CLI reference

NAME

dvx - Daevix - execution-time control plane for autonomous agents

SYNOPSIS

dvx

[--help|-h]
[--version|-v]

DESCRIPTION

Conventions that hold across every command:

Environment: each flag also reads from a DVX_-prefixed variable (e.g. –addr from DVX_ADDR, –database-dsn from DVX_DATABASE_DSN). Precedence is flag > environment > default.
Server components are TLS-only: –tls-cert and –tls-key (PEM) are required to serve.
Errors returned by the servers are RFC 9457 problem documents.
Audit output is a first-class stream, separate from application logging; both go to stdout and are told apart by a top-level “stream” key.

Usage:

dvx [GLOBAL OPTIONS] [command [COMMAND OPTIONS]] [ARGUMENTS...]

GLOBAL OPTIONS

–help, -h: show help

–version, -v: print the version

COMMANDS

serve

Run a Daevix server component

–help, -h: show help

controlplane

Run the controlplane (management plane; never handles sovereign data)

–addr="": TLS listen address for the component API (default: “:8443”)

–agent-token-issuer-url="": public base URL the controlplane issues 60s agent-operator tokens as (bd_2_0-bvw.3): the iss claim + where discovery (/.well-known/openid-configuration) + JWKS (/.well-known/jwks.json) are served. Enabling it mounts the enclave agent-token mint endpoint; requires –oidc-issuer + a database

–agent-token-ttl="": lifetime of a minted agent-operator token (bd_2_0-bvw.3); 0 uses the 60s default. NOT aligned with the 15-min SVID TTL on purpose: containment is enforced by levers (mint-gate, gateway drop, deny-all, grant deletion), not expiry (default: 0s)

–audit-capture-or-deny: fail-closed durability for the AUTHORITY audit tier (bd_2_0-4p8.3, docs/audit-evidence-tiers.md): authority records are durably spooled to the WAL BEFORE the gated effect (denials returned, grants committed, credentials handed over), and the effect is REFUSED if that cannot happen within –audit-capture-timeout. ON by default; set false for best-effort recording (rungs 1+2, never refuses)

–audit-capture-timeout="": how long an authority-gated path blocks for the audit WAL to accept the record before refusing the effect (capture-or-deny, bd_2_0-4p8.3) (default: 5s)

–audit-dsn="": clickhouse-go DSN for the controlplane’s OWN platform-audit store (bd_2_0-8kl.11); when set, audit -> ClickHouse instead of stdout. Empty leaves audit on stdout

–audit-wal-dir="": on-disk WAL dir for the audit store (bd_2_0-8kl.10): durable across a ClickHouse outage/restart, replays on start. REQUIRED with –audit-dsn (fail-closed durability, bd_2_0-8kl.15)

–audit-wal-max-bytes="": per-table on-disk WAL spool ceiling in BYTES (bd_2_0-8kl.16, durability rung 2): the durable buffer absorbing a ClickHouse outage. Size to a realistic outage window and BELOW the WAL disk capacity; past it audit drops (bounded, counted, alertable) rather than filling disk. 0 => the reviewed per-component default (internal/config, bd_2_0-4p8.1; see docs/runbooks/audit-durability.md) (default: 0)

–config-enclave-id="": enclave the published config snapshot is scoped for (self-describing in the snapshot)

–config-org="": the single org the target enclave serves (bd_2_0-j9r) for config scoping; snapshot carries the platform floor plus only this org. Empty = platform-only

–config-publish="": local path to publish the config-value snapshot (bd_2_0-7ha) for one enclave’s IMDS to resolve; requires a database

–config-publish-dir="": directory to fan config values out to, one file per registered enclave (

/<enclave_id>.json), scoped from the enclave registry; requires a database

–database-dsn="": PostgreSQL DSN; empty runs in skeleton mode (no DB)

–exec-access: provision the interactive PTY/exec mode (no WireGuard); independent of –wireguard-access (bd_2_0-0f7.2)

–exec-session-ttl="": lifetime of a minted exec-kind rendezvous session for interactive PTY/exec (bd_2_0-0f7.2); 0 uses the default (default: 0s)

–help, -h: show help

–kms-config="": opaque provider config JSON for –kms-provider (e.g. {“address”:“http://vault:8200”,“token_path”:"/etc/dvx/kms/token"})

–kms-provider="": operator at-rest key store backend (e.g. ‘vault’) for controlplane metadata encryption; empty stores policy values plaintext. The operator’s provider, never a customer’s

–log-format="": application log format (json|text) (default: “json”)

–log-level="": application log level (debug|info|warn|error) (default: “info”)

–metrics-addr="": listen address for the dedicated TLS /metrics endpoint (Prometheus); empty disables it. Reuses –tls-cert/–tls-key; lock to the scraper with a network policy (bd_2_0-pmy)

–oidc-audience="": expected token audience for the operator API; a token minted for another audience is rejected

–oidc-issuer="": trusted OIDC issuer URL (self-hosted Zitadel); with a database, mounts the operator API behind OIDC auth + capability authorization

–policy-enclave-id="": enclave the published snapshot is scoped for (self-describing in the snapshot)

–policy-org="": the single org the target enclave serves (bd_2_0-j9r); the snapshot carries the platform floor plus only this org’s policy. Empty = platform-only

–policy-publish="": local path to publish the governance policy snapshot (platform/org/group/agent) for an enclave gateway to resolve out-of-band; requires a database

–policy-publish-dir="": directory to fan the governance policy out to, one file per registered enclave (

/<enclave_id>.json), scoped from the enclave registry; requires a database

–reference-values="": local path to publish the attestation policy (ReferenceValues JSON) for enclaves to read out-of-band

–rendezvous-signer-key="": PEM file with the controlplane’s rendezvous ECDSA private key; provisions the shared rendezvous transport all interactive-access modes ride (bd_2_0-0f7); requires a database

–ssh-cert-ttl="": lifetime of a minted operator SSH cert + ssh-kind tunnel session (bd_2_0-0f7.3); 0 uses the default (default: 0s)

–tls-cert="": path to the TLS certificate (PEM)

–tls-key="": path to the TLS private key (PEM)

–token-endpoint-override="": override the token endpoint the /oauth/token facade proxies to (default: derived from –oidc-issuer as /oauth/v2/token)

–tunnel-ticket-ttl="": lifetime of a minted tunnel pairing ticket (the entitlement leash); 0 uses the default (default: 0s)

–wireguard-access: provision the WireGuard access modes (localhost tunnel + SSH); set false to run exec-only with no tunnel/SSH endpoints (bd_2_0-0f7)

–zitadel-api-base="": override the Zitadel management-API base URL (default: derived from –oidc-issuer)

–zitadel-key="": path to a Zitadel service-account key JSON; enables provisioning the Zitadel mgmt API (org create/map) from the operator API

help, h

Shows a list of commands or help for one command

imds

Run the IMDS node daemon (enclave satellite; hosts the agent-facing IMDS on a unix socket)

–addr="": TLS listen address for the component API (default: “:8444”)

–audit-capture-or-deny: fail-closed durability for the AUTHORITY audit tier (bd_2_0-4p8.3, docs/audit-evidence-tiers.md): authority records are durably spooled to the WAL BEFORE the gated effect (denials returned, credentials handed over), and the effect is REFUSED if that cannot happen within –audit-capture-timeout. ON by default; set false for best-effort recording (rungs 1+2, never refuses)

