--max-users	int	0	attested seat figure, DISPLAY-ONLY since B10 — no build caps users on it; leave 0 (unlimited), which is what every self-hosted tier gets
--plan	string	commercial	plan label
--support-tier	string	—	attested support relationship label for display only, e.g. business|enterprise (empty = none; never gates — SUPPORT.md)

Command: olivares license status

Show the installed license and its status (offline; resolves –license > env > data-dir)

olivares license status

Flag	Type	Default	Description
--data-dir	string	—	data directory holding the license (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--license	string	—	explicit license file path (highest precedence, like serve –license)
--manifest	string	—	OTA channel manifest to read the license CRL from (its signature must verify)
--manifest-sig	string	—	detached manifest signature (default <manifest>.sig)
--ota-pubkey	string	—	base64 or @file Ed25519 OTA key for the manifest (default: the key embedded in this build)
--pubkey	string	—	base64 Ed25519 public key to verify against instead of the data directory’s license trust

Command: olivares license trust

Show or change which license signing keys this deployment trusts (current, verify-only, revoked, epoch fence)

olivares license trust

Declares no flags of its own; it takes those of olivares license and the root command.

Command: olivares license trust fence

Set the minimum key_epoch this deployment accepts in license credentials

olivares license trust fence

Flag	Type	Default	Description
--data-dir	string	—	data directory whose license trust to change (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--min-key-epoch	int	0	required. minimum accepted key_epoch (0 = no fence)

Command: olivares license trust set

Add a license public key or change a trusted key’s state, epoch or retirement window

olivares license trust set

Flag	Type	Default	Description
--data-dir	string	—	data directory whose license trust to change (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--epoch	int	0	key_epoch the key’s credentials must carry (0 = not pinned)
--kid	string	—	key id (sha256:<hex>) of a key that is already trusted
--public-key	string	—	base64 Ed25519 license public key, or @file (public material only)
--retired-at	string	—	verify_only: RFC3339 UTC instant from which this key’s new licenses are refused
--state	string	—	required. current | verify_only | revoked
--verify-until	string	—	verify_only: RFC3339 UTC instant that ends this key’s verification window

Command: olivares license trust status

Show the effective license trust keyring of a data directory

olivares license trust status

Flag	Type	Default	Description
--data-dir	string	—	data directory whose license trust to show (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)

Command: olivares license uninstall

Remove the installed license from the data dir (the offline half of DELETE /v1/console/license)

olivares license uninstall

Flag	Type	Default	Description
--data-dir	string	—	data directory holding the license (default $OLIVARES_DATA_DIR or ./olivares-data)
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares license verify

Verify a license against a public key (default: embedded key), with profile/grace and optional CRL status

olivares license verify <license-blob>

Flag	Type	Default	Description
--data-dir	string	—	also trust this data directory’s administrative license trust (see ‘license trust’)
--manifest	string	—	OTA channel manifest to read the license CRL from (its signature must verify)
--manifest-sig	string	—	detached manifest signature (default <manifest>.sig)
--ota-pubkey	string	—	base64 or @file Ed25519 OTA key for the manifest (default: the key embedded in this build)
--pubkey	string	—	base64 Ed25519 public key (default: embedded key)

Command: olivares login

Sign in to an engine and keep the sign-in for the next commands

olivares login

Flag	Type	Default	Description
--allow-cleartext	bool	false	allow sending the credential to a non-loopback host over plain HTTP (DANGEROUS: it travels readable)
--ca-cert	string	—	PEM file containing an additional trusted root CA (default: current context)
--context	string	—	context name to create or update (default: server hostname)
--email	string	—	sign in with this account’s password instead of a bearer token
--insecure	bool	false	skip TLS certificate verification (DANGEROUS; development only)
--password	string	—	password for –email (prefer –password-file: this form is visible in the process table)
--password-file	string	—	read the password for –email from a file, or - for stdin
--pin-sha256	stringArray	[]	trusted leaf SPKI SHA-256 pin, base64 or hex, repeatable — the engine prints it as pin_sha256 on the line reporting its certificate (default: current context)
--server	string	—	the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	tenant id (default $OLIVARES_TENANT, then current context)
--timeout	duration	10s	request timeout
--token	string	—	hidden. API bearer token (prefer –token-file: this form is visible in the process table and in shell history; default $OLIVARES_TOKEN, then current context)
--token-file	string	—	read the API bearer token from a file, or - for stdin

Command: olivares logout

Sign out: remove the saved sign-in from this computer

olivares logout

Flag	Type	Default	Description
--context	string	—	context to log out (default: current context)
--purge	bool	false	delete the entire context instead of only its token

Command: olivares mcp

MCP servers that sessions can use

olivares mcp

Flag	Type	Default	Description
--allow-cleartext	bool	false	inherited, hidden. allow sending the credential to a non-loopback host over plain HTTP (DANGEROUS: it travels readable)
--ca-cert	string	—	inherited, hidden. PEM file containing an additional trusted root CA (default: current context)
--insecure	bool	false	inherited, hidden. skip TLS certificate verification (DANGEROUS; development only)
--pin-sha256	stringArray	[]	inherited, hidden. trusted leaf SPKI SHA-256 pin, base64 or hex, repeatable — the engine prints it as pin_sha256 on the line reporting its certificate (default: current context)
--server	string	—	inherited, hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	inherited, hidden. tenant id (default $OLIVARES_TENANT, then current context)
--timeout	duration	10s	inherited, hidden. request timeout
--token	string	—	inherited, hidden. API bearer token (prefer –token-file: this form is visible in the process table and in shell history; default $OLIVARES_TOKEN, then current context)
--token-file	string	—	inherited, hidden. read the API bearer token from a file, or - for stdin

Command: olivares mcp add

Add an MCP server (off until you enable it) and list its tools

olivares mcp add <name> (-- <command> [args...] | <https-url>)

Flag	Type	Default	Description
--egress-host	stringArray	[]	HTTPS host or host:port a local server may reach; the only network it gets (repeatable)
--env	stringArray	[]	NAME=value for a local server’s environment (public values only; repeatable)
--no-test	bool	false	add without testing it
--secret-env	stringArray	[]	NAME=store:mcp/<secret> for a local server’s secret environment (repeatable)
--tool	string	—	<program>@<version> of a tool installed with olivares tool install –from, pinned by its digest

Command: olivares mcp assign

Give an MCP server only to the sessions under a workspace, folder, template, group, agent or session

olivares mcp assign <name>

Flag	Type	Default	Description
--agent	string	—	stored agent identifier
--folder	string	—	registered folder workspace reference
--group	string	—	stored agent group identifier
--session	string	—	stored governed session identifier
--template	string	—	stored template identifier
--workspace	string	—	stored workspace (department) identifier

Command: olivares mcp disable

Turn an MCP server off; sessions stop using it

olivares mcp disable <name>

Declares no flags of its own; it takes those of olivares mcp and the root command.

Command: olivares mcp enable

Turn an MCP server on, so sessions can use its tools

olivares mcp enable <name>

Flag	Type	Default	Description
--allow	stringSlice	[]	tools that run without approval (comma-separated or repeated; every other tool asks)
--allow-proposed	bool	false	let the tools the server calls read-only run without approval (every other tool asks)

Command: olivares mcp ls

List the MCP servers, whether each is on, and the tools its last test found

olivares mcp ls

Aliases: list

Declares no flags of its own; it takes those of olivares mcp and the root command.

Command: olivares mcp pins

Hidden diagnostic: it does not appear in --help output and is not part of the supported surface.

List and manage approved MCP tool fingerprints

olivares mcp pins

Declares no flags of its own; it takes those of olivares mcp and the root command.

Command: olivares mcp pins approve

Approve an explicit or currently drifted tool fingerprint

olivares mcp pins approve <tool>

Flag	Type	Default	Description
--fingerprint	string	—	explicit tool-definition fingerprint to approve
--from-drift	bool	false	approve the tool’s current drift fingerprint

Command: olivares mcp pins ls

List approved MCP tool fingerprints and current drift

olivares mcp pins ls

Aliases: list

Declares no flags of its own; it takes those of olivares mcp pins and the root command.

Command: olivares mcp pins rm

Remove an approved MCP tool fingerprint

olivares mcp pins rm <tool>

Aliases: remove, unpin

Declares no flags of its own; it takes those of olivares mcp pins and the root command.

Command: olivares mcp rm

Remove an MCP server

olivares mcp rm <name>

Aliases: delete, remove

Flag	Type	Default	Description
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares mcp secret

Store a credential for MCP servers, referenced as store:mcp/<name>

olivares mcp secret <name> --value-file <file>

Flag	Type	Default	Description
--description	string	—	optional non-secret note
--value-file	string	—	required. read the value from a file, or - for stdin

Command: olivares mcp sessions

Let sessions use the MCP servers that are on, or stop them (off by default)

olivares mcp sessions <on|off>

Declares no flags of its own; it takes those of olivares mcp and the root command.

Command: olivares mcp test

Start an MCP server and list its tools without calling any

olivares mcp test <name>

Declares no flags of its own; it takes those of olivares mcp and the root command.

Command: olivares mcp unassign

Remove a target from an MCP server

olivares mcp unassign <name>

Flag	Type	Default	Description
--agent	string	—	stored agent identifier
--folder	string	—	registered folder workspace reference
--group	string	—	stored agent group identifier
--session	string	—	stored governed session identifier
--template	string	—	stored template identifier
--workspace	string	—	stored workspace (department) identifier

Command: olivares members

People in an organization and their roles

olivares members

Flag	Type	Default	Description
--allow-cleartext	bool	false	inherited, hidden. allow sending the credential to a non-loopback host over plain HTTP (DANGEROUS: it travels readable)
--ca-cert	string	—	inherited, hidden. PEM file containing an additional trusted root CA (default: current context)
--insecure	bool	false	inherited, hidden. skip TLS certificate verification (DANGEROUS; development only)
--pin-sha256	stringArray	[]	inherited, hidden. trusted leaf SPKI SHA-256 pin, base64 or hex, repeatable — the engine prints it as pin_sha256 on the line reporting its certificate (default: current context)
--server	string	—	inherited, hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	inherited, hidden. tenant id (default $OLIVARES_TENANT, then current context)
--timeout	duration	10s	inherited, hidden. request timeout
--token	string	—	inherited, hidden. API bearer token (prefer –token-file: this form is visible in the process table and in shell history; default $OLIVARES_TOKEN, then current context)
--token-file	string	—	inherited, hidden. read the API bearer token from a file, or - for stdin

Command: olivares members grant

Grant an existing account a role in a tenant

olivares members grant

Flag	Type	Default	Description
--role	string	viewer	role to grant: viewer, editor, admin or owner
--user	string	—	id of the account to grant (required)
--workspace	string	—	confine the membership to one workspace of the tenant (default: tenant-wide)

Command: olivares members invites

List and revoke the tenant’s pending invitations

olivares members invites

Declares no flags of its own; it takes those of olivares members and the root command.

Command: olivares members invites ls

List the tenant’s pending, unexpired invitations

olivares members invites ls

Aliases: list

Declares no flags of its own; it takes those of olivares members invites and the root command.

Command: olivares members invites revoke

Revoke a pending invitation

olivares members invites revoke <invite-id>

Aliases: delete, rm

Flag	Type	Default	Description
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares members ls

List the resolved tenant’s member roster

olivares members ls

Aliases: list

Declares no flags of its own; it takes those of olivares members and the root command.

Command: olivares message

Hidden diagnostic: it does not appear in --help output and is not part of the supported surface.

Exchange exact-session messages through governed channels

olivares message

Declares no flags of its own; it takes those of olivares and the root command.

Command: olivares message ack

Acknowledge this exact session’s delivery

olivares message ack delivery-id

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--idempotency-key	string	—	canonical UUIDv7 key retained for exact retries
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_COMMUNICATION_TOKEN, then normal client resolution)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin
--version	int64	0	current delivery version

Command: olivares message decision

Answer decision requests attached to work

olivares message decision

Declares no flags of its own; it takes those of olivares message and the root command.

Command: olivares message decision respond

Resolve a decision request with one offered choice

olivares message decision respond <request-id> <choice>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--idempotency-key	string	—	stable UUIDv7 key for exact retries (generated if omitted)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--reason	string	—	reason for the choice
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin
--version	int64	0	current decision request version

Command: olivares message get

Read this exact session’s delivery

olivares message get delivery-id

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_COMMUNICATION_TOKEN, then normal client resolution)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares message handoff

Offer and respond to exact-session work handoffs

olivares message handoff

Declares no flags of its own; it takes those of olivares message and the root command.

Command: olivares message handoff get

Read protected handoff context by carrier delivery

olivares message handoff get delivery-id

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_COMMUNICATION_TOKEN, then normal client resolution)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares message handoff inbox

List this exact session’s incoming handoffs

olivares message handoff inbox

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--continuation	string	—	opaque continuation from the previous inbox page
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--limit	int	50	page size (1..200)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--state	string	offered	one handoff state: offered, accepted, rejected, withdrawn or expired
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_COMMUNICATION_TOKEN, then normal client resolution)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin
--workspace-id	string	—	exact session workspace UUID

Command: olivares message handoff offer

Offer owned work to one exact canonical session SID

olivares message handoff offer

Flag	Type	Default	Description
--ack-deadline	string	—	future acknowledgment deadline in RFC3339
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--channel-id	string	—	operator-authorized channel UUID
--context-file	string	—	HandoffContent JSON file, or - for stdin
--idempotency-key	string	—	canonical UUIDv7 key retained for exact retries
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--owner-epoch	int64	0	owner epoch from the current work read
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--to-sid	string	—	exact recipient canonical SID (osn_UUID)
--token	string	—	hidden. API bearer token (default $OLIVARES_COMMUNICATION_TOKEN, then normal client resolution)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin
--version	int64	0	current work item version
--work-item-id	string	—	owned work item UUID

Command: olivares message handoff respond

Accept or reject this exact session’s incoming handoff

olivares message handoff respond handoff-id

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--idempotency-key	string	—	canonical UUIDv7 key retained for exact retries
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--reason-file	string	—	CommunicationReasonContent JSON required for reject; file or - for stdin
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_COMMUNICATION_TOKEN, then normal client resolution)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin
--transition	string	—	accept or reject
--version	int64	0	current handoff version from the protected detail

Command: olivares message inbox

Read this authenticated session’s inbox

olivares message inbox

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--continuation	string	—	opaque continuation from the previous inbox page
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--limit	int	50	page size (1..200)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_COMMUNICATION_TOKEN, then normal client resolution)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin
--workspace-id	string	—	exact session workspace UUID

Command: olivares message send

Send plain-text content to one canonical session SID

olivares message send

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--channel-id	string	—	operator-authorized channel UUID
--idempotency-key	string	—	stable key retained for exact retries
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--subject	string	—	message subject
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--text-file	string	—	plain-text file, or - for stdin
--timeout	duration	30s	hidden. request timeout
--to-sid	string	—	exact recipient canonical SID (osn_UUID)
--token	string	—	hidden. API bearer token (default $OLIVARES_COMMUNICATION_TOKEN, then normal client resolution)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares migrate

Inspect migration state or explicitly apply the PostgreSQL schema

olivares migrate

Flag	Type	Default	Description
--format	string	text	inherited. deprecated alias for -o/–output on this command (text or json) — NOT the export-format flag of ‘audit export’ / ‘findings export’

Command: olivares migrate apply

Apply the PostgreSQL schema and stop WITHOUT serving (migrate → grant → serve)

olivares migrate apply

Flag	Type	Default	Description
--dsn	string	—	PostgreSQL application-role DSN (accepts a file:/env: reference)
--owner-dsn	string	—	PostgreSQL owner-role DSN that runs the DDL (accepts a file:/env: reference); leave empty for the single-role setup

Command: olivares migrate manifest

Print this binary’s registered schema manifest (deterministic; the Community≡Business parity oracle)

olivares migrate manifest

Declares no flags of its own; it takes those of olivares migrate and the root command.

Command: olivares migrate status

List applied schema migrations and their expand/contract phase (read-only)

olivares migrate status

Flag	Type	Default	Description
--data-dir	string	—	data directory holding olivares.db (sqlite; defaults to $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--dsn	string	—	connection string to read (postgres; or an explicit sqlite file path). Accepts a file:/env: reference
--engine	string	sqlite	store engine: sqlite or postgres

Command: olivares models

Govern the model estate, routing, registry and model access

olivares models

Flag	Type	Default	Description
--allow-cleartext	bool	false	inherited, hidden. allow sending the credential to a non-loopback host over plain HTTP (DANGEROUS: it travels readable)
--ca-cert	string	—	inherited, hidden. PEM file containing an additional trusted root CA (default: current context)
--insecure	bool	false	inherited, hidden. skip TLS certificate verification (DANGEROUS; development only)
--pin-sha256	stringArray	[]	inherited, hidden. trusted leaf SPKI SHA-256 pin, base64 or hex, repeatable — the engine prints it as pin_sha256 on the line reporting its certificate (default: current context)
--server	string	—	inherited, hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	inherited, hidden. tenant id (default $OLIVARES_TENANT, then current context)
--timeout	duration	10s	inherited, hidden. request timeout
--token	string	—	inherited, hidden. API bearer token (prefer –token-file: this form is visible in the process table and in shell history; default $OLIVARES_TOKEN, then current context)
--token-file	string	—	inherited, hidden. read the API bearer token from a file, or - for stdin

Command: olivares models access

Author model-access grants (who may use which model)

olivares models access

Aliases: model-access

Declares no flags of its own; it takes those of olivares models and the root command.

Command: olivares models access create

Create a model-access grant

olivares models access create

Flag	Type	Default	Description
--data	string	—	request document: inline JSON, @FILE, or - for stdin

Command: olivares models access ls

List model-access grants

olivares models access ls

Aliases: list

Flag	Type	Default	Description
--all	bool	false	follow the cursor to the end and emit one merged page (json output carries has_more:false and no cursor)
--cursor	string	—	opaque cursor from a previous page’s cursor field
--limit	int	0	page size to request (left out: the engine’s default)
--subject-kind	string	—	only grants whose subject is of this kind (user, role, agent_group)
--subject-ref	string	—	only grants for this subject reference
--target-kind	string	—	only grants whose target is of this kind (model, model_group)
--target-ref	string	—	only grants for this target reference

Command: olivares models access rm

Delete a model-access grant

olivares models access rm <grant-id>

Aliases: delete

Flag	Type	Default	Description
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares models access update

Replace a model-access grant

olivares models access update <grant-id>

Flag	Type	Default	Description
--data	string	—	request document: inline JSON, @FILE, or - for stdin

Command: olivares models admission

Govern the signed-model admission trust root and read its verdicts

olivares models admission

Declares no flags of its own; it takes those of olivares models and the root command.

Command: olivares models admission ls

List recorded admission verdicts

olivares models admission ls

Aliases: list

Flag	Type	Default	Description
--all	bool	false	follow the cursor to the end and emit one merged page (json output carries has_more:false and no cursor)
--cursor	string	—	opaque cursor from a previous page’s cursor field
--limit	int	0	page size to request (left out: the engine’s default)
--verified	string	—	only verdicts with this verification outcome (true or false)
--version-ref	string	—	only verdicts for this version

Command: olivares models admission policy

Show the admission trust root

olivares models admission policy

Declares no flags of its own; it takes those of olivares models admission and the root command.

Command: olivares models admission set-policy

Replace the admission trust root

olivares models admission set-policy

Flag	Type	Default	Description
--data	string	—	request document: inline JSON, @FILE, or - for stdin

Command: olivares models agent-artifacts

Govern the agent-artifact supply chain

olivares models agent-artifacts

Aliases: artifacts

Declares no flags of its own; it takes those of olivares models and the root command.

Command: olivares models agent-artifacts aibom

Generate the agent-supply-chain BOM

olivares models agent-artifacts aibom

Declares no flags of its own; it takes those of olivares models agent-artifacts and the root command.

Command: olivares models agent-artifacts create

Register an agent artifact

olivares models agent-artifacts create

Flag	Type	Default	Description
--data	string	—	request document: inline JSON, @FILE, or - for stdin

Command: olivares models agent-artifacts ls

List governed agent artifacts

olivares models agent-artifacts ls

Aliases: list

Flag	Type	Default	Description
--all	bool	false	follow the cursor to the end and emit one merged page (json output carries has_more:false and no cursor)
--artifact-class	string	—	only artifacts of this class (skill, mcpb_extension, mcp_app_template, agents_md)
--cursor	string	—	opaque cursor from a previous page’s cursor field
--limit	int	0	page size to request (left out: the engine’s default)

Command: olivares models agent-artifacts rm

Remove an agent artifact

olivares models agent-artifacts rm <artifact-id>

Aliases: delete

Flag	Type	Default	Description
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares models agent-artifacts seal

Seal the agent-supply-chain BOM to the ledger

olivares models agent-artifacts seal

Declares no flags of its own; it takes those of olivares models agent-artifacts and the root command.

