Chio/Docs
LOGIN · JOIN

ReferenceSpec

CLI Reference

Every chio command, its arguments, and the flags it adds, generated from the help output of the chio binary.

346 chio commands under 31 top-level commands: api (1), arena (3), attest (10), bind (0), cert (3), certify (14), check (0), commerce (1), conformance (2), did (1), doctor (0), evidence (5), federation (9), finding (17), guard (17), init (0), lineage (3), mcp (4), passport (33), pheromone (51), policy (1), proof (10), receipt (11), replay (1), reputation (2), run (0), runtime (27), settle (1), start (0), trust (87), workflow (1)chio api: 1 commands beneath itapi1chio arena: 3 commands beneath itarena3chio attest: 10 commands beneath itattest10chio bind: a single commandbindleafchio cert: 3 commands beneath itcert3chio certify: 14 commands beneath itcertify14chio check: a single commandcheckleafchio commerce: 1 commands beneath itcommerce1chio conformance: 2 commands beneath itconformance2chio did: 1 commands beneath itdid1chio doctor: a single commanddoctorleafchio evidence: 5 commands beneath itevidence5chio federation: 9 commands beneath itfederation9chio finding: 17 commands beneath itfinding17chio guard: 17 commands beneath itguard17chio init: a single commandinitleafchio lineage: 3 commands beneath itlineage3chio mcp: 4 commands beneath itmcp4chio passport: 33 commands beneath itpassport33chio pheromone: 51 commands beneath itpheromone51chio policy: 1 commands beneath itpolicy1chio proof: 10 commands beneath itproof10chio receipt: 11 commands beneath itreceipt11chio replay: 1 commands beneath itreplay1chio reputation: 2 commands beneath itreputation2chio run: a single commandrunleafchio runtime: 27 commands beneath itruntime27chio settle: 1 commands beneath itsettle1chio start: a single commandstartleafchio trust: 87 commands beneath ittrust87chio workflow: 1 commands beneath itworkflow1

Source

This page is the help output of the chio binary, rendered. The binary is built from the chio repository with cargo build --release -p chio-cli and reports chio-cli 0.1.0.

The generator walks chio --help from the root command through every subcommand and writes one entry per command path: the description the command carries, its usage line, its positional arguments, and the options it adds to the 7 flags every command accepts. It reads 346 command paths and 1256 command-specific options.

Regenerate with bun run docs:cli and commit the diff. Edits written into the page by hand are replaced on the next run.

Synopsis

bash
chio [OPTIONS] <COMMAND>

An entry names one command path. The block under it is the usage line the binary prints: everything outside brackets is required, [OPTIONS] stands for the flags listed beneath it plus the 7 global flags, and a value in angle brackets is the placeholder the binary uses for that argument. Every command answers --help with the text this page is generated from.

Global flags

These flags are declared on the root command. The second column says how far each one reaches: 7 of them are accepted by all 346 command paths, before or after the subcommand name. A command that gives one of them a different meaning lists it in its own entry instead.

FlagAccepted byWhat it does
--json333 commandsShort alias for --format json.
--format <FORMAT>chio onlyOutput format for command results and terminal error reporting. Default human. Values human, json.
--receipt-db <RECEIPT_DB>344 commandsOptional SQLite database path for durable receipt persistence.
--revocation-db <REVOCATION_DB>every commandOptional SQLite database path for durable capability revocation persistence.
--authority-seed-file <AUTHORITY_SEED_FILE>every commandOptional file path for a persistent capability-authority seed.
--authority-db <AUTHORITY_DB>every commandOptional SQLite database path for shared capability-authority state.
--budget-db <BUDGET_DB>every commandOptional SQLite database path for durable shared capability budget state.
--session-db <SESSION_DB>every commandOptional SQLite database path for durable admission, trust authority, and remote MCP session state.
--control-url <CONTROL_URL>every commandOptional shared trust-control service base URL.
--control-token <CONTROL_TOKEN>every commandBearer token used to authenticate to the shared trust-control service. Prefer CHIO_CONTROL_TOKEN env over the argv form so the bearer does not leak via ps / /proc/<pid>/cmdline. Reads CHIO_CONTROL_TOKEN.

Commands

31 top-level commands, and 315 subcommands under them. Each entry below carries the command that owns it in its heading, so the heading is the invocation.

CommandSubcommandsWhat it does
chio run0Spawn an agent subprocess and enforce policy via the kernel.
chio check0Evaluate a single tool call against a policy (no subprocess).
chio init0Scaffold a runnable Chio example project with a governed demo flow.
chio policy1Analyze HushSpec policy rules and admission refinement.
chio api1Protect an HTTP API with Chio using an OpenAPI spec-backed sidecar.
chio mcp4Serve an MCP-compatible edge backed by the Chio kernel.
chio trust87Manage local trust-plane state such as persisted revocations.
chio receipt11Query and list receipts from the receipt store.
chio evidence5Export an offline evidence package from the local receipt database.
chio certify14Evaluate a conformance corpus and emit a signed certification artifact.
chio did1Resolve self-certifying did:chio identifiers into DID Documents.
chio passport33Create, verify, and present Agent Passport bundles.
chio proof10Verify proof bundles and Transaction Passport artifacts.
chio commerce1Verify commerce proof bundles and payment evidence.
chio workflow1Validate read-only workflow planning evidence before dispatch.
chio reputation2Inspect local reputation scorecards from persisted receipts and lineage state.
chio cert3Generate, verify, and inspect ACP session compliance certificates.
chio guard17Guard development lifecycle: scaffold, build, and inspect WASM guards.
chio conformance2Run the cross-language conformance harness against a peer adapter.
chio federation9Produce and verify cross-kernel federation artifacts.
chio attest10Verify offline attestation evidence and buyer proof packages.
chio runtime27Evaluate local live-runtime admission artifacts.
chio pheromone51Receive, query, and relay pheromone artifacts.
chio finding17Publish, discover, verify, and purchase cognition-market findings.
chio replay1Re-evaluate a captured receipt log against the current build.
chio settle1Inspect local settlement lifecycle records.
chio lineage3Query, diff, or list anchored roots in the lineage DAG.
chio doctor0Diagnose toolchain, registry, OTEL, and chio.yaml health.
chio arena3chio-arena coliseum: run scenarios, replay bundles, evolve adversaries.
chio bind0Bind a provider under a signed model card.
chio start0Start the Chio sidecar with sensible zero-config defaults.

chio run

Spawn an agent subprocess and enforce policy via the kernel.

bash
chio run [OPTIONS] --policy <POLICY> <COMMAND>...
  • <COMMAND>... The agent command and its arguments. Required.
  • --policy <POLICY> Path to the policy YAML file. Required.

chio check

Evaluate a single tool call against a policy (no subprocess).

bash
chio check [OPTIONS] --policy <POLICY> --tool <TOOL>
  • --policy <POLICY> Path to the policy YAML file. Required.
  • --mode <MODE> Evaluation mode. Preflight checks only policies that do not need tool output. Default preflight. Values preflight, full.
  • --tool <TOOL> Tool name to evaluate. Required.
  • --params <PARAMS> Tool parameters as a JSON string. Default {}.
  • --server <SERVER> Server ID to use for the evaluation. Default *.
  • --output-fixture <JSON> JSON value returned by the fixture-backed tool server in full mode.

chio init

Scaffold a runnable Chio example project with a governed demo flow.

bash
chio init [OPTIONS] <PATH>
  • <PATH> Directory to create for the scaffolded project. Required.

chio policy

Analyze HushSpec policy rules and admission refinement.

bash
chio policy [OPTIONS] <COMMAND>

chio policy analyze

Analyze policy rules and compare admission refinement.

bash
chio policy analyze [OPTIONS] <POLICY>
  • <POLICY> Effective policy to analyze. Required.
  • --against <AGAINST> Older policy that the analyzed policy must narrow.
  • --fail-on <FAIL_ON> Lowest finding severity that produces exit code 1. Default warning. Values notice, warning, error.
  • --format <FORMAT> Analysis report output format. Values human, json.
  • --max-atoms <MAX_ATOMS> Maximum authored atoms accepted before analysis fails closed. Default 10000.

chio api

Protect an HTTP API with Chio using an OpenAPI spec-backed sidecar.

bash
chio api [OPTIONS] <COMMAND>

chio api protect

Start the Chio HTTP sidecar/reverse proxy.

bash
chio api protect [OPTIONS] --upstream <UPSTREAM>
  • --upstream <UPSTREAM> Upstream base URL to proxy to. Required.
  • --spec <SPEC> Optional local OpenAPI spec path. Auto-discovered when omitted.
  • --listen <LISTEN> Address to listen on. Default 127.0.0.1:9090.
  • --receipt-store <RECEIPT_STORE> Optional SQLite receipt store path.
  • --allow-ephemeral-receipts Permit in-memory receipts, whose audit evidence is lost on every restart. Required to boot without --receipt-store. For local development only.
  • --upstream-timeout-secs <UPSTREAM_TIMEOUT_SECS> Wall-clock ceiling in seconds on a single upstream hop, including reading the full response. Raise it for upstreams with legitimately slow calls or large bounded responses. Defaults to 20 seconds.

chio mcp

Serve an MCP-compatible edge backed by the Chio kernel.

bash
chio mcp [OPTIONS] <COMMAND>
  • chio mcp wrap Wrap a stdio MCP server with verdict gating and emit IDE configs.
  • chio mcp governed-sim Run a single governed MustPrepay call through an ephemeral kernel.
  • chio mcp serve Wrap an MCP server subprocess and expose a secured MCP edge over stdio.
  • chio mcp serve-http Wrap an MCP server subprocess and expose a secured MCP edge over Streamable HTTP.

chio mcp wrap

Wrap a stdio MCP server with verdict gating and emit IDE configs.

Spawns the wrapped server, gates each tools/call through the manifest scaffold, and (when --emit-config is set) prints a paste-ready blob for Cursor / Claude Desktop / Continue / Zed.

bash
chio mcp wrap [OPTIONS] [COMMAND]...
  • [COMMAND]... The wrapped MCP server command and its arguments. Required unless --tools-fixture is supplied (the test-only path).
  • --server-id <SERVER_ID> Server ID to assign to the wrapped MCP server inside the inferred manifest scaffold. Default mcp.
  • --manifest <MANIFEST> Optional path to the user’s manifest scaffold. When absent the command renders the inferred scaffold to stdout instead of running the wrap loop.
  • --print-scopes Print the inferred capability-scope manifest scaffold and exit.
  • --emit-config <EMIT_CONFIG> IDE target for --emit-config. When set, the command prints the paste-ready config for the requested IDE and exits without spawning the wrapped child. Values cursor, claude-desktop, continue, zed.
  • --display-name <DISPLAY_NAME> Display name surfaced inside emitted IDE config blobs.
  • --tools-fixture <TOOLS_FIXTURE> Render the manifest scaffold from a JSON tools/list fixture file instead of spawning the wrapped child. Used by the scope inference and emit-config tests so they stay hermetic on shared CI runners.
  • --e2e-fixture <E2E_FIXTURE> Drive the wrap loop against an in-process JSON-RPC fixture (a JSON object with tools and responses arrays). Reads JSON-RPC frames from stdin and emits framed responses on stdout, gated by the manifest scaffold. Used by the e2e test so the stdio-orchestration round-trip can run without a real wrapped child.
  • --self-test-attestation <SELF_TEST_ATTESTATION> Self-test mode for the attestation header. Prints the "Chio-verified" attestation block for the given tool name as JSON and exits.
  • --strict-execution-nonce Execute allowed tool calls through a kernel path that mints and presents strict execution nonces before invoking the wrapped server.

chio mcp governed-sim

Run a single governed MustPrepay call through an ephemeral kernel.

Builds a local kernel, wires the selected payment adapter (sim or none), executes one governed MustPrepay tool call, and writes the signed receipt bundle to --out. Exits nonzero on denial. Used by the no-key CI lane.

bash
chio mcp governed-sim [OPTIONS] --out <OUT>
  • --payment-adapter <PAYMENT_ADAPTER> Payment adapter: sim (deterministic no-broadcast) or none (absent, deny path). Default sim.
  • --governed-mustprepay Run a governed MustPrepay tool call through the kernel.
  • --out <OUT> Path to write the receipt bundle JSON. Required.

chio mcp serve

Wrap an MCP server subprocess and expose a secured MCP edge over stdio.

bash
chio mcp serve [OPTIONS] <COMMAND>...
  • <COMMAND>... The wrapped MCP server command and its arguments. Required.
  • --policy <POLICY> Path to the policy YAML file. Mutually exclusive with --preset.
  • --preset <PRESET> Bundled policy preset to use instead of --policy. Available presets: * code-agent -- zero-config policy for coding agents (Claude Code, Cursor, MCP filesystem/git/shell servers). Allows safe file reads, denies .env / .git/** / .ssh/** writes, denies git push --force.
  • --server-id <SERVER_ID> Server ID to assign to the wrapped MCP server inside Chio. Default mcp.
  • --server-name <SERVER_NAME> Human-readable name for the wrapped MCP server.
  • --server-version <SERVER_VERSION> Version string for the wrapped MCP server.
  • --manifest-public-key <MANIFEST_PUBLIC_KEY> Override the public key embedded in the synthetic manifest.
  • --page-size <PAGE_SIZE> Page size for paginated tools/list responses. Default 50.
  • --tools-list-changed Whether the edge should advertise notifications/tools/list_changed.

chio mcp serve-http

Wrap an MCP server subprocess and expose a secured MCP edge over Streamable HTTP.

bash
chio mcp serve-http [OPTIONS] --policy <POLICY> --server-id <SERVER_ID> <COMMAND>...
  • <COMMAND>... The wrapped MCP server command and its arguments. Required.
  • --policy <POLICY> Path to the policy YAML file. Required.
  • --server-id <SERVER_ID> Server ID to assign to the wrapped MCP server inside Chio. Required.
  • --server-name <SERVER_NAME> Human-readable name for the wrapped MCP server.
  • --server-version <SERVER_VERSION> Version string for the wrapped MCP server.
  • --manifest-public-key <MANIFEST_PUBLIC_KEY> Override the public key embedded in the synthetic manifest.
  • --page-size <PAGE_SIZE> Page size for paginated tools/list responses. Default 50.
  • --tools-list-changed Whether the edge should advertise notifications/tools/list_changed.
  • --shared-hosted-owner Use one shared wrapped MCP subprocess for all remote sessions.
  • --listen <LISTEN> Socket address to bind the remote MCP edge to. Default 127.0.0.1:8931.
  • --auth-token <AUTH_TOKEN> Static bearer token required for remote MCP session admission. Prefer CHIO_AUTH_TOKEN env over the argv form so the bearer does not leak via ps / /proc/<pid>/cmdline. Reads CHIO_AUTH_TOKEN.
  • --auth-jwt-public-key <AUTH_JWT_PUBLIC_KEY> Public key used to verify externally issued JWT bearer tokens.
  • --auth-jwt-discovery-url <AUTH_JWT_DISCOVERY_URL> OIDC discovery URL used to resolve issuer metadata and JWT JWKS keys.
  • --auth-introspection-url <AUTH_INTROSPECTION_URL> OAuth2 token introspection endpoint used to validate opaque bearer tokens.
  • --auth-introspection-client-id <AUTH_INTROSPECTION_CLIENT_ID> Client ID used when calling the token introspection endpoint.
  • --auth-introspection-client-secret <AUTH_INTROSPECTION_CLIENT_SECRET> Client secret used when calling the token introspection endpoint. Prefer CHIO_MCP_AUTH_INTROSPECTION_CLIENT_SECRET env over the argv form so the secret does not leak via ps / /proc/<pid>/cmdline. Reads CHIO_MCP_AUTH_INTROSPECTION_CLIENT_SECRET.
  • --auth-jwt-provider-profile <AUTH_JWT_PROVIDER_PROFILE> Optional provider profile used for principal mapping and default OIDC discovery behavior. Values generic, auth0, okta, azure-ad.
  • --auth-server-seed-file <AUTH_SERVER_SEED_FILE> Local auth-server signing seed file. When set, serve-http can issue JWTs itself.
  • --identity-federation-seed-file <IDENTITY_FEDERATION_SEED_FILE> Persistent seed file used to derive stable Chio subjects from authenticated OAuth bearer principals.
  • --enterprise-providers-file <ENTERPRISE_PROVIDERS_FILE> Optional file-backed enterprise provider registry shared with trust-control.
  • --auth-jwt-issuer <AUTH_JWT_ISSUER> Expected bearer-token issuer for remote MCP session admission.
  • --auth-jwt-audience <AUTH_JWT_AUDIENCE> Expected bearer-token audience for remote MCP session admission.
  • --admin-token <ADMIN_TOKEN> Optional static bearer token for remote admin APIs. Prefer CHIO_ADMIN_TOKEN env over the argv form so the bearer does not leak via ps / /proc/<pid>/cmdline. Reads CHIO_ADMIN_TOKEN.
  • --public-base-url <PUBLIC_BASE_URL> Public base URL used when constructing protected-resource metadata URLs.
  • --auth-server <AUTH_SERVERS> Authorization server URL advertised via protected-resource metadata.
  • --auth-authorization-endpoint <AUTH_AUTHORIZATION_ENDPOINT> OAuth authorization endpoint advertised in colocated auth-server metadata.
  • --auth-token-endpoint <AUTH_TOKEN_ENDPOINT> OAuth token endpoint advertised in colocated auth-server metadata.
  • --auth-registration-endpoint <AUTH_REGISTRATION_ENDPOINT> Optional dynamic client registration endpoint advertised in auth-server metadata.
  • --auth-jwks-uri <AUTH_JWKS_URI> Optional JWKS URI advertised in auth-server metadata.
  • --auth-scope <AUTH_SCOPES> Scope hint advertised in protected-resource challenges and metadata.
  • --auth-subject <AUTH_SUBJECT> Subject to embed in locally issued auth-server access tokens. Default operator.
  • --auth-code-ttl-secs <AUTH_CODE_TTL_SECS> Authorization-code lifetime for the hosted auth server. Default 300.
  • --auth-access-token-ttl-secs <AUTH_ACCESS_TOKEN_TTL_SECS> Access-token lifetime for the hosted auth server. Default 600.

chio trust

Manage local trust-plane state such as persisted revocations.

bash
chio trust [OPTIONS] <COMMAND>

chio trust serve

Serve the shared trust-control plane over HTTP.

bash
chio trust serve [OPTIONS] --service-token <SERVICE_TOKEN>
  • --listen <LISTEN> Socket address to bind the trust-control service to. Default 127.0.0.1:8940.
  • --service-token <SERVICE_TOKEN> Bearer token required for trust-control service requests. Prefer CHIO_TRUST_SERVICE_TOKEN over --service-token so the secret is not visible to other users via ps//proc. Required. Reads CHIO_TRUST_SERVICE_TOKEN.
  • --tenant-read-token <TENANT=TOKEN> Tenant-scoped read token mapping in tenant_id=token form. Repeat for multiple tenants. Requests presenting one of these tokens are confined to reading the matching tenant’s receipts; the --service-token retains administrative cross-tenant access.
  • --advertise-url <ADVERTISE_URL> Public base URL this trust-control node advertises to peers and clients.
  • --peer-url <PEER_URLS> Peer trust-control base URL. Repeat for multiple peers.
  • --allow-local-peer-urls Allow loopback/private cluster peer URLs for local development only.
  • --cluster-sync-interval-ms <CLUSTER_SYNC_INTERVAL_MS> Background cluster sync interval in milliseconds. Default 500.
  • --policy <POLICY> Optional policy file whose reputation issuance extension is enforced by the service.
  • --enterprise-providers-file <ENTERPRISE_PROVIDERS_FILE> Optional file-backed enterprise provider registry shared with remote MCP edges.
  • --federation-policies-file <FEDERATION_POLICIES_FILE> Optional file-backed permissionless federation policy registry.
  • --scim-lifecycle-file <SCIM_LIFECYCLE_FILE> Optional file-backed SCIM lifecycle registry for external IdP provisioning and deprovisioning.
  • --verifier-policies-file <VERIFIER_POLICIES_FILE> Optional file-backed signed verifier policy registry for remote verifier flows.
  • --verifier-challenge-db <VERIFIER_CHALLENGE_DB> Optional SQLite verifier challenge-state database for replay-safe remote verifier flows.
  • --passport-statuses-file <PASSPORT_STATUSES_FILE> Optional file-backed passport lifecycle registry for publish/resolve/revoke flows.
  • --passport-issuance-offers-file <PASSPORT_ISSUANCE_OFFERS_FILE> Optional file-backed passport issuance registry for OID4VCI-style pre-authorized offers.
  • --certification-registry-file <CERTIFICATION_REGISTRY_FILE> Optional file-backed certification registry for publish/resolve/revoke flows.
  • --certification-discovery-file <CERTIFICATION_DISCOVERY_FILE> Optional multi-operator certification discovery network file.
  • --fiscal-genesis-policy <FISCAL_GENESIS_POLICY> Pinned fiscal genesis policy JSON loaded before the service binds.
  • --fiscal-anchor-url <FISCAL_ANCHOR_URL> Independent HTTPS fiscal continuity anchor base URL.
  • --fiscal-anchor-token <FISCAL_ANCHOR_TOKEN> Bearer token for the independent fiscal continuity anchor. Reads CHIO_FISCAL_ANCHOR_TOKEN.
  • --fiscal-admission-authority-id <FISCAL_ADMISSION_AUTHORITY_ID> Stable identifier for the local durable fiscal admission authority. Default fiscal-admission.
  • --fiscal-admission-signer-key-epoch <FISCAL_ADMISSION_SIGNER_KEY_EPOCH> Monotonic key epoch for the fiscal admission signing key. Default 1.
  • --fiscal-admission-signing-seed <FISCAL_ADMISSION_SIGNING_SEED> Existing private seed file used to sign durable fiscal admissions.
  • --fiscal-anchor-timeout-seconds <FISCAL_ANCHOR_TIMEOUT_SECONDS> Fiscal continuity anchor request timeout in seconds. Default 5.
  • --certification-public-metadata-ttl-seconds <CERTIFICATION_PUBLIC_METADATA_TTL_SECONDS> Public certification metadata TTL in seconds. Default 3600.
  • --roster-policy-file <ROSTER_POLICY_FILE> JSON file containing the operator roster policy (roster, allowed decision rules, roster anchor) for liability adjudication enforcement.

chio trust provider

Manage enterprise federation provider-admin records.

bash
chio trust provider [OPTIONS] <COMMAND>

chio trust provider list

List enterprise provider records from the shared registry.

bash
chio trust provider list [OPTIONS]
  • --enterprise-providers-file <ENTERPRISE_PROVIDERS_FILE> Local registry file to inspect when not using --control-url.

chio trust provider get

Read one enterprise provider record.

bash
chio trust provider get [OPTIONS] --provider-id <PROVIDER_ID>
  • --provider-id <PROVIDER_ID> Provider ID to fetch. Required.
  • --enterprise-providers-file <ENTERPRISE_PROVIDERS_FILE> Local registry file to inspect when not using --control-url.

chio trust provider upsert

Create or update one enterprise provider record from JSON.

bash
chio trust provider upsert [OPTIONS] --input <INPUT>
  • --input <INPUT> Input JSON file containing an EnterpriseProviderRecord. Required.
  • --enterprise-providers-file <ENTERPRISE_PROVIDERS_FILE> Local registry file to update when not using --control-url.

chio trust provider delete

Delete one enterprise provider record.

bash
chio trust provider delete [OPTIONS] --provider-id <PROVIDER_ID>
  • --provider-id <PROVIDER_ID> Provider ID to delete. Required.
  • --enterprise-providers-file <ENTERPRISE_PROVIDERS_FILE> Local registry file to update when not using --control-url.

chio trust federation-policy

Manage permissionless federation admission policies.

bash
chio trust federation-policy [OPTIONS] <COMMAND>

chio trust federation-policy list

List published permissionless federation policies.

bash
chio trust federation-policy list [OPTIONS]
  • --federation-policies-file <FEDERATION_POLICIES_FILE> Local registry file to inspect when not using --control-url.

chio trust federation-policy get

Read one published permissionless federation policy.

bash
chio trust federation-policy get [OPTIONS] --policy-id <POLICY_ID>
  • --policy-id <POLICY_ID> Policy ID to fetch. Required.
  • --federation-policies-file <FEDERATION_POLICIES_FILE> Local registry file to inspect when not using --control-url.

chio trust federation-policy upsert

Create or update one permissionless federation policy record from JSON.