–audit-capture-timeout="": how long an authority-gated path blocks for the audit WAL to accept the record before refusing the effect (capture-or-deny, bd_2_0-4p8.3) (default: 5s)

–audit-dsn="": clickhouse-go DSN for the in-enclave audit store (bd_2_0-8kl); when set, the enclave sends its audit to ClickHouse (not stdout) and (with –oidc-issuer) serves the audit query API. Empty leaves audit on stdout

–config-snapshot="": local path to the published config-value snapshot (bd_2_0-7ha) the config-pull sidecar writes; the IMDS serves GET /v1/config from it. Empty disables config delivery

–database-dsn="": PostgreSQL DSN; empty runs in skeleton mode (no DB)

–enclave-id="": identifier for this enclave (sovereignty boundary)

–enclave-name="": friendly UNIQUE enclave name for display + audit alongside –enclave-id (bd_2_0-49z.2); never an addressing coordinate

–help, -h: show help

–imds-ca-cert="": local path (file/ConfigMap) to the gateway CA public cert; served by the IMDS at GET /v1/ca as an on-demand CA fallback. Public cert only

–imds-socket="": unix socket path for the IMDS-like metadata service agents mount (default: “/run/dvx/imds.sock”)

–inject-cred="": per-use credential rule ’name=destination=header=secret’ (repeatable); IMDS lists these at /v1/credentials (bd_2_0-lai)

–kms-config="": opaque provider config JSON for –kms-provider (e.g. {“address”:“http://vault:8200”,“token”:"…"})

–kms-provider="": at-rest key store backend for this enclave (e.g. ‘vault’); empty disables sovereign data-at-rest encryption. Local deploy config, never sent to the controlplane

–log-format="": application log format (json|text) (default: “json”)

–log-level="": application log level (debug|info|warn|error) (default: “info”)

–metrics-addr="": listen address for the dedicated TLS /metrics endpoint (Prometheus); empty disables it. Reuses –tls-cert/–tls-key; lock to the scraper with a network policy (bd_2_0-pmy)

–node-name="": the node this enclave runs on (downward API spec.nodeName); the reconciler serves only mappings for this node

–oidc-audience="": expected token audience for the audit query API; empty skips the aud check (dev only)

–oidc-issuer="": trusted OIDC issuer (Zitadel) for the audit query API operator authenticator; empty leaves the query API unmounted (fail-closed)

–oidc-org-claim="": token claim to read the caller’s org scope from (default urn:dvx:org); set for IdPs that name it differently

–placement-driver="": this imds’s placement driver (mission bd_2_0-cwnz M3): empty/k8s = CRD registry + node matching; vm = local micro-VM driver (file registry, –vm-state-dir, –placement-id)

–placement-id="": this instance’s positive placement id the reconciler matches mappings against (fail-closed); with –placement-driver=vm (the local analog of the node name)

–policy-snapshot="": local path to the published governance policy snapshot; the node tunnel terminator enforces tunnel.enabled + tunnel.ports locally from it (bd_2_0-kzb.3). Empty leaves the CP ticket gate + allow-all ports

–reference-values="": local path (file/ConfigMap) to load the attestation policy from; empty uses the reduced-assurance SAMPLE dev policy

–registry-crd: materialize agents by reconciling the broker-authored AgentMapping CRs for this node (durable HA registry); requires in-cluster RBAC

–registry-file="": file-backed AgentMapping registry path (with –placement-driver=vm): the same file the local broker authors

–registry-namespace="": namespace holding AgentMapping CRs; empty resolves the pod’s ServiceAccount namespace

–relay-ca="": PEM CA file the node tunnel terminator trusts for the relay’s serving cert on its dial-out (bd_2_0-kzb.3); empty uses the system trust store. Set for a relay fronted by a private CA (dev’s mkcert)

–relay-insecure: skip TLS verification of the relay’s serving cert on the node terminator’s dial-out (DEV ONLY; overrides –relay-ca)

–rendezvous-sessions="": local path to the pending-session snapshot (bd_2_0-kzb.2) a cp-pull sidecar writes; the node stands the right handler up per session for its Kata agents (WireGuard terminator for tunnel/ssh, exec bridge for exec). Requires –vsock-relay. Empty disables all interactive-access modes on the node

–secret-broker-ca="": PEM CA to verify the broker’s serving cert for secret reads (the published broker CA)

–secret-broker-client-cert="": PEM client cert (broker-issued imds identity) presented for the secret-read mTLS

–secret-broker-client-key="": PEM client key for –secret-broker-client-cert

–secret-broker-url="": broker mTLS channel base URL to read SECRET config values through (bd_2_0-dy6); empty uses the deprecated local sovereign store

–tls-cert="": path to the TLS certificate (PEM)

–tls-key="": path to the TLS private key (PEM)

–vm-state-dir="": the VM driver’s per-agent VM state dir (with –placement-driver=vm); the imds serves each agent’s vsock host socket from it

–vsock-dir="": kata runtime state dir the vsock relay reads (per-sandbox clh sockets + pod namespace) (default: “/run/vc”)

–vsock-relay: serve the IMDS to Kata agent VMs over vsock (bd_2_0-aoq.7); requires the node kata state dir mounted

help, h

Shows a list of commands or help for one command

gateway

Run the network gateway (sole egress path; mediates redirected agent traffic)

–agent-token-audience="": audience the minted agent-operator tokens are scoped to; must equal the controlplane’s –oidc-audience (its dvx authenticator enforces the same value). Empty uses the dvx-operator-api default (accepted by a controlplane with no pinned audience) (default: “dvx-operator-api”)

–agent-token-broker-ca="": PEM CA cert verifying the broker’s local serving cert; required with –agent-token-broker-url

–agent-token-broker-client-cert="": PEM client cert for the broker’s local mTLS channel (the broker-minted dvx-gateway-broker-client identity); required with –agent-token-broker-url

–agent-token-broker-client-key="": PEM client key for the broker’s local mTLS channel; required with –agent-token-broker-url

–agent-token-broker-url="": broker local mTLS channel base URL the gateway relays agent SVIDs to for token mints (bd_2_0-bvw.5), e.g. https://dvx-broker.dvx-enclave.svc.cluster.local:8450; required with –cp-api-host

–allow-dest="": allowed destination host suffix (repeatable); non-empty enables default-deny governance

–assert-identity-dests="": JSON array of structured in-cluster assert-identity destinations [{host,namespace,selector,port}] (bd_2_0-bwc/2ye); the gateway presents the agent’s attested SVID over mTLS to each instead of injecting a credential. Requires –svid-dir + –k8s-attribution

–audit-capture-or-deny: fail-closed durability for the AUTHORITY audit tier (bd_2_0-4p8.3, docs/audit-evidence-tiers.md): egress DENY rows and body-capture ALLOW rows are durably spooled to the WAL BEFORE the gated effect (the denial is returned / the captured exchange completes), and the effect is REFUSED if that cannot happen within –audit-capture-timeout. ON by default; set false for best-effort recording (rungs 1+2, never refuses)

–audit-capture-timeout="": how long an authority-gated path blocks for the audit WAL to accept the record before refusing the effect (capture-or-deny, bd_2_0-4p8.3) (default: 5s)

–audit-dsn="": clickhouse-go DSN for the in-enclave audit store (bd_2_0-8kl); when set, the gateway sends its audit events to ClickHouse instead of stdout. Empty leaves audit on stdout

