Module agent_cli 

basil-agent: the standalone Basil daemon.

It loads a 0600 sealed bundle of the broker’s own bootstrap credentials (vault-vh1, designs/unlock-and-bundle.html), unlocks it via an enabled + available slot, hands each backend its credential, zeroizes the plaintext, and hands off to crate::run_grpc.

The old plaintext bootstrap paths (--vault-token / $VAULT_TOKEN / ~/.vault-token and the implicit-SPIFFE flags) are gone: the sealed bundle is the only supported source of bootstrap creds, with no fallback.

The top-level basil bundle subcommand creates and manages sealed bundles. Core broker logic lives in this crate’s library.

Structs

ConfigOverrides

The only startup settings that may be supplied outside the config file.

DoctorArgs

Arguments for the preflight doctor path (basil-f0j).

ExplainArgs

Arguments for the unified policy explain verb (basil-1zx.3).

RunArgs

basil agent: a signing proxy over a Vault transit engine (Vault or OpenBao).

Functions

run_agent

Run the broker daemon behind basil agent.

run_bundle

Run sealed-bundle operations behind top-level basil bundle.

run_doctor_command

Run the preflight doctor behind basil doctor.

run_explain

Run the offline policy dry-run/explainer (basil-4vf).

run_init

Run first-run config scaffolding behind top-level basil init.