bash
chio trust federation-policy upsert [OPTIONS] --input <INPUT>
  • --input <INPUT> Input JSON file containing a FederationAdmissionPolicyRecord. Required.
  • --federation-policies-file <FEDERATION_POLICIES_FILE> Local registry file to update when not using --control-url.

chio trust federation-policy delete

Delete one permissionless federation policy record.

bash
chio trust federation-policy delete [OPTIONS] --policy-id <POLICY_ID>
  • --policy-id <POLICY_ID> Policy ID to delete. Required.
  • --federation-policies-file <FEDERATION_POLICIES_FILE> Local registry file to update when not using --control-url.

chio trust federation-policy evaluate

Evaluate admission for one peer under a published federation policy.

bash
chio trust federation-policy evaluate [OPTIONS] --input <INPUT>
  • --input <INPUT> Input JSON file containing a FederationAdmissionEvaluationRequest. Required.

chio trust evidence-share

Inspect shared remote evidence references used by local delegated activity.

bash
chio trust evidence-share [OPTIONS] <COMMAND>

chio trust evidence-share list

List shared-evidence references visible from local activity or the remote trust service.

bash
chio trust evidence-share list [OPTIONS]
  • --capability <CAPABILITY> Filter by local capability ID.
  • --agent-subject <AGENT_SUBJECT> Filter by local agent subject public key.
  • --tool-server <TOOL_SERVER> Filter by local tool server.
  • --tool-name <TOOL_NAME> Filter by local tool name.
  • --since <SINCE> Filter: receipts with timestamp >= this Unix seconds value.
  • --until <UNTIL> Filter: receipts with timestamp <= this Unix seconds value.
  • --issuer <ISSUER> Filter by remote share issuer.
  • --partner <PARTNER> Filter by remote share partner.
  • --limit <LIMIT> Maximum number of shared-evidence references to return. Default 50.

chio trust authorization-context

Render derived external authorization context from governed receipts.

bash
chio trust authorization-context [OPTIONS] <COMMAND>

chio trust authorization-context metadata

Export machine-readable Chio authorization-profile metadata for enterprise IAM review.

bash
chio trust authorization-context metadata [OPTIONS]

chio trust authorization-context list

List derived authorization-context mappings from local state or trust-control.

bash
chio trust authorization-context list [OPTIONS]
  • --capability <CAPABILITY> Filter by capability ID.
  • --agent-subject <AGENT_SUBJECT> Filter by agent subject public key.
  • --tool-server <TOOL_SERVER> Filter by tool server.
  • --tool-name <TOOL_NAME> Filter by tool name.
  • --since <SINCE> Include receipts with timestamp >= this Unix seconds value.
  • --until <UNTIL> Include receipts with timestamp <= this Unix seconds value.
  • --limit <LIMIT> Maximum number of derived authorization-context rows to embed. Default 50.

chio trust authorization-context review-pack

Export an enterprise reviewer pack tying authorization context back to governed receipt truth.

bash
chio trust authorization-context review-pack [OPTIONS]
  • --capability <CAPABILITY> Filter by capability ID.
  • --agent-subject <AGENT_SUBJECT> Filter by agent subject public key.
  • --tool-server <TOOL_SERVER> Filter by tool server.
  • --tool-name <TOOL_NAME> Filter by tool name.
  • --since <SINCE> Include receipts with timestamp >= this Unix seconds value.
  • --until <UNTIL> Include receipts with timestamp <= this Unix seconds value.
  • --limit <LIMIT> Maximum number of derived authorization-context rows to embed. Default 50.

chio trust appraisal

Export a signed runtime-attestation appraisal report.

bash
chio trust appraisal [OPTIONS] <COMMAND>

chio trust appraisal export

Export a signed runtime-attestation appraisal report from local input or trust-control.

bash
chio trust appraisal export [OPTIONS] --input <INPUT>
  • --input <INPUT> Input JSON or YAML file containing a RuntimeAttestationEvidence payload. Required.
  • --policy-file <POLICY_FILE> Optional HushSpec policy used to evaluate policy-visible outcomes locally.

chio trust appraisal export-result

Export a signed portable runtime-attestation appraisal result artifact.

bash
chio trust appraisal export-result [OPTIONS] --issuer <ISSUER> --input <INPUT>
  • --issuer <ISSUER> Issuer identifier recorded in the exported result. Required.
  • --input <INPUT> Input JSON or YAML file containing a RuntimeAttestationEvidence payload. Required.
  • --policy-file <POLICY_FILE> Optional HushSpec policy used to evaluate exporter-visible outcomes locally.

chio trust appraisal import

Evaluate a signed external runtime-attestation appraisal result against local import policy.

bash
chio trust appraisal import [OPTIONS] --input <INPUT> --policy-file <POLICY_FILE>
  • --input <INPUT> Input JSON or YAML file containing a signed appraisal result envelope. Required.
  • --policy-file <POLICY_FILE> JSON or YAML file containing a RuntimeAttestationImportedAppraisalPolicy payload. Required.

chio trust behavioral-feed

Export a signed insurer-facing behavioral feed from canonical trust data.

bash
chio trust behavioral-feed [OPTIONS] <COMMAND>

chio trust behavioral-feed export

Export a signed behavioral feed from local state or trust-control.

bash
chio trust behavioral-feed export [OPTIONS]
  • --capability <CAPABILITY> Filter by capability ID.
  • --agent-subject <AGENT_SUBJECT> Filter by agent subject public key.
  • --tool-server <TOOL_SERVER> Filter by tool server.
  • --tool-name <TOOL_NAME> Filter by tool name.
  • --since <SINCE> Include receipts with timestamp >= this Unix seconds value.
  • --until <UNTIL> Include receipts with timestamp <= this Unix seconds value.
  • --receipt-limit <RECEIPT_LIMIT> Maximum number of receipt detail rows to embed. Default 100.

chio trust exposure-ledger

Export a signed exposure ledger from canonical trust and underwriting data.

bash
chio trust exposure-ledger [OPTIONS] <COMMAND>

chio trust exposure-ledger export

Export a signed exposure ledger from local state or trust-control.

bash
chio trust exposure-ledger export [OPTIONS]
  • --capability <CAPABILITY> Filter by capability ID.
  • --agent-subject <AGENT_SUBJECT> Filter by agent subject public key.
  • --tool-server <TOOL_SERVER> Filter by tool server.
  • --tool-name <TOOL_NAME> Filter by tool name.
  • --since <SINCE> Include receipts with timestamp >= this Unix seconds value.
  • --until <UNTIL> Include receipts with timestamp <= this Unix seconds value.
  • --receipt-limit <RECEIPT_LIMIT> Maximum number of receipt rows to embed. Default 100.
  • --decision-limit <DECISION_LIMIT> Maximum number of underwriting decision rows to embed. Default 50.

chio trust credit-scorecard

Export a signed subject-scoped credit scorecard from exposure and reputation data.

bash
chio trust credit-scorecard [OPTIONS] <COMMAND>

chio trust credit-scorecard export

Export a signed credit scorecard from local state or trust-control.

bash
chio trust credit-scorecard export [OPTIONS] --agent-subject <AGENT_SUBJECT>
  • --agent-subject <AGENT_SUBJECT> Subject public key to score. Required.
  • --capability <CAPABILITY> Optional filter by capability ID.
  • --tool-server <TOOL_SERVER> Optional filter by tool server.
  • --tool-name <TOOL_NAME> Optional filter by tool name.
  • --since <SINCE> Include receipts with timestamp >= this Unix seconds value.
  • --until <UNTIL> Include receipts with timestamp <= this Unix seconds value.
  • --receipt-limit <RECEIPT_LIMIT> Maximum number of receipt rows to evaluate. Default 100.
  • --decision-limit <DECISION_LIMIT> Maximum number of underwriting decision rows to evaluate. Default 50.

chio trust capital-book

Export a signed live capital book with explicit source-of-funds attribution.

bash
chio trust capital-book [OPTIONS] <COMMAND>

chio trust capital-book export

Export a signed live capital book from canonical facility, bond, and loss posture.

bash
chio trust capital-book export [OPTIONS] --agent-subject <AGENT_SUBJECT>
  • --agent-subject <AGENT_SUBJECT> Subject public key to evaluate. Required.
  • --capability <CAPABILITY> Optional filter by capability ID.
  • --tool-server <TOOL_SERVER> Optional filter by tool server.
  • --tool-name <TOOL_NAME> Optional filter by tool name.
  • --since <SINCE> Include receipts with timestamp >= this Unix seconds value.
  • --until <UNTIL> Include receipts with timestamp <= this Unix seconds value.
  • --receipt-limit <RECEIPT_LIMIT> Maximum number of receipt rows to inspect for disbursement provenance. Default 100.
  • --facility-limit <FACILITY_LIMIT> Maximum number of facility rows to inspect. Default 10.
  • --bond-limit <BOND_LIMIT> Maximum number of bond rows to inspect. Default 10.
  • --loss-event-limit <LOSS_EVENT_LIMIT> Maximum number of loss-lifecycle rows to inspect. Default 25.

chio trust capital-instruction

Issue one custody-neutral escrow or reserve instruction artifact.

bash
chio trust capital-instruction [OPTIONS] <COMMAND>

chio trust capital-instruction issue

Issue one custody-neutral escrow or reserve instruction artifact from JSON or YAML input.

bash
chio trust capital-instruction issue [OPTIONS] --input-file <INPUT_FILE>
  • --input-file <INPUT_FILE> JSON or YAML capital-instruction input file. Required.

chio trust capital-allocation

Issue one simulation-first capital-allocation decision for a governed action.

bash
chio trust capital-allocation [OPTIONS] <COMMAND>

chio trust capital-allocation issue

Issue one live capital-allocation decision artifact from JSON or YAML input.

bash
chio trust capital-allocation issue [OPTIONS] --input-file <INPUT_FILE>
  • --input-file <INPUT_FILE> JSON or YAML capital-allocation input file. Required.
  • --certification-registry-file <CERTIFICATION_REGISTRY_FILE> Optional local certification registry file used when not using --control-url.

chio trust facility

Evaluate, issue, and list bounded credit facilities from subject-scoped evidence.

bash
chio trust facility [OPTIONS] <COMMAND>

chio trust facility evaluate

Evaluate a deterministic facility-policy report without persisting an artifact.

bash
chio trust facility evaluate [OPTIONS] --agent-subject <AGENT_SUBJECT>
  • --agent-subject <AGENT_SUBJECT> Subject public key to evaluate. Required.
  • --capability <CAPABILITY> Optional filter by capability ID.
  • --tool-server <TOOL_SERVER> Optional filter by tool server.
  • --tool-name <TOOL_NAME> Optional filter by tool name.
  • --since <SINCE> Include receipts with timestamp >= this Unix seconds value.
  • --until <UNTIL> Include receipts with timestamp <= this Unix seconds value.
  • --receipt-limit <RECEIPT_LIMIT> Maximum number of receipt rows to evaluate. Default 100.
  • --decision-limit <DECISION_LIMIT> Maximum number of underwriting decision rows to evaluate. Default 50.
  • --certification-registry-file <CERTIFICATION_REGISTRY_FILE> Optional local certification registry file used when not using --control-url.

chio trust facility issue

Issue and persist a signed facility artifact from deterministic facility policy.

bash
chio trust facility issue [OPTIONS] --agent-subject <AGENT_SUBJECT>
  • --agent-subject <AGENT_SUBJECT> Subject public key to evaluate. Required.
  • --capability <CAPABILITY> Optional filter by capability ID.
  • --tool-server <TOOL_SERVER> Optional filter by tool server.
  • --tool-name <TOOL_NAME> Optional filter by tool name.
  • --since <SINCE> Include receipts with timestamp >= this Unix seconds value.
  • --until <UNTIL> Include receipts with timestamp <= this Unix seconds value.
  • --receipt-limit <RECEIPT_LIMIT> Maximum number of receipt rows to evaluate. Default 100.
  • --decision-limit <DECISION_LIMIT> Maximum number of underwriting decision rows to evaluate. Default 50.
  • --supersedes-facility-id <SUPERSEDES_FACILITY_ID> Optional previously active facility to supersede.
  • --certification-registry-file <CERTIFICATION_REGISTRY_FILE> Optional local certification registry file used when not using --control-url.

chio trust facility list

List persisted credit facility artifacts.

bash
chio trust facility list [OPTIONS]
  • --facility-id <FACILITY_ID> Filter by facility ID.
  • --capability <CAPABILITY> Filter by capability ID.
  • --agent-subject <AGENT_SUBJECT> Filter by agent subject public key.
  • --tool-server <TOOL_SERVER> Filter by tool server.
  • --tool-name <TOOL_NAME> Filter by tool name.
  • --disposition <DISPOSITION> Filter by disposition (grant, manual_review, deny).
  • --lifecycle-state <LIFECYCLE_STATE> Filter by lifecycle state (active, superseded, denied, expired).
  • --limit <LIMIT> Maximum number of facility rows to embed. Default 50.

chio trust bond

Evaluate, issue, and list reserve-lock bond artifacts from credit evidence.

bash
chio trust bond [OPTIONS] <COMMAND>

chio trust bond evaluate

Evaluate a deterministic bond-policy report without persisting an artifact.

bash
chio trust bond evaluate [OPTIONS] --agent-subject <AGENT_SUBJECT>
  • --agent-subject <AGENT_SUBJECT> Subject public key to evaluate. Required.
  • --capability <CAPABILITY> Optional filter by capability ID.
  • --tool-server <TOOL_SERVER> Optional filter by tool server.
  • --tool-name <TOOL_NAME> Optional filter by tool name.
  • --since <SINCE> Include receipts with timestamp >= this Unix seconds value.
  • --until <UNTIL> Include receipts with timestamp <= this Unix seconds value.
  • --receipt-limit <RECEIPT_LIMIT> Maximum number of receipt rows to evaluate. Default 100.
  • --decision-limit <DECISION_LIMIT> Maximum number of underwriting decision rows to evaluate. Default 50.
  • --certification-registry-file <CERTIFICATION_REGISTRY_FILE> Optional local certification registry file used when not using --control-url.

chio trust bond issue

Issue and persist a signed bond artifact from deterministic bond policy.

bash
chio trust bond issue [OPTIONS] --agent-subject <AGENT_SUBJECT>
  • --agent-subject <AGENT_SUBJECT> Subject public key to evaluate. Required.
  • --capability <CAPABILITY> Optional filter by capability ID.
  • --tool-server <TOOL_SERVER> Optional filter by tool server.
  • --tool-name <TOOL_NAME> Optional filter by tool name.
  • --since <SINCE> Include receipts with timestamp >= this Unix seconds value.
  • --until <UNTIL> Include receipts with timestamp <= this Unix seconds value.
  • --receipt-limit <RECEIPT_LIMIT> Maximum number of receipt rows to evaluate. Default 100.
  • --decision-limit <DECISION_LIMIT> Maximum number of underwriting decision rows to evaluate. Default 50.
  • --supersedes-bond-id <SUPERSEDES_BOND_ID> Optional previously active bond to supersede.
  • --certification-registry-file <CERTIFICATION_REGISTRY_FILE> Optional local certification registry file used when not using --control-url.

chio trust bond simulate

Simulate bonded execution under an operator control policy without mutating state.

bash
chio trust bond simulate [OPTIONS] --bond-id <BOND_ID> --autonomy-tier <AUTONOMY_TIER> --runtime-assurance-tier <RUNTIME_ASSURANCE_TIER> --policy-file <POLICY_FILE>
  • --bond-id <BOND_ID> Bond artifact ID to evaluate. Required.
  • --autonomy-tier <AUTONOMY_TIER> Requested autonomy tier (direct, delegated, autonomous). Required.
  • --runtime-assurance-tier <RUNTIME_ASSURANCE_TIER> Runtime assurance tier attached to the simulated request. Required.
  • --call-chain-present Whether delegated call-chain context is present.
  • --policy-file <POLICY_FILE> YAML or JSON operator control policy file. Required.

chio trust bond list

List persisted credit bond artifacts.

bash
chio trust bond list [OPTIONS]
  • --bond-id <BOND_ID> Filter by bond ID.
  • --facility-id <FACILITY_ID> Filter by facility ID.
  • --capability <CAPABILITY> Filter by capability ID.
  • --agent-subject <AGENT_SUBJECT> Filter by agent subject public key.
  • --tool-server <TOOL_SERVER> Filter by tool server.
  • --tool-name <TOOL_NAME> Filter by tool name.
  • --disposition <DISPOSITION> Filter by disposition (lock, hold, release, impair).
  • --lifecycle-state <LIFECYCLE_STATE> Filter by lifecycle state (active, superseded, released, impaired, expired).
  • --limit <LIMIT> Maximum number of bond rows to embed. Default 50.

chio trust loss

Evaluate, issue, and list immutable bond loss-lifecycle artifacts.

bash
chio trust loss [OPTIONS] <COMMAND>

chio trust loss evaluate

Evaluate a deterministic bond loss-lifecycle transition without persisting an artifact.

bash
chio trust loss evaluate [OPTIONS] --bond-id <BOND_ID> --event-kind <EVENT_KIND>
  • --bond-id <BOND_ID> Bond ID to evaluate against. Required.
  • --event-kind <EVENT_KIND> Event kind (delinquency, recovery, reserve_release, reserve_slash, write_off). Required.
  • --amount-units <AMOUNT_UNITS> Optional explicit amount in minor units.
  • --amount-currency <AMOUNT_CURRENCY> Optional explicit amount currency.

chio trust loss issue

Issue and persist a signed bond loss-lifecycle artifact.

bash
chio trust loss issue [OPTIONS] --bond-id <BOND_ID> --event-kind <EVENT_KIND>
  • --bond-id <BOND_ID> Bond ID to evaluate against. Required.
  • --event-kind <EVENT_KIND> Event kind (delinquency, recovery, reserve_release, reserve_slash, write_off). Required.
  • --amount-units <AMOUNT_UNITS> Optional explicit amount in minor units.
  • --amount-currency <AMOUNT_CURRENCY> Optional explicit amount currency.
  • --authority-chain-file <AUTHORITY_CHAIN_FILE> Optional JSON/YAML file containing Vec<CapitalExecutionAuthorityStep>.
  • --execution-window-file <EXECUTION_WINDOW_FILE> Optional JSON/YAML file containing CapitalExecutionWindow.
  • --rail-file <RAIL_FILE> Optional JSON/YAML file containing CapitalExecutionRail.
  • --observed-execution-file <OBSERVED_EXECUTION_FILE> Optional JSON/YAML file containing CapitalExecutionObservation.
  • --appeal-window-ends-at <APPEAL_WINDOW_ENDS_AT> Optional reserve-control appeal window close timestamp.
  • --description <DESCRIPTION> Optional reserve-control description recorded on the lifecycle artifact.

chio trust loss list

List persisted bond loss-lifecycle artifacts.

bash
chio trust loss list [OPTIONS]
  • --event-id <EVENT_ID> Filter by event ID.
  • --bond-id <BOND_ID> Filter by bond ID.
  • --facility-id <FACILITY_ID> Filter by facility ID.
  • --capability <CAPABILITY> Filter by capability ID.
  • --agent-subject <AGENT_SUBJECT> Filter by agent subject public key.
  • --tool-server <TOOL_SERVER> Filter by tool server.
  • --tool-name <TOOL_NAME> Filter by tool name.
  • --event-kind <EVENT_KIND> Filter by event kind (delinquency, recovery, reserve_release, reserve_slash, write_off).
  • --limit <LIMIT> Maximum number of event rows to embed. Default 50.

chio trust credit-backtest

Export deterministic credit backtests over historical subject-scoped evidence.

bash
chio trust credit-backtest [OPTIONS] <COMMAND>

chio trust credit-backtest export

Export one deterministic credit backtest report over historical evidence windows.

bash
chio trust credit-backtest export [OPTIONS] --agent-subject <AGENT_SUBJECT>
  • --agent-subject <AGENT_SUBJECT> Subject public key to evaluate. Required.
  • --capability <CAPABILITY> Optional filter by capability ID.
  • --tool-server <TOOL_SERVER> Optional filter by tool server.
  • --tool-name <TOOL_NAME> Optional filter by tool name.
  • --since <SINCE> Include receipts with timestamp >= this Unix seconds value.
  • --until <UNTIL> Include receipts with timestamp <= this Unix seconds value.
  • --receipt-limit <RECEIPT_LIMIT> Maximum number of receipt rows to evaluate per window. Default 100.
  • --decision-limit <DECISION_LIMIT> Maximum number of underwriting decision rows to evaluate per window. Default 50.
  • --window-seconds <WINDOW_SECONDS> Width of each replay window in seconds. Default 604800.
  • --window-count <WINDOW_COUNT> Number of windows to replay. Default 4.
  • --stale-after-seconds <STALE_AFTER_SECONDS> Evidence older than this threshold is flagged stale. Default 2592000.
  • --certification-registry-file <CERTIFICATION_REGISTRY_FILE> Optional local certification registry file used when not using --control-url.

chio trust provider-risk-package

Export one signed provider-facing risk package over canonical credit truth.

bash
chio trust provider-risk-package [OPTIONS] <COMMAND>

chio trust provider-risk-package export

Export one signed provider-facing risk package over canonical subject-scoped evidence.

bash
chio trust provider-risk-package export [OPTIONS] --agent-subject <AGENT_SUBJECT>
  • --agent-subject <AGENT_SUBJECT> Subject public key to evaluate. Required.
  • --capability <CAPABILITY> Optional filter by capability ID.
  • --tool-server <TOOL_SERVER> Optional filter by tool server.
  • --tool-name <TOOL_NAME> Optional filter by tool name.
  • --since <SINCE> Include receipts with timestamp >= this Unix seconds value.
  • --until <UNTIL> Include receipts with timestamp <= this Unix seconds value.
  • --receipt-limit <RECEIPT_LIMIT> Maximum number of receipt rows to evaluate. Default 100.
  • --decision-limit <DECISION_LIMIT> Maximum number of underwriting decision rows to evaluate. Default 50.
  • --recent-loss-limit <RECENT_LOSS_LIMIT> Maximum number of recent loss events to include. Default 10.
  • --certification-registry-file <CERTIFICATION_REGISTRY_FILE> Optional local certification registry file used when not using --control-url.

chio trust liability-provider

Issue, list, and resolve curated liability-market provider registry entries.

bash
chio trust liability-provider [OPTIONS] <COMMAND>

chio trust liability-provider issue

Issue and persist a signed curated liability-provider artifact from JSON or YAML input.

bash
chio trust liability-provider issue [OPTIONS] --input-file <INPUT_FILE>
  • --input-file <INPUT_FILE> JSON or YAML provider report input file. Required.
  • --supersedes-provider-record-id <SUPERSEDES_PROVIDER_RECORD_ID> Optional previously active provider record to supersede.

chio trust liability-provider list

List persisted liability-provider artifacts.

bash
chio trust liability-provider list [OPTIONS]
  • --provider-id <PROVIDER_ID> Filter by provider ID.
  • --jurisdiction <JURISDICTION> Filter by jurisdiction.
  • --coverage-class <COVERAGE_CLASS> Filter by coverage class (tool_execution, data_breach, financial_loss, professional_liability, regulatory_response).
  • --currency <CURRENCY> Filter by currency.
  • --lifecycle-state <LIFECYCLE_STATE> Filter by lifecycle state (active, suspended, superseded, retired).
  • --limit <LIMIT> Maximum number of provider rows to embed. Default 50.

chio trust liability-provider resolve

Resolve one provider + jurisdiction + coverage + currency combination fail closed.

bash
chio trust liability-provider resolve [OPTIONS] --provider-id <PROVIDER_ID> --jurisdiction <JURISDICTION> --coverage-class <COVERAGE_CLASS> --currency <CURRENCY>
  • --provider-id <PROVIDER_ID> Provider ID to resolve. Required.
  • --jurisdiction <JURISDICTION> Jurisdiction to resolve. Required.
  • --coverage-class <COVERAGE_CLASS> Coverage class to resolve. Required.
  • --currency <CURRENCY> Currency to resolve. Required.

chio trust liability-market

Issue quote, placement, and bound-coverage artifacts and list workflow state.

bash
chio trust liability-market [OPTIONS] <COMMAND>

chio trust liability-market quote-request-issue

Issue and persist a signed liability quote request from JSON or YAML input.

bash
chio trust liability-market quote-request-issue [OPTIONS] --input-file <INPUT_FILE>
  • --input-file <INPUT_FILE> JSON or YAML quote-request input file. Required.

chio trust liability-market quote-response-issue

Issue and persist a signed liability quote response from JSON or YAML input.

bash
chio trust liability-market quote-response-issue [OPTIONS] --input-file <INPUT_FILE>
  • --input-file <INPUT_FILE> JSON or YAML quote-response input file. Required.