Command: olivares models agent-artifacts seals

List agent-supply-chain BOM seals

olivares models agent-artifacts seals

Flag	Type	Default	Description
--all	bool	false	follow the cursor to the end and emit one merged page (json output carries has_more:false and no cursor)
--cursor	string	—	opaque cursor from a previous page’s cursor field
--limit	int	0	page size to request (left out: the engine’s default)

Command: olivares models aibom

Generate, seal and list AI bills of materials

olivares models aibom

Declares no flags of its own; it takes those of olivares models and the root command.

Command: olivares models aibom card

Render the model card for one owned model

olivares models aibom card <owned-id>

Flag	Type	Default	Description
--format	string	—	card format: the module’s default (JSON) or md

Command: olivares models aibom get

Generate the AIBOM for one owned model

olivares models aibom get <owned-id>

Flag	Type	Default	Description
--format	string	—	document format: the module’s default (CycloneDX) or spdx

Command: olivares models aibom ls

List AIBOM seals

olivares models aibom ls

Aliases: list

Flag	Type	Default	Description
--all	bool	false	follow the cursor to the end and emit one merged page (json output carries has_more:false and no cursor)
--cursor	string	—	opaque cursor from a previous page’s cursor field
--limit	int	0	page size to request (left out: the engine’s default)
--owned-ref	string	—	only seals for this owned model

Command: olivares models aibom seal

Seal the current AIBOM to the ledger as evidence

olivares models aibom seal <owned-id>

Declares no flags of its own; it takes those of olivares models aibom and the root command.

Command: olivares models availability

Show available models by provider and account

olivares models availability

Flag	Type	Default	Description
--account-ref	string	—	only this account-home profile
--driver	string	—	only this coding tool
--provider-ref	string	—	only this provider record

Command: olivares models catalog

Show the declared reference catalog (capabilities and list pricing)

olivares models catalog

Declares no flags of its own; it takes those of olivares models and the root command.

Command: olivares models data-governance

Show the context-management / memory / ZDR matrix

olivares models data-governance

Declares no flags of its own; it takes those of olivares models and the root command.

Command: olivares models datasets

Govern dataset lineage components

olivares models datasets

Declares no flags of its own; it takes those of olivares models and the root command.

Command: olivares models datasets create

Register a dataset

olivares models datasets create

Flag	Type	Default	Description
--data	string	—	request document: inline JSON, @FILE, or - for stdin

Command: olivares models datasets ls

List governed datasets

olivares models datasets ls

Aliases: list

Flag	Type	Default	Description
--all	bool	false	follow the cursor to the end and emit one merged page (json output carries has_more:false and no cursor)
--cursor	string	—	opaque cursor from a previous page’s cursor field
--limit	int	0	page size to request (left out: the engine’s default)
--owned-ref	string	—	only datasets of this owned model

Command: olivares models datasets rm

Remove a dataset

olivares models datasets rm <dataset-id>

Aliases: delete

Flag	Type	Default	Description
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares models deployments

Govern local inference deployments

olivares models deployments

Declares no flags of its own; it takes those of olivares models and the root command.

Command: olivares models deployments create

Register an inference deployment

olivares models deployments create

Flag	Type	Default	Description
--data	string	—	request document: inline JSON, @FILE, or - for stdin

Command: olivares models deployments ls

List inference deployments

olivares models deployments ls

Aliases: list

Flag	Type	Default	Description
--all	bool	false	follow the cursor to the end and emit one merged page (json output carries has_more:false and no cursor)
--cursor	string	—	opaque cursor from a previous page’s cursor field
--limit	int	0	page size to request (left out: the engine’s default)
--runtime	string	—	only deployments on this runtime
--status	string	—	only deployments in this status

Command: olivares models deployments rm

Remove an inference deployment

olivares models deployments rm <deployment-id>

Aliases: delete

Flag	Type	Default	Description
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares models deployments update

Replace an inference deployment

olivares models deployments update <deployment-id>

Flag	Type	Default	Description
--data	string	—	request document: inline JSON, @FILE, or - for stdin

Command: olivares models entitlements

Attest provider entitlement state for restricted access tiers

olivares models entitlements

Declares no flags of its own; it takes those of olivares models and the root command.

Command: olivares models entitlements ls

List access-tier entitlement attestations

olivares models entitlements ls

Aliases: list

Flag	Type	Default	Description
--all	bool	false	follow the cursor to the end and emit one merged page (json output carries has_more:false and no cursor)
--cursor	string	—	opaque cursor from a previous page’s cursor field
--limit	int	0	page size to request (left out: the engine’s default)
--state	string	—	only entitlements in this state
--tier	string	—	only this access tier

Command: olivares models entitlements set

Attest the entitlement state of one access tier

olivares models entitlements set

Flag	Type	Default	Description
--data	string	—	request document: inline JSON, @FILE, or - for stdin

Command: olivares models features

Show which model families declare each API capability

olivares models features

Declares no flags of its own; it takes those of olivares models and the root command.

Command: olivares models finetune

Record fine-tune jobs and their outcome

olivares models finetune

Declares no flags of its own; it takes those of olivares models and the root command.

Command: olivares models finetune create

Record a fine-tune job

olivares models finetune create

Flag	Type	Default	Description
--data	string	—	request document: inline JSON, @FILE, or - for stdin

Command: olivares models finetune get

Show one fine-tune job record

olivares models finetune get <job-id>

Declares no flags of its own; it takes those of olivares models finetune and the root command.

Command: olivares models finetune ls

List fine-tune job records

olivares models finetune ls

Aliases: list

Flag	Type	Default	Description
--all	bool	false	follow the cursor to the end and emit one merged page (json output carries has_more:false and no cursor)
--cursor	string	—	opaque cursor from a previous page’s cursor field
--limit	int	0	page size to request (left out: the engine’s default)
--status	string	—	only jobs in this status

Command: olivares models finetune update

Replace a fine-tune job record

olivares models finetune update <job-id>

Flag	Type	Default	Description
--data	string	—	request document: inline JSON, @FILE, or - for stdin

Command: olivares models get

Show one governed model

olivares models get <model-id>

Declares no flags of its own; it takes those of olivares models and the root command.

Command: olivares models gpai

Attest per-provider GPAI compliance posture

olivares models gpai

Declares no flags of its own; it takes those of olivares models and the root command.

Command: olivares models gpai attest

Attest one provider’s GPAI posture

olivares models gpai attest

Flag	Type	Default	Description
--data	string	—	request document: inline JSON, @FILE, or - for stdin

Command: olivares models gpai ls

List attested GPAI posture per provider

olivares models gpai ls

Aliases: list

Flag	Type	Default	Description
--all	bool	false	follow the cursor to the end and emit one merged page (json output carries has_more:false and no cursor)
--cursor	string	—	opaque cursor from a previous page’s cursor field
--limit	int	0	page size to request (left out: the engine’s default)
--provider-ref	string	—	only this provider

Command: olivares models groups

Author named model groups

olivares models groups

Aliases: model-groups

Declares no flags of its own; it takes those of olivares models and the root command.

Command: olivares models groups create

Create a model group

olivares models groups create

Flag	Type	Default	Description
--data	string	—	request document: inline JSON, @FILE, or - for stdin

Command: olivares models groups get

Show one model group

olivares models groups get <group-id>

Declares no flags of its own; it takes those of olivares models groups and the root command.

Command: olivares models groups ls

List model groups

olivares models groups ls

Aliases: list

Flag	Type	Default	Description
--all	bool	false	follow the cursor to the end and emit one merged page (json output carries has_more:false and no cursor)
--cursor	string	—	opaque cursor from a previous page’s cursor field
--limit	int	0	page size to request (left out: the engine’s default)

Command: olivares models groups rm

Delete a model group

olivares models groups rm <group-id>

Aliases: delete

Flag	Type	Default	Description
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares models groups update

Replace a model group

olivares models groups update <group-id>

Flag	Type	Default	Description
--data	string	—	request document: inline JSON, @FILE, or - for stdin

Command: olivares models keys

Govern provider API-key and workspace references

olivares models keys

Declares no flags of its own; it takes those of olivares models and the root command.

Command: olivares models keys create

Register a provider key or workspace reference

olivares models keys create

Flag	Type	Default	Description
--data	string	—	request document: inline JSON, @FILE, or - for stdin

Command: olivares models keys ls

List provider key and workspace references

olivares models keys ls

Aliases: list

Flag	Type	Default	Description
--all	bool	false	follow the cursor to the end and emit one merged page (json output carries has_more:false and no cursor)
--cursor	string	—	opaque cursor from a previous page’s cursor field
--limit	int	0	page size to request (left out: the engine’s default)
--provider-ref	string	—	only references for this provider
--ref-kind	string	—	only references of this kind (e.g. api_key, workspace)
--status	string	—	only references in this status

Command: olivares models keys rm

Remove a key or workspace reference

olivares models keys rm <ref-id>

Aliases: delete

Flag	Type	Default	Description
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares models keys update

Replace a key or workspace reference

olivares models keys update <ref-id>

Flag	Type	Default	Description
--data	string	—	request document: inline JSON, @FILE, or - for stdin

Command: olivares models ls

List the governed model estate

olivares models ls

Aliases: list

Flag	Type	Default	Description
--all	bool	false	follow the cursor to the end and emit one merged page (json output carries has_more:false and no cursor)
--cursor	string	—	opaque cursor from a previous page’s cursor field
--limit	int	0	page size to request (left out: the engine’s default)

Command: olivares models owned

Govern the own-model registry

olivares models owned

Declares no flags of its own; it takes those of olivares models and the root command.

Command: olivares models owned create

Register an owned model

olivares models owned create

Flag	Type	Default	Description
--data	string	—	request document: inline JSON, @FILE, or - for stdin

Command: olivares models owned get

Show one owned model

olivares models owned get <owned-id>

Declares no flags of its own; it takes those of olivares models owned and the root command.

Command: olivares models owned ls

List owned models

olivares models owned ls

Aliases: list

Flag	Type	Default	Description
--all	bool	false	follow the cursor to the end and emit one merged page (json output carries has_more:false and no cursor)
--cursor	string	—	opaque cursor from a previous page’s cursor field
--kind	string	—	only models of this kind
--limit	int	0	page size to request (left out: the engine’s default)
--status	string	—	only models in this status

Command: olivares models owned rm

Remove an owned model from the registry

olivares models owned rm <owned-id>

Aliases: delete

Flag	Type	Default	Description
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares models owned update

Replace an owned-model entry

olivares models owned update <owned-id>

Flag	Type	Default	Description
--data	string	—	request document: inline JSON, @FILE, or - for stdin

Command: olivares models platforms

Show the deployment-surface matrix and per-platform lifecycle

olivares models platforms

Declares no flags of its own; it takes those of olivares models and the root command.

Command: olivares models rate-limits

Show the provider rate-limit inventory a gateway must mirror

olivares models rate-limits

Declares no flags of its own; it takes those of olivares models and the root command.

Command: olivares models residency

Govern per-workspace inference-geo residency

olivares models residency

Declares no flags of its own; it takes those of olivares models and the root command.

Command: olivares models residency ls

List per-workspace residency records

olivares models residency ls

Aliases: list

Flag	Type	Default	Description
--all	bool	false	follow the cursor to the end and emit one merged page (json output carries has_more:false and no cursor)
--cursor	string	—	opaque cursor from a previous page’s cursor field
--limit	int	0	page size to request (left out: the engine’s default)
--workspace-ref	string	—	only this workspace

Command: olivares models residency set

Declare a workspace’s permitted inference geographies

olivares models residency set

Flag	Type	Default	Description
--data	string	—	request document: inline JSON, @FILE, or - for stdin

Command: olivares models routing

Author routing policies and resolve or execute them

olivares models routing

Declares no flags of its own; it takes those of olivares models and the root command.

Command: olivares models routing create

Create a routing policy

olivares models routing create

Flag	Type	Default	Description
--data	string	—	request document: inline JSON, @FILE, or - for stdin

Command: olivares models routing execute

Execute a routing policy through the governed executor (SPENDS)

olivares models routing execute <policy-id>

Flag	Type	Default	Description
--data	string	—	request document: inline JSON, @FILE, or - for stdin

Command: olivares models routing get

Show one routing policy

olivares models routing get <policy-id>

Declares no flags of its own; it takes those of olivares models routing and the root command.

Command: olivares models routing ls

List routing policies

olivares models routing ls

Aliases: list

Flag	Type	Default	Description
--all	bool	false	follow the cursor to the end and emit one merged page (json output carries has_more:false and no cursor)
--cursor	string	—	opaque cursor from a previous page’s cursor field
--limit	int	0	page size to request (left out: the engine’s default)

Command: olivares models routing resolve

Resolve a policy to the routing decision it would produce

olivares models routing resolve <policy-id>

Declares no flags of its own; it takes those of olivares models routing and the root command.

Command: olivares models routing rm

Delete a routing policy

olivares models routing rm <policy-id>

Aliases: delete

Flag	Type	Default	Description
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares models routing update

Replace a routing policy in place

olivares models routing update <policy-id>

Flag	Type	Default	Description
--data	string	—	request document: inline JSON, @FILE, or - for stdin

Command: olivares models tool-types

Show the dated tool-type catalog and its cost cross-walk

olivares models tool-types

Declares no flags of its own; it takes those of olivares models and the root command.

Command: olivares models versions

Govern owned-model versions and their signed admission

olivares models versions

Declares no flags of its own; it takes those of olivares models and the root command.

Command: olivares models versions admit

Run the signed-model admission ceremony against a version

olivares models versions admit <version-id>

Flag	Type	Default	Description
--data	string	—	request document: inline JSON, @FILE, or - for stdin

Command: olivares models versions create

Register an owned-model version

olivares models versions create

Flag	Type	Default	Description
--data	string	—	request document: inline JSON, @FILE, or - for stdin

Command: olivares models versions ls

List owned-model versions

olivares models versions ls

Aliases: list

Flag	Type	Default	Description
--all	bool	false	follow the cursor to the end and emit one merged page (json output carries has_more:false and no cursor)
--cursor	string	—	opaque cursor from a previous page’s cursor field
--limit	int	0	page size to request (left out: the engine’s default)
--owned-ref	string	—	only versions of this owned model
--status	string	—	only versions in this status

Command: olivares models versions rm

Remove an owned-model version

olivares models versions rm <version-id>

Aliases: delete

Flag	Type	Default	Description
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares modules

List, turn on and turn off optional modules

olivares modules

Flag	Type	Default	Description
--allow-cleartext	bool	false	inherited, hidden. allow sending the credential to a non-loopback host over plain HTTP (DANGEROUS: it travels readable)
--ca-cert	string	—	inherited, hidden. PEM file containing an additional trusted root CA (default: current context)
--insecure	bool	false	inherited, hidden. skip TLS certificate verification (DANGEROUS; development only)
--pin-sha256	stringArray	[]	inherited, hidden. trusted leaf SPKI SHA-256 pin, base64 or hex, repeatable — the engine prints it as pin_sha256 on the line reporting its certificate (default: current context)
--server	string	—	inherited, hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	inherited, hidden. tenant id (default $OLIVARES_TENANT, then current context)
--timeout	duration	10s	inherited, hidden. request timeout
--token	string	—	inherited, hidden. API bearer token (prefer –token-file: this form is visible in the process table and in shell history; default $OLIVARES_TOKEN, then current context)
--token-file	string	—	inherited, hidden. read the API bearer token from a file, or - for stdin

Command: olivares modules ls

List selected and running modules

olivares modules ls

Declares no flags of its own; it takes those of olivares modules and the root command.

Command: olivares modules off

Turn off a module in the saved selection

olivares modules off <name>

Declares no flags of its own; it takes those of olivares modules and the root command.

Command: olivares modules on

Turn on a module in the saved selection

olivares modules on <name>

Declares no flags of its own; it takes those of olivares modules and the root command.

Command: olivares notify

Author notification routes and inspect deliveries and the outbox

olivares notify

Flag	Type	Default	Description
--allow-cleartext	bool	false	inherited, hidden. allow sending the credential to a non-loopback host over plain HTTP (DANGEROUS: it travels readable)
--ca-cert	string	—	inherited, hidden. PEM file containing an additional trusted root CA (default: current context)
--insecure	bool	false	inherited, hidden. skip TLS certificate verification (DANGEROUS; development only)
--pin-sha256	stringArray	[]	inherited, hidden. trusted leaf SPKI SHA-256 pin, base64 or hex, repeatable — the engine prints it as pin_sha256 on the line reporting its certificate (default: current context)
--server	string	—	inherited, hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	inherited, hidden. tenant id (default $OLIVARES_TENANT, then current context)
--timeout	duration	10s	inherited, hidden. request timeout
--token	string	—	inherited, hidden. API bearer token (prefer –token-file: this form is visible in the process table and in shell history; default $OLIVARES_TOKEN, then current context)
--token-file	string	—	inherited, hidden. read the API bearer token from a file, or - for stdin

Command: olivares notify deliveries

List the append-only delivery ledger

olivares notify deliveries

Aliases: ledger

Flag	Type	Default	Description
--cursor	string	—	continue from the cursor printed by the previous page
--destination	string	—	filter by destination
--finding-kind	string	—	filter by finding kind
--limit	int	0	maximum rows to return in one page (left out: the engine’s default)
--route	string	—	filter by route id
--status	string	—	filter by delivery status

Command: olivares notify destinations

List the destinations THIS tenant may address

olivares notify destinations

Aliases: dests

Declares no flags of its own; it takes those of olivares notify and the root command.

Command: olivares notify evaluate

Ask which routes a signal WOULD select, delivering nothing

olivares notify evaluate

Aliases: dry-run, eval

Flag	Type	Default	Description
--event-type	string	—	the signal’s event type (required)
--kind	string	—	the finding kind
--severity	string	—	the signal’s severity
--source	string	—	the signal’s source
--subject-kind	string	—	the subject’s kind

Command: olivares notify match-types

List the event types a route may match

olivares notify match-types

Aliases: types

Declares no flags of its own; it takes those of olivares notify and the root command.

Command: olivares notify outbox

Inspect the durable outbox and requeue terminal rows

olivares notify outbox

Aliases: dlq

Declares no flags of its own; it takes those of olivares notify and the root command.

Command: olivares notify outbox ls

List durable outbox rows

olivares notify outbox ls

Aliases: list

Flag	Type	Default	Description
--cursor	string	—	continue from the cursor printed by the previous page
--destination	string	—	filter by destination
--limit	int	0	maximum rows to return in one page (left out: the engine’s default)
--status	string	—	filter by status: queued, delivering, delivered or dead

Command: olivares notify outbox redeliver

Requeue a terminal outbox row for another delivery attempt (admin-tier)

olivares notify outbox redeliver <outbox-id>

Aliases: requeue

Declares no flags of its own; it takes those of olivares notify outbox and the root command.

Command: olivares notify routes

Author, inspect, test and roll back notification routes

olivares notify routes

Aliases: route

Declares no flags of its own; it takes those of olivares notify and the root command.

Command: olivares notify routes create

Declare a notification route

olivares notify routes create

Flag	Type	Default	Description
--dedup-window	int64	0	seconds within which an identical signal is suppressed
--destination	string	—	the provisioned destination to send to (required; see ‘notify destinations’)
--enabled	bool	true	whether the route may fire
--match-kind	stringSlice	[]	finding kind to match, repeatable
--match-source	stringSlice	[]	signal source to match, repeatable
--match-subject-kind	stringSlice	[]	subject kind to match, repeatable
--match-type	stringSlice	[]	event type to match, repeatable (see ‘notify match-types’)
--min-severity	string	—	severity floor: info, low, medium, high or critical (empty = no floor)
--name	string	—	the route’s name (required, unique in the tenant)
--priority	int64	0	ordering among matching routes
--throttle-window	int64	0	seconds within which this route sends at most once

Command: olivares notify routes get

Show one route’s full predicate

olivares notify routes get <route-id>

Declares no flags of its own; it takes those of olivares notify routes and the root command.

Command: olivares notify routes ls

List notification routes

olivares notify routes ls

Aliases: list

Flag	Type	Default	Description
--cursor	string	—	continue from the cursor printed by the previous page
--destination	string	—	only routes targeting this destination
--enabled	string	—	only enabled (true) or only disabled (false) routes
--limit	int	0	maximum rows to return in one page (left out: the engine’s default)

Command: olivares notify routes restore

Put a route back to an earlier revision

olivares notify routes restore <route-id>

Flag	Type	Default	Description
--revision-id	string	—	the revision to restore (required)

Command: olivares notify routes revisions

List a route’s revision ledger

olivares notify routes revisions <route-id>

Aliases: history

Flag	Type	Default	Description
--cursor	string	—	continue from the cursor printed by the previous page
--limit	int	0	maximum rows to return in one page (left out: the engine’s default)

Command: olivares notify routes rm

Delete a route (admin-tier)

olivares notify routes rm <route-id>

Aliases: delete, remove

Flag	Type	Default	Description
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares notify routes test

Send a REAL test notification through a route (admin-tier)

olivares notify routes test <route-id>

Declares no flags of its own; it takes those of olivares notify routes and the root command.

