memstead admin — admin-only moderation over the registry’s admin
endpoints. There is deliberately no web admin panel: moderation runs
from the terminal, gated server-side by the MEMSTEAD_ADMINS
allowlist (the CLI just sends the caller’s token; a non-admin gets a
403). Every action is recorded in the registry’s append-only audit
log. Like unpublish, these destructive calls never auto-trigger the
Device Flow — authenticate first with memstead login.
Shared plumbing for the batch command family (batch-update,
batch-create, batch-relate): the per-entry markdown breakdown,
the refused-batch error envelope, and the exit-code mapping. One
module so the three commands render and refuse identically — the
family contract is enforced by construction, not by convention.
memstead batch-create --from <file.json> — create many entities in
one call: one workspace load, one commit per touched mem,
all-or-nothing with report-all refusals.
memstead batch-relate --from <file.json> — apply many edge changes
in one call: one workspace load, one commit per touched mem,
all-or-nothing with report-all refusals.
memstead due — render the due-brief: every open entity whose
schema-declared due date falls inside the window, overdue first,
across every mem whose schema declares the axis (read-only mounts
labelled as third-party quoted data). The renderer is the shared
engine entry point Engine::render_due_brief, so the CLI and
UniFFI serve byte-identical content — the projection-brief
precedent. There is deliberately no MCP tool (briefs are the
CLI/app family); the MCP server instructions name this verb as the
CLI companion.
memstead reload — refresh the engine’s in-memory store from on-disk
branch state. CLI surface parity with the MCP memstead_reload tool:
without the Reload subcommand variant, memstead reload would refuse
with unrecognized subcommand while the same op stays reachable through
MCP. AGENTS.md’s parity rule
(“every operation reachable through the engine SHOULD be
reachable via both UniFFI and CLI”) makes this the correct
direction to close.
memstead fetch / memstead pull / memstead push CLI subcommands. The
three engine surfaces share refusal codes and an outcome shape;
the CLI front-end is a thin print of each.
memstead uninstall <name> — the symmetric removal for
memstead install: unregister an installed read-mem’s
workspace-level mount. Registration-only by default — the global
cache copy is shared across workspaces and survives (a later
install of the same archive re-registers without a download).
memstead verify-anchors --mem <name> — the standalone drift
statement: verify every anchor in a mem against its declared source,
with no binding required. Read-only on mem content — pure sidecar
read plus filesystem observation, no commit on any backend.
--help epilog for memstead search and memstead list. Names the five
frozen named-flag shortcuts and points at --filter KEY=VALUE as
the path to any other schema-declared filterable: equality field.
--help epilog for memstead create and memstead update. The CLI
stores --section / --append / --patch flag values as bytes
verbatim — backslash escapes (\n, \t, …) are NOT interpreted.
Agents reading the help learn the multi-line-authoring escape hatch
(--from <JSON file>) before they hit the friction.
Combined --help epilog for memstead create: the section-bytes-
verbatim note followed by the title-grammar rule (derived from the
validator via memstead_base::TITLE_GRAMMAR_RULE) and the
title→slug pipeline description. clap’s after_long_help takes a
single string, so the epilogs are concatenated here.
Merge a mem_changed notice array into a --json CLI response
body. No-op when no reload happened during the operation or the
body is not a JSON object. Mirrors the MCP server’s
attach_mem_changed so the two surfaces emit the same key.
(Always compiled; on lean the engine never stashes a notice, so
notices is empty and this no-ops.)
Parse a KEY=VALUE argument supplied via --filter. Returns a
typed CliError on malformed input so the failure rides the
INVALID_INPUT envelope rather than crashing the process.
Render a human-readable mem_changed block for markdown CLI
output. Empty when no reload happened. Names memstead changes-since
(never memstead diff) for the follow-up, matching the cross-surface
recovery contract. (Always compiled; on lean notices is always
empty, so this returns the empty string.)
Render the per-entity-type guidance block surfaced on
memstead_create’s text mirror. Emits one “Type-level guidance”
section per entity_type key in the map. Returns an empty string
when the map is empty so callers can concatenate unconditionally.
The structured channel ships the same data top-level on
type_guidance.
--help text describing the title→slug pipeline. Shared by
memstead create and memstead rename so an agent reading either
command’s help can predict what slug a given title will produce
(and therefore why the strict gate refuses titles outside the
pipeline’s accepted character classes). The leading title-grammar
rule is derived from the validator’s own
memstead_base::TITLE_GRAMMAR_RULE at build time, not
transcribed — the docs cannot drift from the accept set alone.