chio trust liability-market pricing-authority-issue

Issue and persist a signed delegated pricing-authority artifact.

bash
chio trust liability-market pricing-authority-issue [OPTIONS] --input-file <INPUT_FILE>
  • --input-file <INPUT_FILE> JSON or YAML pricing-authority input file. Required.

chio trust liability-market placement-issue

Issue and persist a signed liability placement from JSON or YAML input.

bash
chio trust liability-market placement-issue [OPTIONS] --input-file <INPUT_FILE>
  • --input-file <INPUT_FILE> JSON or YAML placement input file. Required.

chio trust liability-market bound-coverage-issue

Issue and persist a signed bound-coverage artifact from JSON or YAML input.

bash
chio trust liability-market bound-coverage-issue [OPTIONS] --input-file <INPUT_FILE>
  • --input-file <INPUT_FILE> JSON or YAML bound-coverage input file. Required.

chio trust liability-market auto-bind-issue

Evaluate and persist one automatic bind decision plus issued placement/bound coverage.

bash
chio trust liability-market auto-bind-issue [OPTIONS] --input-file <INPUT_FILE>
  • --input-file <INPUT_FILE> JSON or YAML auto-bind input file. Required.

chio trust liability-market claim-issue

Issue and persist a signed liability claim package from JSON or YAML input.

bash
chio trust liability-market claim-issue [OPTIONS] --input-file <INPUT_FILE>
  • --input-file <INPUT_FILE> JSON or YAML claim input file. Required.

chio trust liability-market claim-response-issue

Issue and persist a signed liability claim response from JSON or YAML input.

bash
chio trust liability-market claim-response-issue [OPTIONS] --input-file <INPUT_FILE>
  • --input-file <INPUT_FILE> JSON or YAML claim-response input file. Required.

chio trust liability-market dispute-issue

Issue and persist a signed liability claim dispute from JSON or YAML input.

bash
chio trust liability-market dispute-issue [OPTIONS] --input-file <INPUT_FILE>
  • --input-file <INPUT_FILE> JSON or YAML dispute input file. Required.

chio trust liability-market adjudication-issue

Issue and persist a signed liability claim adjudication from JSON or YAML input.

bash
chio trust liability-market adjudication-issue [OPTIONS] --input-file <INPUT_FILE>
  • --input-file <INPUT_FILE> JSON or YAML adjudication input file. Required.
  • --roster-policy-file <ROSTER_POLICY_FILE> JSON file containing the operator roster policy (roster, allowed decision rules, roster anchor). Required when --control-url is not set.

chio trust liability-market claim-payout-instruction-issue

Issue and persist a signed liability claim payout instruction from JSON or YAML input.

bash
chio trust liability-market claim-payout-instruction-issue [OPTIONS] --input-file <INPUT_FILE>
  • --input-file <INPUT_FILE> JSON or YAML claim payout instruction input file. Required.
  • --roster-policy-file <ROSTER_POLICY_FILE> JSON file containing the operator roster policy. Required when --control-url is not set.

chio trust liability-market claim-payout-receipt-issue

Issue and persist a signed liability claim payout receipt from JSON or YAML input.

bash
chio trust liability-market claim-payout-receipt-issue [OPTIONS] --input-file <INPUT_FILE>
  • --input-file <INPUT_FILE> JSON or YAML claim payout receipt input file. Required.

chio trust liability-market claim-settlement-instruction-issue

Issue and persist a signed liability claim settlement instruction from JSON or YAML input.

bash
chio trust liability-market claim-settlement-instruction-issue [OPTIONS] --input-file <INPUT_FILE>
  • --input-file <INPUT_FILE> JSON or YAML claim settlement instruction input file. Required.
  • --roster-policy-file <ROSTER_POLICY_FILE> JSON file containing the operator roster policy. Required when --control-url is not set.

chio trust liability-market claim-settlement-receipt-issue

Issue and persist a signed liability claim settlement receipt from JSON or YAML input.

bash
chio trust liability-market claim-settlement-receipt-issue [OPTIONS] --input-file <INPUT_FILE>
  • --input-file <INPUT_FILE> JSON or YAML claim settlement receipt input file. Required.

chio trust liability-market list

List quote-request to bound-coverage workflow rows.

bash
chio trust liability-market list [OPTIONS]
  • --quote-request-id <QUOTE_REQUEST_ID> Filter by quote request ID.
  • --provider-id <PROVIDER_ID> Filter by provider ID.
  • --agent-subject <AGENT_SUBJECT> Filter by agent subject public key.
  • --jurisdiction <JURISDICTION> Filter by jurisdiction.
  • --coverage-class <COVERAGE_CLASS> Filter by coverage class (tool_execution, data_breach, financial_loss, professional_liability, regulatory_response).
  • --currency <CURRENCY> Filter by currency.
  • --limit <LIMIT> Maximum number of workflow rows to embed. Default 50.

chio trust liability-market claims-list

List claim-package to adjudication workflow rows.

bash
chio trust liability-market claims-list [OPTIONS]
  • --claim-id <CLAIM_ID> Filter by claim ID.
  • --provider-id <PROVIDER_ID> Filter by provider ID.
  • --agent-subject <AGENT_SUBJECT> Filter by agent subject public key.
  • --jurisdiction <JURISDICTION> Filter by jurisdiction.
  • --policy-number <POLICY_NUMBER> Filter by policy number.
  • --limit <LIMIT> Maximum number of claim rows to embed. Default 50.

chio trust underwriting-input

Export a signed underwriting policy-input snapshot from canonical trust data.

bash
chio trust underwriting-input [OPTIONS] <COMMAND>

chio trust underwriting-input export

Export a signed underwriting policy-input snapshot from local state or trust-control.

bash
chio trust underwriting-input export [OPTIONS]
  • --capability <CAPABILITY> Filter by capability ID.
  • --agent-subject <AGENT_SUBJECT> Filter by agent subject public key.
  • --tool-server <TOOL_SERVER> Filter by tool server.
  • --tool-name <TOOL_NAME> Filter by tool name.
  • --since <SINCE> Include receipts with timestamp >= this Unix seconds value.
  • --until <UNTIL> Include receipts with timestamp <= this Unix seconds value.
  • --receipt-limit <RECEIPT_LIMIT> Maximum number of receipt references to embed. Default 100.
  • --certification-registry-file <CERTIFICATION_REGISTRY_FILE> Optional local certification registry file used when not using --control-url.

chio trust underwriting-decision

Evaluate a bounded underwriting decision from canonical trust data.

bash
chio trust underwriting-decision [OPTIONS] <COMMAND>

chio trust underwriting-decision evaluate

Evaluate a bounded underwriting decision from local state or trust-control.

bash
chio trust underwriting-decision evaluate [OPTIONS]
  • --capability <CAPABILITY> Filter by capability ID.
  • --agent-subject <AGENT_SUBJECT> Filter by agent subject public key.
  • --tool-server <TOOL_SERVER> Filter by tool server.
  • --tool-name <TOOL_NAME> Filter by tool name.
  • --since <SINCE> Include receipts with timestamp >= this Unix seconds value.
  • --until <UNTIL> Include receipts with timestamp <= this Unix seconds value.
  • --receipt-limit <RECEIPT_LIMIT> Maximum number of receipt references to inspect. Default 100.
  • --certification-registry-file <CERTIFICATION_REGISTRY_FILE> Optional local certification registry file used when not using --control-url.

chio trust underwriting-decision simulate

Simulate an alternative underwriting policy against canonical evidence without persisting a decision.

bash
chio trust underwriting-decision simulate [OPTIONS] --policy-file <POLICY_FILE>
  • --capability <CAPABILITY> Filter by capability ID.
  • --agent-subject <AGENT_SUBJECT> Filter by agent subject public key.
  • --tool-server <TOOL_SERVER> Filter by tool server.
  • --tool-name <TOOL_NAME> Filter by tool name.
  • --since <SINCE> Include receipts with timestamp >= this Unix seconds value.
  • --until <UNTIL> Include receipts with timestamp <= this Unix seconds value.
  • --receipt-limit <RECEIPT_LIMIT> Maximum number of receipt references to inspect. Default 100.
  • --policy-file <POLICY_FILE> YAML or JSON underwriting decision policy file. Required.
  • --certification-registry-file <CERTIFICATION_REGISTRY_FILE> Optional local certification registry file used when not using --control-url.

chio trust underwriting-decision issue

Issue and persist a signed underwriting decision artifact.

bash
chio trust underwriting-decision issue [OPTIONS]
  • --capability <CAPABILITY> Filter by capability ID.
  • --agent-subject <AGENT_SUBJECT> Filter by agent subject public key.
  • --tool-server <TOOL_SERVER> Filter by tool server.
  • --tool-name <TOOL_NAME> Filter by tool name.
  • --since <SINCE> Include receipts with timestamp >= this Unix seconds value.
  • --until <UNTIL> Include receipts with timestamp <= this Unix seconds value.
  • --receipt-limit <RECEIPT_LIMIT> Maximum number of receipt references to inspect. Default 100.
  • --certification-registry-file <CERTIFICATION_REGISTRY_FILE> Optional local certification registry file used when not using --control-url.
  • --supersedes-decision-id <SUPERSEDES_DECISION_ID> Optional prior decision ID this new artifact supersedes.

chio trust underwriting-decision list

List persisted underwriting decision artifacts and appeal status.

bash
chio trust underwriting-decision list [OPTIONS]
  • --decision-id <DECISION_ID> Filter by decision ID.
  • --capability <CAPABILITY> Filter by capability ID.
  • --agent-subject <AGENT_SUBJECT> Filter by agent subject public key.
  • --tool-server <TOOL_SERVER> Filter by tool server.
  • --tool-name <TOOL_NAME> Filter by tool name.
  • --outcome <OUTCOME> Filter by outcome (approve, reduce_ceiling, step_up, deny).
  • --lifecycle-state <LIFECYCLE_STATE> Filter by lifecycle state (active, superseded).
  • --appeal-status <APPEAL_STATUS> Filter by latest appeal status (open, accepted, rejected).
  • --limit <LIMIT> Maximum number of persisted decision rows to return. Default 50.

chio trust underwriting-appeal

Create or resolve underwriting appeals against persisted decisions.

bash
chio trust underwriting-appeal [OPTIONS] <COMMAND>

chio trust underwriting-appeal create

Create an underwriting appeal record for one persisted decision.

bash
chio trust underwriting-appeal create [OPTIONS] --decision-id <DECISION_ID> --requested-by <REQUESTED_BY> --reason <REASON>
  • --decision-id <DECISION_ID> Decision ID to appeal. Required.
  • --requested-by <REQUESTED_BY> Operator or system subject opening the appeal. Required.
  • --reason <REASON> Short appeal reason. Required.
  • --note <NOTE> Optional freeform note.

chio trust underwriting-appeal resolve

Resolve one open underwriting appeal.

bash
chio trust underwriting-appeal resolve [OPTIONS] --appeal-id <APPEAL_ID> --resolution <RESOLUTION> --resolved-by <RESOLVED_BY>
  • --appeal-id <APPEAL_ID> Appeal ID to resolve. Required.
  • --resolution <RESOLUTION> Resolution outcome (accepted or rejected). Required.
  • --resolved-by <RESOLVED_BY> Operator or system subject resolving the appeal. Required.
  • --note <NOTE> Optional freeform note.
  • --replacement-decision-id <REPLACEMENT_DECISION_ID> Optional replacement decision ID when an appeal resolution references a superseding artifact.

chio trust trace-verify

Check a signed observation log against a bounded transition model.

bash
chio trust trace-verify [OPTIONS] --log <LOG> --trusted-key <TRUSTED_KEYS>
  • --log <LOG> Canonical NDJSON observation log. Required.
  • --trusted-key <TRUSTED_KEYS> Trusted observer public key. Repeat to trust multiple observers. Required.
  • --spec <SPEC> Transition model used for projection and reachability. Default revocation-propagation. Values revocation-propagation.
  • --apalache-bin <APALACHE_BIN> Apalache executable. Default apalache-mc.
  • --timeout-secs <TIMEOUT_SECS> Maximum seconds for each bounded reachability query. Default 300.
  • --itf-output <ITF_OUTPUT> Optional path for the deterministic ITF projection.
  • --report-output <REPORT_OUTPUT> Optional path for the validation report.

chio trust revoke

Persist a capability revocation into the configured revocation database.

bash
chio trust revoke [OPTIONS] --capability-id <CAPABILITY_ID>
  • --capability-id <CAPABILITY_ID> Capability ID to revoke. Required.

chio trust federated-issue

Issue one local capability after verifying a challenge-bound portable presentation.

bash
chio trust federated-issue [OPTIONS] --presentation-response <PRESENTATION_RESPONSE> --challenge <CHALLENGE> --capability-policy <CAPABILITY_POLICY>
  • --presentation-response <PRESENTATION_RESPONSE> Signed passport presentation response from the external agent. Required.
  • --challenge <CHALLENGE> Exact expected challenge JSON used to bind the presentation to this verifier. Required.
  • --capability-policy <CAPABILITY_POLICY> Policy file whose default capability definition is the single capability to issue. Required.
  • --enterprise-identity <ENTERPRISE_IDENTITY> Optional enterprise identity context JSON used for provider-admin-gated admission.
  • --delegation-policy <DELEGATION_POLICY> Optional signed federated delegation policy that sets the parent scope/TTL ceiling.
  • --upstream-capability-id <UPSTREAM_CAPABILITY_ID> Optional imported upstream capability ID used as the parent for multi-hop federated delegation.

chio trust federated-delegation-policy-create

Create a signed federated delegation policy from a single default capability.

bash
chio trust federated-delegation-policy-create [OPTIONS] --output <OUTPUT> --signing-seed-file <SIGNING_SEED_FILE> --issuer <ISSUER> --partner <PARTNER> --verifier <VERIFIER> --capability-policy <CAPABILITY_POLICY> --expires-at <EXPIRES_AT>
  • --output <OUTPUT> Output path for the signed policy JSON. Required.
  • --signing-seed-file <SIGNING_SEED_FILE> Persistent seed file used to sign the federated delegation policy. Required.
  • --issuer <ISSUER> Local issuer name or organization identifier. Required.
  • --partner <PARTNER> External partner name or organization identifier. Required.
  • --verifier <VERIFIER> Trust-control verifier URL this policy is bound to. Required.
  • --capability-policy <CAPABILITY_POLICY> Capability policy whose single default capability becomes the delegation ceiling. Required.
  • --expires-at <EXPIRES_AT> Policy expiration as Unix seconds. Required.
  • --purpose <PURPOSE> Optional reason or purpose string embedded in the policy document.
  • --parent-capability-id <PARENT_CAPABILITY_ID> Optional upstream capability ID that this delegation policy is allowed to continue from.

chio trust status

Query whether a capability ID is currently revoked.

bash
chio trust status [OPTIONS] --capability-id <CAPABILITY_ID>
  • --capability-id <CAPABILITY_ID> Capability ID to check. Required.

chio receipt

Query and list receipts from the receipt store.

bash
chio receipt [OPTIONS] <COMMAND>

chio receipt list

List receipts with optional filters. Output: one JSON receipt per line (JSON Lines).

bash
chio receipt list [OPTIONS]
  • --capability <CAPABILITY> Filter by capability ID.
  • --tool-server <TOOL_SERVER> Filter by tool server ID.
  • --tool-name <TOOL_NAME> Filter by tool name.
  • --outcome <OUTCOME> Filter by decision outcome (allow, deny, cancelled, incomplete).
  • --since <SINCE> Filter: receipts with timestamp >= this Unix seconds value.
  • --until <UNTIL> Filter: receipts with timestamp <= this Unix seconds value.
  • --min-cost <MIN_COST> Filter: minimum cost in minor currency units (only financial receipts).
  • --max-cost <MAX_COST> Filter: maximum cost in minor currency units (only financial receipts).
  • --cost-currency <COST_CURRENCY> Currency for cost filters as a three-letter uppercase code.
  • --limit <LIMIT> Maximum number of receipts per page. Default 50.
  • --cursor <CURSOR> Cursor for pagination (seq value to start after).
  • --tenant <TENANT> Tenant read boundary for the listing. The reading path fails closed when neither --tenant nor --admin-all is supplied.
  • --admin-all Explicitly read across all tenants as an administrative operation.

chio receipt health

Report receipt-store write health and durability status.

bash
chio receipt health [OPTIONS]

chio receipt flush

Flush pending receipt writes to durable storage, bounded by a timeout.

bash
chio receipt flush [OPTIONS]
  • --timeout-ms <TIMEOUT_MS> Maximum time to wait for the flush to complete, in milliseconds. Default 5000.

chio receipt audit

Run the full receipt-log audit: claim-log projection validation plus a complete checkpoint-chain verification (the deep check).

bash
chio receipt audit [OPTIONS]
  • --repair OFFLINE on-disk repair: revalidate the on-disk receipt chain on a local connection before reporting. Run this with the kernel STOPPED. A running kernel keeps its verified head in-memory in a separate process that the CLI cannot reach, so this does NOT clear a live poisoned writer; restart the kernel to reseed a clean head from the validated on-disk state.

chio receipt retention

Inspect or repair the receipt-store retention state.

bash
chio receipt retention [OPTIONS] <COMMAND>

chio receipt retention repair

Repair a receipt store bricked by a retention rotation that left orphaned claim-log rows: remove the rows whose source receipts were archived and deleted, restoring a writable, reopenable store. Fail-closed.

bash
chio receipt retention repair [OPTIONS] --archive <ARCHIVE>
  • --archive <ARCHIVE> Archive file that holds the co-archived claim-log rows to validate the removal against. Required.

chio receipt checkpoint

Inspect or advance the receipt-checkpoint chain.

bash
chio receipt checkpoint [OPTIONS] <COMMAND>

chio receipt checkpoint status

Report the current receipt-checkpoint chain status.

bash
chio receipt checkpoint status [OPTIONS]
  • --max-batch <MAX_BATCH> Maximum number of receipts to consider per checkpoint batch. Default 1024.

chio receipt checkpoint create

Create the next receipt checkpoint, signed by the kernel keypair.

bash
chio receipt checkpoint create [OPTIONS] --kernel-seed-file <KERNEL_SEED_FILE>
  • --kernel-seed-file <KERNEL_SEED_FILE> Kernel checkpoint signing-seed file. Required.
  • --max-batch <MAX_BATCH> Maximum number of receipts to include in the checkpoint batch. Default 1024.

chio receipt checkpoint verify

Verify the integrity of the receipt-checkpoint chain.

bash
chio receipt checkpoint verify [OPTIONS]

chio receipt explain

Explain why a receipt was allowed or denied.

When --input-file points at a BilateralCoSignArtifacts JSON document (the federation signature-slice API emission with both a dualSignedReceipt and a dsseEnvelope), the renderer auto-detects the bilateral shape and prints both the non-section-6-conformant DualSignedReceipt section (NON-SECTION-6-CONFORMANT per B4) and the DSSE signature-slice section. It does not claim strict Chio DSSE section 6 predicate conformance.

Pass --inspect-bilateral to additionally emit a structural **inspection trace** of the envelope (structural / schema checks only). Ed25519 signature verification is NOT performed: the CLI does not carry the org A / org B passport public keys, so the trace makes no cryptographic-verification claim. --explain-bilateral is retained as an alias.

bash
chio receipt explain [OPTIONS] <RECEIPT_ID>
  • <RECEIPT_ID> Receipt ID. Use a sentinel (e.g. bilateral) when reading a bilateral artifact via --input-file; the receipt_id is informational for that path. Required.
  • --input-file <INPUT_FILE> Optional JSON file containing one receipt, or a BilateralCoSignArtifacts document.
  • --depth <DEPTH> Maximum parent depth to render. Default 8.
  • --fanout-limit <FANOUT_LIMIT> Maximum fanout siblings to render per level. Default 32.
  • --inspect-bilateral Emit a structural inspection trace of the bilateral envelope. Note: this trace does NOT perform Ed25519 signature verification. For real verification, use the kernel-resident chio_federation::bilateral_dsse::verify_dsse_envelope against pinned passport keys.
  • --tenant <TENANT> Tenant read boundary for the explanation. The reading path fails closed when neither --tenant nor --admin-all is supplied.
  • --admin-all Explicitly read across all tenants as an administrative operation.

chio evidence

Export an offline evidence package from the local receipt database.

bash
chio evidence [OPTIONS] <COMMAND>

chio evidence export

Export a verifiable local evidence package into a directory.

bash
chio evidence export [OPTIONS] --output <OUTPUT>
  • --output <OUTPUT> Output directory for the evidence package. Must not already contain files. Required.
  • --capability <CAPABILITY> Filter tool receipts by capability ID.
  • --agent-subject <AGENT_SUBJECT> Filter tool receipts by agent subject public key.
  • --since <SINCE> Include tool receipts with timestamp >= this Unix seconds value.
  • --until <UNTIL> Include tool receipts with timestamp <= this Unix seconds value.
  • --tenant <TENANT> Tenant read boundary for the export. Derived from operator auth in service paths.
  • --admin-all Explicitly export across all tenants as an administrative operation.
  • --policy-file <POLICY_FILE> Optional policy file to attach to the export package.
  • --federation-policy <FEDERATION_POLICY> Optional signed bilateral federation policy that constrains the export scope.
  • --require-proofs Fail the export if any selected tool receipt lacks checkpoint coverage.

chio evidence verify

Verify an exported evidence package offline.

bash
chio evidence verify [OPTIONS] --input <INPUT>
  • --input <INPUT> Input directory containing a previously exported evidence package. Required.

chio evidence import

Import a verified bilateral evidence package for later federated delegation.

bash
chio evidence import [OPTIONS] --input <INPUT>
  • --input <INPUT> Input directory containing a previously exported evidence package. Required.

chio evidence federation-policy

Create a signed bilateral receipt-sharing policy document.

bash
chio evidence federation-policy [OPTIONS] <COMMAND>

chio evidence federation-policy create

Create a signed bilateral federation policy for receipt sharing.

bash
chio evidence federation-policy create [OPTIONS] --output <OUTPUT> --signing-seed-file <SIGNING_SEED_FILE> --issuer <ISSUER> --partner <PARTNER> --expires-at <EXPIRES_AT>
  • --output <OUTPUT> Output JSON file for the signed policy document. Required.
  • --signing-seed-file <SIGNING_SEED_FILE> Persistent seed file used to sign the policy document. Required.
  • --issuer <ISSUER> Human-readable identifier for the issuing organization. Required.
  • --partner <PARTNER> Human-readable identifier for the receiving organization. Required.
  • --capability <CAPABILITY> Optional capability scope for the shared export.
  • --agent-subject <AGENT_SUBJECT> Optional agent subject scope for the shared export.
  • --since <SINCE> Optional lower timestamp bound for the allowed export window.
  • --until <UNTIL> Optional upper timestamp bound for the allowed export window.
  • --tenant <TENANT> Tenant read boundary for exports performed under this policy.
  • --admin-all Explicitly allow administrative exports across all tenants under this policy.
  • --expires-at <EXPIRES_AT> Expiration time for the policy document, in Unix seconds. Required.
  • --require-proofs Require full checkpoint coverage for any export performed under this policy.
  • --purpose <PURPOSE> Optional reason or purpose string embedded in the policy document.

chio certify

Evaluate a conformance corpus and emit a signed certification artifact.

bash
chio certify [OPTIONS] <COMMAND>

chio certify check

Evaluate conformance evidence and emit a signed pass/fail certification artifact.

bash
chio certify check [OPTIONS] --scenarios-dir <SCENARIOS_DIR> --results-dir <RESULTS_DIR> --output <OUTPUT> --tool-server-id <TOOL_SERVER_ID> --signing-seed-file <SIGNING_SEED_FILE>
  • --scenarios-dir <SCENARIOS_DIR> Directory containing conformance scenario descriptor JSON files. Required.
  • --results-dir <RESULTS_DIR> Directory containing conformance result JSON files. Required.
  • --output <OUTPUT> Output path for the signed certification artifact JSON. Required.
  • --tool-server-id <TOOL_SERVER_ID> Stable identifier for the tool server being checked. Required.
  • --tool-server-name <TOOL_SERVER_NAME> Optional human-readable name for the tool server being checked.
  • --report-output <REPORT_OUTPUT> Optional path to write a generated markdown report for the evaluated corpus.
  • --criteria-profile <CRITERIA_PROFILE> Certification criteria profile to apply. Default conformance-all-pass-v1.
  • --signing-seed-file <SIGNING_SEED_FILE> Persistent seed file used to sign certification artifacts. Required.

chio certify verify

Verify a signed certification artifact.

bash
chio certify verify [OPTIONS] --input <INPUT>
  • --input <INPUT> Input path for the signed certification artifact JSON. Required.

chio certify registry

Publish, resolve, and revoke certification artifacts in a registry.

bash
chio certify registry [OPTIONS] <COMMAND>

chio certify registry publish

Publish one signed certification artifact into a local or remote registry.

bash
chio certify registry publish [OPTIONS] --input <INPUT>
  • --input <INPUT> Input path for the signed certification artifact JSON. Required.
  • --certification-registry-file <CERTIFICATION_REGISTRY_FILE> Local registry file to update when not using --control-url.

chio certify registry publish-network

Publish one certification artifact across configured discovery-network operators.

bash
chio certify registry publish-network [OPTIONS] --input <INPUT>
  • --input <INPUT> Input path for the signed certification artifact JSON. Required.
  • --certification-discovery-file <CERTIFICATION_DISCOVERY_FILE> Local discovery-network file to use when not using --control-url.
  • --operator-id <OPERATOR_IDS> Optional operator id allowlist. Repeat to target specific operators.

chio certify registry list

List certification artifacts from a local or remote registry.

bash
chio certify registry list [OPTIONS]
  • --certification-registry-file <CERTIFICATION_REGISTRY_FILE> Local registry file to inspect when not using --control-url.

chio certify registry get

Read one certification artifact from a local or remote registry.

bash
chio certify registry get [OPTIONS] --artifact-id <ARTIFACT_ID>
  • --artifact-id <ARTIFACT_ID> Certification artifact ID to fetch. Required.
  • --certification-registry-file <CERTIFICATION_REGISTRY_FILE> Local registry file to inspect when not using --control-url.

chio certify registry resolve

Resolve the current certification status for one tool server.

bash
chio certify registry resolve [OPTIONS] --tool-server-id <TOOL_SERVER_ID>
  • --tool-server-id <TOOL_SERVER_ID> Stable tool-server identifier whose current certification should be resolved. Required.
  • --certification-registry-file <CERTIFICATION_REGISTRY_FILE> Local registry file to inspect when not using --control-url.

chio certify registry discover

Discover certification status across multiple configured operators.

bash
chio certify registry discover [OPTIONS] --tool-server-id <TOOL_SERVER_ID>
  • --tool-server-id <TOOL_SERVER_ID> Stable tool-server identifier whose discovery state should be queried. Required.
  • --certification-discovery-file <CERTIFICATION_DISCOVERY_FILE> Local discovery-network file to use when not using --control-url.

