Chio/Docs

chio guard

Scaffold, build, test, benchmark, sign, and publish WASM guards, and install signed guard packs from a registry.

Reference chio@5f63e6e

On this page

All command families · Global flags

chio guard

Guard development lifecycle: scaffold, build, and inspect WASM guards.

Command synopsistext
chio guard [OPTIONS] <COMMAND>

chio guard new

Scaffold a new guard project with Cargo.toml, src/lib.rs, and guard-manifest.yaml.

Command synopsistext
chio guard new [OPTIONS] <NAME>
  • <NAME> Name of the guard project to create. Required.

chio guard build

Compile the guard in the current directory to wasm32-unknown-unknown.

Command synopsistext
chio guard build [OPTIONS]

chio guard inspect

Inspect a compiled .wasm guard binary and print exports, ABI compatibility, and memory config.

Command synopsistext
chio guard inspect [OPTIONS] <PATH>
  • <PATH> Path to the .wasm file to inspect. Required.

chio guard test

Run YAML test fixtures against a compiled .wasm guard.

Command synopsistext
chio guard test [OPTIONS] [FIXTURES]...
  • [FIXTURES]... Glob or paths to YAML fixture files.
  • --wasm <WASM> Path to the .wasm file to test.
  • --fuel-limit <FUEL_LIMIT> Fuel limit per fixture evaluation (default: 1_000_000). Default 1000000.
Additional behavior

Without --wasm, the module is the wasm_path that guard-manifest.yaml in the current directory names, so a project made by chio guard new tests with chio guard test tests/*.yaml.

chio guard bench

Benchmark a compiled .wasm guard for fuel consumption and latency.

Command synopsistext
chio guard bench [OPTIONS] <PATH>
  • <PATH> Path to the .wasm file to benchmark. Required.
  • --iterations <ITERATIONS> Number of iterations (default: 100). Default 100.
  • --fuel-limit <FUEL_LIMIT> Fuel limit per evaluation (default: 1_000_000). Default 1000000.

chio guard pack

Package a guard project into a distributable .arcguard archive.

Command synopsistext
chio guard pack [OPTIONS]

chio guard publish

Publish a guard project as a three-layer OCI artifact.

Command synopsistext
chio guard publish [OPTIONS] --ref <REFERENCE> --epoch-id-seed <EPOCH_ID_SEED> <PROJECT>
  • <PROJECT> Guard project directory containing guard-manifest.yaml. Required.
  • --ref <REFERENCE> Tag-addressed OCI destination, for example oci://ghcr.io/chio/tool-gate:v1. Required.
  • --wit <WIT> WIT file to publish as the first layer. Default wit/chio-guard/world.wit.
  • --signer-public-key <SIGNER_PUBLIC_KEY> Ed25519 signer public key as ed25519:<base64>. If omitted, guard-manifest.yaml is used.
  • --signer-subject <SIGNER_SUBJECT> Optional Sigstore signer subject annotation.
  • --fuel-limit <FUEL_LIMIT> Runtime fuel limit recorded in the config blob. Default 5000000.
  • --memory-limit-bytes <MEMORY_LIMIT_BYTES> Runtime memory limit in bytes recorded in the config blob. Default 16777216.
  • --epoch-id-seed <EPOCH_ID_SEED> Epoch seed recorded in the config blob. Required.
  • --username <USERNAME> Registry username for HTTP basic auth.
  • --password <PASSWORD> Registry password or token for HTTP basic auth. Prefer CHIO_GUARD_REGISTRY_PASSWORD env over the argv form so the secret does not leak via ps / /proc/<pid>/cmdline. Reads CHIO_GUARD_REGISTRY_PASSWORD.
  • --allow-http-registry <ALLOW_HTTP_REGISTRY> Registry host allowed to use HTTP instead of HTTPS.

chio guard pull

Pull a digest-pinned guard OCI artifact into the local content-addressed cache.

