CLI Reference
Command-line interface for local development and deployment operations.
Installation
Commands
sign-manifest
Sign the security policy manifest with Ed25519 private key.
- Reads:
manifest/security_policy.json - Private key:
manifest/security_policy.ed25519.key - Output:
manifest/security_policy.json.sig(detached) - Use case: After modifying the policy manifest in production, run this command to generate a fresh cryptographic signature. Deployed instances verify the signature at startup and reject mismatches (fail-closed policy enforcement).
(default) Local Audit
Run a test audit locally (no command specified). Demonstrates the tri-agent pipeline (Scout → Nitpicker → Judge).
Output shows:
- [STAGE 1] Scout Score — threat level (0–10)
- [STAGE 2] Sanitized Payload — intent cleaning
- STATUS — final decision (✅ PROCEED or 🛑 BLOCKED)
Environment Variables
ENVIRONMENTSet to production to enforce strict validation. Requires ACTIVE_MODE=true and 32+ character SIGNING_SECRET. Recommended for production deployments.
SIGNING_SECRET(Production only) Random string ≥32 characters for HMAC operations. Generate with: openssl rand -hex 16
ACTIVE_MODESet to true when ENVIRONMENT=production. Confirmation flag to prevent accidental enforcement bypass.
Manifest Setup
- Generate Ed25519 keypair (one-time):ssh-keygen -t ed25519 -N "" -f manifest/security_policy.ed25519.key -m pem
- Extract public key:ssh-keygen -y -f manifest/security_policy.ed25519.key > manifest/security_policy.ed25519.pub
- Edit
manifest/security_policy.jsonwith your policy thresholds. - Sign the manifest:python -m aletheia_cyber_core sign-manifest
- Commit manifest/security_policy.json.sig to version control. Keep private key secure and injected via env vars at deploy time.
Troubleshooting
ManifestTamperedError
Signature verification failed. Ensure the private key matches the public key in the manifest, and re-run sign-manifest.
FATAL: Production running without ACTIVE_MODE=true
Set ACTIVE_MODE=true in your deployment environment when ENVIRONMENT=production.
FATAL: Production missing SIGNING_SECRET
In production, set SIGNING_SECRET to a random string ≥32 characters.