Search public certification listings across configured operators.

bash
chio certify registry search [OPTIONS]
  • --certification-discovery-file <CERTIFICATION_DISCOVERY_FILE> Optional local discovery-network file to use when not using --control-url.
  • --tool-server-id <TOOL_SERVER_ID> Optional exact tool-server id filter.
  • --criteria-profile <CRITERIA_PROFILE> Optional criteria profile filter.
  • --evidence-profile <EVIDENCE_PROFILE> Optional evidence profile filter.
  • --status <STATUS> Optional listing state filter (active, superseded, or revoked).
  • --operator-id <OPERATOR_IDS> Optional operator id allowlist. Repeat to target specific operators.

chio certify registry transparency

Render the public certification transparency feed across configured operators.

bash
chio certify registry transparency [OPTIONS]
  • --certification-discovery-file <CERTIFICATION_DISCOVERY_FILE> Optional local discovery-network file to use when not using --control-url.
  • --tool-server-id <TOOL_SERVER_ID> Optional exact tool-server id filter.
  • --operator-id <OPERATOR_IDS> Optional operator id allowlist. Repeat to target specific operators.

chio certify registry consume

Evaluate public certification listings against a local import policy.

bash
chio certify registry consume [OPTIONS] --tool-server-id <TOOL_SERVER_ID>
  • --tool-server-id <TOOL_SERVER_ID> Stable tool-server identifier whose public listing should be consumed. Required.
  • --certification-discovery-file <CERTIFICATION_DISCOVERY_FILE> Optional local discovery-network file to use when not using --control-url.
  • --operator-id <OPERATOR_IDS> Optional operator id allowlist. Repeat to target specific operators.
  • --criteria-profile <ALLOWED_CRITERIA_PROFILES> Optional allowed criteria profile. Repeat to allow multiple profiles.
  • --evidence-profile <ALLOWED_EVIDENCE_PROFILES> Optional allowed evidence profile. Repeat to allow multiple profiles.

chio certify registry revoke

Revoke one certification artifact in a local or remote registry.

bash
chio certify registry revoke [OPTIONS] --artifact-id <ARTIFACT_ID>
  • --artifact-id <ARTIFACT_ID> Certification artifact ID to revoke. Required.
  • --reason <REASON> Optional human-readable revocation reason.
  • --revoked-at <REVOKED_AT> Optional revocation timestamp override in Unix seconds. Defaults to now.
  • --certification-registry-file <CERTIFICATION_REGISTRY_FILE> Local registry file to update when not using --control-url.

chio certify registry dispute

Open or resolve a public certification dispute record.

bash
chio certify registry dispute [OPTIONS] --artifact-id <ARTIFACT_ID> --state <STATE>
  • --artifact-id <ARTIFACT_ID> Certification artifact ID to update. Required.
  • --state <STATE> Dispute state (open, under-review, resolved-no-change, resolved-revoked). Required.
  • --note <NOTE> Optional dispute note or resolution summary.
  • --updated-at <UPDATED_AT> Optional dispute timestamp override in Unix seconds. Defaults to now.
  • --certification-registry-file <CERTIFICATION_REGISTRY_FILE> Local registry file to update when not using --control-url.

chio did

Resolve self-certifying did:chio identifiers into DID Documents.

bash
chio did [OPTIONS] <COMMAND>

chio did resolve

Resolve a did:chio identifier or Ed25519 public key into a DID Document.

bash
chio did resolve [OPTIONS]
  • --did <DID> Fully-qualified did:chio identifier to resolve.
  • --public-key <PUBLIC_KEY> Hex-encoded Ed25519 public key to resolve as did:chio.
  • --receipt-log-url <RECEIPT_LOG_URLS> Optional receipt log service endpoint to include in the resolved document.
  • --passport-status-url <PASSPORT_STATUS_URLS> Optional passport lifecycle endpoint to include in the resolved document.

chio passport

Create, verify, and present Agent Passport bundles.

bash
chio passport [OPTIONS] <COMMAND>

chio passport generate

Synthesize a trust-tier-enriched Agent Passport for a named agent.

Computes the agent’s compliance score and behavioral anomaly, collapses them into a TrustTier, and emits a minimal passport JSON document with that tier populated.

bash
chio passport generate [OPTIONS] --agent <AGENT>
  • --agent <AGENT> Agent identifier (DID or opaque subject) to stamp on the passport. Required.
  • --output <OUTPUT> Optional output path for the passport JSON. When omitted, the passport is printed to stdout.
  • --compliance-score <COMPLIANCE_SCORE> Compliance score override (0..=1000). Defaults to 1000 when omitted so that a freshly provisioned agent surfaces as Premier rather than Unverified.
  • --behavioral-anomaly When set, treats the agent as having an active behavioral anomaly and caps the synthesized tier below Premier.
  • --validity-days <VALIDITY_DAYS> Passport validity period in days. Default 30.

chio passport create

Create a single-issuer Agent Passport from local receipt and lineage data.

bash
chio passport create [OPTIONS] --subject-public-key <SUBJECT_PUBLIC_KEY> --output <OUTPUT> --signing-seed-file <SIGNING_SEED_FILE>
  • --subject-public-key <SUBJECT_PUBLIC_KEY> Subject Ed25519 public key in hex. Required.
  • --output <OUTPUT> Output path for the passport JSON. Required.
  • --signing-seed-file <SIGNING_SEED_FILE> Persistent seed file used to sign the embedded reputation credential. Required.
  • --validity-days <VALIDITY_DAYS> Passport validity period in days. Default 30.
  • --since <SINCE> Optional lower bound for the attested receipt window, in Unix seconds.
  • --until <UNTIL> Optional upper bound for the attested receipt window, in Unix seconds.
  • --receipt-log-url <RECEIPT_LOG_URLS> Optional receipt log service endpoint(s) to embed in attestation evidence.
  • --require-checkpoints Fail if any selected receipt lacks checkpoint coverage.
  • --enterprise-identity <ENTERPRISE_IDENTITY> Optional enterprise identity context JSON to embed as portable provenance.

chio passport verify

Verify a passport and every embedded credential without external glue code.

bash
chio passport verify [OPTIONS] --input <INPUT>
  • --input <INPUT> Passport JSON file to verify. Required.
  • --at <AT> Verification timestamp override in Unix seconds. Defaults to now.
  • --passport-statuses-file <PASSPORT_STATUSES_FILE> Local passport lifecycle registry file to inspect when not using --control-url.

chio passport evaluate

Evaluate a passport against a relying-party verifier policy.

bash
chio passport evaluate [OPTIONS] --input <INPUT> --policy <POLICY>
  • --input <INPUT> Passport JSON file to evaluate. Required.
  • --policy <POLICY> YAML or JSON verifier policy file. Required.
  • --at <AT> Verification timestamp override in Unix seconds. Defaults to now.
  • --passport-statuses-file <PASSPORT_STATUSES_FILE> Local passport lifecycle registry file to inspect when not using --control-url.

chio passport present

Produce a filtered presentation from an existing passport.

bash
chio passport present [OPTIONS] --input <INPUT> --output <OUTPUT>
  • --input <INPUT> Input passport JSON file. Required.
  • --output <OUTPUT> Output path for the presented passport JSON. Required.
  • --issuer <ISSUERS> Optional issuer DID allowlist. Repeat to allow multiple issuers.
  • --max-credentials <MAX_CREDENTIALS> Maximum number of credentials to include in the presentation.

chio passport policy

Create, verify, and manage signed verifier-policy artifacts.

bash
chio passport policy [OPTIONS] <COMMAND>

chio passport policy create

Create a signed verifier-policy artifact from a raw policy file.

bash
chio passport policy create [OPTIONS] --output <OUTPUT> --policy-id <POLICY_ID> --verifier <VERIFIER> --signing-seed-file <SIGNING_SEED_FILE> --policy <POLICY> --expires-at <EXPIRES_AT>
  • --output <OUTPUT> Output path for the signed verifier-policy document JSON. Required.
  • --policy-id <POLICY_ID> Stable verifier policy ID. Required.
  • --verifier <VERIFIER> Relying-party identifier or audience string that owns this policy. Required.
  • --signing-seed-file <SIGNING_SEED_FILE> Persistent seed file used to sign the verifier policy. Required.
  • --policy <POLICY> YAML or JSON file containing the raw verifier policy body. Required.
  • --expires-at <EXPIRES_AT> Policy expiration as Unix seconds. Required.
  • --verifier-policies-file <VERIFIER_POLICIES_FILE> Optional local verifier policy registry to update after creation.

chio passport policy verify

Verify a signed verifier-policy artifact.

bash
chio passport policy verify [OPTIONS] --input <INPUT>
  • --input <INPUT> Signed verifier-policy document JSON file. Required.
  • --at <AT> Verification timestamp override in Unix seconds. Defaults to now.

chio passport policy list

List verifier-policy artifacts from a local registry or remote service.

bash
chio passport policy list [OPTIONS]
  • --verifier-policies-file <VERIFIER_POLICIES_FILE> Local verifier policy registry file to inspect when not using --control-url.

chio passport policy get

Read one verifier-policy artifact.

bash
chio passport policy get [OPTIONS] --policy-id <POLICY_ID>
  • --policy-id <POLICY_ID> Verifier policy ID to fetch. Required.
  • --verifier-policies-file <VERIFIER_POLICIES_FILE> Local verifier policy registry file to inspect when not using --control-url.

chio passport policy upsert

Create or update one verifier-policy artifact in a local registry or remote service.

bash
chio passport policy upsert [OPTIONS] --input <INPUT>
  • --input <INPUT> Input JSON file containing a signed verifier-policy document. Required.
  • --verifier-policies-file <VERIFIER_POLICIES_FILE> Local verifier policy registry file to update when not using --control-url.

chio passport policy delete

Delete one verifier-policy artifact from a local registry or remote service.

bash
chio passport policy delete [OPTIONS] --policy-id <POLICY_ID>
  • --policy-id <POLICY_ID> Verifier policy ID to delete. Required.
  • --verifier-policies-file <VERIFIER_POLICIES_FILE> Local verifier policy registry file to update when not using --control-url.

chio passport challenge

Create and verify challenge-bound passport presentations.

bash
chio passport challenge [OPTIONS] <COMMAND>

chio passport challenge create

Create a presentation challenge for a relying party.

bash
chio passport challenge create [OPTIONS] --output <OUTPUT> --verifier <VERIFIER>
  • --output <OUTPUT> Output path for the challenge JSON. Required.
  • --verifier <VERIFIER> Relying-party identifier or audience string. Required.
  • --ttl-secs <TTL_SECS> Challenge lifetime in seconds. Default 300.
  • --issuer <ISSUERS> Optional issuer DID allowlist for selective disclosure. Repeat to allow multiple issuers.
  • --max-credentials <MAX_CREDENTIALS> Maximum number of credentials a holder may disclose.
  • --policy <POLICY> Optional verifier policy to embed in the challenge.
  • --policy-id <POLICY_ID> Optional stored verifier policy ID to reference instead of embedding raw policy.
  • --verifier-policies-file <VERIFIER_POLICIES_FILE> Optional verifier policy registry file used when resolving --policy-id locally.
  • --verifier-challenge-db <VERIFIER_CHALLENGE_DB> Optional SQLite challenge-state database used for replay-safe local verification.

chio passport challenge respond

Respond to a presentation challenge using the passport subject key.

bash
chio passport challenge respond [OPTIONS] --input <INPUT> --holder-seed-file <HOLDER_SEED_FILE> --output <OUTPUT>
  • --input <INPUT> Input passport JSON file. Required.
  • --challenge <CHALLENGE> Input challenge JSON file.
  • --challenge-url <CHALLENGE_URL> Public holder-facing challenge URL.
  • --holder-seed-file <HOLDER_SEED_FILE> Existing seed file for the passport subject key. Required.
  • --output <OUTPUT> Output path for the signed response JSON. Required.
  • --at <AT> Response timestamp override in Unix seconds. Defaults to now.

chio passport challenge submit

Submit a signed challenge response to a public verifier transport URL.

bash
chio passport challenge submit [OPTIONS] --input <INPUT> --submit-url <SUBMIT_URL>
  • --input <INPUT> Input response JSON file. Required.
  • --submit-url <SUBMIT_URL> Public submit URL returned by the verifier transport. Required.

chio passport challenge verify

Verify a challenge-bound passport presentation response.

bash
chio passport challenge verify [OPTIONS] --input <INPUT>
  • --input <INPUT> Input response JSON file. Required.
  • --challenge <CHALLENGE> Optional expected challenge JSON file for exact-match verification.
  • --verifier-policies-file <VERIFIER_POLICIES_FILE> Optional verifier policy registry file used to resolve policy references locally.
  • --verifier-challenge-db <VERIFIER_CHALLENGE_DB> Optional SQLite challenge-state database used for replay-safe local verification.
  • --passport-statuses-file <PASSPORT_STATUSES_FILE> Local passport lifecycle registry file to inspect when not using --control-url.
  • --at <AT> Verification timestamp override in Unix seconds. Defaults to now.

chio passport status

Publish, resolve, and revoke passport lifecycle state.

bash
chio passport status [OPTIONS] <COMMAND>

chio passport status publish

Publish one passport into the lifecycle registry as the current active artifact.

bash
chio passport status publish [OPTIONS] --input <INPUT>
  • --input <INPUT> Passport JSON file to publish. Required.
  • --passport-statuses-file <PASSPORT_STATUSES_FILE> Local passport lifecycle registry file to update when not using --control-url.
  • --resolve-url <RESOLVE_URLS> Optional resolve endpoint verifiers can query for lifecycle state.
  • --cache-ttl-secs <CACHE_TTL_SECS> Optional cache TTL verifiers may apply to lifecycle state.

chio passport status list

List lifecycle records from a local registry or remote service.

bash
chio passport status list [OPTIONS]
  • --passport-statuses-file <PASSPORT_STATUSES_FILE> Local passport lifecycle registry file to inspect when not using --control-url.

chio passport status get

Read one lifecycle record by passport id.

bash
chio passport status get [OPTIONS] --passport-id <PASSPORT_ID>
  • --passport-id <PASSPORT_ID> Passport artifact id to fetch. Required.
  • --passport-statuses-file <PASSPORT_STATUSES_FILE> Local passport lifecycle registry file to inspect when not using --control-url.

chio passport status resolve

Resolve lifecycle state for a passport artifact id.

bash
chio passport status resolve [OPTIONS] --passport-id <PASSPORT_ID>
  • --passport-id <PASSPORT_ID> Passport artifact id to resolve. Required.
  • --passport-statuses-file <PASSPORT_STATUSES_FILE> Local passport lifecycle registry file to inspect when not using --control-url.

chio passport status revoke

Revoke one passport lifecycle record.

bash
chio passport status revoke [OPTIONS] --passport-id <PASSPORT_ID>
  • --passport-id <PASSPORT_ID> Passport artifact id to revoke. Required.
  • --passport-statuses-file <PASSPORT_STATUSES_FILE> Local passport lifecycle registry file to update when not using --control-url.
  • --reason <REASON> Optional revocation reason.
  • --revoked-at <REVOKED_AT> Optional revocation timestamp override in Unix seconds.

chio passport issuance

Deliver Chio passports through an OID4VCI-style pre-authorized issuance flow.

bash
chio passport issuance [OPTIONS] <COMMAND>

chio passport issuance metadata

Render OID4VCI-style issuer metadata for Chio passport issuance.

bash
chio passport issuance metadata [OPTIONS]
  • --issuer-url <ISSUER_URL> Local credential issuer base URL when not using --control-url.
  • --signing-seed-file <SIGNING_SEED_FILE> Optional local signing seed used to advertise the standards-native portable credential profile.
  • --passport-status-url <PASSPORT_STATUS_URL> Optional public passport lifecycle resolve endpoint to advertise in local metadata.
  • --passport-status-cache-ttl-secs <PASSPORT_STATUS_CACHE_TTL_SECS> Optional cache hint paired with --passport-status-url in local metadata.

chio passport issuance offer

Create a pre-authorized credential offer for one Chio passport.

bash
chio passport issuance offer [OPTIONS] --input <INPUT>
  • --input <INPUT> Input passport JSON file to deliver. Required.
  • --output <OUTPUT> Optional output path for the credential offer JSON.
  • --issuer-url <ISSUER_URL> Local credential issuer base URL when not using --control-url.
  • --passport-issuance-offers-file <PASSPORT_ISSUANCE_OFFERS_FILE> Local issuance registry file to update when not using --control-url.
  • --passport-statuses-file <PASSPORT_STATUSES_FILE> Optional local passport lifecycle registry used to require published active status before portable issuance.
  • --signing-seed-file <SIGNING_SEED_FILE> Optional local signing seed required when offering portable compact credential configurations.
  • --credential-configuration-id <CREDENTIAL_CONFIGURATION_ID> Optional credential configuration ID. Defaults to Chio’s single passport profile.
  • --ttl-secs <TTL_SECS> Offer lifetime in seconds. Default 600.

chio passport issuance token

Redeem a pre-authorized code into an issuance access token.

bash
chio passport issuance token [OPTIONS] --offer <OFFER>
  • --offer <OFFER> Input credential offer JSON file. Required.
  • --output <OUTPUT> Optional output path for the token response JSON.
  • --passport-issuance-offers-file <PASSPORT_ISSUANCE_OFFERS_FILE> Local issuance registry file to update when not using --control-url.

chio passport issuance credential

Redeem an issuance access token into the delivered Chio passport.

bash
chio passport issuance credential [OPTIONS] --offer <OFFER> --token <TOKEN>
  • --offer <OFFER> Input credential offer JSON file. Required.
  • --token <TOKEN> Input token response JSON file. Required.
  • --output <OUTPUT> Optional output path for the delivered passport JSON.
  • --passport-issuance-offers-file <PASSPORT_ISSUANCE_OFFERS_FILE> Local issuance registry file to update when not using --control-url.
  • --passport-statuses-file <PASSPORT_STATUSES_FILE> Optional local passport lifecycle registry used to attach portable lifecycle status references.
  • --signing-seed-file <SIGNING_SEED_FILE> Optional local signing seed required when redeeming portable compact credential configurations without --control-url.
  • --credential-configuration-id <CREDENTIAL_CONFIGURATION_ID> Optional credential configuration ID override used for fail-closed validation.
  • --credential-format <CREDENTIAL_FORMAT> Optional format override used for fail-closed validation.

chio passport oid4vp

Create and consume Chio’s narrow OID4VP verifier and holder interop flow.

bash
chio passport oid4vp [OPTIONS] <COMMAND>

chio passport oid4vp create

Create a replay-safe verifier request on the running trust-control service.

bash
chio passport oid4vp create [OPTIONS]
  • --output <OUTPUT> Optional output path for the verifier request JSON.
  • --claim <DISCLOSURE_CLAIMS> Requested selective-disclosure claims. Repeat to request multiple claims.
  • --issuer <ISSUER_ALLOWLIST> Optional issuer allowlist. Repeat to allow multiple issuers.
  • --ttl-secs <TTL_SECS> Optional request lifetime in seconds.
  • --identity-subject <IDENTITY_SUBJECT> Optional continuity subject to embed in the bounded identity assertion lane.
  • --identity-continuity-id <IDENTITY_CONTINUITY_ID> Optional continuity ID to embed in the bounded identity assertion lane.
  • --identity-provider <IDENTITY_PROVIDER> Optional upstream provider label for the bounded identity assertion lane.
  • --identity-session-hint <IDENTITY_SESSION_HINT> Optional session hint for the bounded identity assertion lane.
  • --identity-ttl-secs <IDENTITY_TTL_SECS> Optional identity-assertion lifetime in seconds. Defaults to the request TTL.

chio passport oid4vp respond

Build one holder response from a verifier request or launch URL.

bash
chio passport oid4vp respond [OPTIONS] --input <INPUT> --holder-seed-file <HOLDER_SEED_FILE>
  • --input <INPUT> Input portable SD-JWT VC credential file. Required.
  • --request-url <REQUEST_URL> Direct verifier request URI.
  • --same-device-url <SAME_DEVICE_URL> Same-device openid4vp://authorize?... launch URL.
  • --cross-device-url <CROSS_DEVICE_URL> Cross-device HTTPS launch URL.
  • --holder-seed-file <HOLDER_SEED_FILE> Existing seed file for the portable credential subject key. Required.
  • --output <OUTPUT> Optional output path for the signed response JWT.
  • --submit Submit to the verifier’s response URI after building the response.
  • --submit-url <SUBMIT_URL> Override submit URL instead of using the request’s response_uri.
  • --at <AT> Response timestamp override in Unix seconds. Defaults to now.

chio passport oid4vp submit

Submit a previously created OID4VP response JWT.

bash
chio passport oid4vp submit [OPTIONS] --input <INPUT> --submit-url <SUBMIT_URL>
  • --input <INPUT> Input response JWT file. Required.
  • --submit-url <SUBMIT_URL> Public verifier response URL. Required.

chio passport oid4vp metadata

Fetch and display the public verifier metadata document.

bash
chio passport oid4vp metadata [OPTIONS] --verifier-url <VERIFIER_URL>
  • --verifier-url <VERIFIER_URL> Base verifier URL, for example https://verifier.example.com. Required.

chio proof

Verify proof bundles and Transaction Passport artifacts.

bash
chio proof [OPTIONS] <COMMAND>

chio proof assemble

Assemble Transaction Passport roots from evidence artifacts.

bash
chio proof assemble [OPTIONS] --artifact-dir <DIR> --verifier-policy <FILE> --passport-id <PASSPORT_ID> --issued-at <ISSUED_AT> --out <DIR>
  • --artifact-dir <DIR> Directory containing evidence artifacts. Required.
  • --verifier-policy <FILE> Verifier policy JSON to bind into the passport. Required.
  • --passport-id <PASSPORT_ID> Transaction Passport id to write. Required.
  • --issued-at <ISSUED_AT> Issued-at timestamp to write into deterministic roots. Required.
  • --out <DIR> Directory where assembled roots will be written. Required.

chio proof collect

Collect a verifier-backed proof bundle from proof artifacts.