–audit-header-hmac-salt-file="": file holding the enclave-held salt that keyed-hashes SECRET header values in the capture (bd_2_0-xs0.3): lets an operator detect a credential repeating/rotating without disclosing it. Optional; use the SAME salt as llmproxy

–audit-wal-dir="": on-disk WAL dir for the audit store (bd_2_0-8kl.10): durable across a ClickHouse outage/gateway restart, replays on start. REQUIRED with –audit-dsn (fail-closed durability, bd_2_0-8kl.15)

–ca-cert="": gateway CA certificate (PEM); with –ca-key enables TLS termination (MITM)

–ca-key="": gateway CA private key (PEM); never leaves the gateway

–cp-api-ca="": CA that signed the controlplane’s serving cert, verified on the CP-bound re-origination hop. The operator API is a named internal destination with its own anchor — set this whenever –upstream-ca’s bundle does not already carry the CP root. Empty uses the system roots

–cp-api-host="": operator-API host suffix (repeatable) whose agent egress gets a 60s agent-operator token INJECTED (bd_2_0-bvw.5): the gateway mints it via the broker relay, caches it, and presents the Authorization bearer itself — nothing is handed to the agent. Requires –agent-token-broker-url, a gateway CA (MITM), attribution, and –svid-dir

–dns-listen="": local address for the transparent DNS forwarder (the VM driver’s nftables rule steers agent udp/53 here): queries relay verbatim to the host resolver, answers spoof the original source. Requires CAP_NET_ADMIN

–enclave-id="": identifier for this enclave (sovereignty boundary)

–enclave-name="": friendly UNIQUE enclave name for display + audit alongside –enclave-id (bd_2_0-49z.2); never an addressing coordinate

–envoy-socket="": unix socket the gateway listens on; Cilium’s Envoy dials it (PROXY-protocol v2) (default: “/var/run/cilium/envoy/sockets/dvx-gateway.sock”)

–help, -h: show help

–http-capture: record request/response line, headers and a size-capped BODY for MITM’d HTTP/1.x egress the gateway allows (bd_2_0-uwi); bodies sealed per-org like headers. ON by default, but a NO-OP unless the gateway holds a KMS Crypter (–kms-provider) since bodies must be sealable — so it activates exactly where header capture does. Disable with –http-capture=false

–http-capture-max-body="": cap on PLAINTEXT bytes of each captured request/response body that are sealed (the full stream is still forwarded byte-exact); 0 uses the gateway default (16 KiB) (default: 0)

–inject-cred="": egress-injection rule ’name=destination=header=secret’ (repeatable); the gateway attaches a per-use header credential on a matched egress (bd_2_0-lai)

–k8s-attribution: join source pod IP -> agent identity by listing CiliumEndpoints (in-cluster)

–kms-config="": opaque provider config JSON for –kms-provider (e.g. {“address”:“http://vault:8200”,“token_path”:"/etc/dvx/kms/token"})

–kms-provider="": enclave KMS backend (e.g. vault) used to SEAL captured request headers on MITM’d HTTP egress (bd_2_0-xs0.3). OPTIONAL: without it the gateway audits flows as before and captures no headers (header capture is opt-in, since headers can carry sovereign data)

–llmproxy-addr="": host:port of the llmproxy satellite; when set, classified LLM inference calls are force-routed there over mTLS presenting the agent SVID (bd_2_0-b06.1). Requires –ca-cert/–ca-key, –svid-dir, –k8s-attribution

–llmproxy-ca="": PEM CA bundle to verify llmproxy’s serving cert on the routed mTLS hop (default: system roots)

–llmproxy-host="": SNI the gateway presents to llmproxy and verifies its serving cert against; empty derives it from –llmproxy-addr

–log-format="": application log format (json|text) (default: “json”)

–log-level="": application log level (debug|info|warn|error) (default: “info”)

–metrics-addr="": listen address for the dedicated TLS /metrics endpoint (Prometheus); empty disables it. Lock to the scraper with a network policy (bd_2_0-pmy)

–metrics-tls-cert="": PEM serving cert for the /metrics endpoint (required to enable –metrics-addr)

–metrics-tls-key="": PEM serving key for the /metrics endpoint

–policy-snapshot="": path to a published hierarchical governance policy snapshot (platform/org/group/agent); supersedes –allow-dest

–svid-dir="": node-local directory of per-agent SVIDs the enclave mints (bd_2_0-bwc); the gateway reads held credentials from here for the assert-identity tunnel and the LLM force-route

–tcp-listen="": local address for the transparent TCP datapath (the VM driver’s nftables TPROXY target; mission bd_2_0-cwnz M4): agent VM egress redirected here is mediated like the Envoy path - MITM, policy, audit - with the original destination preserved. Requires CAP_NET_ADMIN

–udp-listen="": local address for the transparent UDP/QUIC datapath (TPROXY target); enables HTTP-3 termination. Requires –ca-cert/–ca-key

–upstream-ca="": PEM CA bundle to validate upstream server certs on re-origination (default: system roots); for private/test upstream CAs

–vm-attribution-file="": path to the VM driver’s file-backed registry (mappings.json): mediation attribution joins the connection’s source IP to the agent from the driver’s VM→IP records (no Cilium). Mutually exclusive with –k8s-attribution

help, h

Shows a list of commands or help for one command

broker

Run the enclave broker (central control node; sole controlplane egress; re-serves metadata locally)

–addr="": TLS listen address for the component API (default: “:8450”)

–advertise-broker-url="": the enclave’s CLIENT-REACHABLE broker base URL (for an operator on the same network); announced alongside the relay URL (bd_2_0-cal.2)

–advertise-relay-url="": the enclave’s CLIENT-REACHABLE relay base URL; announced up to the controlplane so operators can discover it (bd_2_0-cal.2). Empty disables announcing

–assert-identity-dests="": JSON array of structured in-cluster assert-identity destinations [{host,namespace,selector,port}] (bd_2_0-2ye); the broker authors the per-agent egress-redirect + gateway egress CiliumNetworkPolicies that make each reachable. Same value as the gateway’s.

–audit-capture-or-deny: fail-closed durability for the AUTHORITY audit tier (bd_2_0-4p8.3, docs/audit-evidence-tiers.md): enclave grant authoring + denied authoring attempts are durably spooled to the WAL BEFORE the gated effect (the grant commits, the denial is returned), and the effect is REFUSED if that cannot happen within –audit-capture-timeout. ON by default; set false for best-effort recording (rungs 1+2, never refuses)

–audit-capture-timeout="": how long an authority-gated path blocks for the audit WAL to accept the record before refusing the effect (capture-or-deny, bd_2_0-4p8.3) (default: 5s)

–audit-dsn="": clickhouse-go DSN for the enclave audit store (bd_2_0-8kl.11); when set, the broker routes its own audit there AND serves the org-scoped audit query API on the operator listener. Empty leaves audit on stdout + the query API unmounted

–ca-cert="": PEM CA bundle to trust for the controlplane TLS cert

–client-service="": an enclave service to issue a local client identity for (repeatable), e.g. dvx-imds, dvx-gateway

–controlplane="": controlplane operator-API base URL to pull metadata from (the enclave’s sole CP egress)

–database-dsn="": PostgreSQL DSN; empty runs in skeleton mode (no DB)

–dev-agent-specs="": Phase-1 dev seam: a JSON array of desired agents the reconcile engine provisions, bypassing the AUTHENTICATED controlplane agents channel (dev only; requires –dev-mode)