Command synopsistext
chio guard pull [OPTIONS] --ref <REFERENCE>
  • --ref <REFERENCE> Digest-pinned OCI source, for example oci://ghcr.io/chio/tool-gate@sha256:<digest>. Required.
  • --username <USERNAME> Registry username for HTTP basic auth.
  • --password <PASSWORD> Registry password or token for HTTP basic auth. Prefer CHIO_GUARD_REGISTRY_PASSWORD env over the argv form so the secret does not leak via ps / /proc/<pid>/cmdline. Reads CHIO_GUARD_REGISTRY_PASSWORD.
  • --allow-http-registry <ALLOW_HTTP_REGISTRY> Registry host allowed to use HTTP instead of HTTPS.
  • --sigstore-bundle <PATH> Optional Sigstore bundle JSON to cache alongside the pulled artifact.
  • --sigstore-identity-regex <REGEX> Fulcio certificate identity SAN regex required for Sigstore cache admission.
  • --sigstore-oidc-issuer <URL> OIDC issuer expected on the Sigstore certificate.

chio guard blocklist

Manage the local guard digest blocklist.

Command synopsistext
chio guard blocklist [OPTIONS] <COMMAND>

chio guard blocklist remove

Remove a digest from the local guard blocklist.

Command synopsistext
chio guard blocklist remove [OPTIONS] <DIGEST>
  • <DIGEST> Digest to remove, as sha256:<64-hex> or bare 64-hex. Required.

chio guard install

Install a .arcguard archive to the guard directory.

Command synopsistext
chio guard install [OPTIONS] <PATH>
  • <PATH> Path to the .arcguard archive file. Required.
  • --target-dir <TARGET_DIR> Target directory to extract into (default: ./guards/). Default guards.

chio guard sign

Sign a .wasm guard binary and write a .wasm.sig sidecar.

Command synopsistext
chio guard sign [OPTIONS] --key <KEY> --name <NAME> --version <VERSION> <WASM>
  • <WASM> Path to the .wasm file to sign. Required.
  • --key <KEY> Path to a file containing a hex-encoded 32-byte Ed25519 signing seed. Required.
  • --name <NAME> Module name to embed in the signed envelope (matches guard-manifest.yaml). Required.

chio guard verify

Verify the .wasm.sig sidecar for a .wasm guard binary (exits 0 on success).

Command synopsistext
chio guard verify [OPTIONS] <WASM>
  • <WASM> Path to the .wasm file to verify. Required.

chio guard market

Marketplace surface: list, info, install priced guards.

Command synopsistext
chio guard market [OPTIONS] <COMMAND>

chio guard market list

List guards visible to the tenant under the tenant’s reputation tier.

Command synopsistext
chio guard market list [OPTIONS] --catalog <PATH>
  • --catalog <PATH> Path to the marketplace catalog JSON file. Required.
  • --tenant <ID> Tenant identifier surfaced in audit-trail output. Default default.
  • --tier <TIER> Tenant reputation tier (tier0/tier1/tier2/tier3). Default tier0.
  • --currency <CCY> Currency the tenant pays in (ISO 4217). Default USD.
  • --json Emit a stable JSON report on stdout instead of a TTY table.

chio guard market info

Show price, reputation floor, cosign status, recent settlements.

Command synopsistext
chio guard market info [OPTIONS] --catalog <PATH> --ref <OCI_REF>
  • --catalog <PATH> Path to the marketplace catalog JSON file. Required.
  • --ref <OCI_REF> Digest-pinned guard reference. Required.
  • --tenant <ID> Tenant identifier surfaced in audit-trail output. Default default.
  • --tier <TIER> Tenant reputation tier. Default tier0.
  • --currency <CCY> Tenant currency. Default USD.
  • --publisher-revoked Treat the publisher as revoked by the revocation oracle.
  • --json Emit a stable JSON report on stdout instead of plain text.

chio guard market install

Bind a pulled guard to the tenant bundle and registered price. Idempotent on replay.

Command synopsistext
chio guard market install [OPTIONS] --catalog <PATH> --bundle-dir <DIR> --ref <OCI_REF>
  • --catalog <PATH> Path to the marketplace catalog JSON file. Required.
  • --bundle-dir <DIR> Path to the tenant bundle directory (created if missing). Required.
  • --ref <OCI_REF> Digest-pinned guard reference to install. Required.
  • --tenant <ID> Tenant identifier. Default default.
  • --tier <TIER> Tenant reputation tier. Default tier0.
  • --currency <CCY> Tenant currency. Default USD.
  • --publisher-revoked Treat the publisher as revoked by the revocation oracle.
  • --json Emit a stable JSON record on stdout.

Read more in Custom guards.

PreviousCLI task index