bash
chio proof collect [OPTIONS] --kind <KIND> --artifact-dir <DIR> --out <DIR>
  • --kind <KIND> Proof bundle kind to collect. Required. Values agent-web-envelope, buyer-package, disclosure-agent-web-envelope, evidence, ioa-web3, replay, transaction-passport, runtime-spine.
  • --artifact-dir <DIR> Directory containing source proof artifacts. Required.
  • --out <DIR> Directory where the collected proof bundle will be written. Required.

chio proof verify

Verify a Transaction Passport proof bundle rooted at a passport JSON file.

bash
chio proof verify [OPTIONS] <PATH>
  • <PATH> Path to transaction-passport.json. Required.
  • --require <REQUIRE> Require a verified proof claim family. Values commerce, delegation, denials, disclosure, enterprise, external-envelope, risk, runtime, runtime-parity, settlement, trust-market.
  • --out <FILE> Write the verifier report to this JSON file.

chio proof explain

Explain a verifier claim from a proof bundle.

bash
chio proof explain [OPTIONS] --claim <CLAIM> <BUNDLE>
  • <BUNDLE> Proof bundle directory, exported archive, or transaction-passport.json path. Required.
  • --claim <CLAIM> Claim id to explain. Required.

chio proof fixture

List and generate bundled proof fixtures.

bash
chio proof fixture [OPTIONS] <COMMAND>

chio proof fixture list

List built-in proof fixtures.

bash
chio proof fixture list [OPTIONS]

chio proof fixture generate

Generate a built-in proof fixture into a directory.

bash
chio proof fixture generate [OPTIONS] --out <DIR> <FIXTURE_ID>
  • <FIXTURE_ID> Fixture id to generate. Required.
  • --out <DIR> Output directory. Required.

chio proof serve

Serve a static Proof Room bundle.

bash
chio proof serve [OPTIONS] <BUNDLE>
  • <BUNDLE> Proof Room bundle directory. Required.
  • --listen <LISTEN> Listen address for the static server. Default 127.0.0.1:0.
  • --dry-run Validate and print the serving report without opening a server.

chio proof export

Export a verified proof bundle as a tar archive.

bash
chio proof export [OPTIONS] --out <FILE> <BUNDLE>
  • <BUNDLE> Proof bundle directory. Required.
  • --out <FILE> Output .tgz, .tar.gz, or .tar.zst file path. Required.
  • --redact <REDACT> Redaction profile to apply before writing the archive. Values admin-full-evidence-v1, public.

chio proof doctor

Check proof evidence required for a proof scenario.

bash
chio proof doctor [OPTIONS]
  • --scenario <SCENARIO> Proof scenario to check. Values agent-web-interop, commerce-payments, disclosure-lineage, enterprise-export, proof-package, public-settlement, runtime-security, single-call-authority, swarm-authority, trust-market, workflow-preflight.
  • --root <PATH> Workspace root containing fixtures and proof evidence.

chio commerce

Verify commerce proof bundles and payment evidence.

bash
chio commerce [OPTIONS] <COMMAND>

chio commerce verify

Verify a commerce Transaction Passport proof bundle.

bash
chio commerce verify [OPTIONS] <PATH>
  • <PATH> Proof bundle directory, exported archive, or transaction-passport.json path. Required.
  • --out <FILE> Write the verifier report to this JSON file.

chio workflow

Validate read-only workflow planning evidence before dispatch.

bash
chio workflow [OPTIONS] <COMMAND>

chio workflow preflight

Validate a read-only workflow preflight plan.

bash
chio workflow preflight [OPTIONS] --plan <PATH>
  • --plan <PATH> Path to a chio.workflow.preflight-plan.v1 JSON artifact. Required.

chio reputation

Inspect local reputation scorecards from persisted receipts and lineage state.

bash
chio reputation [OPTIONS] <COMMAND>

chio reputation local

Compute the local reputation scorecard for one subject.

bash
chio reputation local [OPTIONS] --subject-public-key <SUBJECT_PUBLIC_KEY>
  • --subject-public-key <SUBJECT_PUBLIC_KEY> Subject Ed25519 public key in hex. Required.
  • --since <SINCE> Optional lower bound for the evaluated receipt window, in Unix seconds.
  • --until <UNTIL> Optional upper bound for the evaluated receipt window, in Unix seconds.
  • --policy <POLICY> Optional policy file whose reputation scoring config should be applied for local evaluation.

chio reputation compare

Compare the live local reputation corpus against a portable passport artifact.

bash
chio reputation compare [OPTIONS] --subject-public-key <SUBJECT_PUBLIC_KEY> --passport <PASSPORT>
  • --subject-public-key <SUBJECT_PUBLIC_KEY> Subject Ed25519 public key in hex. Required.
  • --passport <PASSPORT> Passport JSON file to compare against live local state. Required.
  • --since <SINCE> Optional lower bound for the evaluated local receipt window, in Unix seconds.
  • --until <UNTIL> Optional upper bound for the evaluated local receipt window, in Unix seconds.
  • --local-policy <LOCAL_POLICY> Optional HushSpec policy file whose local reputation scoring config should be applied.
  • --verifier-policy <VERIFIER_POLICY> Optional YAML or JSON verifier policy used to evaluate the passport during comparison.

chio cert

Generate, verify, and inspect ACP session compliance certificates.

bash
chio cert [OPTIONS] <COMMAND>

chio cert generate

Generate a compliance certificate for an ACP session.

bash
chio cert generate [OPTIONS] --session-id <SESSION_ID> --receipt-db <RECEIPT_DB>
  • --session-id <SESSION_ID> ACP session ID to certify. Required.
  • --receipt-db <RECEIPT_DB> Path to the receipt database. Required.
  • --budget-limit <BUDGET_LIMIT> Maximum invocation budget (0 = unlimited). Default 0.
  • --output <OUTPUT> Output file for the certificate JSON.

chio cert verify

Verify a compliance certificate.

bash
chio cert verify [OPTIONS] --certificate <CERTIFICATE> --trusted-kernel-pubkey <PATH>
  • --certificate <CERTIFICATE> Path to the certificate JSON file. Required.
  • --trusted-kernel-pubkey <PATH> Trusted kernel public-key file used to verify the certificate signature. Raw 32-byte Ed25519 and algorithm-aware hex files are accepted. Required.
  • --full Enable full-bundle verification (re-verify all receipt signatures).
  • --receipt-db <RECEIPT_DB> Path to the receipt database (required for full-bundle mode).

chio cert inspect

Inspect a compliance certificate and display its contents.

bash
chio cert inspect [OPTIONS] --certificate <CERTIFICATE>
  • --certificate <CERTIFICATE> Path to the certificate JSON file. Required.

chio guard

Guard development lifecycle: scaffold, build, and inspect WASM guards.

bash
chio guard [OPTIONS] <COMMAND>

chio guard new

Scaffold a new guard project with Cargo.toml, src/lib.rs, and guard-manifest.yaml.

bash
chio guard new [OPTIONS] <NAME>
  • <NAME> Name of the guard project to create. Required.

chio guard build

Compile the guard in the current directory to wasm32-unknown-unknown.

bash
chio guard build [OPTIONS]

chio guard inspect

Inspect a compiled .wasm guard binary and print exports, ABI compatibility, and memory config.

bash
chio guard inspect [OPTIONS] <PATH>
  • <PATH> Path to the .wasm file to inspect. Required.

chio guard test

Run YAML test fixtures against a compiled .wasm guard.

bash
chio guard test [OPTIONS] --wasm <WASM> [FIXTURES]...
  • [FIXTURES]... Glob or paths to YAML fixture files.
  • --wasm <WASM> Path to the .wasm file to test. Required.
  • --fuel-limit <FUEL_LIMIT> Fuel limit per fixture evaluation (default: 1_000_000). Default 1000000.

chio guard bench

Benchmark a compiled .wasm guard for fuel consumption and latency.

bash
chio guard bench [OPTIONS] <PATH>
  • <PATH> Path to the .wasm file to benchmark. Required.
  • --iterations <ITERATIONS> Number of iterations (default: 100). Default 100.
  • --fuel-limit <FUEL_LIMIT> Fuel limit per evaluation (default: 1_000_000). Default 1000000.

chio guard pack

Package a guard project into a distributable .arcguard archive.

bash
chio guard pack [OPTIONS]

chio guard publish

Publish a guard project as a three-layer OCI artifact.

bash
chio guard publish [OPTIONS] --ref <REFERENCE> --epoch-id-seed <EPOCH_ID_SEED> <PROJECT>
  • <PROJECT> Guard project directory containing guard-manifest.yaml. Required.
  • --ref <REFERENCE> Tag-addressed OCI destination, for example oci://ghcr.io/chio/tool-gate:v1. Required.
  • --wit <WIT> WIT file to publish as the first layer. Default wit/chio-guard/world.wit.
  • --signer-public-key <SIGNER_PUBLIC_KEY> Ed25519 signer public key as ed25519:<base64>. If omitted, guard-manifest.yaml is used.
  • --signer-subject <SIGNER_SUBJECT> Optional Sigstore signer subject annotation.
  • --fuel-limit <FUEL_LIMIT> Runtime fuel limit recorded in the config blob. Default 5000000.
  • --memory-limit-bytes <MEMORY_LIMIT_BYTES> Runtime memory limit in bytes recorded in the config blob. Default 16777216.
  • --epoch-id-seed <EPOCH_ID_SEED> Epoch seed recorded in the config blob. Required.
  • --username <USERNAME> Registry username for HTTP basic auth.
  • --password <PASSWORD> Registry password or token for HTTP basic auth. Prefer CHIO_GUARD_REGISTRY_PASSWORD env over the argv form so the secret does not leak via ps / /proc/<pid>/cmdline. Reads CHIO_GUARD_REGISTRY_PASSWORD.
  • --allow-http-registry <ALLOW_HTTP_REGISTRY> Registry host allowed to use HTTP instead of HTTPS.

chio guard pull

Pull a digest-pinned guard OCI artifact into the local content-addressed cache.

bash
chio guard pull [OPTIONS] --ref <REFERENCE>
  • --ref <REFERENCE> Digest-pinned OCI source, for example oci://ghcr.io/chio/tool-gate@sha256:<digest>. Required.
  • --username <USERNAME> Registry username for HTTP basic auth.
  • --password <PASSWORD> Registry password or token for HTTP basic auth. Prefer CHIO_GUARD_REGISTRY_PASSWORD env over the argv form so the secret does not leak via ps / /proc/<pid>/cmdline. Reads CHIO_GUARD_REGISTRY_PASSWORD.
  • --allow-http-registry <ALLOW_HTTP_REGISTRY> Registry host allowed to use HTTP instead of HTTPS.
  • --sigstore-bundle <PATH> Optional Sigstore bundle JSON to cache alongside the pulled artifact.
  • --sigstore-identity-regex <REGEX> Fulcio certificate identity SAN regex required for Sigstore cache admission.
  • --sigstore-oidc-issuer <URL> OIDC issuer expected on the Sigstore certificate.

chio guard blocklist

Manage the local guard digest blocklist.

bash
chio guard blocklist [OPTIONS] <COMMAND>

chio guard blocklist remove

Remove a digest from the local guard blocklist.

bash
chio guard blocklist remove [OPTIONS] <DIGEST>
  • <DIGEST> Digest to remove, as sha256:<64-hex> or bare 64-hex. Required.

chio guard install

Install a .arcguard archive to the guard directory.

bash
chio guard install [OPTIONS] <PATH>
  • <PATH> Path to the .arcguard archive file. Required.
  • --target-dir <TARGET_DIR> Target directory to extract into (default: ./guards/). Default guards.

chio guard sign

Sign a .wasm guard binary and write a .wasm.sig sidecar.

bash
chio guard sign [OPTIONS] --key <KEY> --name <NAME> --version <VERSION> <WASM>
  • <WASM> Path to the .wasm file to sign. Required.
  • --key <KEY> Path to a file containing a hex-encoded 32-byte Ed25519 signing seed. Required.
  • --name <NAME> Module name to embed in the signed envelope (matches guard-manifest.yaml). Required.

chio guard verify

Verify the .wasm.sig sidecar for a .wasm guard binary (exits 0 on success).

bash
chio guard verify [OPTIONS] <WASM>
  • <WASM> Path to the .wasm file to verify. Required.

chio guard market

Marketplace surface: list, info, install priced guards.

bash
chio guard market [OPTIONS] <COMMAND>

chio guard market list

List guards visible to the tenant under the tenant’s reputation tier.

bash
chio guard market list [OPTIONS] --catalog <PATH>
  • --catalog <PATH> Path to the marketplace catalog JSON file. Required.
  • --tenant <ID> Tenant identifier surfaced in audit-trail output. Default default.
  • --tier <TIER> Tenant reputation tier (tier0/tier1/tier2/tier3). Default tier0.
  • --currency <CCY> Currency the tenant pays in (ISO 4217). Default USD.
  • --json Emit a stable JSON report on stdout instead of a TTY table.

chio guard market info

Show price, reputation floor, cosign status, recent settlements.

bash
chio guard market info [OPTIONS] --catalog <PATH> --ref <OCI_REF>
  • --catalog <PATH> Path to the marketplace catalog JSON file. Required.
  • --ref <OCI_REF> Digest-pinned guard reference. Required.
  • --tenant <ID> Tenant identifier surfaced in audit-trail output. Default default.
  • --tier <TIER> Tenant reputation tier. Default tier0.
  • --currency <CCY> Tenant currency. Default USD.
  • --publisher-revoked Treat the publisher as revoked by the revocation oracle.
  • --json Emit a stable JSON report on stdout instead of plain text.

chio guard market install

Bind a pulled guard to the tenant bundle and registered price. Idempotent on replay.

bash
chio guard market install [OPTIONS] --catalog <PATH> --bundle-dir <DIR> --ref <OCI_REF>
  • --catalog <PATH> Path to the marketplace catalog JSON file. Required.
  • --bundle-dir <DIR> Path to the tenant bundle directory (created if missing). Required.
  • --ref <OCI_REF> Digest-pinned guard reference to install. Required.
  • --tenant <ID> Tenant identifier. Default default.
  • --tier <TIER> Tenant reputation tier. Default tier0.
  • --currency <CCY> Tenant currency. Default USD.
  • --publisher-revoked Treat the publisher as revoked by the revocation oracle.
  • --json Emit a stable JSON record on stdout.

chio conformance

Run the cross-language conformance harness against a peer adapter.

bash
chio conformance [OPTIONS] <COMMAND>

chio conformance run

Execute conformance scenarios against a peer language adapter.

bash
chio conformance run [OPTIONS] --peer <PEER>
  • --peer <PEER> Peer language adapter to exercise (js, python, go, cpp, or all). Required.
  • --report <REPORT> Optional report format. Pass json to emit machine-readable JSON summarising the run; omit to print a human-readable summary.
  • --scenario <SCENARIO> Optional scenario id filter. When set, only scenarios with this id are surfaced in the printed/written report; the underlying harness still executes the full corpus.
  • --output <OUTPUT> Optional output file. When provided, the report is written to this path; otherwise the report is printed to stdout.
  • --peer-binary <PATH> Explicit peer executable to run. Valid only with a single --peer language, and used by release smoke tests after fetch-peers downloads a pinned artifact.

chio conformance fetch-peers

Download pre-built peer-language adapter binaries pinned in crates/tooling/chio-conformance/peers.lock.toml.

bash
chio conformance fetch-peers [OPTIONS]
  • --check Verify the lockfile shape only; do not download anything.
  • --out <OUT> Output directory for fetched binaries. Default ./.chio-peers.
  • --language <LANGUAGE> Optional language filter (python, js, go, cpp).
  • --allow-unpublished-only Allow a selection whose matching peers are all published = false. This is only for pre-release workflows that validate lockfile shape before release assets exist; normal fetches fail closed.
  • --lockfile <LOCKFILE> Optional explicit path to peers.lock.toml. When omitted the CLI consults $CHIO_PEERS_LOCK, the XDG config dir, the in-repo path, and the cwd in that order.

chio federation

Produce and verify cross-kernel federation artifacts.

bash
chio federation [OPTIONS] <COMMAND>

chio federation authority

Produce local federation authority artifacts for offline verification.

bash
chio federation authority [OPTIONS] <COMMAND>

chio federation authority issue

Issue capability leases, lease-scope bindings, and governance receipts.

bash
chio federation authority issue [OPTIONS] --profile <PATH> --request <PATH> --signing-keys <PATH> --out-dir <DIR>
  • --profile <PATH> Public authority profile JSON. Required.
  • --request <PATH> Chio issuance request JSON. Required.
  • --signing-keys <PATH> Local signing-key JSON. Keep this outside committed fixtures. Required.
  • --out-dir <DIR> Output directory for the issuance bundle and split artifacts. Required.

chio federation authority checkpoint

Publish a signed revocation checkpoint from local authority state.

bash
chio federation authority checkpoint [OPTIONS] --profile <PATH> --revocations <PATH> --signing-keys <PATH> --out <PATH>
  • --profile <PATH> Public authority profile JSON. Required.
  • --revocations <PATH> Revocation publication request JSON. Required.
  • --signing-keys <PATH> Local signing-key JSON. Keep this outside committed fixtures. Required.
  • --out <PATH> Output path for the signed checkpoint JSON. Required.

chio federation authority trust-bundle

Assemble verifier-owned trust inputs.

bash
chio federation authority trust-bundle [OPTIONS] <COMMAND>

chio federation authority trust-bundle assemble

Assemble a strict verifier trust bundle.

bash
chio federation authority trust-bundle assemble [OPTIONS] --profile <PATH> --peer-pins <PATH> --workflow-intersection <PATH> --disclosure-policy <PATH> --checkpoint <PATH> --out <PATH>
  • --profile <PATH> Public authority profile JSON. Required.
  • --peer-pins <PATH> Verifier-owned peer, vendor, and action-class pins JSON. Required.
  • --workflow-intersection <PATH> Workflow intersection artifact JSON. Required.
  • --disclosure-policy <PATH> Disclosure policy JSON. Required.
  • --checkpoint <PATH> Signed revocation checkpoint JSON. Required.
  • --out <PATH> Output path for the verifier trust bundle JSON. Required.

chio federation treaty

Verify treaty-bound cross-kernel provenance artifacts.

bash
chio federation treaty [OPTIONS] <COMMAND>

chio federation treaty intersect

Compute a local ladder intersection from verifier-owned treaty inputs.

bash
chio federation treaty intersect [OPTIONS] --treaty-scope <PATH> --now-unix-ms <NOW_UNIX_MS> --report <PATH>
  • --treaty-scope <PATH> Treaty scope JSON. Required.
  • --manifest <PATH> Governance ladder manifest JSON. Pass once per participant.
  • --now-unix-ms <NOW_UNIX_MS> Intersection generation time in Unix milliseconds. Required.
  • --report <PATH> Output path for ladder intersection JSON. Required.

chio federation treaty admit

Evaluate treaty-bound cross-boundary admission evidence.

bash
chio federation treaty admit [OPTIONS] --treaty-scope <PATH> --ladder-intersection <PATH> --expected-ladder-intersection-sha256 <EXPECTED_LADDER_INTERSECTION_SHA256> --action-class-id <ACTION_CLASS_ID> --now-unix-ms <NOW_UNIX_MS> --report <PATH>
  • --treaty-scope <PATH> Treaty scope JSON. Required.
  • --ladder-intersection <PATH> Ladder intersection JSON. Required.
  • --expected-ladder-intersection-sha256 <EXPECTED_LADDER_INTERSECTION_SHA256> Expected ladder intersection SHA-256 from verifier-owned computation. Required.
  • --action-class-id <ACTION_CLASS_ID> Action class id to admit. Required.
  • --evidence <EVIDENCE> Verified evidence ref as evidence_class=artifact_sha256. Pass once per item.
  • --now-unix-ms <NOW_UNIX_MS> Admission evaluation time in Unix milliseconds. Required.
  • --report <PATH> Output path for cross-boundary admission report JSON. Required.

chio federation treaty verify-packet

Verify a buyer packet against receipt-lineage evidence.

bash
chio federation treaty verify-packet [OPTIONS] --packet <PATH> --lineage-statement <PATH> --continuation <PATH> --admission-report <PATH> --bilateral-invocation <PATH> --report <PATH>
  • --packet <PATH> Buyer attestation packet JSON. Required.
  • --lineage-statement <PATH> Receipt lineage statement JSON. Required.
  • --continuation <PATH> Cross-kernel continuation JSON. Required.
  • --admission-report <PATH> Cross-boundary admission report JSON. Required.
  • --bilateral-invocation <PATH> Bilateral invocation JSON. Required.
  • --report <PATH> Output path for buyer attestation verification report JSON. Required.

chio attest

Verify offline attestation evidence and buyer proof packages.

bash
chio attest [OPTIONS] <COMMAND>

chio attest buyer

Package, verify, and explain buyer-facing attestation evidence.

bash
chio attest buyer [OPTIONS] <COMMAND>

chio attest buyer packet

Build a buyer review packet from a local runtime output directory.

bash
chio attest buyer packet [OPTIONS] --run-output <DIR> --out <PATH>
  • --run-output <DIR> Runtime output directory containing buyer review artifacts. Required.
  • --out <PATH> Output path for buyer attestation review packet JSON. Required.

chio attest buyer verify

Verify a buyer review package against verifier-owned inputs.

bash
chio attest buyer verify [OPTIONS] --package <PATH> --trust-bundle <PATH> --context <PATH> --report <PATH>
  • --package <PATH> Buyer attestation review package JSON. Required.
  • --trust-bundle <PATH> Verifier-owned trust bundle JSON. Required.
  • --context <PATH> Verifier context JSON. Required.
  • --report <PATH> Output path for buyer attestation review report JSON. Required.

chio attest buyer verify-proof

Verify a Chio attest proof package directly.

bash
chio attest buyer verify-proof [OPTIONS] --package <PATH> --trust-bundle <PATH> --context <PATH> --report <PATH>
  • --package <PATH> Chio attest proof package JSON. Required.
  • --trust-bundle <PATH> Verifier-owned trust bundle JSON. Required.
  • --context <PATH> Verifier context JSON. Required.
  • --report <PATH> Output path for verifier report JSON. Required.

chio attest buyer verify-packet

Verify a hash-only buyer packet as unresolved unless full DSSE review hydrates it.

bash
chio attest buyer verify-packet [OPTIONS] --packet <PATH> --lineage-statement <PATH> --continuation <PATH> --admission-report <PATH> --bilateral-invocation <PATH> --report <PATH>
  • --packet <PATH> Buyer attestation packet JSON. Required.
  • --lineage-statement <PATH> Receipt lineage statement JSON. Required.
  • --continuation <PATH> Cross-kernel continuation JSON. Required.
  • --admission-report <PATH> Cross-boundary admission report JSON. Required.
  • --bilateral-invocation <PATH> Bilateral invocation JSON. Required.
  • --report <PATH> Output path for buyer attestation verification report JSON. Required.

chio attest buyer explain

Render a buyer review report as JSON or plain text.

bash
chio attest buyer explain [OPTIONS] --report <PATH> --out <PATH>
  • --report <PATH> Buyer attestation review report JSON. Required.
  • --format <FORMAT> Explanation format. Default text. Values json, text.
  • --out <PATH> Output path for explanation. Required.

chio attest supply-chain

Verify Sigstore-backed supply-chain attestations.

bash
chio attest supply-chain [OPTIONS] <COMMAND>

chio attest supply-chain verify

Verify a Sigstore bundle against the artifact bytes and expected identity.

bash
chio attest supply-chain verify [OPTIONS] --artifact <PATH> --bundle <PATH> --issuer-san-regex <REGEX> --issuer-oidc <URL>
  • --artifact <PATH> Artifact bytes covered by the Sigstore bundle. Required.
  • --bundle <PATH> Sigstore bundle JSON. Required.
  • --issuer-san-regex <REGEX> Fulcio certificate identity SAN regex expected on the signing cert. Required.
  • --issuer-oidc <URL> Fulcio certificate OIDC issuer expected on the signing cert. Required.
  • --report <PATH> Optional output path for a verification report. Defaults to stdout.

chio attest runtime-quote

Verify runtime quote evidence.

bash
chio attest runtime-quote [OPTIONS] <COMMAND>

chio attest runtime-quote verify

Verify runtime quote evidence through chio-attest-verify.

bash
chio attest runtime-quote verify [OPTIONS] --kernel-public-key <KEY> --receipt-root <HEX>
  • --kernel-public-key <KEY> Kernel signing public key in Chio canonical text form. Required.
  • --receipt-root <HEX> Receipt root as 64 lowercase hex characters. Required.
  • --report-data <HEX> Optional observed runtime quote report-data bytes for diagnostic comparison.
  • --tee-kind <KIND> TEE backend that produced the quote. Values intel-tdx, amd-sev-snp, aws-nitro.
  • --quote <PATH> Raw quote bytes to verify.
  • --collateral <PATH> Backend collateral JSON used to verify the quote.
  • --report <PATH> Optional output path for a verification report. Defaults to stdout.

