Module agent_cli 

basil-agent: the standalone Basil daemon.

It loads a 0600 sealed bundle of the broker’s own bootstrap credentials (vault-vh1, designs/unlock-and-bundle.html), unlocks it via an enabled + available slot, hands each backend its credential, zeroizes the plaintext, and hands off to crate::run_grpc.

The old plaintext bootstrap paths (--vault-token / $VAULT_TOKEN / ~/.vault-token and the implicit-SPIFFE flags) are gone: the sealed bundle is the only supported source of bootstrap creds, with no fallback.

The top-level basil bundle subcommand creates and manages sealed bundles. Core broker logic lives in this crate’s library.

Structs

CheckArgs

Arguments for the read-only catalog check (lint) path (vault-roe).

ConfigOverrides

The only startup settings that may be supplied outside the config file.

DoctorArgs

Arguments for the preflight doctor path (basil-f0j).

ExplainArgs

Arguments for the offline policy explain (dry-run) path (basil-4vf).

RunArgs

basil agent: a signing proxy over a Vault transit engine (Vault or OpenBao).

Functions

run_agent

Run the broker daemon behind basil agent.

run_bundle

Run sealed-bundle operations behind top-level basil bundle.

run_config_check

Run the offline catalog/backend check behind basil config check.

run_config_explain

Run the offline policy explainer behind basil config explain.

run_config_init

Run first-run config scaffolding behind basil config init.

run_doctor_command

Run the preflight doctor behind basil doctor.