CLI Reference

Keystone Core agent daemon

Usage:
  kscore-agent [flags]
  kscore-agent [command]

Available Commands:
  bootstrap   Bootstrap the agent (interactive wizard or --non-interactive flags)
  completion  Generate the autocompletion script for the specified shell
  help        Help about any command
  service     Manage the kscore-agent systemd unit

Flags:
      --config string   path to YAML config file (KSCORE_-prefixed env vars overlay)
  -h, --help            help for kscore-agent
  -v, --version         version for kscore-agent

Use "kscore-agent [command] --help" for more information about a command.

Query the Keystone Core audit log + compliance roll-ups.

log / report / stats talk to the PolicyService gRPC on a running kscore-server (default localhost:5397). Audit-mode v1.0: policy evaluations are recorded but never block.

Usage:
  kscore-audit [command]

Available Commands:
  completion  Generate the autocompletion script for the specified shell
  export      Stream the audit log as JSON / JSONL / CSV (redaction applied on export)
  help        Help about any command
  log         Paginated audit-log query
  report      Compliance report (rate, top violations, trend)
  stats       Headline audit counts over a window

Flags:
      --api-key string   API key for authentication (or set KSCORE_API_KEY)
  -h, --help             help for kscore-audit
  -o, --output string    output format: table | json (default "table")
      --server string    policy-service gRPC address (host:port) (default "localhost:5397")
  -v, --version          version for kscore-audit

Use "kscore-audit [command] --help" for more information about a command.

kscore-backup creates, verifies, lists, and restores
portable kscore-server backup artifacts. Task 7a ships the
read-only verify + list subcommands; create + restore land in
task 7b.

Usage:
  kscore-backup [command]

Available Commands:
  completion  Generate the autocompletion script for the specified shell
  create      Create a backup artifact
  help        Help about any command
  list        List backup artifacts at a destination prefix
  restore     Restore a backup artifact
  verify      Verify the integrity of a backup artifact

Flags:
  -h, --help                   help for kscore-backup
      --log-level string       Log level: debug, info, warn, error (default "info")
      --s3-access-key string   S3 access key (default $AWS_ACCESS_KEY_ID)
      --s3-endpoint string     S3 endpoint (default $AWS_ENDPOINT_URL; empty = AWS)
      --s3-region string       S3 region (default $AWS_REGION)
      --s3-secret-key string   S3 secret key (default $AWS_SECRET_ACCESS_KEY)
      --s3-ssl                 Use HTTPS for the S3 endpoint (default true)
  -v, --version                version for kscore-backup

Use "kscore-backup [command] --help" for more information about a command.

Keystone Core blueprint authoring + apply CLI

Usage:
  kscore-blueprint [command]

Available Commands:
  applied     List recorded blueprint applies
  apply       Apply a blueprint
  bundle      Package a validated blueprint into a .tar.gz
  completion  Generate the autocompletion script for the specified shell
  help        Help about any command
  info        Print a summary of a blueprint manifest
  init        Scaffold a new blueprint
  install     install a blueprint into the local library
  lint        Validate the manifest and that every entrypoint file is present
  remove      Remove a blueprint from the local library
  rollback    Roll back a recorded blueprint apply
  update      update a blueprint into the local library
  validate    Load and structurally validate a blueprint manifest

Flags:
  -h, --help      help for kscore-blueprint
  -v, --version   version for kscore-blueprint

Use "kscore-blueprint [command] --help" for more information about a command.

kscore-bootstrap reads a SeedConfig YAML and drives the
selfmgmt.BootstrapManager state machine through the six
phases (detect, configure, validate, install, blueprints,
verify). v1.0 ships only the FSM wiring with a logging
NoOp PhaseHandler; real install / configure / verify work
lands per the gate-v1.0 ROADMAP entry.