Command: olivares notify routes update

Replace a route’s predicate

olivares notify routes update <route-id>

Flag	Type	Default	Description
--dedup-window	int64	0	seconds within which an identical signal is suppressed
--destination	string	—	the provisioned destination to send to (required; see ‘notify destinations’)
--enabled	bool	true	whether the route may fire
--match-kind	stringSlice	[]	finding kind to match, repeatable
--match-source	stringSlice	[]	signal source to match, repeatable
--match-subject-kind	stringSlice	[]	subject kind to match, repeatable
--match-type	stringSlice	[]	event type to match, repeatable (see ‘notify match-types’)
--min-severity	string	—	severity floor: info, low, medium, high or critical (empty = no floor)
--name	string	—	the route’s name
--priority	int64	0	ordering among matching routes
--throttle-window	int64	0	seconds within which this route sends at most once

Command: olivares observability

Inspect ingestion health, ledger traces and binary attestation

olivares observability

Aliases: obs

Flag	Type	Default	Description
--allow-cleartext	bool	false	inherited, hidden. allow sending the credential to a non-loopback host over plain HTTP (DANGEROUS: it travels readable)
--ca-cert	string	—	inherited, hidden. PEM file containing an additional trusted root CA (default: current context)
--insecure	bool	false	inherited, hidden. skip TLS certificate verification (DANGEROUS; development only)
--pin-sha256	stringArray	[]	inherited, hidden. trusted leaf SPKI SHA-256 pin, base64 or hex, repeatable — the engine prints it as pin_sha256 on the line reporting its certificate (default: current context)
--server	string	—	inherited, hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	inherited, hidden. tenant id (default $OLIVARES_TENANT, then current context)
--timeout	duration	10s	inherited, hidden. request timeout
--token	string	—	inherited, hidden. API bearer token (prefer –token-file: this form is visible in the process table and in shell history; default $OLIVARES_TOKEN, then current context)
--token-file	string	—	inherited, hidden. read the API bearer token from a file, or - for stdin

Command: olivares observability attestation

Show the measured attestation of the running binary

olivares observability attestation

Declares no flags of its own; it takes those of olivares observability and the root command.

Command: olivares observability ingestion-health

Report per-standard and per-source telemetry ingestion

olivares observability ingestion-health

Aliases: ingestion

Declares no flags of its own; it takes those of olivares observability and the root command.

Command: olivares observability traces

List and open ledger-derived traces

olivares observability traces

Declares no flags of its own; it takes those of olivares observability and the root command.

Command: olivares observability traces get

Show one trace’s spans

olivares observability traces get <trace-id>

Declares no flags of its own; it takes those of olivares observability traces and the root command.

Command: olivares observability traces ls

List correlated traces

olivares observability traces ls

Aliases: list

Flag	Type	Default	Description
--cursor	string	—	continue from the cursor printed by the previous page
--limit	int	0	maximum rows to return in one page (left out: the engine’s default)

Command: olivares openapi

Print an OpenAPI 3.1 document (stable core, or –beta module routes) for client codegen

olivares openapi

Flag	Type	Default	Description
--beta	bool	false	print the BETA module-route document (/v1/m/<ns>/…) instead of the stable core contract
--permission-inventory	bool	false	hidden. emit the native module permission census for console qualification

Command: olivares orchestration

Hidden diagnostic: it does not appear in --help output and is not part of the supported surface.

Orchestration requires Business Identity & Scale

olivares orchestration

Declares no flags of its own; it takes those of olivares and the root command.

Command: olivares policy

Reconstruct historical policy decisions from the evidence ledger

olivares policy

Flag	Type	Default	Description
--allow-cleartext	bool	false	inherited, hidden. allow sending the credential to a non-loopback host over plain HTTP (DANGEROUS: it travels readable)
--ca-cert	string	—	inherited, hidden. PEM file containing an additional trusted root CA (default: current context)
--insecure	bool	false	inherited, hidden. skip TLS certificate verification (DANGEROUS; development only)
--pin-sha256	stringArray	[]	inherited, hidden. trusted leaf SPKI SHA-256 pin, base64 or hex, repeatable — the engine prints it as pin_sha256 on the line reporting its certificate (default: current context)
--server	string	—	inherited, hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	inherited, hidden. tenant id (default $OLIVARES_TENANT, then current context)
--timeout	duration	10s	inherited, hidden. request timeout
--token	string	—	inherited, hidden. API bearer token (prefer –token-file: this form is visible in the process table and in shell history; default $OLIVARES_TOKEN, then current context)
--token-file	string	—	inherited, hidden. read the API bearer token from a file, or - for stdin

Command: olivares policy replay

Replay a past authorization from the ledger, never from the live policy

olivares policy replay

Flag	Type	Default	Description
--action	string	—	exact action / permission recorded on the question
--action-vocabulary	string	—	vocabulary of –action (required to match a stored question that named one)
--at	string	—	instant to reconstruct (RFC3339); required unless –decision-id is set
--decision-id	string	—	reconstruct this stored decision row
--principal	string	—	principal / actor reference recorded on the question
--resource	string	—	resource reference recorded on the question
--resource-kind	string	—	resource kind recorded on the question
--source-instance	string	—	origin instance that makes the resource reference canonical

Command: olivares provider

API-key accounts sessions can use instead of a tool’s own sign-in

olivares provider

Declares no flags of its own; it takes those of olivares and the root command.

Command: olivares provider account

Create, list, read, edit and adopt the named provider accounts sessions launch under

olivares provider account

Declares no flags of its own; it takes those of olivares provider and the root command.

Command: olivares provider account add

Create a provider account and the home it launches under — exit 5 when the name is taken, 6 when this node builds no homes

olivares provider account add

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--driver	string	—	required. the provider driver this account’s sessions launch
--idempotency-key	string	—	stable create intention; reuse this key after an uncertain result
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--json	bool	false	hidden. deprecated alias for -o json
--name	string	—	the account’s name; omit it and the server generates one
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares provider account adopt

Make an existing provider profile a named account — exit 4 for an unknown profile, 5 when it is already an account or the name is taken

olivares provider account adopt <profile-ref>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--json	bool	false	hidden. deprecated alias for -o json
--name	string	—	the account’s name; omit it and the server generates one
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares provider account edit

Rename an account or edit its label and color without changing its home

olivares provider account edit <account-ref|name>

Flag	Type	Default	Description
--accent	string	—	accent: orange, green, amber, red or blue; empty clears it
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--display-name	string	—	display label; an explicit empty string clears it
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--json	bool	false	hidden. deprecated alias for -o json
--name	string	—	the account’s new name: lowercase letters, digits and ‘-’, starting with a letter, at most 32 characters
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares provider account get

Show one provider account — exit 4 when no account has that reference

olivares provider account get <account-ref>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--json	bool	false	hidden. deprecated alias for -o json
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares provider account ls

List the named provider accounts — exit 3 when the caller may not read them

olivares provider account ls

Aliases: list

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--driver	string	—	only accounts of this driver
--environment	string	—	only accounts of this execution environment
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--json	bool	false	hidden. deprecated alias for -o json
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--state	string	—	only accounts in this state (active, disabled or retired)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares provider add

Register a provider credential with the engine

olivares provider add

Flag	Type	Default	Description
--base-url	string	—	https endpoint override, or plain http at a loopback or private-network address for anthropic, xai and openai_compatible (required for openai_compatible)
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--default-model	string	—	model for new sessions (empty clears; omission lets the first successful test choose)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--key-env	string	—	read the credential from this environment variable instead of stdin (never pass the key as a flag value)
--kind	string	—	anthropic | openai | xai | gemini | openai_compatible (default: openai_compatible with –service or –base-url, else from the key)
--name	string	—	your own name for this credential; it is what a picker shows (default: the kind’s name)
--no-test	bool	false	add the key without testing it
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--profile	string	—	provider profile reference to bind this credential to in the same run
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--service	string	—	documented API service preset: deepseek
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares provider bind

Make a provider profile launch with this credential

olivares provider bind <provider-ref>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--json	bool	false	hidden. deprecated alias for -o json
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--profile	string	—	required. provider profile reference
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin
--unbind	bool	false	clear the profile’s binding instead of setting one

Command: olivares provider get

Show one registered provider

olivares provider get <provider-ref>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--json	bool	false	hidden. deprecated alias for -o json
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares provider ls

List the registered provider credentials

olivares provider ls

Aliases: list

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--json	bool	false	hidden. deprecated alias for -o json
--kind	string	—	only providers of this kind
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--state	string	—	only providers in this state (active or revoked)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares provider rm

Withdraw a provider credential for good

olivares provider rm <provider-ref>

Aliases: revoke

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--json	bool	false	hidden. deprecated alias for -o json
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin
--yes	bool	false	confirm the irreversible withdrawal

Command: olivares provider rotate

Replace a provider’s credential in place

olivares provider rotate <provider-ref>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--json	bool	false	hidden. deprecated alias for -o json
--key-env	string	—	read the credential from this environment variable instead of stdin (never pass the key as a flag value)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares provider set

Choose the default model for new sessions on this provider

olivares provider set <provider-ref>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--default-model	string	—	model for new sessions; empty clears the saved default
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--json	bool	false	hidden. deprecated alias for -o json
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares provider test

Ask the provider which models it serves, with the registered credential — exit 7 when the provider REFUSES it, 8 when the endpoint is unreachable

olivares provider test <provider-ref>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--json	bool	false	hidden. deprecated alias for -o json
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares quickstart

Start the engine for the first time and open the console

olivares quickstart

Flag	Type	Default	Description
--data-dir	string	—	data directory (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--grpc-listen	string	:8444	gRPC listen address. The default :8444 is EVERY interface, like –listen; bind 127.0.0.1:8444 to restrict it
--listen	string	:8443	HTTP (REST + web console) listen address. The default :8443 is EVERY interface (0.0.0.0 and, where the kernel has IPv6, ::); bind 127.0.0.1:8443 to restrict it to this host
--login-trusted-proxies	string	—	comma-separated proxy CIDRs trusted for the password-login throttle’s X-Forwarded-For address only (default $OLIVARES_LOGIN_TRUSTED_PROXIES; empty trusts none). An explicit empty flag clears the environment setting; policy, session and audit keep the transport peer
--postgres	string	—	initialize PostgreSQL from a maintenance URL (file:<path> or env:<VAR> keeps its password out of the command line); role credentials, TLS and keys are generated automatically
--public-url	string	—	the address a browser reaches this console at, as scheme://host[:port] (e.g. https://olivares.example.com). It is what the startup panel prints and what the WebAuthn relying party is derived from, and it is independent of –listen: declare it when the engine sits behind a reverse proxy, binds a wildcard, or is reached by a name that is not the bind. Defaults to $OLIVARES_PUBLIC_URL; passing the flag wins over the environment, and passing it EMPTY clears it. Start-time only: a change takes a restart
--quiet	bool	false	print the guided panel only (the default); engine logs remain in the log file
--verbose	bool	false	also print engine logs in the terminal; retain them in the log file

Command: olivares quickstart governed-rag

Prepare live governed data for Claude Code (S3/Drive -> semantic KB -> MCP retrieval)

olivares quickstart governed-rag

Flag	Type	Default	Description
--agent-gateway-listen	string	127.0.0.1:8446	MCP gateway listen address
--agent-name	string	Claude Code governed RAG	human label for the agent created by the bootstrap script
--agent-ref	string	claude-code-governed	Claude Code agent external_id / MCP token subject
--bucket	string	—	S3 bucket for –source s3
--clearance	string	confidential	expected roster clearance on the identity (documented and checked by the guard)
--credential-ref	string	—	secret-store reference for the source credential, e.g. store:s3/prod-read
--data-dir	string	—	data directory (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--drive-api-base	string	—	Google Drive API base override
--drive-id	string	—	shared Drive ID for –source gdrive (optional)
--endpoint	string	—	optional S3-compatible endpoint (R2/MinIO/GCS interop)
--group-ref	string	group:engineering	expected roster group/ACL ref on the identity
--grpc-listen	string	:8444	gRPC listen address when –start is used
--identity-ref	string	agent:claude-code-governed	NHI identity external_id to bind to the agent
--kb-name	string	governed-data	knowledge base name to create in the bootstrap script
--listen	string	:8443	HTTP (REST + web console) listen address when –start is used
--login-trusted-proxies	string	—	comma-separated proxy CIDRs trusted for the password-login throttle’s X-Forwarded-For address only (default $OLIVARES_LOGIN_TRUSTED_PROXIES; empty trusts none). An explicit empty flag clears the environment setting; policy, session and audit keep the transport peer
--mcp-authorization-server	string	—	authorization server metadata URL (default –mcp-issuer)
--mcp-issuer	string	—	trusted OAuth issuer for MCP access tokens
--mcp-jwks-file	string	—	inline JWKS JSON file for the MCP issuer
--mcp-jwks-url	string	—	JWKS URL for the MCP issuer
--mcp-resource	string	—	MCP protected resource URI (default http://<agent-gateway-listen>/mcp)
--out-dir	string	—	directory for generated governed-RAG config (default <data-dir>/quickstart/governed-rag)
--path-style	bool	false	force S3 path-style bucket addressing
--prefix	string	—	S3 key prefix for –source s3
--public-url	string	—	the address a browser reaches this console at, as scheme://host[:port] (e.g. https://olivares.example.com). It is what the startup panel prints and what the WebAuthn relying party is derived from, and it is independent of –listen: declare it when the engine sits behind a reverse proxy, binds a wildcard, or is reached by a name that is not the bind. Defaults to $OLIVARES_PUBLIC_URL; passing the flag wins over the environment, and passing it EMPTY clears it. Start-time only: a change takes a restart
--region	string	us-east-1	S3 signing region
--source	string	s3	content source kind: s3 or gdrive
--source-name	string	governed-rag-live	registered knowledge content-source name
--start	bool	false	start the engine after writing config
--tenant-id	string	—	tenant id for the MCP retrieval surface and bootstrap script

Command: olivares readyz

Probe this host’s local engine readiness without curl

olivares readyz

Flag	Type	Default	Description
--ca-cert	string	—	PEM trust anchor for HTTPS (Compose: <data-dir>/tls.crt)
--server	string	https://127.0.0.1:8443	local numeric-loopback HTTP(S) origin (default: the active context’s engine when it runs on this host, else the engine this host recorded)
--timeout	duration	3s	whole-probe deadline

Command: olivares recording

Hidden diagnostic: it does not appear in --help output and is not part of the supported surface.

Read the session-recording trail, verify its chain and set the recording policy

olivares recording

Flag	Type	Default	Description
--allow-cleartext	bool	false	inherited, hidden. allow sending the credential to a non-loopback host over plain HTTP (DANGEROUS: it travels readable)
--ca-cert	string	—	inherited, hidden. PEM file containing an additional trusted root CA (default: current context)
--insecure	bool	false	inherited, hidden. skip TLS certificate verification (DANGEROUS; development only)
--pin-sha256	stringArray	[]	inherited, hidden. trusted leaf SPKI SHA-256 pin, base64 or hex, repeatable — the engine prints it as pin_sha256 on the line reporting its certificate (default: current context)
--server	string	—	inherited, hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	inherited, hidden. tenant id (default $OLIVARES_TENANT, then current context)
--timeout	duration	10s	inherited, hidden. request timeout
--token	string	—	inherited, hidden. API bearer token (prefer –token-file: this form is visible in the process table and in shell history; default $OLIVARES_TOKEN, then current context)
--token-file	string	—	inherited, hidden. read the API bearer token from a file, or - for stdin

Command: olivares recording ack

Acknowledge the recording notice for this caller

olivares recording ack

Declares no flags of its own; it takes those of olivares recording and the root command.

Command: olivares recording config

Read and replace the tenant’s recording policy

olivares recording config

Declares no flags of its own; it takes those of olivares recording and the root command.

Command: olivares recording config get

Show the tenant’s recording policy

olivares recording config get

Declares no flags of its own; it takes those of olivares recording config and the root command.

Command: olivares recording config set

Replace the tenant’s recording policy (PUT — the whole policy)

olivares recording config set

Flag	Type	Default	Description
--ai-summaries	bool	false	permit AI summaries: the transcript LEAVES the trust boundary (off unless passed)
--consent	string	notice	notice or required
--idle-seconds	int64	900	seconds of inactivity before a sweep may seal a session
--namespace	stringArray	[]	a namespace to record, repeatable (required)
--retention-days	int64	90	days a sealed trail is retained

Command: olivares recording notice

Show what is recorded for this caller, and whether consent is required

olivares recording notice

Declares no flags of its own; it takes those of olivares recording and the root command.

Command: olivares recording sessions

List, verify, export and seal recorded sessions

olivares recording sessions

Declares no flags of its own; it takes those of olivares recording and the root command.

Command: olivares recording sessions export

Export one session as evidence (json or summary)

olivares recording sessions export <id>

Flag	Type	Default	Description
--format	string	json	export format: json (full trail) or summary — NOT an alias of -o/–output

Command: olivares recording sessions get

Show one recorded session

olivares recording sessions get <id>

Declares no flags of its own; it takes those of olivares recording sessions and the root command.

Command: olivares recording sessions ls

List recorded sessions

olivares recording sessions ls

Flag	Type	Default	Description
--cursor	string	—	continue from the cursor a previous page reported
--grant	string	—	only sessions opened under this break-glass grant
--limit	int	0	page size (left out: the engine’s default)
--opened-after	string	—	only sessions opened at or after this RFC3339 instant
--opened-before	string	—	only sessions opened before this RFC3339 instant
--seal-reason	string	—	only sessions sealed for this reason
--status	string	—	only sessions in this status
--subject-contains	string	—	only sessions whose subject contains this substring
--subject-user	string	—	only sessions of this user

Command: olivares recording sessions replay

Reconstruct one session’s frames and ledger window

olivares recording sessions replay <id>

Flag	Type	Default	Description
--cursor	string	—	continue from the cursor a previous page reported
--limit	int	0	page size (left out: the engine’s default)

Command: olivares recording sessions seal

Close one active session explicitly

olivares recording sessions seal <id>

Declares no flags of its own; it takes those of olivares recording sessions and the root command.

Command: olivares recording sessions summarize

Produce the derived reviewer summary of a sealed session

olivares recording sessions summarize <id>

Declares no flags of its own; it takes those of olivares recording sessions and the root command.

Command: olivares recording sessions unified

Show one session’s frames and audit timeline merged

olivares recording sessions unified <id>

Flag	Type	Default	Description
--cursor	string	—	continue from the cursor a previous page reported
--frame-cursor	string	—	page the frames independently of the timeline
--limit	int	0	page size (left out: the engine’s default)

Command: olivares recording sessions verify

Verify a session’s hash chain — exit 7 when it does not verify

olivares recording sessions verify <id>

Declares no flags of its own; it takes those of olivares recording sessions and the root command.

Command: olivares recording sweep

Seal every idle active session (the lazy-seal safety net)

olivares recording sweep

Declares no flags of its own; it takes those of olivares recording and the root command.

Command: olivares redteam

Hidden diagnostic: it does not appear in --help output and is not part of the supported surface.

Run the consent-gated adversarial battery against your own agents

olivares redteam

Flag	Type	Default	Description
--allow-cleartext	bool	false	inherited, hidden. allow sending the credential to a non-loopback host over plain HTTP (DANGEROUS: it travels readable)
--ca-cert	string	—	inherited, hidden. PEM file containing an additional trusted root CA (default: current context)
--insecure	bool	false	inherited, hidden. skip TLS certificate verification (DANGEROUS; development only)
--pin-sha256	stringArray	[]	inherited, hidden. trusted leaf SPKI SHA-256 pin, base64 or hex, repeatable — the engine prints it as pin_sha256 on the line reporting its certificate (default: current context)
--server	string	—	inherited, hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	inherited, hidden. tenant id (default $OLIVARES_TENANT, then current context)
--timeout	duration	10s	inherited, hidden. request timeout
--token	string	—	inherited, hidden. API bearer token (prefer –token-file: this form is visible in the process table and in shell history; default $OLIVARES_TOKEN, then current context)
--token-file	string	—	inherited, hidden. read the API bearer token from a file, or - for stdin

Command: olivares redteam catalog

List the probe battery and its OWASP/ATLAS coverage

olivares redteam catalog

Flag	Type	Default	Description
--suite	string	—	only probes of this suite

Command: olivares redteam runs

Launch and inspect scored red-team runs

olivares redteam runs

Declares no flags of its own; it takes those of olivares redteam and the root command.

Command: olivares redteam runs get

Show one run’s scorecard

olivares redteam runs get <id>

Declares no flags of its own; it takes those of olivares redteam runs and the root command.

Command: olivares redteam runs launch

Run the battery against an authorized target

olivares redteam runs launch

Flag	Type	Default	Description
--suite	string	—	run only this suite of the battery
--target-ref	string	—	required. the authorized target to probe (required)

Command: olivares redteam runs ls

List red-team runs and their scores

olivares redteam runs ls

Flag	Type	Default	Description
--cursor	string	—	continue from the cursor a previous page reported
--limit	int	0	page size (left out: the engine’s default)
--suite	string	—	only runs of this suite
--target-ref	string	—	only runs against this target

Command: olivares redteam runs results

List one run’s per-probe results

olivares redteam runs results <id>

Declares no flags of its own; it takes those of olivares redteam runs and the root command.