–dev-mode: acknowledge this is a DEV broker: permit dev-only seams (currently –dev-agent-specs) that bypass a production control. Never set in production (bd_2_0-ib4.2)

–enclave-id="": identifier for this enclave (sovereignty boundary)

–enclave-name="": friendly UNIQUE enclave name for display + audit alongside –enclave-id (bd_2_0-49z.2); never an addressing coordinate

–help, -h: show help

–insecure-skip-verify: skip controlplane TLS verification for the pull (dev only)

–issuer="": OIDC issuer URL (Zitadel) the broker mints its pull bearer against; required with –zitadel-key

–issuer-state-dir="": deliver local-issuer material as FILES under this dir instead of Kubernetes Secrets (host-process enclave shape); requires –local-issuer

–kms-config="": opaque KMS provider config JSON/DSN passed verbatim to the provider

–kms-provider="": enclave at-rest KMS backend for the sovereign-secret store (e.g. vault); empty disables the store + secret API (bd_2_0-dy6)

–local-issuer: act as the enclave’s local mTLS issuer: mint per-service client identities + require a client cert on the local channel (bd_2_0-aoq.5)

–log-format="": application log format (json|text) (default: “json”)

–log-level="": application log level (debug|info|warn|error) (default: “info”)

–metrics-addr="": listen address for the dedicated TLS /metrics endpoint (Prometheus); empty disables it. Reuses –tls-cert/–tls-key; lock to the scraper with a network policy (bd_2_0-pmy)

–namespace="": namespace the broker writes its CA + per-service client Secrets to; empty resolves the pod’s ServiceAccount namespace

–operator-addr="": TLS listen address for the operator secret-authoring API, separate from the mTLS satellite channel (bearer auth); empty leaves it unmounted (bd_2_0-dy6)

–operator-audience="": expected audience of operator tokens on the secret API (OIDC aud)

–operator-org-claim="": token claim the operator’s org scope is read from (default urn:dvx:org)

–operator-require-client-cert: require a broker-minted client cert (mTLS) on the operator listener so it is reachable ONLY through the enclave relay (bd_2_0-ib4.1); requires –local-issuer

–owning-org="": the enclave’s owning-org coordinate; with –seed-admin, the broker seeds an initial org-admin enclave grant at provisioning time (bd_2_0-bs1.3)

–placement-driver="": this enclave’s placement driver (mission bd_2_0-cwnz): empty/k8s = in-cluster CRD registry; vm = local micro-VM driver (file registry, –vm-*)

–platform-image="": dvx image the kata imds-shim sidecar runs when provisioning kata-grade (node-cvm-class) agents (default localhost/dvx:dev)

–pull-interval="": fallback re-pull cadence between SSE nudges (0 uses the default) (default: 0s)

–registry-namespace="": control namespace the broker writes AgentMapping CRs to; empty resolves the pod’s ServiceAccount namespace

–seed-admin="": initial org-admin principal for the enclave’s OWN ACL store, e.g. user:_{or group::; idempotently seeded at broker start with –owning-org (bd_2_0-bs1.3). Empty leaves no initial admin (fail-closed)}

–server-dns="": a DNS SAN for the broker’s minted serving cert (repeatable), e.g. its svc DNS name

–sshd-image="": Debian-based dvx image the in-Kata sshd sidecar runs (bd_2_0-0f7.3) (default localhost/dvx-sshd:dev)

–tls-cert="": path to the TLS certificate (PEM)

–tls-key="": path to the TLS private key (PEM)

–vm-bridge="": the persistent host bridge the agent taps enslave to (default dvx-br0). With –vm-net

–vm-dns-tproxy-addr="": the gateway’s transparent DNS listener agent DNS is steered to (default 127.0.0.1:9453; must match the gateway’s –dns-listen). With –vm-net

–vm-gateway-ca-pub="": gateway MITM CA public cert (PEM), injected into every agent rootfs trust store so MITM’d egress verifies with zero payload-side configuration

–vm-helper-bin="": dvx binary the root helper is invoked as (default: this broker’s own executable)

–vm-instance-id="": this host’s placement id (the local analog of the K8s node name); defaults to the hostname. With –placement-driver=vm

–vm-kernel="": the guest kernel bzImage (kata 6.18) for direct kernel boot. With –placement-driver=vm

–vm-net: enable the mediated egress datapath (persistent bridge + per-agent taps + nftables TPROXY steering into the gateway’s transparent listener). Off = identity-only shape (agents get no network device)

–vm-podman-bin="": podman binary the rootfs pipeline uses (default: podman on PATH). With –placement-driver=vm

–vm-state-dir="": the VM driver’s local state dir (registry/, images/, agents/, vms/); MUST be on ext4, never /tmp. With –placement-driver=vm

–vm-subnet="": the agent network (the bridge owns its first host as gateway/DNS). Default 172.16.60.0/24. With –vm-net

–vm-tproxy-addr="": the gateway’s transparent TCP listener the TPROXY rules steer agent egress to (default 127.0.0.1:9443; must match the gateway’s –tcp-listen). With –vm-net

–vm-vmm-bin="": the cloud-hypervisor binary path (static v51.1+). With –placement-driver=vm

–zitadel-key="": path to the enclave’s Zitadel service-account key JSON (its broker identity); mints the CP pull bearer

help, h

Shows a list of commands or help for one command

relay

Run the enclave edge relay (fronts the private broker’s operator API; broker stays dial-out-only)

–addr="": TLS listen address for the component API (default: “:8452”)

–broker-ca="": PEM CA to verify the broker’s serving cert on the proxied hop (the broker-published local CA, dvx-broker-ca)

–broker-client-cert="": PEM client cert (the broker-minted dvx-relay-broker-client identity) presented on the mTLS hop to the broker

–broker-client-key="": PEM client key for –broker-client-cert

–broker-url="": base URL of the private broker’s operator listener to proxy allow-listed routes to (e.g. https://dvx-broker.dvx-enclave.svc.cluster.local:8451)

–database-dsn="": PostgreSQL DSN; empty runs in skeleton mode (no DB)

–enclave-id="": identifier for this enclave (sovereignty boundary; health + audit attribution)

–enclave-name="": friendly UNIQUE enclave name for display + audit alongside –enclave-id (bd_2_0-49z.2); never an addressing coordinate

–help, -h: show help

–issuer="": OIDC issuer URL (Zitadel) the relay validates operator tokens against at the edge; required (fail-closed)

–log-format="": application log format (json|text) (default: “json”)

–log-level="": application log level (debug|info|warn|error) (default: “info”)

–metrics-addr="": listen address for the dedicated TLS /metrics endpoint (Prometheus); empty disables it. Reuses –tls-cert/–tls-key; lock to the scraper with a network policy (bd_2_0-pmy)

–operator-audience="": expected audience of operator tokens (OIDC aud); empty accepts any token from the issuer (dev)

–operator-org-claim="": token claim the operator’s org scope is read from (default urn:dvx:org)

–rendezvous: mount the mode-neutral operator<->agent rendezvous WSS surface (bd_2_0-0f7); hosts pairing for every interactive-access mode (tunnel, SSH, exec); off by default (operational kill-switch, not the per-scope capability)

–rendezvous-idle-timeout="": tear a rendezvous session down after this long with no frame in either direction (default: 0s)

–rendezvous-join-timeout="": how long the first rendezvous peer waits for its partner before the half-open session is torn down (default: 0s)

