Enum Command 

pub enum Command {
    Licenses,
    Init {
        gates: Vec<String>,
        register: bool,
        id: Option<String>,
        display_name: Option<String>,
    },
    Plan {
        goal: Option<String>,
    },
    Run,
    Status {
        json: bool,
    },
    SandboxProbe {
        json: bool,
    },
    SandboxPrepare {
        targets: Vec<PathBuf>,
    },
    Outcomes {
        json: bool,
        all: bool,
        window_days: u64,
    },
    EscalationMetrics {
        json: bool,
    },
    Provenance {
        mission_id: Option<String>,
        json: bool,
    },
    GateScores {
        gate: String,
        json: bool,
    },
    Pause,
    Resume,
    Msg {
        text: String,
        interrupt: bool,
    },
    Revise {
        id: String,
        instructions: Vec<String>,
    },
    Revision {
        command: RevisionCommand,
    },
    Grant {
        command: GrantCommand,
    },
    Question {
        command: QuestionCommand,
    },
    Missions,
    Abandon {
        id: Option<String>,
        reason: Option<String>,
    },
    Clean {
        yes: bool,
        all: bool,
    },
    Ticket {
        command: TicketCommand,
    },
    Draft {
        slug: String,
        yes: bool,
        from_mission: Option<String>,
    },
    Decompose {
        goal: String,
        yes: bool,
    },
    Exec {
        file: PathBuf,
        yes: bool,
        max_cycles: Option<u32>,
        enqueue: bool,
        enqueue_source: Option<String>,
        enqueue_external_ref: Option<String>,
        push: Option<String>,
        allow_unvalidated: bool,
    },
    Queue {
        remove: Option<String>,
    },
    KnowledgeRefresh {
        json: bool,
    },
    Scan {
        staged: bool,
        range: Option<String>,
    },
    DomainLint {
        seed_config: Option<PathBuf>,
        json: bool,
    },
    HookGuard {
        config: PathBuf,
    },
    HookStatus {
        config: PathBuf,
    },
    Ready {
        json: bool,
        all: bool,
    },
    Work {
        once: bool,
        expect: Option<String>,
    },
    Serve {
        port: u16,
        host: String,
        insecure_lan: bool,
        read_auth: bool,
        open: bool,
        dashboard: Option<PathBuf>,
        token: Option<String>,
        read_token: Option<String>,
        slack: bool,
    },
    Release {
        url: String,
        token: Option<String>,
    },
    Otel {
        endpoint: String,
        from_start: bool,
    },
    EvidenceBundle {
        mission_id: Option<String>,
        out: Option<PathBuf>,
    },
    ExportTraces {
        mission_id: Option<String>,
        all: bool,
        out: Option<PathBuf>,
    },
    ExportCorpus {
        mission_id: Option<String>,
        all: bool,
        out: Option<PathBuf>,
    },
    Config {
        command: ConfigCommand,
    },
    Pack {
        command: PackCommand,
    },
    Standards {
        command: StandardsCommand,
    },
}

Variants

Licenses

Print Kranz, Rust dependency and embedded-dashboard license notices

Init

Prepare an existing Git worktree for its first Kranz mission.

Scaffolds an additive runtime-ignore block, a tracked merge-gate suite, and the tickets directory. Common Rust, Node, and Python gates are detected; unfamiliar toolchains must supply –gate. Re-running is safe: existing gates are validated and never replaced.

Fields

gates: Vec<String>

Unconditional validation command (repeat for multiple gates). Overrides toolchain detection when creating a new gate suite.

register: bool

Register this canonical root in the global multi-repo host catalog.

id: Option<String>

Host-catalog repository id (defaults to a slug of the directory).

display_name: Option<String>

Friendly name shown in the dashboard project picker.

Plan

Create a mission and shape its plan in an interactive conversation.

With no goal, resumes the most recent mission still in planning (e.g. after a Claude usage-limit interruption) — the orchestrator session is resumed with its full conversation context.

Fields

goal: Option<String>

The mission goal, in plain language (omit to resume planning)

Run

Execute the mission loop (also crash-resumes an interrupted mission)

Status

Show the mission tree, totals and recent decisions (read-only, no lock)

Fields

json: bool

Dump the full MissionState as JSON instead of the tree

SandboxProbe

Probe the native Windows AppContainer candidate without launching it.

Loads processmodel.dll from System32 only, checks for Microsoft’s experimental process-sandbox export, and records the Windows build. API presence never enables production enforcement by itself.