Command: olivares redteam targets

Register agents as red-team targets and grant or withdraw consent

olivares redteam targets

Declares no flags of its own; it takes those of olivares redteam and the root command.

Command: olivares redteam targets authorize

Consent to red-teaming this target (confirmed; needs –yes when unattended)

olivares redteam targets authorize <id>

Flag	Type	Default	Description
--scope	string	—	limit the consent to this scope
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares redteam targets get

Show one target and its consent record

olivares redteam targets get <id>

Declares no flags of its own; it takes those of olivares redteam targets and the root command.

Command: olivares redteam targets ls

List registered red-team targets and their consent state

olivares redteam targets ls

Flag	Type	Default	Description
--cursor	string	—	continue from the cursor a previous page reported
--limit	int	0	page size (left out: the engine’s default)
--status	string	—	only targets in this status

Command: olivares redteam targets register

Register an agent from your inventory as a red-team target

olivares redteam targets register

Flag	Type	Default	Description
--agent-ref	string	—	required. an agent in this tenant’s inventory (required)
--endpoint	string	—	where the target is reachable
--name	string	—	required. human name for the target (required)
--scope	string	—	the scope consent will be limited to

Command: olivares redteam targets revoke

Withdraw consent to red-team this target

olivares redteam targets revoke <id>

Declares no flags of its own; it takes those of olivares redteam targets and the root command.

Command: olivares release

Hidden diagnostic: it does not appear in --help output and is not part of the supported surface.

Release/OTA tooling (manifest generation) — ops use

olivares release

Declares no flags of its own; it takes those of olivares and the root command.

Command: olivares release export-mirror

Hidden diagnostic: it does not appear in --help output and is not part of the supported surface.

Export an offline mirror (requires Enterprise)

olivares release export-mirror

Flag	Type	Default	Description
--channel	string	stable	release channel
--endpoint	string	—	endpoint
--force	bool	false	replace output
--out	string	—	out
--platform	stringSlice	[]	os/arch to mirror; repeatable
--pubkey	string	—	pubkey
--set	string	—	set
--timeout	duration	10m0s	request timeout
--token	string	—	token

Command: olivares release manifest

Build (and optionally sign) a per-channel OTA update manifest from a release directory

olivares release manifest

Flag	Type	Default	Description
--advisory	stringArray	[]	advisory/CVE id fixed by this release (repeatable)
--channel	string	stable	channel: stable | security (lts is accepted by the validator, but no lts line is produced)
--dir	string	.	directory holding the release archives
--edition	string	—	edition stated by the signer; Enterprise may install a signed community bundle without a license; Community supports only –bundle –check. Leave unset on the public channel manifest for older binaries
--eol-at	string	—	channel/line end-of-life date (RFC3339): recorded and printed, never enforced — a past date only warns, it never refuses (core/release/manifest.go:638-640)
--expires-in	string	2160h	freshness window as a duration (e.g. 168h): clients REFUSE the manifest after released_at+this (anti-freeze; re-sign periodically)
--license-key-epoch	string	—	key-compromise fence (RFC3339, the PAST compromise time): licenses issued before it are invalid; set only during an O03 rotation
--min-version	string	—	minimum current version allowed to jump directly to this release
--no-expiry	bool	false	UNSAFE: emit a manifest with NO freshness bound — a mirror can then serve it forever. Only for a throwaway/test manifest
--notes	string	—	short human note or URL
--out	string	manifest.json	output manifest path (a .sig is written beside it when –sign-key is set)
--revoke-holder	stringArray	[]	holder_id whose EVERY license is revoked via this channel’s CRL (repeatable)
--revoke-serial	stringArray	[]	license serial to revoke via this channel’s CRL (repeatable)
--rollout	int	-1	staged rollout percentage 0..100 (-1 = full rollout / omit)
--security	bool	false	mark this as a security release
--sign-key	string	—	base64 (or @file) Ed25519 PRIVATE key to sign the manifest
--start-at	string	—	rollout start time (RFC3339); before it no node upgrades
--version	string	—	release version (MAJOR.MINOR, required)

Command: olivares release sign-manifest

Sign an existing OTA manifest during the off-box release ceremony

olivares release sign-manifest

Flag	Type	Default	Description
--checksums	string	—	the cosign-verified checksums.txt the manifest must agree with (REQUIRED: signing binds these digests)
--manifest	string	—	existing manifest JSON to sign (required)
--out	string	—	detached signature output (default <manifest>.sig)
--sign-key	string	—	base64 (or @file) dedicated OTA Ed25519 PRIVATE key
--unsafe-no-crosscheck	bool	false	UNSAFE: sign without binding the manifest to checksums.txt or reviewing its policy

Command: olivares release verify-channel-advance

Refuse a channel publication that would not move the LIVE channel forward

olivares release verify-channel-advance

Flag	Type	Default	Description
--candidate	string	—	the manifest JSON about to be published (required)
--channel	string	stable	channel to compare (stable | security | lts)
--endpoint	string	https://github.com/olivaresai/olivares	the channel to read: a GitHub repository, one of its releases, or a static mirror base
--pubkey	string	—	base64 or @file Ed25519 OTA key; when set the LIVE manifest’s signature is verified before its version is believed
--timeout	duration	1m0s	network timeout for reading the live channel

Command: olivares release verify-manifest

Cross-check an OTA manifest against the cosign-verified checksums.txt (and, with –dir, the published bytes)

olivares release verify-manifest

Flag	Type	Default	Description
--allow-no-expiry	bool	false	UNSAFE: accept a manifest with no freshness bound (anti-freeze disabled)
--allow-paused-rollout	bool	false	accept a SECURITY manifest whose rollout is paused (percentage 0 or a future start_at) — only when the pause is deliberate
--checksums	string	—	the release’s checksums.txt, ALREADY verified with cosign (required)
--dir	string	—	directory holding the published archives; every manifest artifact must be present and re-hash to its digest
--expect-channel	string	—	fail unless the manifest declares this channel
--expect-version	string	—	fail unless the manifest declares this exact release version (bare MAJOR.MINOR)
--manifest	string	—	manifest JSON to cross-check (required)
--max-expires-in	string	4320h0m0s	upper bound on the freshness window (expires-released_at and expires-now): beyond it the anti-freeze defense is effectively off
--pubkey	string	—	base64 or @file Ed25519 OTA key for –sig (default: the key embedded in this build)
--require-expiry	bool	true	hidden, deprecated: a freshness bound is required by default; use –allow-no-expiry to opt OUT. DEPRECATED (now the default): a freshness bound is required unless –allow-no-expiry
--sig	string	—	detached manifest signature; when set the signature is verified BEFORE the cross-check

Command: olivares reporting

Generate reports and manage schedules, branding and templates

olivares reporting

Aliases: reports

Flag	Type	Default	Description
--allow-cleartext	bool	false	inherited, hidden. allow sending the credential to a non-loopback host over plain HTTP (DANGEROUS: it travels readable)
--ca-cert	string	—	inherited, hidden. PEM file containing an additional trusted root CA (default: current context)
--insecure	bool	false	inherited, hidden. skip TLS certificate verification (DANGEROUS; development only)
--pin-sha256	stringArray	[]	inherited, hidden. trusted leaf SPKI SHA-256 pin, base64 or hex, repeatable — the engine prints it as pin_sha256 on the line reporting its certificate (default: current context)
--server	string	—	inherited, hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	inherited, hidden. tenant id (default $OLIVARES_TENANT, then current context)
--timeout	duration	10s	inherited, hidden. request timeout
--token	string	—	inherited, hidden. API bearer token (prefer –token-file: this form is visible in the process table and in shell history; default $OLIVARES_TOKEN, then current context)
--token-file	string	—	inherited, hidden. read the API bearer token from a file, or - for stdin

Command: olivares reporting branding

Hidden diagnostic: it does not appear in --help output and is not part of the supported surface.

Read and set the tenant’s report branding

olivares reporting branding

Declares no flags of its own; it takes those of olivares reporting and the root command.

Command: olivares reporting branding get

Show the tenant’s report branding

olivares reporting branding get

Declares no flags of its own; it takes those of olivares reporting branding and the root command.

Command: olivares reporting branding set

Replace the tenant’s report branding

olivares reporting branding set

Flag	Type	Default	Description
--company-name	string	—	company name shown on reports
--footer-text	string	—	footer text for every page
--logo-path	string	—	path to the logo the renderer should use
--primary-color	string	—	primary brand color
--secondary-color	string	—	secondary brand color

Command: olivares reporting enterprise

Hidden diagnostic: it does not appear in --help output and is not part of the supported surface.

Read the Business posture, risk and evidence-bundle reports

olivares reporting enterprise

Declares no flags of its own; it takes those of olivares reporting and the root command.

Command: olivares reporting enterprise bundle

Business evidence bundle

olivares reporting enterprise bundle

Declares no flags of its own; it takes those of olivares reporting enterprise and the root command.

Command: olivares reporting enterprise posture

Business governance posture report

olivares reporting enterprise posture

Declares no flags of its own; it takes those of olivares reporting enterprise and the root command.

Command: olivares reporting enterprise risk

Business risk report

olivares reporting enterprise risk

Declares no flags of its own; it takes those of olivares reporting enterprise and the root command.

Command: olivares reporting reports

List the report catalog and generate a report

olivares reporting reports

Declares no flags of its own; it takes those of olivares reporting and the root command.

Command: olivares reporting reports get

Generate one report and write it to a file

olivares reporting reports get <report-type>

Aliases: generate

Flag	Type	Default	Description
--format	string	—	html (default) or pdf
--framework	string	—	compliance-evidence only: filter by framework
--from	string	—	window start: RFC3339 or YYYY-MM-DD
--locale	string	—	i18n locale for the rendered report (default en)
--out	string	—	write the artifact here; ‘-’ means stdout (required: these routes answer with a rendered document, not JSON)
--team	string	—	finops-report only: filter by team
--to	string	—	window end: RFC3339 or YYYY-MM-DD

Command: olivares reporting reports ls

List the reports this build can generate

olivares reporting reports ls

Aliases: list

Declares no flags of its own; it takes those of olivares reporting reports and the root command.

Command: olivares reporting schedules

Hidden diagnostic: it does not appear in --help output and is not part of the supported surface.

Manage scheduled reports and read their runs

olivares reporting schedules

Aliases: schedule

Declares no flags of its own; it takes those of olivares reporting and the root command.

Command: olivares reporting schedules create

Schedule a report on a cron cadence

olivares reporting schedules create

Flag	Type	Default	Description
--cron	string	—	five-field cron spec, e.g. “0 6 * * *” (required)
--enabled	bool	true	whether the schedule may fire
--format	string	—	html (default) or pdf
--framework	string	—	compliance-evidence only: filter by framework
--locale	string	—	i18n locale for the rendered report
--report-type	string	—	the report to generate (required)
--team	string	—	finops-report only: filter by team

Command: olivares reporting schedules ls

List report schedules

olivares reporting schedules ls

Aliases: list

Declares no flags of its own; it takes those of olivares reporting schedules and the root command.

Command: olivares reporting schedules rm

Delete a report schedule

olivares reporting schedules rm <schedule-id>

Aliases: delete, remove

Flag	Type	Default	Description
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares reporting schedules run

Fetch one run’s stored report artifact

olivares reporting schedules run <schedule-id> <run-id>

Flag	Type	Default	Description
--out	string	—	write the artifact here; ‘-’ means stdout (required: these routes answer with a rendered document, not JSON)

Command: olivares reporting schedules runs

List a schedule’s executions

olivares reporting schedules runs <schedule-id>

Declares no flags of its own; it takes those of olivares reporting schedules and the root command.

Command: olivares reporting signing

Hidden diagnostic: it does not appear in --help output and is not part of the supported surface.

Manage evidence bundle signing in the engine

olivares reporting signing

Declares no flags of its own; it takes those of olivares reporting and the root command.

Command: olivares reporting signing disable

Turn off evidence bundle signing

olivares reporting signing disable

Declares no flags of its own; it takes those of olivares reporting signing and the root command.

Command: olivares reporting signing enable

Turn on evidence bundle signing

olivares reporting signing enable

Declares no flags of its own; it takes those of olivares reporting signing and the root command.

Command: olivares reporting signing status

Show evidence bundle signing and its public key

olivares reporting signing status

Declares no flags of its own; it takes those of olivares reporting signing and the root command.

Command: olivares reporting templates

Hidden diagnostic: it does not appear in --help output and is not part of the supported surface.

Read, store and remove custom report templates

olivares reporting templates

Aliases: template

Declares no flags of its own; it takes those of olivares reporting and the root command.

Command: olivares reporting templates get

Fetch the custom template stored for one report type

olivares reporting templates get <report-type>

Flag	Type	Default	Description
--out	string	—	write the artifact here; ‘-’ means stdout (required: these routes answer with a rendered document, not JSON)

Command: olivares reporting templates rm

Remove the custom template for one report type

olivares reporting templates rm <report-type>

Aliases: delete, remove

Flag	Type	Default	Description
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares reporting templates set

Store a custom HTML template for one report type

olivares reporting templates set <report-type> <template-file>

Declares no flags of its own; it takes those of olivares reporting templates and the root command.

Command: olivares sandbox

Run agents against synthetic scenarios and compare two variants

olivares sandbox

Flag	Type	Default	Description
--allow-cleartext	bool	false	inherited, hidden. allow sending the credential to a non-loopback host over plain HTTP (DANGEROUS: it travels readable)
--ca-cert	string	—	inherited, hidden. PEM file containing an additional trusted root CA (default: current context)
--insecure	bool	false	inherited, hidden. skip TLS certificate verification (DANGEROUS; development only)
--pin-sha256	stringArray	[]	inherited, hidden. trusted leaf SPKI SHA-256 pin, base64 or hex, repeatable — the engine prints it as pin_sha256 on the line reporting its certificate (default: current context)
--server	string	—	inherited, hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	inherited, hidden. tenant id (default $OLIVARES_TENANT, then current context)
--timeout	duration	10s	inherited, hidden. request timeout
--token	string	—	inherited, hidden. API bearer token (prefer –token-file: this form is visible in the process table and in shell history; default $OLIVARES_TOKEN, then current context)
--token-file	string	—	inherited, hidden. read the API bearer token from a file, or - for stdin

Command: olivares sandbox compare

Run the same scenario as two variants and record the verdict

olivares sandbox compare

Flag	Type	Default	Description
--baseline-variant	string	—	required. the variant label to treat as the baseline (required)
--candidate-variant	string	—	required. the variant label to treat as the candidate (required)
--scenario-ref	string	—	compare using this scenario’s steps
--session-ref	string	—	compare using this recorded session’s steps
--suite-ref	string	—	score both runs against this evals suite

Command: olivares sandbox comparisons

Inspect the append-only A/B comparison ledger

olivares sandbox comparisons

Declares no flags of its own; it takes those of olivares sandbox and the root command.

Command: olivares sandbox comparisons get

Show one comparison

olivares sandbox comparisons get <id>

Declares no flags of its own; it takes those of olivares sandbox comparisons and the root command.

Command: olivares sandbox comparisons ls

List recorded comparisons

olivares sandbox comparisons ls

Flag	Type	Default	Description
--cursor	string	—	continue from the cursor a previous page reported
--limit	int	0	page size (left out: the engine’s default)
--scenario-ref	string	—	only comparisons of this scenario
--verdict	string	—	only comparisons with this verdict

Command: olivares sandbox generate

Generate reproducible scenario inputs from a local template

olivares sandbox generate

Flag	Type	Default	Description
--count	int	10	number of samples (1–100; zero uses the default)
--seed-file	string	—	literal template file (up to 8192 bytes), ‘-’ for stdin; omitted uses the server default
--subject-kind	string	agent	subject substituted into the template (up to 200 bytes)

Command: olivares sandbox replay

Deterministically re-execute a recorded session against supplied mocks

olivares sandbox replay

Flag	Type	Default	Description
--mocks-file	string	—	JSON array of mock objects, ‘-’ for stdin
--session-ref	string	—	required. the recorded session to replay (required)
--suite-ref	string	—	score the replayed outputs against this evals suite

Command: olivares sandbox runs

Inspect sandbox runs, their outputs and their live stream

olivares sandbox runs

Declares no flags of its own; it takes those of olivares sandbox and the root command.

Command: olivares sandbox runs get

Show one run

olivares sandbox runs get <id>

Declares no flags of its own; it takes those of olivares sandbox runs and the root command.

Command: olivares sandbox runs ls

List sandbox runs

olivares sandbox runs ls

Flag	Type	Default	Description
--cursor	string	—	continue from the cursor a previous page reported
--kind	string	—	only runs of this kind
--limit	int	0	page size (left out: the engine’s default)
--scenario-ref	string	—	only runs of this scenario

Command: olivares sandbox runs outputs

List one run’s per-step outputs

olivares sandbox runs outputs <id>

Declares no flags of its own; it takes those of olivares sandbox runs and the root command.

Command: olivares sandbox runs stream

Follow a live run as NDJSON (one object per event)

olivares sandbox runs stream <id>

Declares no flags of its own; it takes those of olivares sandbox runs and the root command.

Command: olivares sandbox scenarios

Author, inspect, run and archive sandbox scenarios

olivares sandbox scenarios

Declares no flags of its own; it takes those of olivares sandbox and the root command.

Command: olivares sandbox scenarios archive

Archive a scenario (destructive; needs –yes when unattended)

olivares sandbox scenarios archive <id>

Flag	Type	Default	Description
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares sandbox scenarios create

Author a scenario from JSON step and mock files

olivares sandbox scenarios create

Flag	Type	Default	Description
--description	string	—	what the fixture exercises
--mocks-file	string	—	JSON array of mock objects, ‘-’ for stdin
--name	string	—	required. scenario name (required, unique per tenant)
--steps-file	string	—	JSON array of step objects, ‘-’ for stdin
--subject-kind	string	—	what kind of subject the scenario drives

Command: olivares sandbox scenarios get

Show one scenario with its steps and mocks

olivares sandbox scenarios get <id>

Declares no flags of its own; it takes those of olivares sandbox scenarios and the root command.

Command: olivares sandbox scenarios ls

List the tenant’s scenarios

olivares sandbox scenarios ls

Flag	Type	Default	Description
--cursor	string	—	continue from the cursor a previous page reported
--limit	int	0	page size (left out: the engine’s default)
--status	string	—	only scenarios in this status

Command: olivares sandbox scenarios run

Run a scenario against the isolated runner (synchronous)

olivares sandbox scenarios run <id>

Flag	Type	Default	Description
--suite-ref	string	—	score the outputs against this evals suite
--variant	string	—	label this run’s variant (used by compare)

Command: olivares secrets

Manage the runtime secret store (sealed; referenced from configs as store:<name>)

olivares secrets

Flag	Type	Default	Description
--format	string	text	inherited. deprecated alias for -o/–output on this command (text or json) — NOT the export-format flag of ‘audit export’ / ‘findings export’

Command: olivares secrets ls

List stored secrets (names and non-secret hints; never the value)

olivares secrets ls

Flag	Type	Default	Description
--data-dir	string	—	data directory (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--dsn	string	—	store DSN (default a SQLite file in the data dir)
--engine	string	sqlite	store engine: sqlite or postgres

Command: olivares secrets put

Create or update a secret (seals the value at rest)

olivares secrets put

Flag	Type	Default	Description
--actor	string	—	REQUIRED: who is performing this privileged operation (an operator or service identity; recorded in the audit ledger)
--data-dir	string	—	data directory (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--description	string	—	optional non-secret note
--dsn	string	—	store DSN (default a SQLite file in the data dir)
--engine	string	sqlite	store engine: sqlite or postgres
--name	string	—	required. secret name (referenced as store:<name>)
--reason	string	—	REQUIRED: why this privileged operation is being performed (recorded in the audit ledger)
--value	string	—	secret value (prefer –value-file to keep it out of shell history)
--value-file	string	—	read the value from a file, or - for stdin

Command: olivares secrets rm

Delete a secret (a reference to it then fails closed)

olivares secrets rm

Aliases: delete, remove

Flag	Type	Default	Description
--actor	string	—	REQUIRED: who is performing this privileged operation (an operator or service identity; recorded in the audit ledger)
--data-dir	string	—	data directory (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--dsn	string	—	store DSN (default a SQLite file in the data dir)
--engine	string	sqlite	store engine: sqlite or postgres
--name	string	—	required. secret name
--reason	string	—	REQUIRED: why this privileged operation is being performed (recorded in the audit ledger)
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares secrets rotate

Replace a secret’s value (a new value is required)

olivares secrets rotate

Flag	Type	Default	Description
--actor	string	—	REQUIRED: who is performing this privileged operation (an operator or service identity; recorded in the audit ledger)
--data-dir	string	—	data directory (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--dsn	string	—	store DSN (default a SQLite file in the data dir)
--engine	string	sqlite	store engine: sqlite or postgres
--name	string	—	required. secret name
--reason	string	—	REQUIRED: why this privileged operation is being performed (recorded in the audit ledger)
--value	string	—	new secret value (prefer –value-file)
--value-file	string	—	read the new value from a file, or - for stdin

Command: olivares security

Security self-checks (advisory feed verification and affected-version reporting)

olivares security

Declares no flags of its own; it takes those of olivares and the root command.