–rendezvous-max-lifetime="": absolute cap on a rendezvous session regardless of activity (the transport-level leash) (default: 0s)

–rendezvous-ticket-pubkey="": PEM file with the controlplane’s rendezvous ECDSA public key; when set the relay requires a valid CP-minted ticket on every peer (production)

–tls-cert="": path to the TLS certificate (PEM)

–tls-key="": path to the TLS private key (PEM)

help, h

Shows a list of commands or help for one command

llmproxy

Run the enclave LLM inference gateway satellite (verifies force-routed agent SVIDs; forwards inference to upstreams)

–addr="": TLS listen address for the component API (default: “:8480”)

–agent-ca="": PEM agent-identity trust bundle a presented SVID must chain to (hot-reloaded; fail-closed)

–allow-unattested-host: opt out of the default fail-closed posture: permit a force-routed call lacking the gateway’s PROXY-v2 SNI preamble to fall back to the agent Host header (bd_2_0-1c0). Default off (strict) — leave off on gateway-fronted deployments

–audit-capture-or-deny: fail-closed durability for the sovereign received body (bd_2_0-8kl.19): spool the request record to the WAL before forwarding and DENY the inference if it cannot be durably captured within –audit-capture-timeout, rather than silently lose it. ON by default; set false for best-effort recording (rungs 1+2, never denies)

–audit-capture-timeout="": how long the request path blocks for the audit WAL to accept the sovereign record before denying (capture-or-deny, bd_2_0-8kl.19) (default: 5s)

–audit-dsn="": clickhouse-go DSN enabling the inference-audit producer (epic bd_2_0-8kl.6): one encrypted inference_request per forwarded call. Empty leaves it off

–audit-header-hmac-salt-file="": file holding the enclave-held salt that keyed-hashes SECRET header values in the audit capture (bd_2_0-xs0.2): lets an operator detect a credential repeating/rotating without disclosing it. Optional - empty still captures+seals+redacts headers, just omits the hash

–audit-wal-dir="": on-disk WAL dir for the audit store (bd_2_0-8kl.10): durable across a ClickHouse outage/restart. REQUIRED with –audit-dsn (fail-closed durability, bd_2_0-8kl.15)

–database-dsn="": PostgreSQL DSN; empty runs in skeleton mode (no DB)

–enclave-id="": identifier for this enclave (sovereignty boundary; audit attribution)

–enclave-name="": friendly UNIQUE enclave name for display + audit alongside –enclave-id (bd_2_0-49z.2); never an addressing coordinate

–escalation-timeout="": how long a held (escalated) response waits for a decision before the fail-closed deny reaches the agent (default 5m) (default: 0s)

–help, -h: show help

–inspection-disclosure="": what the AGENT sees when the response-inspection pipeline rejects/denies/times out: “detailed” (default) names the reason, “opaque” sends a generic problem. Operators and the audit always see the detail

–kms-config="": opaque provider config JSON for –kms-provider (e.g. {“address”:“http://vault:8200”,“token_path”:"/etc/dvx/kms/token"})

–kms-provider="": enclave KMS backend (e.g. vault) used to SEAL inference bodies per-org before storage; REQUIRED with –audit-dsn (no plaintext bodies, bd_2_0-8kl.6.2)

–log-format="": application log format (json|text) (default: “json”)

–log-level="": application log level (debug|info|warn|error) (default: “info”)

–metrics-addr="": listen address for the dedicated TLS /metrics endpoint (Prometheus); empty disables it. Reuses –tls-cert/–tls-key; lock to the scraper with a network policy (bd_2_0-pmy)

–min-tier="": minimum attested assurance tier an agent must present (e.g. node-cvm); empty admits any verified SVID

–policy-snapshot="": path to a published governance policy snapshot; resolves per-agent->org credential_mode + upstream override + model allow/blocklist (bd_2_0-b06.3/.4/.6). Empty leaves the satellite ungoverned (passthrough + provider defaults, no model gating)

–secret-broker-ca="": PEM CA to verify the broker’s serving cert on the secret/policy pull hop

–secret-broker-client-cert="": PEM client cert (the broker-issued llmproxy identity) presented on the mTLS pull hop

–secret-broker-client-key="": PEM client key for –secret-broker-client-cert

–secret-broker-url="": broker mTLS base URL to pull the sovereign llm.api_key from in inject mode (bd_2_0-b06.4); empty leaves inject unavailable (fail-closed)

–tls-cert="": path to the TLS certificate (PEM)

–tls-key="": path to the TLS private key (PEM)

–translate: enable cross-format translation: a request whose client wire format (anthropic-messages / openai-chat / openai-responses) differs from the resolved upstream’s expected format is translated via internal/translation, and the response/stream/error translated back into the client’s format. Same-format traffic stays byte-transparent; off (default) forwards every call byte-unchanged

–translate-upstream-format="": with –translate, force the EXPECTED wire format of the upstreams (e.g. openai-responses for a Responses-API upstream); empty derives each provider’s expected format from the llmreg registry

–upstream-ca="": PEM CA bundle validating the provider’s serving cert on the direct egress hop (default: system roots)

–upstream-default="": catch-all upstream base URL (absolute https) for requests whose provider is not path-resolvable; empty fails closed on an unresolvable upstream

help, h

Shows a list of commands or help for one command

forensics

Run the forensic-capture node daemon (enclave satellite; snapshots a contained agent’s Kata VM state for evidence)

–enclave-id="": identifier for this enclave (sovereignty boundary); agent namespaces are parsed with the broker’s naming.AgentNamespace rule (<12-hex prefix>-)

–help, -h: show help

–log-format="": log format (json|text) (default: “json”)

–log-level="": log level (debug|info|warn|error) (default: “info”)

–poll-interval="": how often to re-check the cluster’s containment policies (default: 30s)

–proc-dir="": the /proc filesystem to scan for the VMM’s RAM fds (the DaemonSet mounts the HOST /proc at /host/proc) (default: “/proc”)

–run-dir="": this enclave’s node run dir (/run/dvx/ subtree); snapshots land under forensics/ (default: “/run/dvx”)

–vc-dir="": the node’s kata runtime dir (/run/vc): per-sandbox persist.json + CLH control sockets (default: “/run/vc”)

help, h

Shows a list of commands or help for one command

companion

Run the keyless in-Kata tunnel pipe (splice host->guest connections to the agent’s localhost)

–help, -h: show help

–pipe-port="": AF_VSOCK port to accept host->guest tunnel connections on (default: 1401)

help, h

Shows a list of commands or help for one command

sshd

Run the in-guest stock-OpenSSH supervisor for operator SSH into the agent

–agent-id="": the agent this sshd fronts (binds certs by principal)

–ca-pubkey="": per-enclave SSH CA public key file (TrustedUserCAKeys), delivered by the controlplane (default: “/etc/dvx/ssh-ca/ca.pub”)

–exec-port="": localhost port for the interactive PTY/exec host (bd_2_0-0f7.2); 0 uses the default (default: 2223)

–help, -h: show help

–login-user="": unprivileged account operators authenticate as (holds NOPASSWD sudo for nsenter) (default: “dvx”)

–port="": localhost port to bind sshd on (default: 2222)

help, h

Shows a list of commands or help for one command

terminator

Run the trusted node-local tunnel terminator (terminate WireGuard on the host; forward into the agent guest over vsock)

–agent-namespace="": target agent’s pod namespace; the guest sandbox is resolved under –vc-dir (preferred over –guest-vsock)