Fields

json: bool

Print the stable probe report as JSON.

SandboxPrepare

Prepare the Windows host for AppContainer enforcement.

Adds only the two persistent, non-inheriting metadata ACEs required by Windows tools on each drive root and reapplies the documented null-device descriptor that resets at boot. Run from an elevated PowerShell; ordinary Kranz launches verify both prerequisites read-only.

Fields

targets: Vec<PathBuf>

Literal local drive root to prepare (repeat for multiple drives).

Outcomes

Show the flight-surgeon outcomes fold: autonomy ratio, grant-latency distribution, per-task-class rows, context reuse, the rubber-stamp flag, and the escalation ledger (read-only, no lock)

Fields

json: bool

Dump the full Outcomes struct as JSON instead of the text report

all: bool

Cost per merged change grouped by repo across the host catalog (~/.kranz/config.json), beside the autonomy ratio (KRZ-329)

window_days: u64

Window in days for the merged-change denominator (only with –all; default 30, inclusive at both ends)

EscalationMetrics

Show the flight-surgeon console: autonomy ratio split by outcome, the rubber-stamp signal (park→grant p50/p90 + sub-10s count), false greens (completed missions with traced defect tickets), and the escalation ledger (read-only, no lock)

Fields

json: bool

Dump the full EscalationMetrics struct as JSON instead of the text report

Provenance

Replay why a mission’s unit passed from its event log alone: the gate ladder in order (verdicts + artefact resolution against the mission dir), each session’s backend/model and prompt identity, every human decision with its event seq, and the terminal outcome (read-only, no lock). A cleaned runs/ degrades artefact refs to “unresolved”, never to an error.

Fields

mission_id: Option<String>

The mission id (defaults to the global –mission / auto-selection)

json: bool

Dump the full ProvenanceChain struct as JSON instead of the text report

GateScores

Show the recorded evaluation series for one gate identity across all missions: every gate.result with that gate name, in log order — verdict, and the gate-supplied score + threshold where the gate reported them (read-only, no lock). kranz records what gates report, never normalizes it, and never derives the verdict from the score; a boolean-only gate’s series shows verdicts with no score column (absence is the normal case, never a zero).

Fields

gate: String

The gate identity (the gate field on gate.result events — a defect-class name like vacuous-filter, a pack gate name, merge-gate-suite)

json: bool

Dump the GateScoreSeries struct as JSON instead of the text table

Pause

Pause the mission (takes effect between worker runs)

Resume

Resume a paused mission (takes effect between worker runs)

Msg

Queue a message for the orchestrator

Fields

text: String

The message text

interrupt: bool

Abort the current worker run (recorded as partial) before injecting the message

Revise

Request a revised plan for an active mission

Fields

id: String

Mission id to revise

instructions: Vec<String>

Operator instructions for the revision

Revision

Approve or reject a pending plan revision

Fields

command: RevisionCommand

Grant

Approve or deny a parked capability-grant request

Fields

command: GrantCommand

Question

Answer an open structured human question (the pending-decision projection the dashboard and Slack also render)

Fields

command: QuestionCommand

Missions

List this repo’s missions

Abandon

Retire a mission: mark it ABANDONED (a terminal state, not a failure).

Appends mission.abandoned to the event log and stops here — git branches, tags, and the deliverable are left untouched. A mission that is already terminal (Complete/Failed/Abandoned) is rejected. If a live engine still holds the mission lock, stop it first; –force-lock steals only a lock whose holder is not provably alive, and –dangerously-steal-live-lock steals even a live one.

Fields

id: Option<String>

The mission id (defaults to the global –mission / auto-selection)

reason: Option<String>

Why the mission is being retired (recorded on the event)

Clean

Remove stale mission directories under .kranz/missions/.

Cleans Failed, Abandoned, and abandoned-in-planning husks (Planning with no plan.json) by default; –all additionally removes Complete missions. A mission whose lock is held by a live engine is never cleaned. Only mission directories are removed — git branches/tags and the missions index.md are left intact.

Fields

yes: bool

Skip the confirmation prompt (assume yes)

all: bool

Also remove Complete missions (kept by default for review)

Ticket

Work with mission tickets (the backlog): list, show, new, queue

Fields

command: TicketCommand

Draft

Draft a plan for a ticket non-interactively (orchestrator only).