Command: olivares security advisories

Hidden diagnostic: it does not appear in --help output and is not part of the supported surface.

Build and sign an OSV advisory feed the product self-checks — PSIRT use

olivares security advisories

Flag	Type	Default	Description
--author	string	—	override the feed author
--expect-pubkey	string	—	required. base64 (or @file) Ed25519 PUBLIC key the signature must verify against — the anchor the fleet pins (required)
--in	string	—	draft advisory JSON ({“author”:“…”,“advisories”:[…OSV…]}) (required)
--out	string	advisories.json	output feed path (a .sig is written beside it)
--sign-key	string	—	base64 (or @file) Ed25519 private key (required)

Command: olivares security check

Check a product version against a signed advisories feed

olivares security check

Flag	Type	Default	Description
--feed	string	—	path to the signed advisories feed (OSV JSON)
--product-version	string	—	product version to check (default: the running binary version)
--pubkey	string	—	release public key (base64 or @file); default: the embedded key
--quiet	bool	false	print nothing when unaffected
--sig	string	—	path to the detached signature (default: <feed>.sig)

Command: olivares security drill

Timed end-to-end PSIRT advisory-pipeline drill

olivares security drill

Flag	Type	Default	Description
--draft	string	—	override the embedded advisory draft fixture
--keep-artifacts	bool	false	keep the scratch dir instead of removing it (debugging)

Command: olivares security rulepack

Author/verify signed hot-reload security rule-packs (deny-lists, MCP blocks, patterns)

olivares security rulepack

Declares no flags of its own; it takes those of olivares security and the root command.

Command: olivares security rulepack sign

Hidden diagnostic: it does not appear in --help output and is not part of the supported surface.

Build and sign a rule-pack from a draft (writes <out> + <out>.sig)

olivares security rulepack sign

Flag	Type	Default	Description
--expect-pubkey	string	—	required. base64 (or @file) Ed25519 PUBLIC key the signature must verify against — the anchor the fleet pins (required)
--in	string	—	draft rule-pack JSON (required)
--out	string	rulepack.json	output rule-pack path
--sign-key	string	—	base64 (or @file) Ed25519 private key (required)

Command: olivares security rulepack verify

Verify a signed rule-pack against a trusted key and print its summary

olivares security rulepack verify

Flag	Type	Default	Description
--in	string	—	rule-pack JSON to verify (required)
--pubkey	string	—	base64 Ed25519 trusted key (required)
--sig	string	—	signature path (default: <in>.sig)

Command: olivares serve

Run the engine (REST + gRPC + embedded console), TLS-on-by-default

olivares serve

Flag	Type	Default	Description
--admin-dsn	string	—	Postgres: optional DSN of a dedicated NOSUPERUSER BYPASSRLS read role for cross-tenant operations (org listing, checkpoints, DR backup). Provision with olivares db init –admin-role; see deploy/postgres/README.md. Keep the app role NOSUPERUSER NOBYPASSRLS; never use a superuser here
--allow-privileged-db-role	bool	false	allow connecting Postgres as a superuser/BYPASSRLS role (DANGEROUS: disables the row-level-security tenant backstop; single-tenant/dev only)
--checkpoint-interval	duration	1h0m0s	how often to write a signed audit checkpoint over every tenant chain (0 disables; tamper-evidence anchor, docs/SECURITY-HARDENING.md §5)
--data-dir	string	—	data directory (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--dsn	string	—	store DSN (default a SQLite file in the data dir). May be a file:<path> or env:<VAR> reference resolved at boot, so the password stays out of the env file
--engine	string	sqlite	store engine: sqlite or postgres
--grpc-client-ca	string	—	PEM bundle of CAs authorized to issue collector client certs; when set, the gRPC server requires mutual TLS (verified client cert) for collector→core (docs/SECURITY-HARDENING.md §1/§3)
--grpc-listen	string	:8444	gRPC listen address. The default :8444 is EVERY interface, like –listen; bind 127.0.0.1:8444 to restrict it
--insecure	bool	false	serve plaintext HTTP/gRPC (DANGEROUS; localhost dev only). A non-loopback bind is REFUSED unless –insecure-allow-public-bind is also given
--insecure-allow-public-bind	bool	false	with –insecure, allow binding a non-loopback address (DANGEROUS: the console, bearer tokens and the first-boot setup token cross the network in CLEAR TEXT). Only for a deployment where something in front of the engine terminates TLS. Inert without –insecure
--known-regions	stringSlice	[]	comma-separated region codes valid across the whole deployment (e.g. eu,us); a tenant pin must be one of these. The home –region is always included. Only meaningful with –region set
--license	string	—	path to a commercial license file (informational only)
--listen	string	:8443	HTTP (REST + web) listen address. The default :8443 is EVERY interface (0.0.0.0 and, where the kernel has IPv6, ::) — this is a server. Bind 127.0.0.1:8443 to restrict it to this host
--login-trusted-proxies	string	—	comma-separated proxy CIDRs trusted for the password-login throttle’s X-Forwarded-For address only (default $OLIVARES_LOGIN_TRUSTED_PROXIES; empty trusts none). An explicit empty flag clears the environment setting; policy, session and audit keep the transport peer
--owner-dsn	string	—	Postgres only: DSN of the owner role that owns the schema and runs DDL/migrations. Set it to a SEPARATE NOSUPERUSER NOBYPASSRLS role to make –dsn a least-privilege non-owner app role with only DML grants (provision both with ‘olivares db init’). Empty = the –dsn role owns the schema (single-role). Accepts a file:/env: reference like –dsn
--public-url	string	—	the address a browser reaches this console at, as scheme://host[:port] (e.g. https://olivares.example.com). It is what the startup panel prints and what the WebAuthn relying party is derived from, and it is independent of –listen: declare it when the engine sits behind a reverse proxy, binds a wildcard, or is reached by a name that is not the bind. Defaults to $OLIVARES_PUBLIC_URL; passing the flag wins over the environment, and passing it EMPTY clears it. Start-time only: a change takes a restart
--region	string	—	data-residency HOME region of THIS instance (e.g. eu, us). When set, the instance is region-scoped: it serves only tenants pinned to this region and denies cross-region access fail-closed. Empty = single-region mode, no residency enforcement
--reuse-port	bool	false	bind listeners with SO_REUSEPORT so a NEW instance can hold the same ports while this one drains — enables a zero-downtime restart/upgrade handover on a single node (Linux/BSD; docs/UPGRADE-AND-ROLLBACK.md)
--seed-demo	bool	false	load a SYNTHETIC sample estate for demos/E2E (fabricated data; use a throwaway data-dir)
--tls-cert	string	—	TLS certificate PEM (default a self-signed cert in the data dir)
--tls-key	string	—	TLS private key PEM

Command: olivares session

Start, follow, send to, stop and resume agent sessions

olivares session

Aliases: sessions

Declares no flags of its own; it takes those of olivares and the root command.

Command: olivares session archive

Archive a session, or unarchive it with –undo

olivares session archive <session>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin
--undo	bool	false	unarchive the session

Command: olivares session done

Mark a session done in your list

olivares session done <session>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin
--undo	bool	false	Remove the done mark

Command: olivares session events

Show a session’s lifecycle record (start, stop, failures)

olivares session events <session>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares session follow

Show a session’s output as it happens

olivares session follow <session>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--from	int64	0	start from this output sequence number
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares session handoff

Continue a session in another tool or account as a new, linked session

olivares session handoff <session> [--account <account>]

Flag	Type	Default	Description
--account	string	—	the account to continue in (its name or profile reference); without it the summary is only shown
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--name	string	—	the new session’s name
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--summary-file	string	—	start from this reviewed summary instead of the generated one (- reads standard input)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares session interrupt

Cancel the current turn and keep the session running

olivares session interrupt <session>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares session ls

List sessions, pinned first, then newest first

olivares session ls

Aliases: list

Flag	Type	Default	Description
--account	string	—	only sessions of this account (its name or profile reference; see olivares provider account ls)
--all	bool	false	include released (cleaned) and archived sessions
--archived	bool	false	list only archived sessions
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--state	string	—	only sessions in this state (pending|waiting_approval|running|idle|stopped|failed|cleaned)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares session messages

List, search and find messages of a session

olivares session messages <session>

Aliases: msgs

Flag	Type	Default	Description
--all	bool	false	include the tool’s answers, not only your messages
--at	string	—	start at this date or time: 2026-10-14, “2026-10-14 10:30” or 2026-10-14T10:30:00Z
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--cursor	int	0	continue from this message id (the page before it with –newest)
--id	int	0	print this message whole
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--limit	int	0	messages per page (default 50, at most 200)
--newest	bool	false	start from the latest message (a page is always printed oldest first)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--search	string	—	only messages with this phrase anywhere in them (case-insensitive)
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares session move

Move a stopped session to another account of the same tool

olivares session move <session> --account <account>

Flag	Type	Default	Description
--account	string	—	the account to move to (its name or profile reference; see olivares provider account ls)
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--resume	bool	false	resume the session on the account right after the move
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares session peers

Choose which sessions a session may message

olivares session peers <session> [peer...]

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--none	bool	false	allow no session
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--same-template	bool	false	allow every running session started from the same template
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares session pin

Pin a session to the top of your list

olivares session pin <session>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares session rename

Rename a session

olivares session rename <session> <name>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares session resume

Resume a stopped session

olivares session resume <session>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares session rm

Remove a stopped session

olivares session rm <session>

Aliases: delete, remove

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--discard-worktree	bool	false	also remove the session’s git worktree and branch when its work is not merged or has uncommitted files
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares session send

Send a message to a session and show the reply

olivares session send <session> [text]

Flag	Type	Default	Description
--attach	stringArray	[]	attach an image file (PNG, JPEG, WebP or GIF) to the message; repeat for several
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--detach	bool	false	return once the message is accepted, without showing the reply
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares session show

Show one session

olivares session show <session>

Aliases: get

Flag	Type	Default	Description
--activity	bool	false	print what the session’s tool is doing: agents, background tasks, files, task list, context
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares session snooze

Hide a session from your list until a moment

olivares session snooze <session> <for|until>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin
--undo	bool	false	End the snooze now

Command: olivares session start

Start an agent session in a folder, optionally with a first prompt

olivares session start [folder] [prompt]

Flag	Type	Default	Description
--account	string	—	launch under this provider account (its name or profile reference; see olivares provider account ls)
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--detach	bool	false	with a prompt, send it and return without showing the reply
--dlp	string	off	DLP posture for a folder this command registers: off, label or deny
--effort	string	—	low|medium|high|xhigh|max
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--isolation	string	native	native (a process beside the engine) or container (podman or Docker on this server; see olivares doctor)
--model	string	—	model alias or id (default: the tool’s own; Claude Code launches an alias, or none, on its exact id)
--name	string	—	session name (default: the folder’s name; -2, -3 … when taken)
--no-setup	bool	false	skip the folder’s setup command for this start
--permission	string	edits-and-commands	what the agent may do without asking: edits-and-commands, edits-only, read-only, ask, or full (every tool, no prompts; administrators only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--profile	string	—	provider profile to launch under (default: the one the engine picks, as in the console)
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--template	string	—	saved session template ID; its terms apply at launch and resume
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin
--tool	string	—	agent tool: claude, codex, grok, opencode or gemini-cli (default: the first one that is ready)
--worktree	bool	false	work in a git worktree of its own, on a new branch (the folder must be a git repository’s top folder)
--worktree-from	string	—	start the worktree at this commit id or local branch instead of the current commit (implies –worktree)

Command: olivares session stop

Stop a session

olivares session stop <session>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares session unpin

Unpin a session

olivares session unpin <session>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares setup

Guided, validated first-run configuration (profiles, Postgres onboarding, no SQL by hand)

olivares setup

Flag	Type	Default	Description
--force	bool	false	overwrite the env file / secret files if they exist
--out	string	/etc/olivares/olivares.env	env file to write
--secrets-dir	string	/etc/olivares/secrets	directory for 0600 secret files (DSNs)

Command: olivares skills

Install and manage immutable skills in the catalog

olivares skills

Flag	Type	Default	Description
--allow-cleartext	bool	false	inherited, hidden. allow sending the credential to a non-loopback host over plain HTTP (DANGEROUS: it travels readable)
--ca-cert	string	—	inherited, hidden. PEM file containing an additional trusted root CA (default: current context)
--insecure	bool	false	inherited, hidden. skip TLS certificate verification (DANGEROUS; development only)
--pin-sha256	stringArray	[]	inherited, hidden. trusted leaf SPKI SHA-256 pin, base64 or hex, repeatable — the engine prints it as pin_sha256 on the line reporting its certificate (default: current context)
--server	string	—	inherited, hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	inherited, hidden. tenant id (default $OLIVARES_TENANT, then current context)
--timeout	duration	10s	inherited, hidden. request timeout
--token	string	—	inherited, hidden. API bearer token (prefer –token-file: this form is visible in the process table and in shell history; default $OLIVARES_TOKEN, then current context)
--token-file	string	—	inherited, hidden. read the API bearer token from a file, or - for stdin

Command: olivares skills assign

Pin a catalog revision for new conversations

olivares skills assign <pack-id>

Flag	Type	Default	Description
--agent	string	—	stored agent identifier
--approve-active-content	bool	false	approve skills that carry hooks, shell interpolation, tool pre-approvals or plugin files
--assignment	string	—	existing binding to change
--folder	string	—	registered folder workspace reference
--group	string	—	stored agent group identifier
--member	stringSlice	[]	selected member names (all revision members when omitted)
--profile	string	—	provider profile reference
--revision	string	—	immutable revision identifier
--session	string	—	stored governed session identifier
--template	string	—	stored template identifier
--version	int64	0	current binding version for a change
--workspace	string	—	stored workspace (department) identifier

Command: olivares skills assignments

List pinned bindings on an authorized target or of one pack

olivares skills assignments

Flag	Type	Default	Description
--agent	string	—	stored agent identifier
--cursor	string	—	opaque cursor from a previous page’s has_more result
--folder	string	—	registered folder workspace reference
--group	string	—	stored agent group identifier
--limit	int	0	maximum rows per page (server default when unset)
--pack	string	—	catalog pack identifier: list the targets it is pinned to
--profile	string	—	provider profile reference
--session	string	—	stored governed session identifier
--template	string	—	stored template identifier
--workspace	string	—	stored workspace (department) identifier

Command: olivares skills diff

Show what changed between two revisions of a pack

olivares skills diff <pack-id>

Flag	Type	Default	Description
--diff	bool	false	print the unified text diff of each changed file
--from	string	—	revision to compare from (defaults to the one before –to)
--to	string	—	revision to compare to (defaults to the latest)

Command: olivares skills disable

Disable skills pinned to a workspace, profile, folder, template, group, agent or session

olivares skills disable <skill>...

Flag	Type	Default	Description
--agent	string	—	stored agent identifier
--folder	string	—	registered folder workspace reference
--group	string	—	stored agent group identifier
--pack	string	—	catalog pack identifier: change only this pack’s pin
--profile	string	—	provider profile reference
--session	string	—	stored governed session identifier
--template	string	—	stored template identifier
--workspace	string	—	stored workspace (department) identifier

Command: olivares skills enable

Enable skills on a workspace, profile, folder, template, group, agent or session

olivares skills enable <skill>...

Flag	Type	Default	Description
--agent	string	—	stored agent identifier
--approve-active-content	bool	false	approve skills that carry hooks, shell interpolation or tool pre-approvals
--folder	string	—	registered folder workspace reference
--group	string	—	stored agent group identifier
--pack	string	—	catalog pack identifier to take the skills from
--profile	string	—	provider profile reference
--session	string	—	stored governed session identifier
--template	string	—	stored template identifier
--workspace	string	—	stored workspace (department) identifier

Command: olivares skills get

Show catalog provenance and immutable revisions

olivares skills get <pack-id>

Flag	Type	Default	Description
--cursor	string	—	opaque cursor from a previous page’s has_more result
--limit	int	0	maximum rows per page (server default when unset)

Command: olivares skills install

Publish a reviewed immutable catalog revision

olivares skills install

Flag	Type	Default	Description
--archive	string	—	local ZIP or tar.gz archive
--builtin	string	—	pinned built-in pack ID (browse with skills ls –builtin)
--expected-digest	string	—	expected SHA-256 source digest
--folder	string	—	selected local folder; validated bytes are uploaded
--format	string	—	archive format: zip or tar.gz
--git	string	—	public HTTPS git URL
--idempotency-key	string	—	retain this key to read back an ambiguous import
--name	string	—	catalog pack name (defaults to the selected source name)
--ref	string	—	git ref or full commit (defaults to HEAD; the published revision records the resolved commit)
--subdir	string	—	selected skills directory inside the git source

Command: olivares skills ls

List installed catalog packs

olivares skills ls

Aliases: list

Flag	Type	Default	Description
--builtin	bool	false	browse the pinned built-in catalog
--cursor	string	—	opaque cursor from a previous page’s has_more result
--limit	int	0	maximum rows per page (server default when unset)

Command: olivares skills pin

Move every pin of a pack to one revision (update or roll back)

olivares skills pin <pack-id>

Flag	Type	Default	Description
--approve-active-content	bool	false	approve skills that carry hooks, shell interpolation or tool pre-approvals
--dry-run	bool	false	list what would move and write nothing
--revision	string	—	revision to pin (defaults to the latest)

Command: olivares skills rm

Retire an unused catalog pack and retain its provenance

olivares skills rm <pack-id>

Aliases: remove

Flag	Type	Default	Description
--version	int64	0	expected pack version (defaults to the current server version)

Command: olivares skills selection

Show the skills a new session will get, before it starts

olivares skills selection

Flag	Type	Default	Description
--agent	string	—	stored agent identifier
--folder	string	—	registered folder workspace reference
--group	string	—	stored agent group identifier
--profile	string	—	provider profile reference
--session	string	—	stored governed session identifier
--template	string	—	stored template identifier
--workspace	string	—	stored workspace (department) identifier

Command: olivares skills unassign

Remove future inheritance; recorded conversations retain their snapshot

olivares skills unassign <assignment-id>

Flag	Type	Default	Description
--version	int64	0	current binding version

Command: olivares skills update

Publish a reviewed immutable catalog revision

olivares skills update <pack-id>

Flag	Type	Default	Description
--apply	bool	false	with no source flag: publish the update the check showed (needs –expected-digest)
--archive	string	—	local ZIP or tar.gz archive
--builtin	string	—	pinned built-in pack ID (browse with skills ls –builtin)
--diff	bool	false	with no source flag: print the unified text diff of each changed file
--expected-digest	string	—	expected SHA-256 source digest
--folder	string	—	selected local folder; validated bytes are uploaded
--format	string	—	archive format: zip or tar.gz
--git	string	—	public HTTPS git URL
--idempotency-key	string	—	retain this key to read back an ambiguous import
--name	string	—	catalog pack name (defaults to the selected source name)
--ref	string	—	git ref or full commit (defaults to HEAD; the published revision records the resolved commit)
--subdir	string	—	selected skills directory inside the git source

Command: olivares sources

Manage the durable source roster (connectors the engine ingests from)

olivares sources

Declares no flags of its own; it takes those of olivares and the root command.