Usage:
  kscore-bootstrap [flags]

Flags:
  -h, --help               help for kscore-bootstrap
      --log-level string   Log level: debug, info, warn, error (default "info")
      --seed string        Path to the SeedConfig YAML
  -v, --version            version for kscore-bootstrap

Operator surface for the Keystone Core clustering control plane.

Talks to the ClusterService gRPC on a running kscore-server (default localhost:5397). `add` is a contract passthrough — members self-register on start, so the server returns Unimplemented.

Usage:
  kscore-cluster [command]

Available Commands:
  add             Add a member (passthrough — members self-register; server returns Unimplemented)
  backup          Create a cluster snapshot (leader-initiated)
  completion      Generate the autocompletion script for the specified shell
  help            Help about any command
  leader          Show the current cluster leader
  members         List cluster members, or show one by ID
  rebalance       Trigger a shard rebalance
  remove          Remove (evict) a member by ID
  restore         Restore a cluster snapshot from a file
  status          Show cluster status: members, leader, health, quorum
  transfer-leader Transfer leadership (optionally to a target member)

Flags:
      --api-key string   API key for authentication (or set KSCORE_API_KEY)
  -h, --help             help for kscore-cluster
  -o, --output string    output format: table | json (default "table")
      --server string    cluster-service gRPC address (host:port) (default "localhost:5397")
  -v, --version          version for kscore-cluster

Use "kscore-cluster [command] --help" for more information about a command.

Disaster-recovery tool for cluster snapshots.

backup / restore talk to the ClusterService gRPC on a running kscore-server. list / verify inspect snapshot files locally — no server required. schedule is deferred to a future release.

Usage:
  kscore-cluster-backup [command]

Available Commands:
  backup      Create a cluster snapshot (leader-initiated)
  completion  Generate the autocompletion script for the specified shell
  help        Help about any command
  list        List snapshot files in a directory (local; default: .)
  restore     Restore a cluster snapshot from a file
  verify      Validate a snapshot file (local; non-zero exit if invalid)

Flags:
      --api-key string   API key for authentication (or set KSCORE_API_KEY)
  -h, --help             help for kscore-cluster-backup
  -o, --output string    output format: table | json (default "table")
      --server string    cluster-service gRPC address (host:port) (default "localhost:5397")
  -v, --version          version for kscore-cluster-backup

Use "kscore-cluster-backup [command] --help" for more information about a command.

Operator surface for the Keystone Core event bus — list / get / emit events; subscribe / watch / replay event streams; inspect the taxonomy + storage stats.

All commands talk to the EventService gRPC on the running kscore-server (default localhost:5397).

Usage:
  kscore-events [command]

Available Commands:
  completion  Generate the autocompletion script for the specified shell
  emit        Publish an event (sync; waits for NATS ack)
  get         Fetch one event by ID
  help        Help about any command
  list        Paginated event list (structural filters)
  replay      Historical-only playback (no live tail)
  stats       Aggregate counts by event type + severity
  subscribe   Stream events from the bus (live; optional historical replay)
  types       List the 22 canonical v1.0 event types
  watch       Tail the event stream live (compact one-line-per-event)

Flags:
      --api-key string   API key for authentication (or set KSCORE_API_KEY)
  -h, --help             help for kscore-events
  -o, --output string    output format for non-streaming commands: table | json (default "table")
      --server string    events-service gRPC address (host:port) (default "localhost:5397")
  -v, --version          version for kscore-events

Use "kscore-events [command] --help" for more information about a command.

kscore-files reads and writes files in the kscore
file service over NATS. Remote paths accept both bare paths
(configs/app.yaml) and kv:// URIs (kv://configs/app.yaml).

Connection defaults come from env vars when flags are absent:
KSCORE_NATS_URL, KSCORE_CLUSTER, KSCORE_PRINCIPAL_ID,
KSCORE_PRINCIPAL_ROLE.