Seeds the orchestrator with the whole ticket, requests the plan, and either parks a committed plan.md for review (default) or, with –yes, approves and queues it immediately. If the orchestrator needs more context, its questions are appended to the ticket and the ticket is flagged NEEDS-CONTEXT. Spend is bounded by the orchestrator budget cap.

Fields

slug: String

The ticket slug (file stem under .kranz/tickets/)

yes: bool

Approve and enqueue the plan immediately instead of parking it for review

from_mission: Option<String>

Seed the ticket’s traced-from-mission frontmatter with this mission id (drafting a defect ticket traced back to the mission that shipped the defect — the flight-surgeon false-green join)

Decompose

Decompose a complex goal into a ticket DAG (blocked-by edges).

One planner turn proposes 1..=8 tickets as JSON; the proposed DAG (slugs, titles, priorities, edges) is printed for review. Without –yes nothing is written (dry-run preview). With –yes all tickets are written at once: slug rules, unknown blockers, a missing root, or a blocked-by cycle each refuse the whole write loudly — no partial writes. Every emitted ticket is an ordinary ticket: draft it with kranz draft <slug>, queue it with kranz ticket queue <slug>; deps gating keeps a node from running before its blockers Complete.

Fields

goal: String

The complex goal, in plain language

yes: bool

Write the proposed tickets (without this flag it is a dry-run preview)

Exec

Run a mission fully headlessly from a plan file (CI: plan in, exit code out).

The file is a ticket-shaped markdown (## Goal, ## Context, ## Scoping answers, ## Acceptance hints). exec seeds the orchestrator with the whole file, auto-approves the returned plan (no human), and runs the mission to a terminal state. Events stream to stderr; the only line on stdout is kranz exec <id> <STATUS> cost=$X.XX branch=<b>.

Exit codes: 0 complete, 1 failed, 2 blocked, 3 underspecified (the orchestrator wanted clarification a headless run cannot provide — make the plan file self-sufficient and re-run). stdin is never read.

Fields

file: PathBuf

The mission plan file (ticket-shaped markdown)

yes: bool

Accepted for symmetry; headless runs always auto-approve (no-op)

max_cycles: Option<u32>

Override maxFixCyclesPerMilestone for this run (bounds CI spend)

enqueue: bool

Create, plan, approve, and enqueue the mission without running it. A later kranz work drain owns execution. This is the native-queue handoff for headless producers such as the Gas City pack.

enqueue_source: Option<String>

Stable producer name recorded beside an enqueued mission so its terminal state can be returned even if another dispatcher drains the shared queue. Must be paired with –enqueue-external-ref.

enqueue_external_ref: Option<String>

Producer-owned identifier recorded with –enqueue-source.

push: Option<String>

After a COMPLETE run, push the mission’s kranz/* branch to this git remote (the cloud-mission handoff: a human reviews the branch and opens the PR). Refuses to push anything but a kranz/* ref.

allow_unvalidated: bool

Override the unattended scrutiny floor: without this, exec refuses to run a mission whose config has skipScrutiny set, since a headless run with the scrutiny validator disabled has no adversarial reader and can pass its own tautological acceptance (see docs/gascity.md lesson 3). The KRANZ_ALLOW_UNVALIDATED=1 env var is equivalent.

Queue

Show or remove an entry from the per-repo execution queue

Fields

remove: Option<String>

Remove the queued entry for this mission without running it. The mission itself is retained for audit; abandon it separately when the producer is cancelling the work rather than re-enqueueing it.

KnowledgeRefresh

Report docs/knowledge notes whose verified_against paths drifted.

Fields

json: bool

Print the report as JSON instead of text

Scan

Scan a git diff for unwaived secret findings.

Fields

staged: bool

Scan staged changes (git diff --cached)

range: Option<String>

Scan a git range such as main..HEAD

DomainLint

Lint the scoped tree for banned domain vocabulary (the KRZ-314 clean-room boundary: kranz core stays domain-free, domain knowledge ships in private packs). Policy is the committed hashed denylist (.kranz/domain-denylist.json) plus reviewed waivers (.kranz/domain-allowlist); see docs/domain-lint.md. Exit 0 clean, 1 on unwaived hits — each named by fingerprint + file:line, never quoting the matched term.