chio runtime

Evaluate local live-runtime admission artifacts.

bash
chio runtime [OPTIONS] <COMMAND>

chio runtime admit

Evaluate a runtime admission request against verifier-owned local state.

bash
chio runtime admit [OPTIONS] --request <PATH> --admission-profile <PATH> --admission-bundle <PATH> --store <PATH> --now-unix-ms <NOW_UNIX_MS> --report <PATH>
  • --request <PATH> Stable request binding JSON. Required.
  • --admission-profile <PATH> Runtime admission profile JSON. Required.
  • --admission-bundle <PATH> Runtime admission bundle JSON to pin into local admission state. Required.
  • --runtime-trust-input <PATH> Signed strict runtime trust input JSON.
  • --trusted-verifiers <PATH> Caller-supplied trusted verifier keys JSON.
  • --pheromone-query-report <PATH> Signed pheromone query report to record as observe-only advice.
  • --runtime-pheromone-policy <PATH> Signed verifier-owned runtime pheromone policy JSON.
  • --runtime-peer-weights <PATH> Signed verifier-owned runtime peer weights JSON.
  • --action-class-id <ACTION_CLASS_ID> Treaty or governance action class id used for runtime policy matching.
  • --trust-floor-state <PATH> Durable trust-floor state path. Uses --store when omitted.
  • --store <PATH> Durable local admission store JSON. Required.
  • --now-unix-ms <NOW_UNIX_MS> Admission evaluation time in Unix milliseconds. Required.
  • --report <PATH> Output path for runtime admission report JSON. Required.

chio runtime sign-trust-input

Sign a strict runtime trust input from verifier-owned local material.

bash
chio runtime sign-trust-input [OPTIONS] --body <PATH> --signing-seed-file <PATH> --out <PATH>
  • --body <PATH> Runtime trust input body JSON. Required.
  • --signing-seed-file <PATH> Hex-encoded 32-byte Ed25519 signing seed file. Required.
  • --out <PATH> Output path for signed runtime trust input JSON. Required.

chio runtime policy

Sign verifier-owned runtime pheromone policy material.

bash
chio runtime policy [OPTIONS] <COMMAND>

chio runtime policy sign

Sign a runtime pheromone policy body.

bash
chio runtime policy sign [OPTIONS] --body <PATH> --signing-seed-file <PATH> --out <PATH>
  • --body <PATH> Runtime pheromone policy body JSON. Required.
  • --signing-seed-file <PATH> Hex-encoded 32-byte Ed25519 signing seed file. Required.
  • --out <PATH> Output path for signed runtime pheromone policy JSON. Required.

chio runtime peer-weights

Sign verifier-owned runtime peer weights material.

bash
chio runtime peer-weights [OPTIONS] <COMMAND>

chio runtime peer-weights hash

Compute the canonical hash of a runtime peer weights body.

bash
chio runtime peer-weights hash [OPTIONS] --body <PATH> --out <PATH>
  • --body <PATH> Runtime peer weights body JSON. Required.
  • --out <PATH> Output path for the canonical hash. Required.

chio runtime peer-weights sign

Sign a runtime peer weights body.

bash
chio runtime peer-weights sign [OPTIONS] --body <PATH> --signing-seed-file <PATH> --out <PATH>
  • --body <PATH> Runtime peer weights body JSON. Required.
  • --signing-seed-file <PATH> Hex-encoded 32-byte Ed25519 signing seed file. Required.
  • --out <PATH> Output path for signed runtime peer weights JSON. Required.

chio runtime pheromone

Evaluate runtime pheromone policy without mutating admission state.

bash
chio runtime pheromone [OPTIONS] <COMMAND>

chio runtime pheromone sign-query-report

Sign a pheromone query report for runtime admission.

bash
chio runtime pheromone sign-query-report [OPTIONS] --body <PATH> --signing-seed-file <PATH> --out <PATH>
  • --body <PATH> Pheromone query report body JSON. Required.
  • --signing-seed-file <PATH> Hex seed file for the verifier signing key. Required.
  • --out <PATH> Output path for signed pheromone query report JSON. Required.

chio runtime pheromone evaluate

Evaluate a signed runtime pheromone policy over a query report.

bash
chio runtime pheromone evaluate [OPTIONS] --admission-bundle <PATH> --runtime-trust-input <PATH> --trusted-verifiers <PATH> --pheromone-query-report <PATH> --runtime-pheromone-policy <PATH> --runtime-peer-weights <PATH> --now-unix-ms <NOW_UNIX_MS> --report <PATH>
  • --admission-bundle <PATH> Runtime admission bundle JSON for request binding. Required.
  • --runtime-trust-input <PATH> Signed strict runtime trust input JSON. Required.
  • --trusted-verifiers <PATH> Caller-supplied trusted verifier keys JSON. Required.
  • --pheromone-query-report <PATH> Signed pheromone query report JSON. Required.
  • --runtime-pheromone-policy <PATH> Signed verifier-owned runtime pheromone policy JSON. Required.
  • --runtime-peer-weights <PATH> Signed verifier-owned runtime peer weights JSON. Required.
  • --action-class-id <ACTION_CLASS_ID> Treaty or governance action class id used for runtime policy matching.
  • --now-unix-ms <NOW_UNIX_MS> Evaluation time in Unix milliseconds. Required.
  • --report <PATH> Output path for policy decision JSON. Required.

chio runtime orchestrate

Run production local Chio runtime orchestration checks.

bash
chio runtime orchestrate [OPTIONS] <COMMAND>

chio runtime orchestrate lint

Validate a runtime orchestration profile.

bash
chio runtime orchestrate lint [OPTIONS] --profile <PATH> --report <PATH>
  • --profile <PATH> Runtime orchestration profile JSON. Required.
  • --report <PATH> Output path for schema-valid status report JSON. Required.

chio runtime orchestrate plan

Build a local runtime orchestration plan.

bash
chio runtime orchestrate plan [OPTIONS] --profile <PATH> --run-contract <PATH> --store <PATH> --evidence-dir <DIR> --now-unix-ms <NOW_UNIX_MS> --report <PATH>
  • --profile <PATH> Runtime orchestration profile JSON. Required.
  • --run-contract <PATH> Runtime run contract JSON. Required.
  • --store <PATH> SQLite runtime orchestration store path. Required.
  • --evidence-dir <DIR> Runtime evidence directory. Required.
  • --now-unix-ms <NOW_UNIX_MS> Plan time in Unix milliseconds. Required.
  • --report <PATH> Output path for orchestration plan JSON. Required.

chio runtime orchestrate run

Record a local runtime orchestration run from verifier-accepted evidence.

bash
chio runtime orchestrate run [OPTIONS] --profile <PATH> --run-contract <PATH> --store <PATH> --evidence-dir <DIR> --now-unix-ms <NOW_UNIX_MS> --report <PATH>
  • --profile <PATH> Runtime orchestration profile JSON. Required.
  • --run-contract <PATH> Runtime run contract JSON. Required.
  • --store <PATH> SQLite runtime orchestration store path. Required.
  • --evidence-dir <DIR> Runtime evidence directory produced by run-loopback. Required.
  • --now-unix-ms <NOW_UNIX_MS> Run time in Unix milliseconds. Required.
  • --report <PATH> Output path for orchestration run report JSON. Required.

chio runtime orchestrate resume

Build a local runtime orchestration resume plan.

bash
chio runtime orchestrate resume [OPTIONS] --profile <PATH> --resume-plan <PATH> --store <PATH> --evidence-dir <DIR> --now-unix-ms <NOW_UNIX_MS> --report <PATH>
  • --profile <PATH> Runtime orchestration profile JSON. Required.
  • --resume-plan <PATH> Runtime orchestration resume plan input JSON. Required.
  • --store <PATH> SQLite runtime orchestration store path. Required.
  • --evidence-dir <DIR> Runtime evidence directory. Required.
  • --now-unix-ms <NOW_UNIX_MS> Resume time in Unix milliseconds. Required.
  • --report <PATH> Output path for resolved resume plan JSON. Required.

chio runtime orchestrate status

Summarize local runtime orchestration state.

bash
chio runtime orchestrate status [OPTIONS] --profile <PATH> --store <PATH> --evidence-dir <DIR> --report <PATH>
  • --profile <PATH> Runtime orchestration profile JSON. Required.
  • --store <PATH> SQLite runtime orchestration store path. Required.
  • --evidence-dir <DIR> Runtime evidence directory. Required.
  • --now-unix-ms <NOW_UNIX_MS> Status time in Unix milliseconds. Defaults to current wall time.
  • --report <PATH> Output path for status report JSON. Required.

chio runtime orchestrate drift

Compare repeated local runtime proof regeneration outputs.

bash
chio runtime orchestrate drift [OPTIONS] --profile <PATH> --runs-dir <DIR> --since-unix-ms <SINCE_UNIX_MS> --until-unix-ms <UNTIL_UNIX_MS> --report <PATH>
  • --profile <PATH> Runtime orchestration profile JSON. Required.
  • --runs-dir <DIR> Directory containing per-run runtime evidence directories. Required.
  • --since-unix-ms <SINCE_UNIX_MS> Inclusive lower time bound in Unix milliseconds. Required.
  • --until-unix-ms <UNTIL_UNIX_MS> Inclusive upper time bound in Unix milliseconds. Required.
  • --report <PATH> Output path for proof drift report JSON. Required.

chio runtime ops

Run local Chio runtime operations supervision checks.

bash
chio runtime ops [OPTIONS] <COMMAND>

chio runtime ops supervise

Supervise local runtime operations and emit aggregate status.

bash
chio runtime ops supervise [OPTIONS] --supervisor-profile <PATH> --store <PATH> --evidence-root <DIR> --now-unix-ms <NOW_UNIX_MS> --report <PATH>
  • --supervisor-profile <PATH> Required.
  • --store <PATH> Required.
  • --evidence-root <DIR> Required.
  • --provider-bindings <PATH>
  • --now-unix-ms <NOW_UNIX_MS> Required.
  • --report <PATH> Required.

chio runtime ops tick

Run one bounded local scheduler tick.

bash
chio runtime ops tick [OPTIONS] --supervisor-profile <PATH> --store <PATH> --evidence-root <DIR> --owner-id <OWNER_ID> --now-unix-ms <NOW_UNIX_MS> --max-runs <MAX_RUNS> --report <PATH>
  • --supervisor-profile <PATH> Required.
  • --store <PATH> Required.
  • --evidence-root <DIR> Required.
  • --owner-id <OWNER_ID> Required.
  • --now-unix-ms <NOW_UNIX_MS> Required.
  • --max-runs <MAX_RUNS> Required.
  • --report <PATH> Required.

chio runtime ops status

Summarize local runtime operations status.

bash
chio runtime ops status [OPTIONS] --supervisor-profile <PATH> --store <PATH> --evidence-root <DIR> --report <PATH>
  • --supervisor-profile <PATH> Required.
  • --store <PATH> Required.
  • --evidence-root <DIR> Required.
  • --provider-bindings <PATH>
  • --now-unix-ms <NOW_UNIX_MS>
  • --report <PATH> Required.

chio runtime ops recovery-drill

Dry-run local recovery classification for a runtime run.

bash
chio runtime ops recovery-drill [OPTIONS] --supervisor-profile <PATH> --run-id <RUN_ID> --store <PATH> --evidence-root <DIR> --now-unix-ms <NOW_UNIX_MS> --report <PATH>
  • --supervisor-profile <PATH> Required.
  • --run-id <RUN_ID> Required.
  • --store <PATH> Required.
  • --evidence-root <DIR> Required.
  • --now-unix-ms <NOW_UNIX_MS> Required.
  • --report <PATH> Required.

chio runtime ops evidence-health

Verify local runtime evidence sink health for one run.

bash
chio runtime ops evidence-health [OPTIONS] --supervisor-profile <PATH> --run-id <RUN_ID> --store <PATH> --evidence-root <DIR> --report <PATH>
  • --supervisor-profile <PATH> Required.
  • --run-id <RUN_ID> Required.
  • --store <PATH> Required.
  • --evidence-root <DIR> Required.
  • --now-unix-ms <NOW_UNIX_MS>
  • --report <PATH> Required.

chio runtime ops provider-health

Verify static local provider bindings.

bash
chio runtime ops provider-health [OPTIONS] --supervisor-profile <PATH> --provider-bindings <PATH> --report <PATH>
  • --supervisor-profile <PATH> Required.
  • --provider-bindings <PATH> Required.
  • --now-unix-ms <NOW_UNIX_MS>
  • --report <PATH> Required.

chio runtime ops retention

Plan runtime artifact retention without mutating evidence.

bash
chio runtime ops retention [OPTIONS] <COMMAND>

chio runtime ops retention plan

Plan dry-run runtime artifact retention.

bash
chio runtime ops retention plan [OPTIONS] --retention-profile <PATH> --store <PATH> --evidence-root <DIR> --now-unix-ms <NOW_UNIX_MS> --report <PATH>
  • --retention-profile <PATH> Required.
  • --store <PATH> Required.
  • --evidence-root <DIR> Required.
  • --now-unix-ms <NOW_UNIX_MS> Required.
  • --report <PATH> Required.

chio runtime run-loopback

Generate a local loopback runtime scenario report.

bash
chio runtime run-loopback [OPTIONS] --scenario <PATH> --store-dir <PATH> --now-unix-ms <NOW_UNIX_MS> --out-dir <PATH>
  • --scenario <PATH> Runtime loopback scenario JSON. Required.
  • --static-package <PATH> Static proof package used as the parity baseline.
  • --static-report <PATH> Static verifier report used as the parity baseline.
  • --store-dir <PATH> Directory for local runtime stores. Required.
  • --now-unix-ms <NOW_UNIX_MS> Scenario evaluation time in Unix milliseconds. Required.
  • --out-dir <PATH> Output directory for generated runtime evidence. Required.

chio pheromone

Receive, query, and relay pheromone artifacts.

bash
chio pheromone [OPTIONS] <COMMAND>

chio pheromone receive

Verify and store a local pheromone gossip batch.

bash
chio pheromone receive [OPTIONS] --batch <PATH> --transit-policy <PATH> --proof-package <PATH> --trust-bundle <PATH> --context <PATH> --store <PATH> --report <PATH>
  • --batch <PATH> Pheromone gossip batch JSON. Required.
  • --transit-policy <PATH> Local transit policy JSON with receiver admission material. Required.
  • --proof-package <PATH> Verified Chio proof package JSON. Required.
  • --trust-bundle <PATH> Verifier-owned Chio trust bundle JSON. Required.
  • --context <PATH> Chio verification context JSON. Required.
  • --store <PATH> SQLite store path for local pheromone state. Required.
  • --now-unix-ms <NOW_UNIX_MS> Receiver evaluation time in Unix milliseconds.
  • --report <PATH> Output path for receive report JSON. Required.

chio pheromone query

Query local pheromone concentration from a durable store.

bash
chio pheromone query [OPTIONS] --store <PATH> --subject-class <ID> --namespace <NS> --reputation-epoch <REPUTATION_EPOCH> --peer-weights <PATH> --report <PATH>
  • --store <PATH> SQLite store path for local pheromone state. Required.
  • --subject-class <ID> Subject class id. Required.
  • --namespace <NS> Subject class namespace. Required.
  • --reputation-epoch <REPUTATION_EPOCH> Reputation epoch for advisory weighting. Required.
  • --peer-weights <PATH> Peer weights JSON. Required.
  • --now-unix-ms <NOW_UNIX_MS> Query evaluation time in Unix milliseconds.
  • --report <PATH> Output path for query report JSON. Required.

chio pheromone relay

Run or inspect live pheromone relay state.

bash
chio pheromone relay [OPTIONS] <COMMAND>

chio pheromone relay lint

Lint a relay peer directory against an operational profile.

bash
chio pheromone relay lint [OPTIONS] --profile <PROFILE> --report <PATH>
  • --peer-directory <PATH> Raw peer directory or signed peer-directory bundle JSON.
  • --peer-directory-state <PATH> Verifier-owned active peer-directory state JSON.
  • --profile <PROFILE> Relay operational profile. Required. Values local-dev, production.
  • --trusted-issuers <PATH> Trusted peer-directory issuer config required for production bundles.
  • --report <PATH> Output path for lint report JSON. Required.

chio pheromone relay serve

Serve signed pheromone relay HTTP endpoints.

bash
chio pheromone relay serve [OPTIONS] --listen <ADDR> --store <PATH> --transit-policy <PATH> --proof-package <PATH> --trust-bundle <PATH> --context <PATH> --report-dir <DIR>
  • --listen <ADDR> Listen address for the relay HTTP service. Required.
  • --store <PATH> SQLite store path for runtime and relay state. Required.
  • --peer-directory <PATH> Verifier-owned peer directory JSON.
  • --peer-directory-state <PATH> Verifier-owned active peer-directory state JSON.
  • --profile <PROFILE> Relay operational profile. Default local-dev. Values local-dev, production.
  • --trusted-issuers <PATH> Trusted peer-directory issuer config for signed bundles.
  • --transit-policy <PATH> Local transit policy JSON with receiver admission material. Required.
  • --proof-package <PATH> Verified Chio proof package JSON. Required.
  • --trust-bundle <PATH> Verifier-owned Chio trust bundle JSON. Required.
  • --context <PATH> Chio verification context JSON. Required.
  • --report-dir <DIR> Directory for per-request relay reports. Required.
  • --operator-token-env <ENV> Environment variable containing the operator token for observability endpoints.
  • --iroh-enable Mount the iroh federation-transport mesh alongside the HTTP relay (DUAL). OFF by default: with it off the serve path is byte-for-byte unchanged.
  • --iroh-transport-directory <PATH> Issuer-signed iroh transport-directory bundle JSON. Required with --iroh-enable; verified fail-closed against --trusted-issuers.
  • --iroh-transport-directory-state <PATH> Optional rotation-state pin ({ "versionFloor": N, "expectedPreviousVersionSha256": ".." }) for the transport-directory bundle. Without it only a GENESIS bundle loads (floor 0, no predecessor); a rotated successor bundle needs this to pin the rollback floor and the predecessor hash it must chain onto.
  • --iroh-transport-key <PATH> Dedicated rotatable ed25519 transport key file ({ "seedHex": ".." }), SEPARATE from the passport/relay signing key. Required with --iroh-enable.
  • --iroh-bind-addr <ADDR> Socket address the iroh endpoint binds. Default 0.0.0.0:0 (ephemeral port) is convenient for a quick DUAL trial, but a random port cannot be found by peers under the default RelayMode::Disabled. For a DURABLE deployment set a STABLE address here and pair it with a discovery mechanism / --iroh-relay-url so peers can reach a fixed EndpointId at a fixed address. The actual bound address(es) + EndpointId are logged at startup (tracing target "chio.iroh.transport"). Default 0.0.0.0:0.
  • --iroh-relay-url <URL> Self-hosted relay URL(s). Repeatable. Omitted -> RelayMode::Disabled (direct addressing; never the n0 free relays).
  • --iroh-lanes <LANES> Comma-separated iroh lanes to mount. Default: pheromone (the only lane that shares the relay receiver + store on this hook). Default pheromone.

chio pheromone relay enqueue

Queue accepted local relay work for subscribed peers.

bash
chio pheromone relay enqueue [OPTIONS] --store <PATH> --batch <PATH> --transit-policy <PATH> --trust-bundle <PATH> --now-unix-ms <NOW_UNIX_MS> --report <PATH>
  • --store <PATH> SQLite store path for relay state. Required.
  • --batch <PATH> Pheromone gossip batch JSON to queue for a subscribed peer. Required.
  • --transit-policy <PATH> Local transit policy JSON used to verify non-empty relay batches. Required.
  • --trust-bundle <PATH> Verifier-owned Chio trust bundle that authorizes the signed transit policy issuer. Required.
  • --peer-directory <PATH> Verifier-owned peer directory JSON.
  • --peer-directory-state <PATH> Verifier-owned active peer-directory state JSON.
  • --profile <PROFILE> Relay operational profile. Default local-dev. Values local-dev, production.
  • --trusted-issuers <PATH> Trusted peer-directory issuer config for signed bundles.
  • --now-unix-ms <NOW_UNIX_MS> Evaluation time in Unix milliseconds. Required.
  • --report <PATH> Output path for enqueue report JSON. Required.

chio pheromone relay tick

Run one deterministic relay scheduler tick.

bash
chio pheromone relay tick [OPTIONS] --store <PATH> --max-batches <MAX_BATCHES> --signing-key <PATH> --report <PATH>
  • --store <PATH> SQLite store path for relay state. Required.
  • --peer-directory <PATH> Verifier-owned peer directory JSON.
  • --peer-directory-state <PATH> Verifier-owned active peer-directory state JSON.
  • --profile <PROFILE> Relay operational profile. Default local-dev. Values local-dev, production.
  • --trusted-issuers <PATH> Trusted peer-directory issuer config for signed bundles.
  • --now-unix-ms <NOW_UNIX_MS> Evaluation time in Unix milliseconds. Defaults to the local clock.
  • --max-batches <MAX_BATCHES> Maximum batches to lease this tick. Required.
  • --signing-key <PATH> Local relay signing key JSON for the sender kernel. Required.
  • --report <PATH> Output path for tick report JSON. Required.
  • --report-dir <DIR> Directory for bounded outbound delivery event reports.
  • --iroh-enable Drain due batches over the iroh federation transport INSTEAD of HTTP for this tick (DUAL). OFF by default: with it off the tick delivers over HTTP exactly as before. A single tick drains over exactly one transport (an iroh tick and an HTTP tick would both lease the same outbox rows).
  • --iroh-transport-directory <PATH> Issuer-signed iroh transport-directory bundle JSON. Required with --iroh-enable; verified fail-closed against --trusted-issuers. Supplies the recipient kernel_id -> transport EndpointId resolution the drain dials.
  • --iroh-transport-directory-state <PATH> Optional rotation-state pin ({ "versionFloor": N, "expectedPreviousVersionSha256": ".." }) for the transport-directory bundle. Without it only a GENESIS bundle loads (floor 0, no predecessor); a rotated successor bundle needs this to pin the rollback floor and the predecessor hash it must chain onto.
  • --iroh-transport-key <PATH> Dedicated rotatable ed25519 transport key file ({ "seedHex": ".." }), SEPARATE from the passport/relay signing key. Required with --iroh-enable.
  • --iroh-bind-addr <ADDR> Socket address the outbound iroh endpoint binds. Default 0.0.0.0:0 (ephemeral port); the drain only dials, so an ephemeral local port is fine. Default 0.0.0.0:0.
  • --iroh-relay-url <URL> Self-hosted relay URL(s). Repeatable. Omitted -> RelayMode::Disabled (direct addressing; never the n0 free relays).
  • --iroh-peer-addr <KERNEL_ID=HOST:PORT> Direct dialable socket address(es) for a recipient in the relay-disabled / direct-address deployment, as KERNEL_ID=HOST:PORT. Repeatable; repeat the same KERNEL_ID to add multiple sockets. The verified transport directory binds kernel_id -> transport EndpointId but carries NO socket address, so without discovery / --iroh-relay-url the drain cannot reach a peer known only by EndpointId + socket. Each entry threads its socket(s) onto the resolved EndpointId so the drain dials directly. The EndpointId binding still comes from the verified directory and iroh authenticates it at the handshake, so a wrong/hostile socket cannot redirect delivery to an unauthorized peer.
  • --iroh-lanes <LANES> Comma-separated iroh lanes to drain. Default: pheromone (the only outbound lane on this hook). Default pheromone.

chio pheromone relay catchup

Request bounded catch-up metadata from local relay state.

bash
chio pheromone relay catchup [OPTIONS] --store <PATH> --peer <ID> --peer-directory-state <PATH> --treaty <ID> --after-cursor <CURSOR> --limit <LIMIT> --report <PATH>
  • --store <PATH> SQLite store path for relay state. Required.
  • --peer <ID> Peer kernel id requesting catch-up. Required.
  • --peer-directory-state <PATH> Verifier-owned active peer-directory state JSON. Required.
  • --profile <PROFILE> Relay operational profile for state validation. Default local-dev. Values local-dev, production.
  • --trusted-issuers <PATH> Trusted peer-directory issuer config for signed active state.
  • --now-unix-ms <NOW_UNIX_MS> Evaluation time in Unix milliseconds.
  • --treaty <ID> Treaty id for the catch-up window. Required.
  • --after-cursor <CURSOR> Cursor after which frames are requested. Required.
  • --limit <LIMIT> Maximum frames to return. Required.
  • --report <PATH> Output path for catch-up report JSON. Required.