Command: olivares sources get

Show one source’s definition, including the config ls cannot render

olivares sources get <name>

Flag	Type	Default	Description
--data-dir	string	—	data directory (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--dsn	string	—	store DSN (default a SQLite file in the data dir)
--engine	string	sqlite	store engine: sqlite or postgres

Command: olivares sources ls

List the source roster (name, kind, tenant, mode, poll, enabled)

olivares sources ls

Flag	Type	Default	Description
--data-dir	string	—	data directory (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--dsn	string	—	store DSN (default a SQLite file in the data dir)
--engine	string	sqlite	store engine: sqlite or postgres

Command: olivares sources plan

Show what a sources set with these flags WOULD change — no source is written or opened

olivares sources plan

Flag	Type	Default	Description
--config	stringArray	[]	connector setting key=value (repeatable); use store:<name> for secrets
--data-dir	string	—	data directory (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--dsn	string	—	store DSN (default a SQLite file in the data dir)
--enabled	bool	true	whether the source is wired into the engine
--engine	string	sqlite	store engine: sqlite or postgres
--kind	string	—	first-party connector kind (e.g. vault, claude); omit for a plugin source
--name	string	—	required. source name (the roster key)
--plugin-bundle	string	—	external plugin Sigstore attestation bundle path
--plugin-path	string	—	external connector plugin binary path
--plugin-predicate	stringArray	[]	narrow the trust policy’s predicate allow-list for this source (repeatable)
--plugin-sha256	string	—	external plugin pinned sha256 digest
--poll-seconds	int	0	re-run a batch source every N seconds (0 = run once / streaming)
--tenant	string	—	business tenant the observations belong to

Command: olivares sources rm

Delete a source from the roster

olivares sources rm

Aliases: delete, remove

Flag	Type	Default	Description
--actor	string	—	REQUIRED: who is performing this privileged operation (an operator or service identity; recorded in the audit ledger)
--data-dir	string	—	data directory (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--dsn	string	—	store DSN (default a SQLite file in the data dir)
--engine	string	sqlite	store engine: sqlite or postgres
--name	string	—	required. source name
--reason	string	—	REQUIRED: why this privileged operation is being performed (recorded in the audit ledger)
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares sources set

Create or update a source (only the flags you pass are changed on an existing source)

olivares sources set

Flag	Type	Default	Description
--actor	string	—	REQUIRED: who is performing this privileged operation (an operator or service identity; recorded in the audit ledger)
--config	stringArray	[]	connector setting key=value (repeatable); use store:<name> for secrets
--data-dir	string	—	data directory (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--dsn	string	—	store DSN (default a SQLite file in the data dir)
--enabled	bool	true	whether the source is wired into the engine
--engine	string	sqlite	store engine: sqlite or postgres
--kind	string	—	first-party connector kind (e.g. vault, claude); omit for a plugin source
--name	string	—	required. source name (the roster key)
--plugin-bundle	string	—	external plugin Sigstore attestation bundle path
--plugin-path	string	—	external connector plugin binary path
--plugin-predicate	stringArray	[]	narrow the trust policy’s predicate allow-list for this source (repeatable)
--plugin-sha256	string	—	external plugin pinned sha256 digest
--poll-seconds	int	0	re-run a batch source every N seconds (0 = run once / streaming)
--reason	string	—	REQUIRED: why this privileged operation is being performed (recorded in the audit ledger)
--tenant	string	—	business tenant the observations belong to

Command: olivares sources test

Open the source for real to prove it answers, then close it — nothing is wired or written

olivares sources test

Flag	Type	Default	Description
--config	stringArray	[]	connector setting key=value (repeatable); use store:<name> for secrets
--data-dir	string	—	data directory (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--dsn	string	—	store DSN (default a SQLite file in the data dir)
--enabled	bool	true	whether the source is wired into the engine
--engine	string	sqlite	store engine: sqlite or postgres
--kind	string	—	first-party connector kind (e.g. vault, claude); omit for a plugin source
--name	string	—	required. source name (the roster key)
--plugin-bundle	string	—	external plugin Sigstore attestation bundle path
--plugin-path	string	—	external connector plugin binary path
--plugin-predicate	stringArray	[]	narrow the trust policy’s predicate allow-list for this source (repeatable)
--plugin-sha256	string	—	external plugin pinned sha256 digest
--poll-seconds	int	0	re-run a batch source every N seconds (0 = run once / streaming)
--show-connector-error	bool	false	print the connector’s own failure message. It was produced against the RESOLVED configuration and can embed credential material, so it is off by default
--tenant	string	—	business tenant the observations belong to
--timeout	duration	30s	give up on the connector after this long (a source that never answers must not hang the command forever)

Command: olivares sources validate

Check a source definition is coherent by itself — offline, no network, no writes

olivares sources validate

Flag	Type	Default	Description
--config	stringArray	[]	connector setting key=value (repeatable); use store:<name> for secrets
--data-dir	string	—	data directory (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--dsn	string	—	store DSN (default a SQLite file in the data dir)
--enabled	bool	true	whether the source is wired into the engine
--engine	string	sqlite	store engine: sqlite or postgres
--kind	string	—	first-party connector kind (e.g. vault, claude); omit for a plugin source
--name	string	—	source name (the roster key)
--plugin-bundle	string	—	external plugin Sigstore attestation bundle path
--plugin-path	string	—	external connector plugin binary path
--plugin-predicate	stringArray	[]	narrow the trust policy’s predicate allow-list for this source (repeatable)
--plugin-sha256	string	—	external plugin pinned sha256 digest
--poll-seconds	int	0	re-run a batch source every N seconds (0 = run once / streaming)
--tenant	string	—	business tenant the observations belong to

Command: olivares sourcescope

Decide which sources a workspace or agent may reach

olivares sourcescope

Aliases: source-scope

Flag	Type	Default	Description
--allow-cleartext	bool	false	inherited, hidden. allow sending the credential to a non-loopback host over plain HTTP (DANGEROUS: it travels readable)
--ca-cert	string	—	inherited, hidden. PEM file containing an additional trusted root CA (default: current context)
--insecure	bool	false	inherited, hidden. skip TLS certificate verification (DANGEROUS; development only)
--pin-sha256	stringArray	[]	inherited, hidden. trusted leaf SPKI SHA-256 pin, base64 or hex, repeatable — the engine prints it as pin_sha256 on the line reporting its certificate (default: current context)
--server	string	—	inherited, hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	inherited, hidden. tenant id (default $OLIVARES_TENANT, then current context)
--timeout	duration	10s	inherited, hidden. request timeout
--token	string	—	inherited, hidden. API bearer token (prefer –token-file: this form is visible in the process table and in shell history; default $OLIVARES_TOKEN, then current context)
--token-file	string	—	inherited, hidden. read the API bearer token from a file, or - for stdin

Command: olivares sourcescope assignments

Assign global connectors to workspaces

olivares sourcescope assignments

Declares no flags of its own; it takes those of olivares sourcescope and the root command.

Command: olivares sourcescope assignments create

Assign a connector to a workspace

olivares sourcescope assignments create

Flag	Type	Default	Description
--connector-name	string	—	name of the global connector being assigned
--enabled	bool	false	whether the assignment is in force
--mode	string	—	rw (default) or r
--note	string	—	note recorded with the assignment
--workspace-ref	string	—	workspace the connector is assigned to

Command: olivares sourcescope assignments get

Show one assignment

olivares sourcescope assignments get <assignment-id>

Declares no flags of its own; it takes those of olivares sourcescope assignments and the root command.

Command: olivares sourcescope assignments ls

List connector-to-workspace assignments

olivares sourcescope assignments ls

Aliases: list

Flag	Type	Default	Description
--connector-name	string	—	only assignments of this connector
--cursor	string	—	opaque cursor from a previous page’s has_more result
--limit	int	0	maximum rows per page (server default when unset)
--workspace-ref	string	—	only assignments to this workspace

Command: olivares sourcescope assignments rm

Delete an assignment

olivares sourcescope assignments rm <assignment-id>

Aliases: delete

Flag	Type	Default	Description
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares sourcescope assignments set

Replace an assignment

olivares sourcescope assignments set <assignment-id>

Flag	Type	Default	Description
--connector-name	string	—	name of the global connector being assigned
--enabled	bool	false	whether the assignment is in force
--mode	string	—	rw (default) or r
--note	string	—	note recorded with the assignment
--replace	bool	false	accept that every field not passed is RESET to its server default (this endpoint replaces, it does not patch)
--workspace-ref	string	—	workspace the connector is assigned to

Command: olivares sourcescope bindings

Confine a source to a workspace or agent group

olivares sourcescope bindings

Declares no flags of its own; it takes those of olivares sourcescope and the root command.

Command: olivares sourcescope bindings create

Bind a source to a scope

olivares sourcescope bindings create

Flag	Type	Default	Description
--cred-hint	string	—	non-secret hint shown to operators
--cred-name	string	—	name of the scoped credential the binding carries
--cred-ref	string	—	credential reference (a locator, never a secret)
--cred-ref-kind	string	—	kind of the credential reference
--effect	string	—	allow or forbid
--enabled	bool	false	whether the binding is in force
--folder-path	string	—	folder or subtree the binding is anchored to
--note	string	—	note recorded with the binding
--scope-ref	string	—	reference within the scope tree
--scope-tree	string	—	scope tree the binding attaches to (e.g. workspace, agent_group)
--source-ref	string	—	reference of the source being confined
--source-type	string	—	mcp, model, provider, knowledge, data, profile or tool

Command: olivares sourcescope bindings get

Show one binding

olivares sourcescope bindings get <binding-id>

Declares no flags of its own; it takes those of olivares sourcescope bindings and the root command.

Command: olivares sourcescope bindings ls

List source-to-scope bindings

olivares sourcescope bindings ls

Aliases: list

Flag	Type	Default	Description
--cursor	string	—	opaque cursor from a previous page’s has_more result
--limit	int	0	maximum rows per page (server default when unset)
--scope-tree	string	—	only bindings in this scope tree
--source-ref	string	—	only bindings of this source reference
--source-type	string	—	only bindings of this source type

Command: olivares sourcescope bindings rm

Delete a binding

olivares sourcescope bindings rm <binding-id>

Aliases: delete

Flag	Type	Default	Description
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares sourcescope bindings set

Replace a binding

olivares sourcescope bindings set <binding-id>

Flag	Type	Default	Description
--cred-hint	string	—	non-secret hint shown to operators
--cred-name	string	—	name of the scoped credential the binding carries
--cred-ref	string	—	credential reference (a locator, never a secret)
--cred-ref-kind	string	—	kind of the credential reference
--effect	string	—	allow or forbid
--enabled	bool	false	whether the binding is in force
--folder-path	string	—	folder or subtree the binding is anchored to
--note	string	—	note recorded with the binding
--replace	bool	false	accept that every field not passed is RESET to its server default (this endpoint replaces, it does not patch)
--scope-ref	string	—	reference within the scope tree
--scope-tree	string	—	scope tree the binding attaches to (e.g. workspace, agent_group)
--source-ref	string	—	reference of the source being confined
--source-type	string	—	mcp, model, provider, knowledge, data, profile or tool

Command: olivares sourcescope guard-postures

Read and set the retrieval guard posture

olivares sourcescope guard-postures

Declares no flags of its own; it takes those of olivares sourcescope and the root command.

Command: olivares sourcescope guard-postures ls

List explicit guard-posture overrides

olivares sourcescope guard-postures ls

Aliases: list

Flag	Type	Default	Description
--cursor	string	—	opaque cursor from a previous page’s has_more result
--limit	int	0	maximum rows per page (server default when unset)
--profile	string	—	only postures with this profile
--source-ref	string	—	only postures of this source reference
--source-type	string	—	only postures of this source type

Command: olivares sourcescope guard-postures set

Set the guard posture of one source

olivares sourcescope guard-postures set

Flag	Type	Default	Description
--profile	string	—	acl_aware (tightens) or public_only (relaxes, dual-controlled)
--reason	string	—	reason an approver will read
--source-ref	string	—	reference of the source the posture applies to
--source-type	string	—	source type (the engine requires knowledge here)

Command: olivares sourcescope posture-requests

Review the dual-control queue of proposed relaxations

olivares sourcescope posture-requests

Declares no flags of its own; it takes those of olivares sourcescope and the root command.

Command: olivares sourcescope posture-requests approve

Approve a pending relaxation and apply it

olivares sourcescope posture-requests approve <request-id>

Flag	Type	Default	Description
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares sourcescope posture-requests get

Show one posture-change request

olivares sourcescope posture-requests get <request-id>

Declares no flags of its own; it takes those of olivares sourcescope posture-requests and the root command.

Command: olivares sourcescope posture-requests ls

List posture-change requests

olivares sourcescope posture-requests ls

Aliases: list

Flag	Type	Default	Description
--cursor	string	—	opaque cursor from a previous page’s has_more result
--limit	int	0	maximum rows per page (server default when unset)
--source-ref	string	—	only requests for this source reference
--source-type	string	—	only requests for this source type
--status	string	—	only requests in this status

Command: olivares sourcescope posture-requests reject

Reject a pending relaxation, changing nothing

olivares sourcescope posture-requests reject <request-id>

Declares no flags of its own; it takes those of olivares sourcescope posture-requests and the root command.

Command: olivares sourcescope resolve

Preview what one actor would resolve for one source

olivares sourcescope resolve

Flag	Type	Default	Description
--actor-kind	string	—	session or agent
--actor-ref	string	—	reference of the actor to resolve for
--source-ref	string	—	reference of the source to resolve
--source-type	string	—	mcp, model, provider, knowledge, data, profile or tool

Command: olivares sourcescope resources

Navigate the tenant’s resource tree

olivares sourcescope resources

Declares no flags of its own; it takes those of olivares sourcescope and the root command.

Command: olivares sourcescope resources ls

List resources, by children or by subtree

olivares sourcescope resources ls

Aliases: list

Flag	Type	Default	Description
--cursor	string	—	opaque cursor from a previous page’s has_more result
--kind	string	—	only resources of this kind
--limit	int	0	maximum rows per page (server default when unset)
--parent	string	—	list the direct children of this resource id
--subtree	string	—	list everything beneath this resource id
--workspace-id	string	—	only resources of this workspace

Command: olivares sourcescope sources

Source-wide posture operations

olivares sourcescope sources

Declares no flags of its own; it takes those of olivares sourcescope and the root command.

Command: olivares sourcescope sources disable-scoping

Propose removing ALL scoping from a source

olivares sourcescope sources disable-scoping

Flag	Type	Default	Description
--source-ref	string	—	reference of the source to unconfine
--source-type	string	—	mcp, model, provider, knowledge, data, profile or tool
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares sourcescope workspace-connectors

Manage connectors that belong to one workspace

olivares sourcescope workspace-connectors

Aliases: ws-connectors

Declares no flags of its own; it takes those of olivares sourcescope and the root command.

Command: olivares sourcescope workspace-connectors create

Declare a workspace connector

olivares sourcescope workspace-connectors create

Flag	Type	Default	Description
--config	stringArray	[]	config entry as key=value, repeatable
--enabled	bool	false	whether the connector is in force
--kind	string	—	connector kind
--name	string	—	workspace connector name
--note	string	—	note recorded with the connector
--poll-seconds	int	0	polling interval in seconds
--secrets-file	string	—	file holding the secrets as a JSON object of string values (- for stdin)
--workspace-ref	string	—	workspace the connector belongs to

Command: olivares sourcescope workspace-connectors get

Show one workspace connector

olivares sourcescope workspace-connectors get <connector-id>

Declares no flags of its own; it takes those of olivares sourcescope workspace-connectors and the root command.

Command: olivares sourcescope workspace-connectors ls

List workspace connectors

olivares sourcescope workspace-connectors ls

Aliases: list

Flag	Type	Default	Description
--cursor	string	—	opaque cursor from a previous page’s has_more result
--kind	string	—	only connectors of this kind
--limit	int	0	maximum rows per page (server default when unset)
--workspace-ref	string	—	only connectors of this workspace

Command: olivares sourcescope workspace-connectors rm

Delete a workspace connector

olivares sourcescope workspace-connectors rm <connector-id>

Aliases: delete

Flag	Type	Default	Description
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares sourcescope workspace-connectors set

Replace a workspace connector

olivares sourcescope workspace-connectors set <connector-id>

Flag	Type	Default	Description
--config	stringArray	[]	config entry as key=value, repeatable
--enabled	bool	false	whether the connector is in force
--kind	string	—	connector kind
--name	string	—	workspace connector name
--note	string	—	note recorded with the connector
--poll-seconds	int	0	polling interval in seconds
--replace	bool	false	accept that every field not passed is RESET to its server default (this endpoint replaces, it does not patch)
--secrets-file	string	—	file holding the secrets as a JSON object of string values (- for stdin)
--workspace-ref	string	—	workspace the connector belongs to

Command: olivares status

Show whether the engine is up and which parts are configured

olivares status

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM file containing an additional trusted root CA (default: current context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--json	bool	false	hidden. deprecated alias for -o json
--pin-sha256	stringArray	[]	hidden. trusted leaf SPKI SHA-256 pin, base64 or hex, repeatable — the engine prints it as pin_sha256 on the line reporting its certificate (default: current context)
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--timeout	duration	10s	hidden. request timeout
--verbose	bool	false	also print the knowledge search posture (embedder, semantic retrieval, guard)

Command: olivares superadmin

Enable/disable internal superadmin accounts (never deletes)

olivares superadmin

Flag	Type	Default	Description
--format	string	text	inherited. deprecated alias for -o/–output on this command (text or json) — NOT the export-format flag of ‘audit export’ / ‘findings export’

Command: olivares superadmin disable

Disable an internal superadmin (marks it inactive and revokes its sessions and tokens; never deletes)

olivares superadmin disable

Flag	Type	Default	Description
--actor	string	—	REQUIRED: who is performing this privileged operation (an operator or service identity; recorded in the audit ledger)
--data-dir	string	—	data directory (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--dsn	string	—	store DSN (default a SQLite file in the data dir)
--email	string	—	superadmin email (alternative to –id)
--engine	string	sqlite	store engine: sqlite or postgres
--id	string	—	superadmin user id (see ‘superadmin status’)
--reason	string	—	REQUIRED: why this privileged operation is being performed (recorded in the audit ledger)

Command: olivares superadmin enable

Re-enable a previously disabled internal superadmin

olivares superadmin enable

Flag	Type	Default	Description
--actor	string	—	REQUIRED: who is performing this privileged operation (an operator or service identity; recorded in the audit ledger)
--data-dir	string	—	data directory (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--dsn	string	—	store DSN (default a SQLite file in the data dir)
--email	string	—	superadmin email (alternative to –id)
--engine	string	sqlite	store engine: sqlite or postgres
--id	string	—	superadmin user id (see ‘superadmin status’)
--reason	string	—	REQUIRED: why this privileged operation is being performed (recorded in the audit ledger)

Command: olivares superadmin status

List internal superadmin accounts and their active/inactive status

olivares superadmin status

Flag	Type	Default	Description
--data-dir	string	—	data directory (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--dsn	string	—	store DSN (default a SQLite file in the data dir)
--engine	string	sqlite	store engine: sqlite or postgres

Command: olivares support

Collect redacted diagnostics for support and incident response

olivares support

Declares no flags of its own; it takes those of olivares and the root command.

Command: olivares support bundle

Build a redacted diagnostic tarball with an integrity manifest

olivares support bundle

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine
--config	string	/etc/olivares/olivares.env	effective systemd env file to redact
--data-dir	string	—	data directory (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--dr-bundle	stringArray	[]	DR bundle whose non-secret manifest to include (repeatable)
--dsn	string	—	store DSN (default a SQLite file in the data dir)
--engine	string	sqlite	store engine: sqlite or postgres
--exclude	stringSlice	[]	sections to exclude after –include selection
--include	stringSlice	[]	sections to include: config,status,logs,manifests,verify,secrets (default all)
--insecure	bool	false	hidden. skip TLS certificate verification for the status request
--journal	bool	false	collect journalctl output for the olivares unit
--logs	string	—	engine log file to redact line by line
--offline	bool	false	skip the live GET /status request
--out	string	—	output tar.gz path (default olivares-support-<UTC timestamp>.tar.gz)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL)
--since	string	24 hours ago	journalctl –since value (used with –journal)
--timeout	duration	10s	hidden. status request timeout
--verify-report	stringArray	[]	JSON output from audit verify or dr.RestoreVerify to redact and include (repeatable)

Command: olivares tenants

Hidden diagnostic: it does not appear in --help output and is not part of the supported surface.

Organization management requires Enterprise

olivares tenants

Aliases: orgs

Declares no flags of its own; it takes those of olivares and the root command.

Command: olivares threatintel

Hidden diagnostic: it does not appear in --help output and is not part of the supported surface.

Manage the AI threat-intel catalog and its signed catalog releases (Business)

olivares threatintel

Declares no flags of its own; it takes those of olivares and the root command.

Command: olivares threatintel apply

Verify and apply a signed catalog release (fail-closed, anti-rollback); persists it for the engine

olivares threatintel apply <catalog-file>

Declares no flags of its own; it takes those of olivares threatintel and the root command.

Command: olivares threatintel pull

Pull the catalog release from the configured endpoint, then verify and apply it (fail-closed)

olivares threatintel pull

Declares no flags of its own; it takes those of olivares threatintel and the root command.

Command: olivares threatintel sign

Sign an unsigned catalog envelope (publisher side; key minted with olivares license keygen)

olivares threatintel sign

Flag	Type	Default	Description
--in	string	-	unsigned feed envelope JSON file (“-” = stdin)
--key	string	—	base64-std Ed25519 private key file (else $OLIVARES_THREATINTEL_SIGNING_KEY)
--out	string	-	signed feed output file (“-” = stdout)

Command: olivares threatintel status

Show the active catalog release (versions, expiry, channels) and the governance crosswalk summary

olivares threatintel status

Flag	Type	Default	Description
--crosswalk	bool	false	print the Claude/Anthropic governance crosswalk instead of the feed status

Command: olivares threatintel verify

Verify a signed catalog release (signature + expiry + schema); does not apply it

olivares threatintel verify <catalog-file>

Declares no flags of its own; it takes those of olivares threatintel and the root command.