Fields

seed_config: Option<PathBuf>

Regenerate the hashed denylist from a plaintext terms file (one term per line, # comments) instead of linting. The terms file IS the protected vocabulary: keep it out of the repo — .kranz/domain-terms.local is gitignored for exactly this.

json: bool

Print the report as JSON instead of text

HookGuard

INTERNAL: the Claude Code lifecycle-hook command the engine installs into worker sessions (KRZ-302). Never invoked by operators — the session’s CLI pipes a PreToolUse hook payload to stdin; the guard judges it against the engine-written spec file, records the outcome, and exits 0 (allow) / 2 (block, stderr fed to the model) / 1 (guard error, failing open — the engine-side sweep remains authoritative).

Fields

config: PathBuf

The per-session hook-gate spec file the engine wrote

HookStatus

INTERNAL: the cursor CLI lifecycle-hook relay the backend installs into agent sessions (ticket agent-hooks-status-signals). Never invoked by operators — the session’s CLI pipes a lifecycle hook payload to stdin; the relay maps it to a coarse signal and POSTs it to the loopback endpoint in the engine-written spec file. Purely observational: every failure exits 0.

Fields

config: PathBuf

The per-session hook-status spec file the engine wrote

Ready

Score how ready this repo is for autonomous kranz missions.

Fields

json: bool

Print the serializable scorecard JSON.

all: bool

Score every repo in the host catalog (~/.kranz/config.json) and report the N-of-M-at-L3+ org headline.

Work

Drain the execution queue: run queued missions one at a time per repo

Fields

once: bool

Process exactly one front entry (exit 0 if the repo is busy) instead of draining until the queue is empty

expect: Option<String>

With –once, run only when this exact mission is still at the front. A changed front is released without execution.

Serve

Serve the REST/WebSocket API (and the dashboard, if built)

Fields

port: u16

TCP port to bind

host: String

Bind address. Default loopback; set e.g. 0.0.0.0 (LAN) or a tailnet IP to reach the API from other devices (glasses app, phones). Non-loopback binds require --insecure-lan — every /api GET/POST/WS then requires a token. Reads accept the read-only token; POSTs require the mutation token.

insecure_lan: bool

Acknowledge that a non-loopback bind exposes the API on the network. Required when --host is not a loopback address; off-loopback, GETs and WS upgrades require either the read-only or mutation token; POSTs require the mutation token. Ignored for loopback addresses (127.0.0.0/8, ::1).

read_auth: bool

Require either the read-only or mutation token on /api GETs and the WS upgrade on ANY bind class, including loopback. POSTs still require the mutation token. Off-loopback binds already gate reads; this flag forces that posture on loopback too. Still requires --insecure-lan for a non-loopback bind (unchanged).

open: bool

Open the dashboard in the default browser

dashboard: Option<PathBuf>

Directory holding the built dashboard (index.html + assets). Default search order: $KRANZ_DASHBOARD_DIST, <repo>/apps/dashboard/dist, installed asset dirs, the kranz source checkout used to build the binary, then the embedded dashboard bundled into the CLI.

token: Option<String>

Pin the mutation token instead of generating one (scripting). Every POST /api/… must carry it in the x-kranz-token header. Falls back to $KRANZ_TOKEN when unset.

read_token: Option<String>

Pin the read-only token instead of generating one (falls back to $KRANZ_READ_TOKEN). Authenticates /api GETs and the WS upgrade only — never mutations — so it is the token safe to hand to dashboards and agents. Stored next to serve.token at .kranz/serve.read.token (operator catalog: ~/.kranz/serve/<endpoint>.read.token). Must be non-empty visible ASCII without whitespace and differ from the mutation token.

slack: bool

Also run the Slack bridge (Socket Mode). Requires bot/app tokens + channel in ~/.kranz/config.json or KRANZ_SLACK_* env vars; a no-op with a log line when unconfigured. See docs/backlog-and-slack.md.

Release

Free the mission’s single-writer lock held by a running kranz serve.

Resolves the selected root against the running serve’s live catalog, then POSTs to its repository-scoped release endpoint. The CLI runs in a different process and cannot reach serve’s in-memory registry directly. The mission id comes from the global –mission / auto-selection, same as kranz abandon.

Fields

url: String

Base URL of the running kranz serve instance

token: Option<String>

Mutation token printed by kranz serve (falls back to $KRANZ_TOKEN)

Otel

Tail mission event logs and export OpenTelemetry spans over OTLP HTTP.

Entirely read-side: polls each in-scope mission’s events.jsonl (like kranz run’s tail and the Slack bridge), folds spans from the event timestamps, and exports one span per closed run/milestone/mission. Runs until Ctrl-C. Honors the global –repo/–mission.