chio pheromone relay status

Write local relay operator status.

bash
chio pheromone relay status [OPTIONS] --store <PATH> --report <PATH>
  • --store <PATH> SQLite store path for relay state. Required.
  • --report <PATH> Output path for status report JSON. Required.

chio pheromone relay observe

Write the relay observability report from durable local evidence.

bash
chio pheromone relay observe [OPTIONS] --store <PATH> --peer-directory-state <PATH> --profile <PROFILE> --trusted-issuers <PATH> --report-dir <DIR> --report <PATH>
  • --store <PATH> SQLite store path for relay state. Required.
  • --peer-directory-state <PATH> Verifier-owned active peer-directory state JSON. Required.
  • --profile <PROFILE> Relay operational profile. Required. Values local-dev, production.
  • --trusted-issuers <PATH> Trusted peer-directory issuer config for signed active state. Required.
  • --report-dir <DIR> Directory containing bounded relay event reports. Required.
  • --limit <LIMIT> Maximum recent failure codes to include. Default 25.
  • --report <PATH> Output path for observability report JSON. Required.

chio pheromone relay metrics

Export relay metrics from durable local state.

bash
chio pheromone relay metrics [OPTIONS] --store <PATH> --output <PATH>
  • --store <PATH> SQLite store path for relay state. Required.
  • --format <relay_metrics_format> Output encoding for relay metrics. Default prometheus. Values prometheus, json.
  • --output <PATH> Output path for relay metrics. Required.

chio pheromone relay alert

Evaluate relay alert routing from canonical observability artifacts.

bash
chio pheromone relay alert [OPTIONS] <COMMAND>

chio pheromone relay alert evaluate

Evaluate routeable relay alerts from current observability.

bash
chio pheromone relay alert evaluate [OPTIONS] --observability-report <PATH> --event-dir <DIR> --routing-profile <PATH> --suppression-state <PATH> --now-unix-ms <NOW_UNIX_MS> --report <PATH>
  • --observability-report <PATH> Canonical relay observability report JSON. Required.
  • --event-dir <DIR> Directory containing bounded relay event reports. Required.
  • --routing-profile <PATH> Relay alert routing profile JSON. Required.
  • --suppression-state <PATH> Relay alert suppression state JSON. Required.
  • --now-unix-ms <NOW_UNIX_MS> Evaluation time in Unix milliseconds. Required.
  • --report <PATH> Output path for relay alert report JSON. Required.

chio pheromone relay alert handoff

Dry-run downstream relay alert handoff readiness.

bash
chio pheromone relay alert handoff [OPTIONS] --alert-report <PATH> --trend-report <PATH> --routing-profile <PATH> --handoff-profile <PATH> --now-unix-ms <NOW_UNIX_MS> --report <PATH>
  • --alert-report <PATH> Relay alert report JSON. Required.
  • --trend-report <PATH> Relay trend report JSON. Required.
  • --routing-profile <PATH> Relay alert routing profile JSON. Required.
  • --handoff-profile <PATH> Relay alert handoff profile JSON. Required.
  • --now-unix-ms <NOW_UNIX_MS> Evaluation time in Unix milliseconds. Required.
  • --report <PATH> Output path for relay alert handoff report JSON. Required.

chio pheromone relay alert normalize

Normalize local downstream alert exports into Chio delivery evidence.

bash
chio pheromone relay alert normalize [OPTIONS] --profile <PATH> --input-dir <DIR> --now-unix-ms <NOW_UNIX_MS> --out-dir <DIR> --report <PATH>
  • --profile <PATH> Relay alert normalization profile JSON. Required.
  • --input-dir <DIR> Directory containing local downstream alert export JSON. Required.
  • --now-unix-ms <NOW_UNIX_MS> Evaluation time in Unix milliseconds. Required.
  • --out-dir <DIR> Directory for canonical Chio delivery evidence JSON. Required.
  • --report <PATH> Output path for relay alert normalization report JSON. Required.

chio pheromone relay alert delivery

Import downstream delivery, acknowledgement, or drift evidence.

bash
chio pheromone relay alert delivery [OPTIONS] <COMMAND>

chio pheromone relay alert delivery import

Import local downstream delivery-result artifacts.

bash
chio pheromone relay alert delivery import [OPTIONS] --handoff-report <PATH> --delivery-profile <PATH> --evidence-dir <DIR> --now-unix-ms <NOW_UNIX_MS> --report <PATH>
  • --handoff-report <PATH> Relay alert handoff report JSON. Required.
  • --delivery-profile <PATH> Relay alert delivery profile JSON. Required.
  • --evidence-dir <DIR> Directory containing local downstream delivery evidence JSON. Required.
  • --now-unix-ms <NOW_UNIX_MS> Evaluation time in Unix milliseconds. Required.
  • --report <PATH> Output path for relay alert delivery report JSON. Required.

chio pheromone relay alert delivery acknowledge

Summarize downstream acknowledgement evidence from a delivery report.

bash
chio pheromone relay alert delivery acknowledge [OPTIONS] --handoff-report <PATH> --delivery-report <PATH> --delivery-profile <PATH> --now-unix-ms <NOW_UNIX_MS> --report <PATH>
  • --handoff-report <PATH> Relay alert handoff report JSON. Required.
  • --delivery-report <PATH> Relay alert delivery report JSON. Required.
  • --delivery-profile <PATH> Relay alert delivery profile JSON. Required.
  • --now-unix-ms <NOW_UNIX_MS> Evaluation time in Unix milliseconds. Required.
  • --report <PATH> Output path for relay alert acknowledgement report JSON. Required.

chio pheromone relay alert delivery drift

Compare handoff and delivery report directories for bounded drift.

bash
chio pheromone relay alert delivery drift [OPTIONS] --handoff-reports-dir <DIR> --delivery-reports-dir <DIR> --delivery-profile <PATH> --since-unix-ms <SINCE_UNIX_MS> --until-unix-ms <UNTIL_UNIX_MS> --report <PATH>
  • --handoff-reports-dir <DIR> Directory containing relay alert handoff reports. Required.
  • --delivery-reports-dir <DIR> Directory containing relay alert delivery reports. Required.
  • --delivery-profile <PATH> Relay alert delivery profile JSON. Required.
  • --since-unix-ms <SINCE_UNIX_MS> Lower bound in Unix milliseconds. Required.
  • --until-unix-ms <UNTIL_UNIX_MS> Upper bound in Unix milliseconds. Required.
  • --report <PATH> Output path for relay alert handoff drift report JSON. Required.

chio pheromone relay alert delivery drift-window

Compare handoff and delivery report directories with source-bound delivery drift.

bash
chio pheromone relay alert delivery drift-window [OPTIONS] --handoff-reports-dir <DIR> --delivery-reports-dir <DIR> --delivery-profile <PATH> --since-unix-ms <SINCE_UNIX_MS> --until-unix-ms <UNTIL_UNIX_MS> --report <PATH>
  • --handoff-reports-dir <DIR> Directory containing relay alert handoff reports. Required.
  • --delivery-reports-dir <DIR> Directory containing relay alert delivery reports. Required.
  • --delivery-profile <PATH> Relay alert delivery profile JSON. Required.
  • --since-unix-ms <SINCE_UNIX_MS> Lower bound in Unix milliseconds. Required.
  • --until-unix-ms <UNTIL_UNIX_MS> Upper bound in Unix milliseconds. Required.
  • --report <PATH> Output path for source-bound relay alert delivery drift report JSON. Required.

chio pheromone relay alert review

Generate route-owner review evidence.

bash
chio pheromone relay alert review [OPTIONS] --handoff-report <PATH> --delivery-report <PATH> --acknowledgement-report <PATH> --drift-report <PATH> --route-owner-profile <PATH> --now-unix-ms <NOW_UNIX_MS> --report <PATH>
  • --handoff-report <PATH> Relay alert handoff report JSON. Required.
  • --delivery-report <PATH> Relay alert delivery report JSON. Required.
  • --acknowledgement-report <PATH> Relay alert acknowledgement report JSON. Required.
  • --drift-report <PATH> Relay alert delivery drift report JSON. Required.
  • --route-owner-profile <PATH> Relay alert route-owner profile JSON. Required.
  • --now-unix-ms <NOW_UNIX_MS> Evaluation time in Unix milliseconds. Required.
  • --report <PATH> Output path for relay alert route review packet JSON. Required.

chio pheromone relay alert assurance

Build relay alert assurance packages.

bash
chio pheromone relay alert assurance [OPTIONS] <COMMAND>

chio pheromone relay alert assurance package

Bind alert evidence into one operator-safe assurance package.

bash
chio pheromone relay alert assurance package [OPTIONS] --alert-report <PATH> --trend-report <PATH> --handoff-report <PATH> --normalization-report <PATH> --delivery-report <PATH> --acknowledgement-report <PATH> --drift-report <PATH> --review-packet <PATH> --now-unix-ms <NOW_UNIX_MS> --report <PATH>
  • --alert-report <PATH> Relay alert report JSON. Required.
  • --trend-report <PATH> Relay trend report JSON. Required.
  • --handoff-report <PATH> Relay alert handoff report JSON. Required.
  • --normalization-report <PATH> Relay alert normalization report JSON. Required.
  • --delivery-report <PATH> Relay alert delivery report JSON. Required.
  • --acknowledgement-report <PATH> Relay alert acknowledgement report JSON. Required.
  • --drift-report <PATH> Source-bound relay alert delivery drift report JSON. Required.
  • --review-packet <PATH> Relay alert route review packet JSON. Required.
  • --now-unix-ms <NOW_UNIX_MS> Evaluation time in Unix milliseconds. Required.
  • --report <PATH> Output path for relay alert assurance package JSON. Required.

chio pheromone relay alert assurance export

Export signed local alert assurance evidence.

bash
chio pheromone relay alert assurance export [OPTIONS] --package <PATH> --alert-report <PATH> --trend-report <PATH> --handoff-report <PATH> --normalization-report <PATH> --delivery-report <PATH> --acknowledgement-report <PATH> --drift-report <PATH> --review-packet <PATH> --retention-profile <PATH> --signing-key <PATH> --now-unix-ms <NOW_UNIX_MS> --out-dir <DIR> --report <PATH>
  • --package <PATH> Relay alert assurance package JSON. Required.
  • --alert-report <PATH> Relay alert report JSON. Required.
  • --trend-report <PATH> Relay trend report JSON. Required.
  • --handoff-report <PATH> Relay alert handoff report JSON. Required.
  • --normalization-report <PATH> Relay alert normalization report JSON. Required.
  • --delivery-report <PATH> Relay alert delivery report JSON. Required.
  • --acknowledgement-report <PATH> Relay alert acknowledgement report JSON. Required.
  • --drift-report <PATH> Source-bound relay alert delivery drift report JSON. Required.
  • --review-packet <PATH> Relay alert route review packet JSON. Required.
  • --retention-profile <PATH> Relay alert assurance retention profile JSON. Required.
  • --signing-key <PATH> Local relay export signing key JSON. Required.
  • --now-unix-ms <NOW_UNIX_MS> Evaluation time in Unix milliseconds. Required.
  • --out-dir <DIR> Output bundle directory. Required.
  • --report <PATH> Output path for relay alert assurance export report JSON. Required.

chio pheromone relay alert assurance verify

Verify a signed local alert assurance export bundle.

bash
chio pheromone relay alert assurance verify [OPTIONS] --bundle-dir <DIR> --trusted-exporters <PATH> --now-unix-ms <NOW_UNIX_MS> --report <PATH>
  • --bundle-dir <DIR> Export bundle directory. Required.
  • --trusted-exporters <PATH> Trusted exporter profile JSON. Required.
  • --now-unix-ms <NOW_UNIX_MS> Evaluation time in Unix milliseconds. Required.
  • --report <PATH> Output path for relay alert assurance export report JSON. Required.

chio pheromone relay alert assurance replay

Replay a signed local alert assurance export bundle.

bash
chio pheromone relay alert assurance replay [OPTIONS] --bundle-dir <DIR> --trusted-exporters <PATH> --now-unix-ms <NOW_UNIX_MS> --report <PATH>
  • --bundle-dir <DIR> Export bundle directory. Required.
  • --trusted-exporters <PATH> Trusted exporter profile JSON. Required.
  • --now-unix-ms <NOW_UNIX_MS> Evaluation time in Unix milliseconds. Required.
  • --report <PATH> Output path for relay alert assurance replay report JSON. Required.

chio pheromone relay alert assurance retention

Plan retention for signed local alert assurance export bundles.

bash
chio pheromone relay alert assurance retention [OPTIONS] <COMMAND>

chio pheromone relay alert assurance retention plan

Plan retention over local export bundle directories without deleting evidence.

bash
chio pheromone relay alert assurance retention plan [OPTIONS] --bundle-root <DIR> --retention-profile <PATH> --now-unix-ms <NOW_UNIX_MS> --report <PATH>
  • --bundle-root <DIR> Directory containing export bundle directories. Required.
  • --retention-profile <PATH> Relay alert assurance retention profile JSON. Required.
  • --now-unix-ms <NOW_UNIX_MS> Evaluation time in Unix milliseconds. Required.
  • --report <PATH> Output path for relay alert assurance retention report JSON. Required.

chio pheromone relay alert assurance retention handoff

Review local-only retention handoff readiness evidence.

bash
chio pheromone relay alert assurance retention handoff [OPTIONS] <COMMAND>

chio pheromone relay alert assurance retention handoff review

Review local evidence that is ready for external retention handoff.

bash
chio pheromone relay alert assurance retention handoff review [OPTIONS] --evidence <PATH> --profile <PATH> --package-report <PATH> --now-unix-ms <NOW_UNIX_MS> --report <PATH>
  • --evidence <PATH> Retention handoff evidence JSON. Required.
  • --profile <PATH> Retention handoff profile JSON. Required.
  • --package-report <PATH> Expected archive package report JSON. Required.
  • --now-unix-ms <NOW_UNIX_MS> Evaluation time in Unix milliseconds. Required.
  • --report <PATH> Output path for retention handoff report JSON. Required.

chio pheromone relay alert assurance retention external-review

Review local evidence for operator-managed external retention readiness.

bash
chio pheromone relay alert assurance retention external-review [OPTIONS] --package-dir <DIR> --source-report-dir <DIR> --trusted-packagers <PATH> --trusted-exporters <PATH> --profile <PATH> --since-unix-ms <SINCE_UNIX_MS> --until-unix-ms <UNTIL_UNIX_MS> --now-unix-ms <NOW_UNIX_MS> --report <PATH>
  • --package-dir <DIR> Directory containing archive packages or archive package report JSON files. Required.
  • --source-report-dir <DIR> Directory containing source archive, closeout, restore, physical, and handoff reports. Required.
  • --trusted-packagers <PATH> Trusted archive packager profile JSON. Required.
  • --trusted-exporters <PATH> Trusted exporter profile JSON. Required.
  • --profile <PATH> External retention review profile JSON. Required.
  • --since-unix-ms <SINCE_UNIX_MS> Start of review window in Unix milliseconds. Required.
  • --until-unix-ms <UNTIL_UNIX_MS> End of review window in Unix milliseconds. Required.
  • --now-unix-ms <NOW_UNIX_MS> Evaluation time in Unix milliseconds. Required.
  • --report <PATH> Output path for external retention review report JSON. Required.

chio pheromone relay alert assurance recovery-drill

Run offline recovery drills against an export bundle.

bash
chio pheromone relay alert assurance recovery-drill [OPTIONS] --bundle-dir <DIR> --trusted-exporters <PATH> --case <ID> --now-unix-ms <NOW_UNIX_MS> --report <PATH>
  • --bundle-dir <DIR> Export bundle directory. Required.
  • --trusted-exporters <PATH> Trusted exporter profile JSON. Required.
  • --case <ID> Recovery case id or all. Required.
  • --now-unix-ms <NOW_UNIX_MS> Evaluation time in Unix milliseconds. Required.
  • --report <PATH> Output path for relay alert assurance recovery drill report JSON. Required.

chio pheromone relay alert assurance archive

Plan verifier-owned archive lifecycle over signed export bundles.

bash
chio pheromone relay alert assurance archive [OPTIONS] <COMMAND>

chio pheromone relay alert assurance archive plan

Plan archive lifecycle over local export bundle directories without moving evidence.

bash
chio pheromone relay alert assurance archive plan [OPTIONS] --bundle-root <DIR> --trusted-exporters <PATH> --archive-profile <PATH> --retention-profile <PATH> --now-unix-ms <NOW_UNIX_MS> --report <PATH>
  • --bundle-root <DIR> Directory containing export bundle directories. Required.
  • --trusted-exporters <PATH> Trusted exporter profile JSON. Required.
  • --archive-profile <PATH> Relay alert assurance archive profile JSON. Required.
  • --retention-profile <PATH> Relay alert assurance retention profile JSON. Required.
  • --now-unix-ms <NOW_UNIX_MS> Evaluation time in Unix milliseconds. Required.
  • --report <PATH> Output path for relay alert assurance archive report JSON. Required.

chio pheromone relay alert assurance archive package

Create, verify, or safely extract signed archive packages.

bash
chio pheromone relay alert assurance archive package [OPTIONS] <COMMAND>

chio pheromone relay alert assurance archive package create

Create a signed local tar.gz archive package from export bundles.

bash
chio pheromone relay alert assurance archive package create [OPTIONS] --bundle-root <DIR> --trusted-exporters <PATH> --archive-report <PATH> --closeout-report <PATH> --signing-key <PATH> --package-id <ID> --now-unix-ms <NOW_UNIX_MS> --out <PATH> --report <PATH>
  • --bundle-root <DIR> Directory containing export bundle directories. Required.
  • --trusted-exporters <PATH> Trusted exporter profile JSON. Required.
  • --archive-report <PATH> Source archive report JSON. Required.
  • --closeout-report <PATH> Source closeout report JSON. Required.
  • --signing-key <PATH> Local relay archive packager signing key JSON. Required.
  • --package-id <ID> Archive package id. Required.
  • --packager-key-id <PACKAGER_KEY_ID> Archive packager key id. Default default.
  • --package-generation <PACKAGE_GENERATION> Archive package generation. Default 1.
  • --previous-package-report <PATH> Previous archive package report JSON. Required when generation is greater than 1.
  • --now-unix-ms <NOW_UNIX_MS> Evaluation time in Unix milliseconds. Required.
  • --out <PATH> Output tar.gz package path. Required.
  • --report <PATH> Output path for archive package report JSON. Required.

chio pheromone relay alert assurance archive package verify

Verify a signed local tar.gz archive package without extracting it.

bash
chio pheromone relay alert assurance archive package verify [OPTIONS] --package <PATH> --trusted-packagers <PATH> --trusted-exporters <PATH> --archive-report <PATH> --closeout-report <PATH> --now-unix-ms <NOW_UNIX_MS> --report <PATH>
  • --package <PATH> Archive package tar.gz path. Required.
  • --trusted-packagers <PATH> Trusted archive packager profile JSON. Required.
  • --trusted-exporters <PATH> Trusted exporter profile JSON. Required.
  • --archive-report <PATH> Source archive report JSON. Required.
  • --closeout-report <PATH> Source closeout report JSON. Required.
  • --now-unix-ms <NOW_UNIX_MS> Evaluation time in Unix milliseconds. Required.
  • --report <PATH> Output path for archive package report JSON. Required.

chio pheromone relay alert assurance archive package extract

Verify then safely extract a signed archive package into a new path.

bash
chio pheromone relay alert assurance archive package extract [OPTIONS] --package <PATH> --trusted-packagers <PATH> --trusted-exporters <PATH> --archive-report <PATH> --closeout-report <PATH> --out-dir <DIR> --now-unix-ms <NOW_UNIX_MS> --report <PATH>
  • --package <PATH> Archive package tar.gz path. Required.
  • --trusted-packagers <PATH> Trusted archive packager profile JSON. Required.
  • --trusted-exporters <PATH> Trusted exporter profile JSON. Required.
  • --archive-report <PATH> Source archive report JSON. Required.
  • --closeout-report <PATH> Source closeout report JSON. Required.
  • --out-dir <DIR> Fresh output directory. The path must not exist. Required.
  • --now-unix-ms <NOW_UNIX_MS> Evaluation time in Unix milliseconds. Required.
  • --report <PATH> Output path for archive extraction report JSON. Required.

chio pheromone relay alert assurance archive physical-drill

Review operator-managed physical archive readback evidence.

bash
chio pheromone relay alert assurance archive physical-drill [OPTIONS] <COMMAND>

chio pheromone relay alert assurance archive physical-drill review

Review local physical archive readback evidence without media claims.

bash
chio pheromone relay alert assurance archive physical-drill review [OPTIONS] --evidence <PATH> --package-report <PATH> --now-unix-ms <NOW_UNIX_MS> --report <PATH>
  • --evidence <PATH> Physical archive evidence JSON. Required.
  • --package-report <PATH> Expected archive package report JSON. Required.
  • --now-unix-ms <NOW_UNIX_MS> Evaluation time in Unix milliseconds. Required.
  • --report <PATH> Output path for physical archive drill report JSON. Required.

chio pheromone relay alert assurance archive restore-drill

Review multi-generation archive package restore evidence.

bash
chio pheromone relay alert assurance archive restore-drill [OPTIONS] <COMMAND>

chio pheromone relay alert assurance archive restore-drill review

Review local archive package generations and readback evidence.

bash
chio pheromone relay alert assurance archive restore-drill review [OPTIONS] --package-dir <DIR> --source-report-dir <DIR> --trusted-packagers <PATH> --trusted-exporters <PATH> --restore-profile <PATH> --now-unix-ms <NOW_UNIX_MS> --report <PATH>
  • --package-dir <DIR> Directory containing archive package report JSON files. Required.
  • --source-report-dir <DIR> Directory containing physical drill and retention handoff reports. Required.
  • --trusted-packagers <PATH> Trusted archive packager profile JSON. Required.
  • --trusted-exporters <PATH> Trusted exporter profile JSON. Required.
  • --restore-profile <PATH> Archive restore profile JSON. Required.
  • --now-unix-ms <NOW_UNIX_MS> Evaluation time in Unix milliseconds. Required.
  • --report <PATH> Output path for archive restore drill report JSON. Required.

chio pheromone relay alert assurance closeout

Review signed export bundles for operator-managed closeout.

bash
chio pheromone relay alert assurance closeout [OPTIONS] <COMMAND>

chio pheromone relay alert assurance closeout review

Review local export bundle directories for operator-managed closeout.

bash
chio pheromone relay alert assurance closeout review [OPTIONS] --bundle-root <DIR> --trusted-exporters <PATH> --closeout-profile <PATH> --retention-profile <PATH> --now-unix-ms <NOW_UNIX_MS> --report <PATH>
  • --bundle-root <DIR> Directory containing export bundle directories. Required.
  • --trusted-exporters <PATH> Trusted exporter profile JSON. Required.
  • --closeout-profile <PATH> Relay alert assurance closeout profile JSON. Required.
  • --retention-profile <PATH> Relay alert assurance retention profile JSON. Required.
  • --now-unix-ms <NOW_UNIX_MS> Evaluation time in Unix milliseconds. Required.
  • --report <PATH> Output path for relay alert assurance closeout report JSON. Required.

chio pheromone relay trend

Aggregate long-horizon relay operations trends from report artifacts.

bash
chio pheromone relay trend [OPTIONS] --reports-dir <DIR> --event-dir <DIR> --routing-profile <PATH> --since-unix-ms <SINCE_UNIX_MS> --until-unix-ms <UNTIL_UNIX_MS> --report <PATH>
  • --reports-dir <DIR> Directory containing relay observability reports. Required.
  • --event-dir <DIR> Directory containing bounded relay event reports. Required.
  • --routing-profile <PATH> Relay alert routing profile JSON. Required.
  • --since-unix-ms <SINCE_UNIX_MS> Lower bound in Unix milliseconds. Required.
  • --until-unix-ms <UNTIL_UNIX_MS> Upper bound in Unix milliseconds. Required.
  • --report <PATH> Output path for relay trend report JSON. Required.

chio pheromone relay directory

Inspect, promote, or reject verifier-owned relay peer-directory state.

bash
chio pheromone relay directory [OPTIONS] <COMMAND>

chio pheromone relay directory inspect

Inspect active peer-directory state.

bash
chio pheromone relay directory inspect [OPTIONS] --state <PATH> --report <PATH>
  • --state <PATH> Peer-directory state JSON. Required.
  • --report <PATH> Output path for inspection report JSON. Required.