Usage:
  kscore-files [command]

Available Commands:
  completion  Generate the autocompletion script for the specified shell
  delete      Remove a file from the kscore file service
  get         Download a file via NATS chunks; verifies SHA-256
  help        Help about any command
  list        List files at a prefix (empty = list all)
  put         Upload a local file via NATS chunks
  stat        Print metadata for a remote file

Flags:
      --cluster string          Cluster name for subject scoping (default $KSCORE_CLUSTER, else default)
  -h, --help                    help for kscore-files
      --log-level string        Log level: debug, info, warn, error (default "info")
      --nats-url string         NATS server URL (default $KSCORE_NATS_URL, else nats://localhost:4222)
      --principal-id string     Caller identity emitted in NATS headers (default $KSCORE_PRINCIPAL_ID)
      --principal-role string   Caller role: admin|operator|readonly (default $KSCORE_PRINCIPAL_ROLE)
      --timeout duration        Per-request response timeout (default 1m0s)
  -v, --version                 version for kscore-files

Use "kscore-files [command] --help" for more information about a command.

GitOps verification + rollback CLI

Usage:
  kscore-gitops [command]

Available Commands:
  completion  Generate the autocompletion script for the specified shell
  help        Help about any command
  rollback    Trigger a GitOps rollback
  verify      Run a GitOps verification workflow

Flags:
  -h, --help      help for kscore-gitops
  -v, --version   version for kscore-gitops

Use "kscore-gitops [command] --help" for more information about a command.

Operator surface for the Keystone Core identity provider — mint join tokens, inspect + rotate the CA, query provider health.

All commands talk to the IdentityService gRPC on the running kscore-server (default localhost:5397).

Usage:
  kscore-identity [command]

Available Commands:
  ca          Inspect and manage the embedded CA (info / rotate-signing / export / encrypt)
  completion  Generate the autocompletion script for the specified shell
  help        Help about any command
  status      Show provider health + token + CA expiry snapshot
  token       Manage join tokens (create / list / revoke / cleanup)

Flags:
      --api-key string   API key for authentication (or set KSCORE_API_KEY)
  -h, --help             help for kscore-identity
  -o, --output string    output format: table | json (default "table")
      --server string    identity-service gRPC address (host:port) (default "localhost:5397")
  -v, --version          version for kscore-identity

Use "kscore-identity [command] --help" for more information about a command.

Migrate Keystone Core state from SQLite to PostgreSQL

Usage:
  kscore-migrate [command]

Available Commands:
  completion  Generate the autocompletion script for the specified shell
  help        Help about any command
  run         Copy rows from SQLite source to PostgreSQL target
  validate    Compare row counts between SQLite source and PostgreSQL target
  version     Print version metadata

Flags:
  -h, --help      help for kscore-migrate
  -v, --version   version for kscore-migrate

Use "kscore-migrate [command] --help" for more information about a command.

Keystone Core module author + distribution CLI

Usage:
  kscore-module [command]

Available Commands:
  build       Package a module directory as a ZIP
  clean       Clear the local module cache
  completion  Generate the autocompletion script for the specified shell
  help        Help about any command
  init        Scaffold a new Starlark module
  install     Resolve, download, verify, and lock a module + its deps
  publish     Upload a built (and optionally signed) module to a registry
  resolve     Resolve a module's dependency graph
  run         Load, verify, and execute a module
  sign        Produce a detached Cosign-compatible signature
  test        Run a module's Starlark unit tests
  tree        Print the resolved dependency tree
  update      Re-resolve from scratch and rewrite module.lock
  validate    Validate a module manifest
  verify      Verify a module ZIP against a trusted public key

Flags:
  -h, --help      help for kscore-module
  -v, --version   version for kscore-module

Use "kscore-module [command] --help" for more information about a command.

Operator + authoring surface for the Keystone Core policy engine.

list / show / compliance / violations talk to the PolicyService gRPC on a running kscore-server (default localhost:5397). eval / validate run the evaluator in-process against a policy source file — no server required.

v1.0 is audit-mode: policies evaluate + record but never block.