Fields

endpoint: String

OTLP HTTP traces endpoint, e.g. http://localhost:4318/v1/traces

from_start: bool

Replay each mission’s full log (spans built from event timestamps) before following live. Without this, each mission’s cursor is seeded at its current head — only spans whose opening AND closing events arrive during the tail are exported.

EvidenceBundle

Export a mission’s portable audit bundle (KRZ-326): a self-contained directory an auditor can open without repo access — manifest.json (every entry with its sha256 + source ref), a human summary.md, the provenance chain.json, the escalation ledger and cost fold, the raw scrubbed event log, and every resolvable artefact’s bytes under artefacts/. Missing artefact bytes are listed as unresolved manifest entries, never omitted. The same log always yields the same bundle.

Fields

mission_id: Option<String>

The mission id (defaults to the global –mission / auto-selection)

out: Option<PathBuf>

Directory to write the bundle into (created; must be empty). Defaults to ./evidence-bundle-<mission-id>

ExportTraces

Export validation-PASSED worker traces as fine-tuning-ready JSONL.

Derived and regenerable: loads and folds the target mission’s event log on demand (like status) and prints one instruction-pair JSON object per line to stdout — there is no persisted dataset file, so re-running this command over an unchanged event log always yields byte-identical output.

Fields

mission_id: Option<String>

The mission id (defaults to the global –mission / auto-selection; ignored with –all)

all: bool

Aggregate passed traces across every mission under .kranz/missions. A mission whose event log is missing or unreadable is skipped, not fatal.

out: Option<PathBuf>

Write the JSONL output to this path instead of stdout.

ExportCorpus

Export the provenance-tagged training corpus as JSONL (KRZ-332).

One tagged record per line (source: worker-trace / divergence / escalation): validation-PASSED worker traces, divergence comparison+resolution pairs, and escalation-ledger human judgments — every record carrying the provenance refs (mission, backend/model, run id, gate-chain seqs) that resolve it through kranz provenance. Derived and regenerable like export-traces (which stays a traces-only contract): same logs in, byte-identical JSONL out.

Fields

mission_id: Option<String>

The mission id (defaults to the global –mission / auto-selection; ignored with –all)

all: bool

Aggregate the corpus across every mission under .kranz/missions (ids sorted). A mission whose event log is missing, unreadable, or corrupt is skipped, not fatal.

out: Option<PathBuf>

Write the JSONL output to this path instead of stdout.

Config

Inspect and edit kranz configuration (files + mid-mission changes).

Config resolves from three layers, later winning: compiled-in defaults <- ~/.kranz/config.json (--global) <- <repo>/.kranz/config.json (the default target). show prints the effective merge; set/unset edit one layer file (validated before writing, other keys preserved); role is the MID-MISSION path — it enqueues a config-change control command on a running mission (the CLI twin of Slack’s /kranz config), while file edits only shape future missions.

Fields

command: ConfigCommand

Pack

Work with kranz packs (the pack contract: deterministic gates, role prompts, checklists, artefact stores — docs/pack-contract.md)

Fields

command: PackCommand

Standards

Work with Flight Rules standards (KRZ-341): the schema-4 pack standards corpus — RFCs, rules, the normalized manifest + content digest, and the lifecycle transition lint (docs/scoping/flight-rules-engineering-standards.md)

Fields

command: StandardsCommand

Trait Implementations

impl Debug for Command

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl FromArgMatches for Command

fn from_arg_matches(__clap_arg_matches: &ArgMatches) -> Result<Self, Error>

Instantiate Self from ArgMatches, parsing the arguments as needed.

fn from_arg_matches_mut( __clap_arg_matches: &mut ArgMatches, ) -> Result<Self, Error>

Instantiate Self from ArgMatches, parsing the arguments as needed.

fn update_from_arg_matches( &mut self, __clap_arg_matches: &ArgMatches, ) -> Result<(), Error>

Assign values from ArgMatches to self.

fn update_from_arg_matches_mut<'b>( &mut self, __clap_arg_matches: &mut ArgMatches, ) -> Result<(), Error>

Assign values from ArgMatches to self.

impl Subcommand for Command

fn augment_subcommands<'b>(__clap_app: Command) -> Command

Append to Command so it can instantiate Self via FromArgMatches::from_arg_matches_mut

fn augment_subcommands_for_update<'b>(__clap_app: Command) -> Command

Append to Command so it can instantiate self via FromArgMatches::update_from_arg_matches_mut

fn has_subcommand(__clap_name: &str) -> bool

Test whether Self can parse a specific subcommand