chio pheromone relay directory promote

Promote a signed peer-directory candidate into active state.

bash
chio pheromone relay directory promote [OPTIONS] --state <PATH> --candidate <PATH> --trusted-issuers <PATH> --profile <PROFILE> --report <PATH>
  • --state <PATH> Peer-directory state JSON to update. Required.
  • --candidate <PATH> Signed peer-directory bundle candidate JSON. Required.
  • --trusted-issuers <PATH> Trusted peer-directory issuer config. Required.
  • --profile <PROFILE> Relay operational profile. Required. Values local-dev, production.
  • --now-unix-ms <NOW_UNIX_MS> Evaluation time in Unix milliseconds.
  • --report <PATH> Output path for rotation report JSON. Required.

chio pheromone relay directory reject

Reject a signed peer-directory candidate without changing active state.

bash
chio pheromone relay directory reject [OPTIONS] --state <PATH> --candidate <PATH> --reason <CODE> --report <PATH>
  • --state <PATH> Peer-directory state JSON to update. Required.
  • --candidate <PATH> Signed peer-directory bundle candidate JSON. Required.
  • --reason <CODE> Stable rejection reason code. Required.
  • --now-unix-ms <NOW_UNIX_MS> Evaluation time in Unix milliseconds.
  • --report <PATH> Output path for rotation report JSON. Required.

chio pheromone relay supervisor

Validate local relay supervisor deployment profiles.

bash
chio pheromone relay supervisor [OPTIONS] <COMMAND>

chio pheromone relay supervisor lint

Lint a relay supervisor deployment profile.

bash
chio pheromone relay supervisor lint [OPTIONS] --profile <PATH> --report <PATH>
  • --profile <PATH> Relay supervisor profile JSON. Required.
  • --report <PATH> Output path for drill report JSON. Required.

chio finding

Publish, discover, verify, and purchase cognition-market findings.

bash
chio finding [OPTIONS] <COMMAND>

chio finding operator

Initialize, serve, or reconcile a single-operator cognition market.

bash
chio finding operator [OPTIONS] <COMMAND>

chio finding operator init

Create a strict local operator profile and its durable stores.

bash
chio finding operator init [OPTIONS] --directory <DIRECTORY> --repository-root <REPOSITORY_ROOT>
  • --directory <DIRECTORY> New or empty deployment directory. Required.
  • --listen <LISTEN> HTTP address for the operator service. Default 127.0.0.1:7143.
  • --repository-root <REPOSITORY_ROOT> Existing root containing every seller-accessible source repository. Required.
  • --buyer-principal <BUYER_PRINCIPAL> Initial buyer principal installed in the profile. Default coding-agent-buyer.
  • --buyer-payout <BUYER_PAYOUT> Canonical EVM destination used for initial buyer compensation. Default 0x1111111111111111111111111111111111111111.
  • --seller-principal <SELLER_PRINCIPAL> Initial seller principal installed in the profile. Default coding-agent-seller.
  • --seller-payout <SELLER_PAYOUT> Canonical EVM destination used for initial seller proceeds. Default 0x2222222222222222222222222222222222222222.

chio finding operator serve

Run the production-composed purchase service from one profile.

bash
chio finding operator serve [OPTIONS] --profile <PROFILE>
  • --profile <PROFILE> Strict canonical operator profile created by operator init. Required.

chio finding operator tick

Reconcile durable operator work and print current health counters.

bash
chio finding operator tick [OPTIONS] --profile <PROFILE>
  • --profile <PROFILE> Strict canonical operator profile created by operator init. Required.

chio finding operator repair-challenge-retention

Restore missing signed challenge filings in an offline operator database.

bash
chio finding operator repair-challenge-retention [OPTIONS] --database <DATABASE> --bundle <BUNDLE> --receipt <RECEIPT> --receipt-signing-seed-env <RECEIPT_SIGNING_SEED_ENV>
  • --database <DATABASE> Existing operator SQLite database. Stop every operator process first. Required.
  • --bundle <BUNDLE> Strict canonical repair bundle containing exact signed envelopes. Required.
  • --receipt <RECEIPT> New private file receiving the canonical signed repair receipt. Required.
  • --receipt-signing-seed-env <RECEIPT_SIGNING_SEED_ENV> Environment variable containing the repair authority’s hex seed. Required.

chio finding operator validate-hosted

Validate a hosted profile, its referenced files, and secret references.

bash
chio finding operator validate-hosted [OPTIONS] --profile <PROFILE>
  • --profile <PROFILE> Strict canonical hosted operator profile. Required.

chio finding operator evaluate-canary

Evaluate a bounded hosted canary observation and fail on rollback.

bash
chio finding operator evaluate-canary [OPTIONS] --profile <PROFILE> --observation <OBSERVATION>
  • --profile <PROFILE> Strict canonical hosted operator profile. Required.
  • --observation <OBSERVATION> Strict canonical audit-authority-signed canary observation. Required.

chio finding package

Build a signed cognition-market package from ordinary development files.

bash
chio finding package [OPTIONS] <COMMAND>

chio finding package verified-fix

Prove a failing baseline and passing candidate, then package their patch.

bash
chio finding package verified-fix [OPTIONS] --profile <PROFILE> --repository <REPOSITORY> --base <BASE> --candidate <CANDIDATE> --test <TESTS> --topic <TOPIC>
  • --profile <PROFILE> Strict canonical operator profile. Required.
  • --repository <REPOSITORY> Git repository containing both revisions. Required.
  • --base <BASE> Baseline commit or revision that must fail at least one test. Required.
  • --candidate <CANDIDATE> Candidate commit or revision that must pass every test. Required.
  • --test <TESTS> Test command. Repeat this flag to run more than one command. Required.
  • --topic <TOPIC> Finding topic used by market discovery. Required.
  • --seller <SELLER> Configured seller principal used to sign the Finding. Default coding-agent-seller.
  • --price <PRICE> Listing price in USD minor units. Default 300.
  • --output <OUTPUT> Output path. Defaults to the profile’s packages directory.

chio finding admit

Admit a verified-fix draft through the running local operator.

bash
chio finding admit [OPTIONS] --profile <PROFILE> --package <PACKAGE>
  • --profile <PROFILE> Strict canonical operator profile. Required.
  • --package <PACKAGE> Draft emitted by chio finding package verified-fix. Required.

chio finding verify-bundle

Re-run the Rust reference verifier over a public proof bundle.

bash
chio finding verify-bundle [OPTIONS] --input <INPUT> --profile <PROFILE>
  • --input <INPUT> Proof bundle file, or - for standard input. Required.
  • --profile <PROFILE> Strict canonical operator profile containing public deployment pins. Required.
  • --purchase-request <PURCHASE_REQUEST> Exact canonical purchase request to bind to an optional result.
  • --purchase-result <PURCHASE_RESULT> Exact canonical purchase result whose signed terminal is verified.

chio finding publish

Publish a canonical chio.finding.v1 artifact to the venue index.

bash
chio finding publish [OPTIONS] --file <FILE>
  • --file <FILE> Canonical artifact file. The bytes are sent verbatim; the venue rejects any spelling that is not the canonical serialization. Required.

Search the venue descriptor index.

bash
chio finding search [OPTIONS] --topic-prefix <TOPIC_PREFIX>
  • --topic-prefix <TOPIC_PREFIX> Topic prefix to match. Required.
  • --context-sha256 <CONTEXT_SHA256> Optional exact context digest filter (64 lowercase hex characters).
  • --after <AFTER> Resume after this finding id, using the cursor from a prior page.
  • --limit <LIMIT> Maximum number of rows to request. The venue clamps its own bounds.

chio finding verify

Verify a finding: strict canonical ingress first, then the pinned evidence facet report.

bash
chio finding verify [OPTIONS]
  • --file <FILE> Local artifact file to verify without contacting a venue.
  • --id <ID> Finding id to fetch verbatim from the venue before verifying.
  • --trust-roots <TRUST_ROOTS> Pinned verifier trust roots (governance authority, admitted verifier profile, admitted kernel keys, collateral authority, and optional status operator authorization and freshness policy).
  • --evidence <EVIDENCE> Resolved evidence bundle: receipts with inclusion proofs, checkpoints, the collateral allocation snapshot, and an optional exact canonical status proof encoded as base64.
  • --recipe <RECIPE> Raw replay-recipe preimage bytes the artifact commits to.
  • --status-rollback-floor <STATUS_ROLLBACK_FLOOR> Durable per-feed status rollback floor. Required whenever the evidence bundle carries a portable status proof. This may point to the same floor file used by chio finding status.
  • --integrity-only Assert artifact integrity alone and name every facet left unevaluated instead of failing on absent evidence.

chio finding buy

Purchase a reveal of a published finding.

bash
chio finding buy [OPTIONS] --id <ID> --max-price <MAX_PRICE> --currency <CURRENCY>
  • --id <ID> Finding id to purchase. Required.
  • --max-price <MAX_PRICE> Maximum acceptable price in minor units of --currency. Required.
  • --currency <CURRENCY> Currency the price ceiling is denominated in. Required.
  • --payer <PAYER> Buyer principal the purchase context binds.
  • --deadline-secs <DEADLINE_SECS> Seconds the buyer allows for delivery before the failed-delivery terminal applies.

chio finding status

Inspect the venue-verified portable status proof for one finding.

bash
chio finding status [OPTIONS] --id <ID> --feed <FEED> --operator-authorization <OPERATOR_AUTHORIZATION> --service-bond <SERVICE_BOND> --rollback-floor <ROLLBACK_FLOOR> --max-epoch-age-secs <MAX_EPOCH_AGE_SECS>
  • --id <ID> Finding id whose current status proof should be fetched. Required.
  • --feed <FEED> Governance-pinned status feed configured by the venue. Required.
  • --operator-authorization <OPERATOR_AUTHORIZATION> Governance-pinned status operator authorization (strict canonical JSON). Required.
  • --service-bond <SERVICE_BOND> Governance-pinned current status service bond (strict canonical JSON). Required.
  • --rollback-floor <ROLLBACK_FLOOR> Durable rollback floor; retain its sibling .retractions directory. Required.
  • --max-epoch-age-secs <MAX_EPOCH_AGE_SECS> Maximum accepted age of the signed status epoch in seconds. Required.

chio finding challenge

Open a dispute against one admitted finding listing.

Exactly one authorization branch and exactly one mechanical evidence class per challenge. A buyer submission carries a dispute fee, a dispute bond, and standing, and is signed by the challenger it names. A venue audit carries none of those and is signed by the venue’s pinned audit authority, which this surface does not hold.

bash
chio finding challenge [OPTIONS] --finding <FINDING> --class <CLASS> --evidence <EVIDENCE>
  • --finding <FINDING> Finding id the challenge targets. The venue’s stored artifact is fetched verbatim, re-derived through the strict ingress, and its exact digest is bound into the challenge. Required.
  • --class <CLASS> Mechanical evidence class presented. Must name the same class as the evidence union the document carries; the closed guarantee/evidence compatibility matrix is checked against the fetched finding before anything is signed. Required. Values digest-mismatch, evidence-invalid, replay-contradiction.
  • --evidence <EVIDENCE> Challenge evidence document (JSON). Strict canonical I-JSON: the file bytes must be exactly their own canonical serialization, and every field is required. The document carries the operator-supplied half of the challenge; the fetched artifact supplies schema, challenge_id, finding_id, and finding_artifact_sha256. Every key below, at every depth, is in canonical order, which is the order the file must use. { "affected_deliveries": [ {"checkpoint_ref": "...", "checkpoint_sha256": "<64 hex>", "receipt_id": "...", "receipt_sha256": "<64 hex>"} ], "authorization": {"buyer_submission": {"challenger": "<64 hex>", "dispute_fee_terminal": {...}, "dispute_lock_ref": {...}, "standing": {"failed_delivery": {...}}}} | {"venue_audit": {"audit_epoch_envelope_sha256": "<64 hex>", "authorization_digest": "<64 hex>", "selection_digest": "<64 hex>"}}, "evidence": {"digest_mismatch": {"deny_checkpoint_ref": {...}, "deny_receipt_ref": {...}, "failed_delivery_envelope_sha256": "<64 hex>"}} | {"evidence_invalid": {"challenged_checkpoint_ref": {...}, "challenged_evidence_receipt_refs": [...], "purchase_record_envelope_sha256": "<64 hex>"}} | {"replay_contradiction": { "purchase_record_envelope_sha256": "<64 hex>", "recipe_preimage": "<canonical recipe text>", "reproduction": [...]}}, "filed_at": 1750000000, "listing": {"backing_envelope_sha256": "<64 hex>", "listing_id": "...", "profile_envelope_sha256": "<64 hex>", "terms_envelope_sha256": "<64 hex>", "venue_admission_envelope_sha256": "<64 hex>"} } Both unions and every branch member use the registered chio.finding.challenge.v1 spelling. Copy the listing block from the venue’s current signed admission envelope. Required.
  • --challenger-key <CHALLENGER_KEY> Ed25519 seed file for the challenger the document names: 64 hex characters, optional 0x prefix, surrounding whitespace ignored. Required for a buyer submission, because the signer must be that challenger. Refused for a venue audit, which carries no challenger at all.
  • --venue-audit Build the bondless venue-audit branch. The document’s authorization must be the matching branch, so a submission carrying a dispute fee or a dispute bond is refused rather than stripped.
  • --dry-run Emit the canonical challenge, the signed envelope when one was produced, and their digests, without transmitting anything.

chio replay

Re-evaluate a captured receipt log against the current build.

Reads a directory of signed receipts (or an NDJSON tee stream), re-verifies every signature, recomputes the Merkle root incrementally, and reports the first divergence by byte offset and JSON pointer.

EXIT CODES: 0 All receipts (or tee frames) verify and root matches expectation. 10 Verdict drift: a receipt’s allow/deny decision differs from the current build for the same input. 20 Signature mismatch: Ed25519 verification failed on at least one receipt or frame tenant_sig. 30 Parse error: malformed JSON or missing required field. 40 Schema mismatch: unsupported schema_version or schema validation failed against the canonical-JSON schema set. 50 Redaction mismatch: redaction_pass_id unavailable, or rerunning the redaction manifest produces a different result.

bash
chio replay [OPTIONS] [LOG] [COMMAND]
  • [LOG] Path to a receipt-log directory or NDJSON stream. Required when no sub-subcommand is supplied.
  • --from-tee Treat log as a tee NDJSON stream. When omitted, the reader auto-detects the input shape (directory vs. NDJSON file).
  • --tenant-pubkey <PATH> Ed25519 tenant public-key file required when --from-tee is used. Raw 32-byte and 64-lowercase-hex files are accepted.
  • --trusted-kernel-pubkey <PATH> Trusted kernel public-key file required for receipt-log replay. Raw 32-byte Ed25519 and algorithm-aware hex files are accepted.
  • --expect-root <HEX> Assert the recomputed Merkle root matches this hex string.
  • --json Emit a structured JSON report on stdout (instead of human text).
  • --bless (Restricted) Convert a TEE capture into a replay fixture directory. Requires the local chio:tee/bless@1 capability gate.
  • --into <FIXTURE-DIR> Destination fixture directory for --bless.

chio replay traffic

Validate or re-execute an NDJSON chio-tee-frame.v1 capture. Supply --against <policy-path> to run pre-output replay against a policy with namespaced replay receipts (replay:<run_id>:<frame_id>).

bash
chio replay traffic [OPTIONS] --from <NDJSON>
  • --from <NDJSON> Path to an NDJSON file containing one chio-tee-frame.v1 per line. Required.
  • --schema <SCHEMA> Pinned schema name. Defaults to chio-tee-frame.v1. The on-the-wire schema_version field is the literal "1"; this flag lets callers pin the schema name for diagnostic clarity. Frames whose schema_version does not match the pinned literal are rejected regardless of this value. Default chio-tee-frame.v1.
  • --tenant-pubkey <PATH> Optional path to an Ed25519 tenant public-key file (32 raw bytes or 64 lowercase-hex characters). When supplied, every frame’s tenant_sig is verified against this key; mismatches fail closed. When omitted, the verifier is skipped (frames are still schema-validated).
  • --json Emit a structured JSON report on stdout instead of human text.
  • --against <POLICY-PATH> Re-execute every frame against this policy reference in pre-output mode. Accepted shape: path:<file> or a workspace-local YAML policy path. Registry-backed manifest hashes and package coordinates are rejected: no resolver materializes a verified policy from them. Policies with concrete-server grants or post-output guards are rejected because chio-tee-frame.v1 carries neither the original Chio tool-server id nor redacted response bytes. Replay receipts are namespaced replay:<run_id>:<frame_id> to prevent collisions with production receipts.
  • --run-id <ID> Optional caller-supplied replay run-id. When omitted a fresh random UUID-v4 is generated per invocation. Useful for deterministic fixture generation in tests; format is [A-Za-z0-9_-]+ (token-shaped so the resulting replay:<run_id>:<frame_id> ids stay grep-friendly).

chio settle

Inspect local settlement lifecycle records.

Lists pending IOU envelopes (minted but not yet settled), settled receipts (rows in settlement_reconciliations whose state is settled), and dead-lettered settlements (rows in settle_dead_letters).

bash
chio settle [OPTIONS] <COMMAND>

chio settle status

Show pending IOU envelopes, settled receipts, and dead-lettered settlements for the local store.

bash
chio settle status [OPTIONS]
  • --store <PATH> Path to the chio-store-sqlite database. Defaults to --receipt-db when omitted, which is the same store every other receipt-aware subcommand reads.
  • --json Emit a structured JSON report on stdout instead of the human-readable text summary.

chio lineage

Query, diff, or list anchored roots in the lineage DAG.

Surfaces the lineage graph (chio-lineage): - query walks forward or reverse from a seed node id over a lineage JSON dump. - diff computes the symmetric edge diff between two dumps. - roots lists pinned-frontier artifacts in a directory.

bash
chio lineage [OPTIONS] <COMMAND>

chio lineage query

Walk forward or reverse from a seed node id over a lineage JSON dump.

bash
chio lineage query [OPTIONS] --graph <PATH>
  • --graph <PATH> Path to the lineage JSON dump (the same format the static viewer at docs/demo/lineage reads). Required.
  • --seed <ID> Seed node ids. Repeatable.
  • --direction <DIRECTION> Walk direction. forward walks downstream edges; reverse walks upstream. Default forward.
  • --depth-limit <DEPTH_LIMIT> Maximum recursion depth. Defaults to 20 (matches the recursive-CTE bound documented on chio-store-sqlite::lineage_cte). Default 20.
  • --row-limit <ROW_LIMIT> Maximum row count. Default 10000.
  • --json Emit a JSON report instead of a TTY summary.

chio lineage diff

Symmetric edge diff between two lineage JSON dumps.

bash
chio lineage diff [OPTIONS] --left-label <LABEL> --left <PATH> --right-label <LABEL> --right <PATH>
  • --left-label <LABEL> Required.
  • --left <PATH> Required.
  • --right-label <LABEL> Required.
  • --right <PATH> Required.
  • --json

chio lineage roots

List pinned-frontier artifacts in a directory.

bash
chio lineage roots [OPTIONS] --dir <PATH>
  • --dir <PATH> Required.
  • --json

chio doctor

Diagnose toolchain, registry, OTEL, and chio.yaml health.

Probes (in order):

1. Toolchain version vs. workspace MSRV / rust-toolchain.toml. 2. OCI guard registry reachability. 3. Cosign guard-bundle freshness. 4. OTEL exporter endpoint resolution. 5. Kernel runtime /metrics (asserts the chio_kernel_dispatch_inflight gauge is reachable). 6. chio.yaml schema validity.

Exit codes follow the worst observed severity: 0 for ok / info / warning, 1 for error, 2 for fatal. The optional --fix flag runs idempotent repairs only; destructive operations are rejected.

bash
chio doctor [OPTIONS]
  • --json Emit a structured JSON report on stdout instead of human text.
  • --fix Run idempotent repairs after probes complete. Destructive repairs are explicitly rejected.
  • --skip-network Skip probes that would otherwise reach the network. Useful in CI sandboxes; equivalent to CHIO_DOCTOR_SKIP_NETWORK=1.

chio arena

chio-arena coliseum: run scenarios, replay bundles, evolve adversaries.

chio arena run scenarios/<name>.toml loads a scenario, drives the kernel via the async surface, and writes a receipt bundle byte-compatible with the replay corpus under target/arena/<scenario-id>/. chio arena replay <scenario-id> resolves the bundle directory and delegates to chio replay. chio arena evolve scenarios/<seed>.toml --generations N runs the co-evolution driver under the bounded-budget gate.

bash
chio arena [OPTIONS] <COMMAND>

chio arena run

Run a scenario file and write an arena bundle under target/arena/.

bash
chio arena run [OPTIONS] <SCENARIO>
  • <SCENARIO> Path to the scenario TOML file. Required.
  • --output-root <DIR> Override the bundle output root (default target/arena/).
  • --json Emit the run summary as JSON on stdout.

chio arena replay

Replay a previously emitted arena bundle by scenario id.

Resolves target/arena/<scenario-id>/ and delegates to the chio replay engine. Use --bundle-dir to point at a non-default bundle location.

bash
chio arena replay [OPTIONS] <SCENARIO_ID>
  • <SCENARIO_ID> Scenario id to replay. Required.
  • --output-root <DIR> Override the bundle output root.
  • --bundle-dir <DIR> Resolved bundle directory (overrides --output-root plus id).
  • --json Emit the resolved bundle metadata as JSON.

chio arena evolve

Run the co-evolution loop for a scenario seed.

bash
chio arena evolve [OPTIONS] <SEED>
  • <SEED> Path to the seed scenario TOML file. Required.
  • --generations <GENERATIONS> Number of generations to run (the bounded-budget gate clamps). Default 5.
  • --wall-seconds <WALL_SECONDS> Maximum wall-clock budget in seconds. Default 1800.
  • --output-root <DIR> Override the leaderboard output root (default target/arena/).
  • --json Emit the evolve summary as JSON on stdout.

chio bind

Bind a provider under a signed model card.

chio bind <provider> --card <path> loads the model card from <path> (canonical-JSON encoded per spec/schemas/model-card.v1.json), validates its structural shape, and prints the resolved weights_hash and allowed_capability_set so an operator can sanity check before promoting to production policy. The cosign bundle verify path consumes chio-attest-verify when --bundle is supplied; otherwise the helper prints the card fields without attesting authenticity.

bash
chio bind [OPTIONS] --card <PATH> <PROVIDER>
  • <PROVIDER> Provider identifier to bind under the card. Free-form string surfaced in the resolved-binding summary; not interpreted by the helper. Required.
  • --card <PATH> Path to the canonical-JSON encoded model card. Required.
  • --bundle <PATH> Optional path to the cosign bundle for the card. When supplied, the helper verifies the bundle through chio_attest_verify::SigstoreVerifier::verify_bundle and refuses to print the binding summary on failure.
  • --issuer-san-regex <REGEX> Cosign certificate identity SAN regex required when --bundle is supplied. Forwarded verbatim to chio_attest_verify::ExpectedIdentity::certificate_identity_regexp.
  • --issuer-oidc <URL> OIDC issuer expected on the cosign certificate. Required with --bundle.
  • --weights-binding-mode <MODE> Runtime weights binding mode. required and required_with_pin require --bundle so card verification cannot be silently skipped. Default not_required.

chio start

Start the Chio sidecar with sensible zero-config defaults.

Convenience alias for chio api protect aimed at SDK quickstart and chio-hermes integration users. It runs the same axum router (capability mint/release/validate, receipt verify, tool-call evaluate, HITL approval endpoints) but with:

  • no upstream proxy (the catch-all /{*path} 502s loud).
  • durable receipts by default (pass --allow-ephemeral-receipts for the in-memory quickstart that leaves no on-disk artifacts).
  • a friendly startup banner that prints the bound address.

chio api protect remains the canonical name for production deployments that need --upstream, --spec, and persistent stores.

bash
chio start [OPTIONS]
  • --listen <LISTEN> Address to listen on. Defaults to 127.0.0.1:9090 to match chio-sdk-python’s ChioClient.DEFAULT_BASE_URL. Pass 127.0.0.1:0 to bind an ephemeral port; the bound address is then printed in the startup banner. Default 127.0.0.1:9090.
  • --receipt-store <RECEIPT_STORE> Optional SQLite receipt store path for a durable audit log.
  • --allow-ephemeral-receipts Permit in-memory receipts, whose audit evidence is lost on every restart. Required to boot without --receipt-store. For local development only.
  • --print-config Print the chio-hermes config snippet (env vars + slash commands) on startup so users can copy/paste into their shell before running their agent. Off by default to keep the banner short.
NextProtocol