–allow-port="": restrict to these agent localhost ports (repeatable); omit to allow all

–guest-vsock="": override: target guest’s hybrid-vsock socket (e.g. /run/vc/vm//clh.sock)

–help, -h: show help

–operator-pubkey="": pin the operator WireGuard public key (base64); omit to learn it over the rendezvous preamble

–pipe-port="": AF_VSOCK pipe port the in-guest companion listens on (default: 1401)

–private-key="": pin the terminator’s WireGuard private key (base64); omit to mint an ephemeral one and exchange keys over the rendezvous preamble

–relay-ca="": PEM CA file to trust for the relay’s serving cert on the dial-out; empty uses the system trust store (bd_2_0-kzb.3)

–relay-insecure: skip TLS verification of the relay’s serving cert (DEV ONLY; overrides –relay-ca)

–relay-url="": relay base URL (wss://…)

–session="": rendezvous session id

–ticket="": enclave-role pairing ticket (empty in dev)

–tunnel-ip="": terminator’s tunnel IP (the operator dials this on any port) (default: “10.44.0.2”)

–vc-dir="": kata runtime state dir for sandbox resolution (default: “/run/vc”)

help, h

Shows a list of commands or help for one command

help, h

Shows a list of commands or help for one command

net-helper

Root helper: manage the VM driver’s bridge/tap/nft datapath (run via sudo -n dvx net-helper ...; the only privileged dvx surface)

Shows a list of commands or help for one command

help, h

Shows a list of commands or help for one command

agent

Create and manage agents via the controlplane operator API (the operator never touches K8s)

–help, -h: show help

create

Create (or replace) a desired agent; the enclave broker provisions it

–audience="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it

–ca-cert="": PEM CA bundle to trust for the operator-API TLS cert

–command="": container entrypoint override token (repeatable; optional)

–controlplane="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves)

–enclave="": enclave id to place the agent in

–group="": governance group id (optional; must belong to –org)

–help, -h: show help

–image="": agent container image (BYO)

–insecure-skip-verify: skip operator-API TLS verification (dev only)

–issuer="": OIDC issuer URL (required with –zitadel-key)

–name="": human-facing agent name; defaults to the (generated) uid

–org="": org id the agent belongs to

–policy-pack="": policy pack (shared catalog) to install at this agent’s scope in the same create call (repeatable; requires policy:write at the org)

–token-file="": static bearer token file (alternative to –zitadel-key)

–uid="": stable unique agent id (names its namespace + IMDS socket); omit to auto-generate a memorable one (e.g. nostalgic-otter)

–zitadel-key="": service-account key JSON for API auth (mints its own token)

help, h

Shows a list of commands or help for one command

Shows a list of commands or help for one command

grant

Create and manage grants (role/capability bindings) via the controlplane operator API

–help, -h: show help

create

Bind a principal to a role or capability in an org (homes a user principal to the org’s dvx:org claim)

–audience="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it

–ca-cert="": PEM CA bundle to trust for the operator-API TLS cert

–capability="": direct capability to grant (mutually exclusive with –role)

–controlplane="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves)

–group="": optional: narrow the grant to one group within the org

–help, -h: show help

–insecure-skip-verify: skip operator-API TLS verification (dev only)

–issuer="": OIDC issuer URL (required with –zitadel-key)

–org="": org id the grant is scoped to

–principal="": principal to bind, e.g. user: or group::

–role="": role to assign, e.g. admin | member (mutually exclusive with –capability)

–token-file="": static bearer token file (alternative to –zitadel-key)

–zitadel-key="": service-account key JSON for API auth (mints its own token)

help, h

Shows a list of commands or help for one command

list

List an org’s grants

–audience="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it

–ca-cert="": PEM CA bundle to trust for the operator-API TLS cert

–controlplane="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves)

–help, -h: show help

–insecure-skip-verify: skip operator-API TLS verification (dev only)

–issuer="": OIDC issuer URL (required with –zitadel-key)

–org="": org id

–token-file="": static bearer token file (alternative to –zitadel-key)

–zitadel-key="": service-account key JSON for API auth (mints its own token)

help, h

Shows a list of commands or help for one command

delete

Revoke a grant by id

–audience="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it

–ca-cert="": PEM CA bundle to trust for the operator-API TLS cert

–controlplane="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves)

–help, -h: show help

–id="": grant id

–insecure-skip-verify: skip operator-API TLS verification (dev only)

–issuer="": OIDC issuer URL (required with –zitadel-key)

–org="": org id the grant is scoped to

–token-file="": static bearer token file (alternative to –zitadel-key)

–zitadel-key="": service-account key JSON for API auth (mints its own token)

help, h

Shows a list of commands or help for one command

help, h

Shows a list of commands or help for one command

policy

Author governance policy via the controlplane operator API

–help, -h: show help

destination

Set destination allow/deny policy at a scope (platform/org/group/agent)

–agent="": agent id (requires –org; cannot be locked)

–allow="": allowed destination host suffix (repeatable)

–audience="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it

–ca-cert="": PEM CA bundle to trust for the operator-API TLS cert

–controlplane="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves)

–deny="": denied destination host suffix (repeatable)

–deny-reason="": reason recorded on –deny rules (surfaced in audit)

–group="": group id (requires –org)

–help, -h: show help

–insecure-skip-verify: skip operator-API TLS verification (dev only)

–issuer="": OIDC issuer URL (required with –zitadel-key)

–lock: lock so more-specific scopes cannot override (refused at agent scope)

–org="": org id (omit for platform scope)

–token-file="": static bearer token file (alternative to –zitadel-key)

–zitadel-key="": service-account key JSON for API auth (mints its own token)

help, h

Shows a list of commands or help for one command

llm

Author LLM governance policy (credential mode, model + provider allow/blocklist, upstream override)

–help, -h: show help

credential-mode

Set upstream-auth mode: passthrough (agent’s own auth) or inject (sovereign key)

–agent="": agent id (requires –org; cannot be locked)

–audience="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it

–ca-cert="": PEM CA bundle to trust for the operator-API TLS cert

–controlplane="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves)

–group="": group id (requires –org)

–help, -h: show help

–insecure-skip-verify: skip operator-API TLS verification (dev only)

–issuer="": OIDC issuer URL (required with –zitadel-key)

–lock: lock so more-specific scopes cannot override (refused at agent scope)

–mode="": passthrough|inject

–org="": org id (omit for platform scope)

–token-file="": static bearer token file (alternative to –zitadel-key)

–zitadel-key="": service-account key JSON for API auth (mints its own token)

help, h

Shows a list of commands or help for one command

models

Set the model allow/blocklist (ratchet: deny unions, each allow is an independent gate)

–agent="": agent id (requires –org; cannot be locked)

–allow="": allowed model name/glob (repeatable)

–audience="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it

–ca-cert="": PEM CA bundle to trust for the operator-API TLS cert

–controlplane="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves)

–deny="": denied model name/glob (repeatable)

–group="": group id (requires –org)

–help, -h: show help

–insecure-skip-verify: skip operator-API TLS verification (dev only)

–issuer="": OIDC issuer URL (required with –zitadel-key)

–lock: lock so more-specific scopes cannot override (refused at agent scope)

–org="": org id (omit for platform scope)

–token-file="": static bearer token file (alternative to –zitadel-key)

–zitadel-key="": service-account key JSON for API auth (mints its own token)

help, h

Shows a list of commands or help for one command

upstream

Force a provider’s upstream base URL (repeatable –set provider=https://…)