Usage:
  kscore-policy [command]

Available Commands:
  completion  Generate the autocompletion script for the specified shell
  compliance  Compliance report over an audit window
  eval        Evaluate a policy source file locally (no server)
  help        Help about any command
  list        List registered policies (or policy sets with --policy-sets)
  show        Show a policy (or a policy set with --policy-set) by ID
  validate    Compile-check a policy source file locally (no server)
  violations  List denied audit entries (policy violations)

Flags:
      --api-key string   API key for authentication (or set KSCORE_API_KEY)
  -h, --help             help for kscore-policy
  -o, --output string    output format: table | json (default "table")
      --server string    policy-service gRPC address (host:port) — used by remote subcommands (default "localhost:5397")
  -v, --version          version for kscore-policy

Use "kscore-policy [command] --help" for more information about a command.

Keystone Core module registry server

Usage:
  kscore-registry [command]

Available Commands:
  completion  Generate the autocompletion script for the specified shell
  help        Help about any command
  serve       Run the registry HTTP server
  version     Print version metadata

Flags:
  -h, --help      help for kscore-registry
  -v, --version   version for kscore-registry

Use "kscore-registry [command] --help" for more information about a command.

Keystone Core runbook CLI

Usage:
  kscore-runbook [command]

Available Commands:
  audit           Print a runbook execution's audit trail
  completion      Generate the autocompletion script for the specified shell
  execute         Execute a runbook
  help            Help about any command
  list            List runbooks (*.yaml) in a directory
  list-executions List recorded runbook executions
  status          Show a runbook execution's status
  test            Statically validate a runbook (load + validate + DAG cycle check)

Flags:
  -h, --help      help for kscore-runbook
  -v, --version   version for kscore-runbook

Use "kscore-runbook [command] --help" for more information about a command.

Operator surface for the Keystone Core secrets domain — read / write KV secrets, manage leases for dynamic credentials, and run transit encrypt/decrypt/sign/verify operations.

All commands talk to the SecretsService gRPC on the running kscore-server (default localhost:5397).

Usage:
  kscore-secrets [command]

Available Commands:
  completion  Generate the autocompletion script for the specified shell
  delete      Delete a secret
  get         Read a secret
  help        Help about any command
  leases      List + manage dynamic-secret leases
  list        List secrets under a prefix (metadata only)
  put         Write a secret
  transit     Encryption-as-a-service (Vault transit engine)

Flags:
      --api-key string   API key for authentication (or set KSCORE_API_KEY)
  -h, --help             help for kscore-secrets
  -o, --output string    output format: table | json (default "table")
      --server string    secrets-service gRPC address (host:port) (default "localhost:5397")
  -v, --version          version for kscore-secrets

Use "kscore-secrets [command] --help" for more information about a command.

Keystone Core control-plane server

Usage:
  kscore-server [flags]

Flags:
      --config string   path to YAML config file (KSCORE_-prefixed env vars overlay)
  -h, --help            help for kscore-server
  -v, --version         version for kscore-server

Keystone Core webhook subscriptions CLI

Usage:
  kscore-webhook [command]

Available Commands:
  completion  Generate the autocompletion script for the specified shell
  help        Help about any command
  outbound    Manage outbound webhook subscriptions

Flags:
  -h, --help      help for kscore-webhook
  -v, --version   version for kscore-webhook

Use "kscore-webhook [command] --help" for more information about a command.

Keystone Core operator CLI

Usage:
  kscorectl [flags]
  kscorectl [command]

Available Commands:
  agent       Inspect registered agents
  completion  Generate the autocompletion script for the specified shell
  exec        Execute commands across agents
  help        Help about any command
  state       Declarative state management (apply / check / drift / compile)

Flags:
      --config string   path to YAML config file (KSCORE_-prefixed env vars overlay)
  -h, --help            help for kscorectl
  -v, --version         version for kscorectl

Use "kscorectl [command] --help" for more information about a command.