Command: olivares tokens

API tokens for scripts: issue, list, rotate, revoke

olivares tokens

Flag	Type	Default	Description
--allow-cleartext	bool	false	inherited, hidden. allow sending the credential to a non-loopback host over plain HTTP (DANGEROUS: it travels readable)
--ca-cert	string	—	inherited, hidden. PEM file containing an additional trusted root CA (default: current context)
--insecure	bool	false	inherited, hidden. skip TLS certificate verification (DANGEROUS; development only)
--pin-sha256	stringArray	[]	inherited, hidden. trusted leaf SPKI SHA-256 pin, base64 or hex, repeatable — the engine prints it as pin_sha256 on the line reporting its certificate (default: current context)
--server	string	—	inherited, hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	inherited, hidden. tenant id (default $OLIVARES_TENANT, then current context)
--timeout	duration	10s	inherited, hidden. request timeout
--token	string	—	inherited, hidden. API bearer token (prefer –token-file: this form is visible in the process table and in shell history; default $OLIVARES_TOKEN, then current context)
--token-file	string	—	inherited, hidden. read the API bearer token from a file, or - for stdin

Command: olivares tokens issue

Issue an API token and print its secret ONCE

olivares tokens issue

Flag	Type	Default	Description
--name	string	—	human label for the token (required; shown in ‘tokens ls’)
--role	string	viewer	role the bound token carries: viewer, editor, admin or owner
--superadmin	bool	false	mint a CROSS-TENANT superadmin token instead of a tenant-bound one (superadmin callers only)

Command: olivares tokens ls

List the API tokens the caller may see

olivares tokens ls

Aliases: list

Flag	Type	Default	Description
--cursor	string	—	continue from the cursor a previous page reported
--include-revoked	bool	false	also list tokens that have been revoked
--limit	int	0	server-side page size (left out: the engine’s default)

Command: olivares tokens revoke

Revoke an API token

olivares tokens revoke <token-id>

Aliases: delete, rm

Flag	Type	Default	Description
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares tokens rotate

Rotate an API token: issue a replacement with the same spec and revoke the old one

olivares tokens rotate <token-id>

Declares no flags of its own; it takes those of olivares tokens and the root command.

Command: olivares tool

Install and sign in the agent tools sessions run (Claude Code, Codex, Grok Build, OpenCode, Gemini CLI)

olivares tool

Aliases: tools

Declares no flags of its own; it takes those of olivares and the root command.

Command: olivares tool install

Install an official or catalog-admitted tool on the engine’s host

olivares tool install [tool] [--from URL --version VERSION]

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--from	string	—	Git or release URL of a catalog-admitted tool
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	2m0s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin
--version	string	latest	release version, or the vendor’s channel (latest; stable for Grok Build)

Command: olivares tool login

Sign an agent tool in with its own login (Claude, ChatGPT, xAI, Google or OpenCode account)

olivares tool login <claude|codex|grok|opencode|gemini>

Flag	Type	Default	Description
--account	string	—	sign in an existing provider account (name or profile reference)
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--method	string	—	the tool’s official login method, when it offers several (the first one the engine lists otherwise)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares tool ls

List the agent tools on the engine’s host and whether each is signed in

olivares tool ls

Aliases: list, status

Flag	Type	Default	Description
--account	string	—	read an existing provider account’s own login (name or profile reference)
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares tool pin

Select a session tool version for a workspace or agent

olivares tool pin <tool> --workspace <ref> --version <version>

Flag	Type	Default	Description
--agent	string	—	agent ID in this organization
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--clear	bool	false	clear this version selection
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin
--version	string	—	exact installed version for new and resumed sessions
--workspace	string	—	registered session workspace reference

Command: olivares tool providers

Show each tool’s own login: email, plan, usage windows and models

olivares tool providers

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares tool pull

Download an Ollama or public Hugging Face GGUF model on the engine’s host

olivares tool pull <model>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares tool rm

Remove an installed tool version when no session uses it

olivares tool rm <tool> --version <version>

Aliases: remove

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin
--version	string	—	required. exact installed version to remove

Command: olivares tool start

Start Ollama, llama.cpp or vLLM on the engine’s host as the engine’s own service

olivares tool start <ollama|llama-cpp|vllm>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--model	string	—	llama-cpp: an absolute .gguf path or a Hugging Face user/repo[:quantization]; vllm: an absolute model directory or a Hugging Face user/repo
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares tool stop

Stop Ollama, llama.cpp or vLLM, the engine’s own service

olivares tool stop <ollama|llama-cpp|vllm>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares tool update

Update an agent tool from its verified official release

olivares tool update <claude|codex|grok|opencode|gemini|ollama>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--from	string	—	Git or release URL of a catalog-admitted tool
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	2m0s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin
--version	string	latest	release version, or the vendor’s channel (latest; stable for Grok Build)

Command: olivares ui

Open the interactive main menu on a terminal

olivares ui

Declares no flags of its own; it takes those of olivares and the root command.

Command: olivares ui session

Follow, message, interrupt and stop one session on a terminal

olivares ui session <name|new>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares uninstall

Plan or remove a local installation without crossing its signed-release layout

olivares uninstall (--plan|--preserve|--purge)

Flag	Type	Default	Description
--data-dir	string	—	logical data directory containing install-manifest.json
--manifest	string	—	read the ownership manifest from this path (must name the requested data dir)
--plan	bool	false	print every remove/keep action without mutation
--preserve	bool	false	remove managed software and service files; retain data, config, logs and keys
--purge	bool	false	also remove allowlisted data, config, logs and keys (requires confirmation)
--root	string	—	hidden. prefix logical paths with an offline staging root (no host init/account mutation)
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares upgrade

Upgrade this binary in place to a newer signed release (verified, atomic, reversible)

olivares upgrade

Flag	Type	Default	Description
--arch	string	amd64	target architecture to download for
--bundle	string	—	verify a local bundle with –check; offline installation requires Enterprise
--channel	string	stable	release channel: stable | security (lts is accepted by the validator, but no lts line is published)
--check	bool	false	show the upgrade plan (current -> available, channel, CVEs) without swapping
--connect	bool	false	with –enterprise: refresh this data directory’s connected credential and download token by proof of possession (‘license connect’) instead of a pasted token; works when the installed credential has expired. It refreshes only when upgrade runs: a timer runs it on –timer-schedule, not at the credential’s refresh planning boundary
--current-version	string	—	declare the version installed at –target when it cannot be probed (cross-arch staging, a noexec mount, or a build from source); keeps anti-rollback and min_version armed instead of guessing
--data-dir	string	—	data directory (license + install-id) (default $OLIVARES_DATA_DIR, an existing ./olivares-data, else $XDG_DATA_HOME/olivares or ~/.local/share/olivares)
--download-protocol	string	release-v1	gated download protocol for –enterprise: release-v1 (default; resolves one consistent {version,set,manifest,signature} tuple) or legacy (the existing per-request /download route, for a custom or older gateway). A 404 from the new route is a compatibility diagnostic, not an automatic downgrade
--edition	string	—	install or update the licensed build of this edition: business (or its alias enterprise); the same route as –enterprise, and the one a Community build with a Business license takes
--endpoint	string	—	update channel source: a GitHub repository (https://github.com/&lt;owner&gt;/&lt;repo>), one of its releases (…/releases/tag/<tag>), or a static mirror base (<base>/<channel>/manifest.json). Default: the public repository’s releases; the license worker with –enterprise
--enterprise	bool	false	upgrade the licensed Business edition (gated download; needs a live license)
--force-rollback	bool	false	allow installing an OLDER version than the running one (records an audit entry)
--if-eligible	bool	false	only proceed if this node is in the manifest’s staged-rollout cohort (used by the timer)
--install-timer	bool	false	emit an opt-in systemd timer+service that runs ‘upgrade –if-eligible’ in a maintenance window; refused for the package-owned /usr/bin/olivares, which the package manager upgrades
--license	string	—	explicit license file path (Business; highest precedence)
--os	string	linux	target OS to download for
--pubkey	string	—	base64 or @file Ed25519 OTA key to verify against (default: the key embedded in this build)
--target	string	—	binary path to replace (default: the running executable)
--timeout	duration	5m0s	overall network timeout
--timer-dir	string	—	write the systemd units to this directory instead of printing them
--timer-schedule	string	Sun *-*-* 03:00:00	systemd OnCalendar expression for the auto-check timer; when omitted, an –enterprise –connect timer runs daily (--* 03:00:00)
--token	string	—	Business download token from your license/fulfillment email
-y, --yes	bool	false	do not prompt for confirmation before swapping

Command: olivares users

User accounts: list, create, disable, enable

olivares users

Flag	Type	Default	Description
--allow-cleartext	bool	false	inherited, hidden. allow sending the credential to a non-loopback host over plain HTTP (DANGEROUS: it travels readable)
--ca-cert	string	—	inherited, hidden. PEM file containing an additional trusted root CA (default: current context)
--insecure	bool	false	inherited, hidden. skip TLS certificate verification (DANGEROUS; development only)
--pin-sha256	stringArray	[]	inherited, hidden. trusted leaf SPKI SHA-256 pin, base64 or hex, repeatable — the engine prints it as pin_sha256 on the line reporting its certificate (default: current context)
--server	string	—	inherited, hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	inherited, hidden. tenant id (default $OLIVARES_TENANT, then current context)
--timeout	duration	10s	inherited, hidden. request timeout
--token	string	—	inherited, hidden. API bearer token (prefer –token-file: this form is visible in the process table and in shell history; default $OLIVARES_TOKEN, then current context)
--token-file	string	—	inherited, hidden. read the API bearer token from a file, or - for stdin

Command: olivares users create

Create a global user account (superadmin)

olivares users create

Flag	Type	Default	Description
--display-name	string	—	human name shown in the console and audit ledger
--email	string	—	email address that identifies the account (required)
--member-of	string	—	grant the account its first membership in this tenant, in the same transaction
--password	string	—	initial password (prefer –password-file: this form is visible in the process table)
--password-file	string	—	read the initial password from a file, or - for stdin
--role	string	viewer	role of the first membership: viewer, editor, admin or owner (with –member-of)
--superadmin	bool	false	create the account as a cross-tenant superadmin (the engine accepts this only from a superadmin)

Command: olivares users disable

Disable a superadmin account (reversible)

olivares users disable <user-id>

Flag	Type	Default	Description
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares users enable

Re-enable a disabled superadmin account

olivares users enable <user-id>

Declares no flags of its own; it takes those of olivares users and the root command.

Command: olivares users ls

List the global user accounts

olivares users ls

Aliases: list

Flag	Type	Default	Description
--cursor	string	—	continue from the cursor a previous page reported
--limit	int	0	server-side page size (left out: the engine’s default)

Command: olivares users superadmins

List the superadmin accounts and whether each is active

olivares users superadmins

Declares no flags of its own; it takes those of olivares users and the root command.

Command: olivares users totp

Show an account’s TOTP second factor (non-secret)

olivares users totp <user-id>

Declares no flags of its own; it takes those of olivares users and the root command.

Command: olivares users totp-reset

Reset an account’s TOTP factor (destructive)

olivares users totp-reset <user-id>

Flag	Type	Default	Description
-y, --yes	bool	false	proceed without the confirmation prompt (required in a non-interactive session)

Command: olivares vault

Your personal vault: logins, notes and authenticator codes only you can read back

olivares vault

Flag	Type	Default	Description
--allow-cleartext	bool	false	inherited, hidden. allow sending the credential to a non-loopback host over plain HTTP (DANGEROUS: it travels readable)
--ca-cert	string	—	inherited, hidden. PEM file containing an additional trusted root CA (default: current context)
--insecure	bool	false	inherited, hidden. skip TLS certificate verification (DANGEROUS; development only)
--pin-sha256	stringArray	[]	inherited, hidden. trusted leaf SPKI SHA-256 pin, base64 or hex, repeatable — the engine prints it as pin_sha256 on the line reporting its certificate (default: current context)
--server	string	—	inherited, hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	inherited, hidden. tenant id (default $OLIVARES_TENANT, then current context)
--timeout	duration	10s	inherited, hidden. request timeout
--token	string	—	inherited, hidden. API bearer token (prefer –token-file: this form is visible in the process table and in shell history; default $OLIVARES_TOKEN, then current context)
--token-file	string	—	inherited, hidden. read the API bearer token from a file, or - for stdin

Command: olivares vault export

Write every item of your vault to a file, to move it or keep a copy

olivares vault export

Flag	Type	Default	Description
--file	string	—	where to write the export, or - for stdout (required; never overwrites a file)

Command: olivares vault generate

Print a random password

olivares vault generate

Flag	Type	Default	Description
--length	int	20	password length, 8 to 128
--no-digits	bool	false	leave out digits
--no-lower	bool	false	leave out lowercase letters
--no-symbols	bool	false	leave out symbols
--no-upper	bool	false	leave out uppercase letters

Command: olivares vault get

Print one part of an item of your vault

olivares vault get <item>

Flag	Type	Default	Description
--field	string	—	the part to print: username, password, url, note or totp (default: the password, note or key)

Command: olivares vault import

Add the items of another password manager’s export to your vault

olivares vault import <file>

Flag	Type	Default	Description
--dry-run	bool	false	read and check the file and print counts only; store nothing
--from	string	—	the program that wrote the file: bitwarden, keepass, 1password, chrome, proton or olivares
--replace	bool	false	overwrite items that are already in the vault

Command: olivares vault ls

List your vault items (names and kinds; never a value)

olivares vault ls

Aliases: list

Declares no flags of its own; it takes those of olivares vault and the root command.

Command: olivares vault put

Add or replace an item of your vault

olivares vault put <item>

Flag	Type	Default	Description
--description	string	—	a non-secret description shown in the list
--generate	bool	false	generate the password instead of reading it
--length	int	20	password length, 8 to 128
--no-digits	bool	false	leave out digits
--no-lower	bool	false	leave out lowercase letters
--no-symbols	bool	false	leave out symbols
--no-upper	bool	false	leave out uppercase letters
--note-file	string	—	read the note from a file, or - for stdin
--password-file	string	—	read the password from a file, or - for stdin
--totp-file	string	—	read the authenticator key (base32 or otpauth:// link) from a file, or - for stdin
--type	string	—	login, note or totp (default: inferred from what you give)
--url	string	—	the login’s website
--username	string	—	the login’s username

Command: olivares vault rm

Delete an item of your vault

olivares vault rm <item>

Aliases: delete, remove

Flag	Type	Default	Description
-y, --yes	bool	false	do not ask for confirmation

Command: olivares vault totp

Print the current authenticator code of an item

olivares vault totp <item>

Declares no flags of its own; it takes those of olivares vault and the root command.

Command: olivares version

Print the olivares version, build metadata and FIPS 140-3 mode

olivares version

Declares no flags of its own; it takes those of olivares and the root command.

Command: olivares voice

Inspect governed voice sessions and set the per-agent voice policy

olivares voice

Flag	Type	Default	Description
--allow-cleartext	bool	false	inherited, hidden. allow sending the credential to a non-loopback host over plain HTTP (DANGEROUS: it travels readable)
--ca-cert	string	—	inherited, hidden. PEM file containing an additional trusted root CA (default: current context)
--insecure	bool	false	inherited, hidden. skip TLS certificate verification (DANGEROUS; development only)
--pin-sha256	stringArray	[]	inherited, hidden. trusted leaf SPKI SHA-256 pin, base64 or hex, repeatable — the engine prints it as pin_sha256 on the line reporting its certificate (default: current context)
--server	string	—	inherited, hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	inherited, hidden. tenant id (default $OLIVARES_TENANT, then current context)
--timeout	duration	10s	inherited, hidden. request timeout
--token	string	—	inherited, hidden. API bearer token (prefer –token-file: this form is visible in the process table and in shell history; default $OLIVARES_TOKEN, then current context)
--token-file	string	—	inherited, hidden. read the API bearer token from a file, or - for stdin

Command: olivares voice decisions

List the append-only voice decision ledger for the tenant

olivares voice decisions

Flag	Type	Default	Description
--cursor	string	—	continue from the cursor a previous page reported
--limit	int	0	page size (left out: the engine’s default)

Command: olivares voice policies

Read and replace the per-agent voice policy

olivares voice policies

Declares no flags of its own; it takes those of olivares voice and the root command.

Command: olivares voice policies ls

List the voice policies in force

olivares voice policies ls

Flag	Type	Default	Description
--cursor	string	—	continue from the cursor a previous page reported
--limit	int	0	page size (left out: the engine’s default)

Command: olivares voice policies set

Replace one agent’s voice policy (PUT — the whole policy)

olivares voice policies set

Flag	Type	Default	Description
--agent-ref	string	—	required. the agent this policy governs (required)
--allowed-model-ref	string	—	required. the only model this agent may speak through (required)
--allowed-provider-ref	string	—	required. the only provider this agent may speak through (required)
--calls-file	string	—	JSON call-policy object, ‘-’ for stdin
--max-latency-ms	int64	0	tolerated latency in milliseconds (0 = no limit)
--max-session-minutes	int64	0	cap a session’s length in minutes (0 = no cap)

Command: olivares voice sessions

List, follow and open governed voice sessions

olivares voice sessions

Declares no flags of its own; it takes those of olivares voice and the root command.

Command: olivares voice sessions decisions

List one session’s governance decisions

olivares voice sessions decisions <session-ref>

Flag	Type	Default	Description
--cursor	string	—	continue from the cursor a previous page reported
--limit	int	0	page size (left out: the engine’s default)

Command: olivares voice sessions get

Show one voice session

olivares voice sessions get <session-ref>

Declares no flags of its own; it takes those of olivares voice sessions and the root command.

Command: olivares voice sessions ls

List voice sessions with their derived state

olivares voice sessions ls

Flag	Type	Default	Description
--cursor	string	—	continue from the cursor a previous page reported
--limit	int	0	page size (left out: the engine’s default)

Command: olivares voice sessions open

Open a governed voice session through the approval gate (two-phase)

olivares voice sessions open

Flag	Type	Default	Description
--agent-ref	string	—	required. the agent that will speak (required)
--approval-ref	string	—	phase 2: the approval that authorizes this open
--model-ref	string	—	required. the model requested for this session (required)
--provider-ref	string	—	required. the provider requested for this session (required)
--session-ref	string	—	required. the session reference to open (required)

Command: olivares voice sessions stream

Follow one live voice session as NDJSON (one object per event)

olivares voice sessions stream <session-ref>

Declares no flags of its own; it takes those of olivares voice sessions and the root command.

Command: olivares webui-files

Hidden diagnostic: it does not appear in --help output and is not part of the supported surface.

List the web UI assets embedded in this binary (diagnostic)

olivares webui-files

Declares no flags of its own; it takes those of olivares and the root command.

Command: olivares wiki

Initialize a folder wiki and run its ingest, query or lint skill

olivares wiki

Declares no flags of its own; it takes those of olivares and the root command.

Command: olivares wiki ingest

Run the wiki ingest skill in a governed session and return its ID

olivares wiki ingest <workspace> <path-under-raw>

Flag	Type	Default	Description
--account	string	—	launch under this provider account (its name or profile reference; see olivares provider account ls)
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--detach	bool	false	with a prompt, send it and return without showing the reply
--dlp	string	off	DLP posture for a folder this command registers: off, label or deny
--effort	string	—	low|medium|high|xhigh|max
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--isolation	string	native	native (a process beside the engine) or container (podman or Docker on this server; see olivares doctor)
--model	string	—	model alias or id (default: the tool’s own; Claude Code launches an alias, or none, on its exact id)
--name	string	—	session name (default: the folder’s name; -2, -3 … when taken)
--no-setup	bool	false	skip the folder’s setup command for this start
--permission	string	edits-and-commands	what the agent may do without asking: edits-and-commands, edits-only, read-only, ask, or full (every tool, no prompts; administrators only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--profile	string	—	provider profile to launch under (default: the one the engine picks, as in the console)
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--template	string	—	saved session template ID; its terms apply at launch and resume
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin
--tool	string	—	agent tool: claude, codex, grok, opencode or gemini-cli (default: the first one that is ready)
--worktree	bool	false	work in a git worktree of its own, on a new branch (the folder must be a git repository’s top folder)
--worktree-from	string	—	start the worktree at this commit id or local branch instead of the current commit (implies –worktree)

Command: olivares wiki init

Create a wiki and assign its bundled skill without replacing files

olivares wiki init <workspace>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares wiki lint

Run the wiki lint skill in a governed session and return its ID

olivares wiki lint <workspace>

Flag	Type	Default	Description
--account	string	—	launch under this provider account (its name or profile reference; see olivares provider account ls)
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--detach	bool	false	with a prompt, send it and return without showing the reply
--dlp	string	off	DLP posture for a folder this command registers: off, label or deny
--effort	string	—	low|medium|high|xhigh|max
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--isolation	string	native	native (a process beside the engine) or container (podman or Docker on this server; see olivares doctor)
--model	string	—	model alias or id (default: the tool’s own; Claude Code launches an alias, or none, on its exact id)
--name	string	—	session name (default: the folder’s name; -2, -3 … when taken)
--no-setup	bool	false	skip the folder’s setup command for this start
--permission	string	edits-and-commands	what the agent may do without asking: edits-and-commands, edits-only, read-only, ask, or full (every tool, no prompts; administrators only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--profile	string	—	provider profile to launch under (default: the one the engine picks, as in the console)
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--template	string	—	saved session template ID; its terms apply at launch and resume
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin
--tool	string	—	agent tool: claude, codex, grok, opencode or gemini-cli (default: the first one that is ready)
--worktree	bool	false	work in a git worktree of its own, on a new branch (the folder must be a git repository’s top folder)
--worktree-from	string	—	start the worktree at this commit id or local branch instead of the current commit (implies –worktree)

Command: olivares wiki query

Run the wiki query skill in a governed session and return its ID

olivares wiki query <workspace> <question>

Flag	Type	Default	Description
--account	string	—	launch under this provider account (its name or profile reference; see olivares provider account ls)
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--detach	bool	false	with a prompt, send it and return without showing the reply
--dlp	string	off	DLP posture for a folder this command registers: off, label or deny
--effort	string	—	low|medium|high|xhigh|max
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--isolation	string	native	native (a process beside the engine) or container (podman or Docker on this server; see olivares doctor)
--model	string	—	model alias or id (default: the tool’s own; Claude Code launches an alias, or none, on its exact id)
--name	string	—	session name (default: the folder’s name; -2, -3 … when taken)
--no-setup	bool	false	skip the folder’s setup command for this start
--permission	string	edits-and-commands	what the agent may do without asking: edits-and-commands, edits-only, read-only, ask, or full (every tool, no prompts; administrators only)
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--profile	string	—	provider profile to launch under (default: the one the engine picks, as in the console)
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--template	string	—	saved session template ID; its terms apply at launch and resume
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin
--tool	string	—	agent tool: claude, codex, grok, opencode or gemini-cli (default: the first one that is ready)
--worktree	bool	false	work in a git worktree of its own, on a new branch (the folder must be a git repository’s top folder)
--worktree-from	string	—	start the worktree at this commit id or local branch instead of the current commit (implies –worktree)

Command: olivares work

Manage durable cross-session work, leases, decisions, and acceptance

olivares work

Declares no flags of its own; it takes those of olivares and the root command.