–agent="": agent id (requires –org; cannot be locked)

–audience="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it

–ca-cert="": PEM CA bundle to trust for the operator-API TLS cert

–controlplane="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves)

–group="": group id (requires –org)

–help, -h: show help

–insecure-skip-verify: skip operator-API TLS verification (dev only)

–issuer="": OIDC issuer URL (required with –zitadel-key)

–lock: lock so more-specific scopes cannot override (refused at agent scope)

–org="": org id (omit for platform scope)

–set="": provider=https://base-url (repeatable)

–token-file="": static bearer token file (alternative to –zitadel-key)

–zitadel-key="": service-account key JSON for API auth (mints its own token)

help, h

Shows a list of commands or help for one command

providers

Restrict which known providers a scope may reach (ratchet: deny unions, each allow is a gate)

–agent="": agent id (requires –org; cannot be locked)

–allow="": allowed provider name/glob, e.g. hetzner (repeatable)

–audience="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it

–ca-cert="": PEM CA bundle to trust for the operator-API TLS cert

–controlplane="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves)

–deny="": denied provider name/glob (repeatable)

–group="": group id (requires –org)

–help, -h: show help

–insecure-skip-verify: skip operator-API TLS verification (dev only)

–issuer="": OIDC issuer URL (required with –zitadel-key)

–lock: lock so more-specific scopes cannot override (refused at agent scope)

–org="": org id (omit for platform scope)

–token-file="": static bearer token file (alternative to –zitadel-key)

–zitadel-key="": service-account key JSON for API auth (mints its own token)

help, h

Shows a list of commands or help for one command

inspection

Set the response-inspection policy (inspectors + rules the enclave llmproxy pipeline runs)

–agent="": agent id (requires –org; cannot be locked)

–audience="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it

–ca-cert="": PEM CA bundle to trust for the operator-API TLS cert

–controlplane="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves)

–file="": path to the inspection policy JSON (LLMInspectionPolicy: inspectors + rules); ‘-’ reads stdin

–group="": group id (requires –org)

–help, -h: show help

–insecure-skip-verify: skip operator-API TLS verification (dev only)

–issuer="": OIDC issuer URL (required with –zitadel-key)

–lock: lock so more-specific scopes cannot override (refused at agent scope)

–org="": org id (omit for platform scope)

–token-file="": static bearer token file (alternative to –zitadel-key)

–zitadel-key="": service-account key JSON for API auth (mints its own token)

help, h

Shows a list of commands or help for one command

help, h

Shows a list of commands or help for one command

tunnel

Enable or disable interactive agent access (tunnel/SSH/PTY) at a scope

–help, -h: show help

enable

Enable interactive access at a scope (platform/org/group/agent)

–agent="": agent id (requires –org; cannot be locked)

–audience="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it

–ca-cert="": PEM CA bundle to trust for the operator-API TLS cert

–controlplane="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves)

–group="": group id (requires –org)

–help, -h: show help

–insecure-skip-verify: skip operator-API TLS verification (dev only)

–issuer="": OIDC issuer URL (required with –zitadel-key)

–lock: lock so more-specific scopes cannot override (refused at agent scope)

–org="": org id (omit for platform scope)

–token-file="": static bearer token file (alternative to –zitadel-key)

–zitadel-key="": service-account key JSON for API auth (mints its own token)

help, h

Shows a list of commands or help for one command

disable

Disable interactive access at a scope (platform/org/group/agent)

–agent="": agent id (requires –org; cannot be locked)

–audience="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it

–ca-cert="": PEM CA bundle to trust for the operator-API TLS cert

–controlplane="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves)

–group="": group id (requires –org)

–help, -h: show help

–insecure-skip-verify: skip operator-API TLS verification (dev only)

–issuer="": OIDC issuer URL (required with –zitadel-key)

–lock: lock so more-specific scopes cannot override (refused at agent scope)

–org="": org id (omit for platform scope)

–token-file="": static bearer token file (alternative to –zitadel-key)

–zitadel-key="": service-account key JSON for API auth (mints its own token)

help, h

Shows a list of commands or help for one command

help, h

Shows a list of commands or help for one command

tunnel-ports

Set the interactive-access (tunnel) port allow-list at a scope

–help, -h: show help

set

Set the allowed agent-localhost ports at a scope (platform/org/group/agent)

–agent="": agent id (requires –org; cannot be locked)

–audience="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it

–ca-cert="": PEM CA bundle to trust for the operator-API TLS cert

–clear: author an empty list (deny all ports) instead of an allow-list

–controlplane="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves)

–group="": group id (requires –org)

–help, -h: show help

–insecure-skip-verify: skip operator-API TLS verification (dev only)

–issuer="": OIDC issuer URL (required with –zitadel-key)

–lock: lock so more-specific scopes cannot override (refused at agent scope)

–org="": org id (omit for platform scope)

–port="": an allowed agent-localhost port (repeatable)

–token-file="": static bearer token file (alternative to –zitadel-key)

–zitadel-key="": service-account key JSON for API auth (mints its own token)

help, h

Shows a list of commands or help for one command

help, h

Shows a list of commands or help for one command

ssh

Enable or disable operator SSH access into an agent (filesystem + exec) at a scope

–help, -h: show help

enable

Enable operator SSH access at a scope (platform/org/group/agent)

–agent="": agent id (requires –org; cannot be locked)

–audience="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it

–ca-cert="": PEM CA bundle to trust for the operator-API TLS cert

–controlplane="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves)

–group="": group id (requires –org)

–help, -h: show help

–insecure-skip-verify: skip operator-API TLS verification (dev only)

–issuer="": OIDC issuer URL (required with –zitadel-key)

–lock: lock so more-specific scopes cannot override (refused at agent scope)

–org="": org id (omit for platform scope)

–token-file="": static bearer token file (alternative to –zitadel-key)

–zitadel-key="": service-account key JSON for API auth (mints its own token)

help, h

Shows a list of commands or help for one command

disable

Disable operator SSH access at a scope (platform/org/group/agent)

–agent="": agent id (requires –org; cannot be locked)

–audience="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it

–ca-cert="": PEM CA bundle to trust for the operator-API TLS cert

–controlplane="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves)

–group="": group id (requires –org)

–help, -h: show help

–insecure-skip-verify: skip operator-API TLS verification (dev only)

–issuer="": OIDC issuer URL (required with –zitadel-key)

–lock: lock so more-specific scopes cannot override (refused at agent scope)

–org="": org id (omit for platform scope)

–token-file="": static bearer token file (alternative to –zitadel-key)

–zitadel-key="": service-account key JSON for API auth (mints its own token)

help, h

Shows a list of commands or help for one command

help, h

Shows a list of commands or help for one command

exec

Enable or disable operator PTY/exec access into an agent (kube-exec over WSS) at a scope

–help, -h: show help

enable

Enable operator exec access at a scope (platform/org/group/agent)

–agent="": agent id (requires –org; cannot be locked)

–audience="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it

–ca-cert="": PEM CA bundle to trust for the operator-API TLS cert

–controlplane="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves)

–group="": group id (requires –org)

–help, -h: show help

–insecure-skip-verify: skip operator-API TLS verification (dev only)

–issuer="": OIDC issuer URL (required with –zitadel-key)

–lock: lock so more-specific scopes cannot override (refused at agent scope)