Command: olivares work apply

Apply one validated work command idempotently

olivares work apply <command>

Flag	Type	Default	Description
--authority-ref	string	—	WorkCommand authority_ref
--blocked-code	string	—	WorkCommand blocked_code
--blocked-reason	string	—	WorkCommand blocked_reason
--brief	string	—	WorkCommand brief_md
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--changes-requested	bool	false	WorkCommand changes_requested
--code	string	—	WorkCommand code
--criterion-id	string	—	WorkCommand criterion_id
--criterion-key	string	—	WorkCommand criterion_key
--decision-id	string	—	WorkCommand decision_id
--decision-key	string	—	WorkCommand decision_key
--dependency-id	string	—	WorkCommand dependency_id
--depends-on-id	string	—	WorkCommand depends_on_id
--due-at	string	—	WorkCommand due_at
--evidence-hash	string	—	WorkCommand evidence_hash
--evidence-ref	string	—	WorkCommand evidence_ref
--fence	int64	0	WorkCommand fence
--field	stringArray	[]	additional WorkCommand field as key=JSON (repeatable)
-f, --file	string	—	YAML or JSON WorkCommand file (‘-’ reads stdin; exactly one document)
--force	bool	false	WorkCommand force
--holder-agent-ref	string	—	WorkCommand holder_agent_ref
--holder-run-ref	string	—	WorkCommand holder_run_ref
--holder-sid	string	—	WorkCommand holder_sid
--idempotency-key	string	—	UUID reused for an unambiguous retry (generated and printed when omitted)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--json	bool	false	hidden. deprecated alias for -o json
--ordinal	int	0	acceptance criterion display order
--owner-kind	string	—	WorkCommand owner_kind
--owner-ref	string	—	WorkCommand owner_ref
--parent-id	string	—	WorkCommand parent_id
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--plan	string	—	replay a work-plan artifact instead of -f or inline fields
--plan-hash	string	—	bind the request to this plan hash
--priority	string	—	WorkCommand priority
--provenance-hash	string	—	WorkCommand provenance_hash
--provenance-kind	string	—	WorkCommand provenance_kind
--provenance-ref	string	—	WorkCommand provenance_ref
--rationale	string	—	WorkCommand rationale_md
--reason	string	—	WorkCommand reason
--required	bool	false	make an acceptance criterion required
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--state	string	—	WorkCommand state
--statement	string	—	WorkCommand statement
--statement-md	string	—	WorkCommand statement_md
--subject-kind	string	—	WorkCommand subject_kind
--subject-ref	string	—	WorkCommand subject_ref
--supersedes-id	string	—	WorkCommand supersedes_id
--target-id	string	—	WorkCommand target_id
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--terminal-code	string	—	WorkCommand terminal_code
--terminal-reason	string	—	WorkCommand terminal_reason
--timeout	duration	30s	hidden. request timeout
--title	string	—	WorkCommand title
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin
--transition	string	—	WorkCommand transition
--ttl-seconds	int64	0	WorkCommand ttl_seconds
--unblock	bool	false	WorkCommand unblock
--version	uint64	0	expected resource version N (sent as strong If-Match “vN”)
--waiver-decision-id	string	—	WorkCommand waiver_decision_id
--work-item-id	string	—	WorkCommand work_item_id
--work-kind	string	—	WorkCommand work_kind
--workspace-id	string	—	WorkCommand workspace_id

Command: olivares work get

Get one durable work item, decision, or lease

olivares work get item|decision|lease <id>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--json	bool	false	hidden. deprecated alias for -o json
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares work list

List durable work items, decisions, or leases with keyset pagination

olivares work list items|decisions|leases

Aliases: ls

Flag	Type	Default	Description
--actor-kind	string	—	filter by actor kind
--actor-ref	string	—	filter by actor ref
--archived	bool	false	filter work items by archived state
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--cursor	string	—	opaque UUIDv7 keyset cursor
--decision-key	string	—	filter by decision key
--due-before	string	—	filter by due before
--effective	bool	false	filter decisions by effective head state
--expires-before	string	—	filter by expires before
--filter	stringArray	[]	additional allowlisted filter as key=value (repeatable)
--holder-sid	string	—	filter by holder sid
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--json	bool	false	hidden. deprecated alias for -o json
--limit	int	100	page size (1..200)
--owner-kind	string	—	filter by owner kind
--owner-ref	string	—	filter by owner ref
--parent-id	string	—	filter by parent id
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--priority	string	—	filter by priority
--provenance-kind	string	—	filter by provenance kind
--provenance-ref	string	—	filter by provenance ref
--revoked	bool	false	filter decisions by revoked head state
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--state	string	—	filter by state
--status	string	—	filter by status
--subject-kind	string	—	filter by subject kind
--subject-ref	string	—	filter by subject ref
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin
--updated-after	string	—	filter by updated after
--work-item-id	string	—	filter by work item id
--work-kind	string	—	filter by work kind

Command: olivares work plan

Plan one work command and its expected durable effects without writing

olivares work plan <command>

Flag	Type	Default	Description
--authority-ref	string	—	WorkCommand authority_ref
--blocked-code	string	—	WorkCommand blocked_code
--blocked-reason	string	—	WorkCommand blocked_reason
--brief	string	—	WorkCommand brief_md
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--changes-requested	bool	false	WorkCommand changes_requested
--code	string	—	WorkCommand code
--criterion-id	string	—	WorkCommand criterion_id
--criterion-key	string	—	WorkCommand criterion_key
--decision-id	string	—	WorkCommand decision_id
--decision-key	string	—	WorkCommand decision_key
--dependency-id	string	—	WorkCommand dependency_id
--depends-on-id	string	—	WorkCommand depends_on_id
--due-at	string	—	WorkCommand due_at
--evidence-hash	string	—	WorkCommand evidence_hash
--evidence-ref	string	—	WorkCommand evidence_ref
--fence	int64	0	WorkCommand fence
--field	stringArray	[]	additional WorkCommand field as key=JSON (repeatable)
-f, --file	string	—	YAML or JSON WorkCommand file (‘-’ reads stdin; exactly one document)
--force	bool	false	WorkCommand force
--holder-agent-ref	string	—	WorkCommand holder_agent_ref
--holder-run-ref	string	—	WorkCommand holder_run_ref
--holder-sid	string	—	WorkCommand holder_sid
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--json	bool	false	hidden. deprecated alias for -o json
--ordinal	int	0	acceptance criterion display order
--out	string	—	atomically write a reusable 0600 work-plan artifact
--owner-kind	string	—	WorkCommand owner_kind
--owner-ref	string	—	WorkCommand owner_ref
--parent-id	string	—	WorkCommand parent_id
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--plan-hash	string	—	bind the request to this plan hash
--priority	string	—	WorkCommand priority
--provenance-hash	string	—	WorkCommand provenance_hash
--provenance-kind	string	—	WorkCommand provenance_kind
--provenance-ref	string	—	WorkCommand provenance_ref
--rationale	string	—	WorkCommand rationale_md
--reason	string	—	WorkCommand reason
--required	bool	false	make an acceptance criterion required
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--state	string	—	WorkCommand state
--statement	string	—	WorkCommand statement
--statement-md	string	—	WorkCommand statement_md
--subject-kind	string	—	WorkCommand subject_kind
--subject-ref	string	—	WorkCommand subject_ref
--supersedes-id	string	—	WorkCommand supersedes_id
--target-id	string	—	WorkCommand target_id
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--terminal-code	string	—	WorkCommand terminal_code
--terminal-reason	string	—	WorkCommand terminal_reason
--timeout	duration	30s	hidden. request timeout
--title	string	—	WorkCommand title
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin
--transition	string	—	WorkCommand transition
--ttl-seconds	int64	0	WorkCommand ttl_seconds
--unblock	bool	false	WorkCommand unblock
--version	uint64	0	expected resource version N (sent as strong If-Match “vN”)
--waiver-decision-id	string	—	WorkCommand waiver_decision_id
--work-item-id	string	—	WorkCommand work_item_id
--work-kind	string	—	WorkCommand work_kind
--workspace-id	string	—	WorkCommand workspace_id

Command: olivares work protocol-binding

Compose and reconcile durable A2A and MCP protocol bindings

olivares work protocol-binding

Declares no flags of its own; it takes those of olivares work and the root command.

Command: olivares work protocol-binding binding

Inspect and reconcile durable protocol bindings

olivares work protocol-binding binding

Declares no flags of its own; it takes those of olivares work protocol-binding and the root command.

Command: olivares work protocol-binding binding get

Get one durable protocol binding generation

olivares work protocol-binding binding get <binding-id>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--json	bool	false	hidden. deprecated alias for -o json
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares work protocol-binding binding list

List durable protocol bindings in one workspace

olivares work protocol-binding binding list

Aliases: ls

Flag	Type	Default	Description
--binding-spec-id	string	—	exact binding specification UUID
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--cursor	string	—	opaque keyset cursor
--external-id	string	—	remote resource ID
--external-kind	string	—	remote resource kind
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--json	bool	false	hidden. deprecated alias for -o json
--limit	int	0	page size
--owner-kind	string	—	binding owner kind
--owner-ref	string	—	binding owner reference
--peer-authority	string	—	canonical peer authority
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--protocol	string	—	protocol: a2a or mcp
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--terminal	string	—	terminal filter: true or false
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin
--verdict	string	—	observation verdict
--work-item-id	string	—	exact work item UUID
--workspace-id	string	—	workspace UUID (optional for a confined principal)

Command: olivares work protocol-binding binding reconcile

Validate, plan, test, or apply one exact-generation remote observation

olivares work protocol-binding binding reconcile <binding-id>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--idempotency-key	string	—	UUID reused for an exact apply retry
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--json	bool	false	hidden. deprecated alias for -o json
--mode	string	test	operation phase: validate, plan, test, or apply
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--plan-hash	string	—	SHA-256 plan hash required by apply
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin
--version	uint64	0	expected resource version N

Command: olivares work protocol-binding spec

Manage immutable protocol binding specifications

olivares work protocol-binding spec

Declares no flags of its own; it takes those of olivares work protocol-binding and the root command.

Command: olivares work protocol-binding spec activate

Activate one protocol binding spec generation

olivares work protocol-binding spec activate <spec-id>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--idempotency-key	string	—	UUID reused for an exact apply retry
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--json	bool	false	hidden. deprecated alias for -o json
--mode	string	plan	operation phase: validate, plan, test, or apply
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--plan-hash	string	—	SHA-256 plan hash required by apply
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin
--version	uint64	0	expected resource version N

Command: olivares work protocol-binding spec create

Validate, plan, or create one draft protocol binding spec

olivares work protocol-binding spec create

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
-f, --file	string	—	YAML or JSON protocol binding spec (‘-’ reads stdin)
--idempotency-key	string	—	UUID reused for an exact apply retry
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--json	bool	false	hidden. deprecated alias for -o json
--mode	string	plan	operation phase: validate, plan, test, or apply
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--plan-hash	string	—	SHA-256 plan hash required by apply
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares work protocol-binding spec disable

Disable one protocol binding spec generation

olivares work protocol-binding spec disable <spec-id>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--idempotency-key	string	—	UUID reused for an exact apply retry
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--json	bool	false	hidden. deprecated alias for -o json
--mode	string	plan	operation phase: validate, plan, test, or apply
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--plan-hash	string	—	SHA-256 plan hash required by apply
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin
--version	uint64	0	expected resource version N

Command: olivares work protocol-binding spec get

Get one immutable protocol binding spec generation

olivares work protocol-binding spec get <spec-id>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--json	bool	false	hidden. deprecated alias for -o json
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares work protocol-binding spec list

List protocol binding spec generations in one workspace

olivares work protocol-binding spec list

Aliases: ls

Flag	Type	Default	Description
--binding-key	string	—	stable binding specification key
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--cursor	string	—	opaque keyset cursor
--direction	string	—	binding direction
--generation	int64	0	exact specification generation
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--json	bool	false	hidden. deprecated alias for -o json
--limit	int	0	page size
--local-kind	string	—	local resource kind
--peer-authority	string	—	canonical peer authority
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--protocol	string	—	protocol: a2a or mcp
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--state	string	—	specification state
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin
--workspace-id	string	—	workspace UUID (optional for a confined principal)

Command: olivares work replay

Replay a dead-lettered durable work event

olivares work replay

Declares no flags of its own; it takes those of olivares work and the root command.

Command: olivares work replay event

Requeue one dead-lettered WorkEvent under its stable event ID

olivares work replay event <event-id>

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--idempotency-key	string	—	UUID reused for an exact apply retry
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--json	bool	false	hidden. deprecated alias for -o json
--mode	string	apply	command phase: validate, plan, or apply
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--plan-hash	string	—	required replay plan hash for apply
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin
--version	uint64	0	outbox row version from replay plan ETag (required for apply)

Command: olivares work validate

Validate one work command without writing

olivares work validate <command>

Flag	Type	Default	Description
--authority-ref	string	—	WorkCommand authority_ref
--blocked-code	string	—	WorkCommand blocked_code
--blocked-reason	string	—	WorkCommand blocked_reason
--brief	string	—	WorkCommand brief_md
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--changes-requested	bool	false	WorkCommand changes_requested
--code	string	—	WorkCommand code
--criterion-id	string	—	WorkCommand criterion_id
--criterion-key	string	—	WorkCommand criterion_key
--decision-id	string	—	WorkCommand decision_id
--decision-key	string	—	WorkCommand decision_key
--dependency-id	string	—	WorkCommand dependency_id
--depends-on-id	string	—	WorkCommand depends_on_id
--due-at	string	—	WorkCommand due_at
--evidence-hash	string	—	WorkCommand evidence_hash
--evidence-ref	string	—	WorkCommand evidence_ref
--fence	int64	0	WorkCommand fence
--field	stringArray	[]	additional WorkCommand field as key=JSON (repeatable)
-f, --file	string	—	YAML or JSON WorkCommand file (‘-’ reads stdin; exactly one document)
--force	bool	false	WorkCommand force
--holder-agent-ref	string	—	WorkCommand holder_agent_ref
--holder-run-ref	string	—	WorkCommand holder_run_ref
--holder-sid	string	—	WorkCommand holder_sid
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--json	bool	false	hidden. deprecated alias for -o json
--ordinal	int	0	acceptance criterion display order
--owner-kind	string	—	WorkCommand owner_kind
--owner-ref	string	—	WorkCommand owner_ref
--parent-id	string	—	WorkCommand parent_id
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--plan-hash	string	—	bind the request to this plan hash
--priority	string	—	WorkCommand priority
--provenance-hash	string	—	WorkCommand provenance_hash
--provenance-kind	string	—	WorkCommand provenance_kind
--provenance-ref	string	—	WorkCommand provenance_ref
--rationale	string	—	WorkCommand rationale_md
--reason	string	—	WorkCommand reason
--required	bool	false	make an acceptance criterion required
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--state	string	—	WorkCommand state
--statement	string	—	WorkCommand statement
--statement-md	string	—	WorkCommand statement_md
--subject-kind	string	—	WorkCommand subject_kind
--subject-ref	string	—	WorkCommand subject_ref
--supersedes-id	string	—	WorkCommand supersedes_id
--target-id	string	—	WorkCommand target_id
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--terminal-code	string	—	WorkCommand terminal_code
--terminal-reason	string	—	WorkCommand terminal_reason
--timeout	duration	30s	hidden. request timeout
--title	string	—	WorkCommand title
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin
--transition	string	—	WorkCommand transition
--ttl-seconds	int64	0	WorkCommand ttl_seconds
--unblock	bool	false	WorkCommand unblock
--version	uint64	0	expected resource version N (sent as strong If-Match “vN”)
--waiver-decision-id	string	—	WorkCommand waiver_decision_id
--work-item-id	string	—	WorkCommand work_item_id
--work-kind	string	—	WorkCommand work_kind
--workspace-id	string	—	WorkCommand workspace_id

Command: olivares work watch

Watch the durable work-event stream from a resumable cursor

olivares work watch

Flag	Type	Default	Description
--ca-cert	string	—	hidden. PEM CA bundle used to verify the engine (default: the active client context)
--cursor	string	—	resume after this persisted WorkEvent cursor
--insecure	bool	false	hidden. skip TLS certificate verification (self-signed development engines only)
--json	bool	false	hidden. deprecated alias for -o json
--pin-sha256	stringArray	[]	hidden. pinned leaf SPKI SHA-256, base64 or hex (repeatable) — the engine prints it as pin_sha256 on the line reporting its certificate; default: the active client context
--server	string	—	hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	hidden. tenant id (default $OLIVARES_TENANT or the active client context)
--timeout	duration	30s	hidden. request timeout
--token	string	—	hidden. API bearer token (default $OLIVARES_TOKEN or the active client context)
--token-file	string	—	hidden. read the API bearer token from a file, or - for stdin

Command: olivares workspaces

Workspaces: list, show

olivares workspaces

Aliases: workspace

Flag	Type	Default	Description
--allow-cleartext	bool	false	inherited, hidden. allow sending the credential to a non-loopback host over plain HTTP (DANGEROUS: it travels readable)
--ca-cert	string	—	inherited, hidden. PEM file containing an additional trusted root CA (default: current context)
--insecure	bool	false	inherited, hidden. skip TLS certificate verification (DANGEROUS; development only)
--pin-sha256	stringArray	[]	inherited, hidden. trusted leaf SPKI SHA-256 pin, base64 or hex, repeatable — the engine prints it as pin_sha256 on the line reporting its certificate (default: current context)
--server	string	—	inherited, hidden. the engine’s address, https://<host>:8443 (default $OLIVARES_SERVER_URL, then the saved sign-in)
--tenant	string	—	inherited, hidden. tenant id (default $OLIVARES_TENANT, then current context)
--timeout	duration	10s	inherited, hidden. request timeout
--token	string	—	inherited, hidden. API bearer token (prefer –token-file: this form is visible in the process table and in shell history; default $OLIVARES_TOKEN, then current context)
--token-file	string	—	inherited, hidden. read the API bearer token from a file, or - for stdin

Command: olivares workspaces get

Show one workspace and what it holds

olivares workspaces get <workspace-id>

Aliases: show

Declares no flags of its own; it takes those of olivares workspaces and the root command.

Command: olivares workspaces ls

List the workspaces of the tenant

olivares workspaces ls

Aliases: list

Flag	Type	Default	Description
--cursor	string	—	continue from the cursor a previous page reported
--limit	int	0	server-side page size (left out: the engine’s default)

Stability

Dies ist ein pre-1.0-Produkt in aktiver Entwicklung. Die obigen Subcommands und Flags sind im aktuellen Binary bestätigt, aber die vollständige CLI-Schnittstelle entwickelt sich noch: Subcommands, Flags, Defaults und Ausgabeformate können sich vor einem stable-Release ändern. Im Zweifel führen Sie olivares <subcommand> --help gegen den exakten Build aus, den Sie deployt haben, und behandeln das als maßgeblich gegenüber jedem Dokument. Was heute implementiert ist gegenüber dem Geplanten, siehe Ehrlichkeit und Grenzen. Die REST/gRPC-API-Schnittstelle selbst unterliegt der API-Stabilitätsrichtlinie.