–org="": org id (omit for platform scope)

–token-file="": static bearer token file (alternative to –zitadel-key)

–zitadel-key="": service-account key JSON for API auth (mints its own token)

help, h

Shows a list of commands or help for one command

disable

Disable operator exec access at a scope (platform/org/group/agent)

–agent="": agent id (requires –org; cannot be locked)

–audience="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it

–ca-cert="": PEM CA bundle to trust for the operator-API TLS cert

–controlplane="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves)

–group="": group id (requires –org)

–help, -h: show help

–insecure-skip-verify: skip operator-API TLS verification (dev only)

–issuer="": OIDC issuer URL (required with –zitadel-key)

–lock: lock so more-specific scopes cannot override (refused at agent scope)

–org="": org id (omit for platform scope)

–token-file="": static bearer token file (alternative to –zitadel-key)

–zitadel-key="": service-account key JSON for API auth (mints its own token)

help, h

Shows a list of commands or help for one command

help, h

Shows a list of commands or help for one command

pack

Define and install reusable policy packs (bd_2_0-apa.8)

–help, -h: show help

define

Define (upsert) a named pack in the shared catalog

–allow="": allowed destination host suffix (repeatable)

–audience="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it

–ca-cert="": PEM CA bundle to trust for the operator-API TLS cert

–controlplane="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves)

–deny="": denied destination host suffix (repeatable)

–deny-reason="": reason recorded on –deny rules

–help, -h: show help

–insecure-skip-verify: skip operator-API TLS verification (dev only)

–issuer="": OIDC issuer URL (required with –zitadel-key)

–name="": pack name

–token-file="": static bearer token file (alternative to –zitadel-key)

–zitadel-key="": service-account key JSON for API auth (mints its own token)

help, h

Shows a list of commands or help for one command

install

Install a defined pack at an org/group/agent scope

–agent="": agent id (requires –org; cannot be locked)

–audience="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it

–ca-cert="": PEM CA bundle to trust for the operator-API TLS cert

–controlplane="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves)

–group="": group id (requires –org)

–help, -h: show help

–insecure-skip-verify: skip operator-API TLS verification (dev only)

–issuer="": OIDC issuer URL (required with –zitadel-key)

–name="": pack name

–org="": org id (omit for platform scope)

–token-file="": static bearer token file (alternative to –zitadel-key)

–zitadel-key="": service-account key JSON for API auth (mints its own token)

help, h

Shows a list of commands or help for one command

uninstall

Remove a pack install at an org/group/agent scope

–agent="": agent id (requires –org; cannot be locked)

–audience="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it

–ca-cert="": PEM CA bundle to trust for the operator-API TLS cert

–controlplane="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves)

–group="": group id (requires –org)

–help, -h: show help

–insecure-skip-verify: skip operator-API TLS verification (dev only)

–issuer="": OIDC issuer URL (required with –zitadel-key)

–name="": pack name

–org="": org id (omit for platform scope)

–token-file="": static bearer token file (alternative to –zitadel-key)

–zitadel-key="": service-account key JSON for API auth (mints its own token)

help, h

Shows a list of commands or help for one command

help, h

Shows a list of commands or help for one command

help, h

Shows a list of commands or help for one command

policy-pull

Actively pull this enclave’s governance snapshot from the controlplane (sidecar)

–ca-cert="": PEM CA bundle to trust for the controlplane TLS cert

–client-cert="": PEM client certificate to present for mutual TLS (when the source requires it, e.g. the broker)

–client-key="": PEM client private key for –client-cert

–controlplane="": controlplane operator-API base URL (e.g. https://dvx-controlplane:8443)

–enclave-id="": this enclave’s id (the snapshot is scoped to it)

–help, -h: show help

–insecure-skip-verify: skip controlplane TLS verification (dev only)

–interval="": pull period (default: 30s)

–issuer="": OIDC issuer URL (Zitadel) for key-based auth; required with –zitadel-key

–no-events: disable the SSE nudge stream; poll on –interval only

–snapshot="": local path to write the snapshot to (a writable volume the gateway reads)

–token-file="": file holding a static bearer token (used only when –zitadel-key is unset)

–zitadel-key="": path to this enclave’s Zitadel service-account key JSON; the puller mints its own bearer (key-based auth, preferred)

help, h

Shows a list of commands or help for one command

config

Author agent config values via the controlplane operator API

–help, -h: show help

set

Set a config value at a scope: dvx config set –value

–agent="": agent id (requires –org; cannot be locked)

–audience="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it

–ca-cert="": PEM CA bundle to trust for the operator-API TLS cert

–controlplane="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves)

–group="": group id (requires –org)

–help, -h: show help

–insecure-skip-verify: skip operator-API TLS verification (dev only)

–issuer="": OIDC issuer URL (required with –zitadel-key)

–lock: lock so more-specific scopes cannot override (refused at agent scope)

–org="": org id (omit for platform scope)

–secret: declare a SOVEREIGN secret (bd_2_0-7ha.2): no bytes cross the controlplane; inject them enclave-side with dvx secret set

–token-file="": static bearer token file (alternative to –zitadel-key)

–value="": the config value; raw JSON, or a bare string (auto-quoted). Omit with –secret

–zitadel-key="": service-account key JSON for API auth (mints its own token)

help, h

Shows a list of commands or help for one command

delete

Delete a config value at a scope: dvx config delete

–agent="": agent id (requires –org; cannot be locked)

–audience="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it

–ca-cert="": PEM CA bundle to trust for the operator-API TLS cert

–controlplane="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves)

–group="": group id (requires –org)

–help, -h: show help

–insecure-skip-verify: skip operator-API TLS verification (dev only)

–issuer="": OIDC issuer URL (required with –zitadel-key)

–org="": org id (omit for platform scope)

–token-file="": static bearer token file (alternative to –zitadel-key)

–zitadel-key="": service-account key JSON for API auth (mints its own token)

help, h

Shows a list of commands or help for one command

help, h

Shows a list of commands or help for one command

config-pull

Actively pull this enclave’s config-value snapshot from the controlplane/broker (sidecar)

–ca-cert="": PEM CA bundle to trust for the controlplane TLS cert

–client-cert="": PEM client certificate to present for mutual TLS (when the source requires it, e.g. the broker)

–client-key="": PEM client private key for –client-cert

–controlplane="": controlplane/broker operator-API base URL to pull the config snapshot from

–enclave-id="": this enclave’s id (the snapshot is scoped to it)

–help, -h: show help

–insecure-skip-verify: skip controlplane TLS verification (dev only)

–interval="": pull period (default: 30s)

–issuer="": OIDC issuer URL (Zitadel) for key-based auth; required with –zitadel-key

–no-events: disable the SSE nudge stream; poll on –interval only

–snapshot="": local path to write the config snapshot to (a writable volume the IMDS reads)

–token-file="": file holding a static bearer token (used only when –zitadel-key is unset)

–zitadel-key="": path to this enclave’s Zitadel service-account key JSON; the puller mints its own bearer (key-based auth, preferred)

help, h

Shows a list of commands or help for one command

secret

Author sovereign secret bytes via the broker API (bd_2_0-dy6)

–help, -h: show help

set

Set a secret’s bytes: dvx secret set –value

–agent="": agent id (agent-scoped secret; mutually exclusive with –group)

–audience="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it

–broker-url="": broker operator-API base URL (the authenticated secret-authoring endpoint)

–ca-cert="": PEM CA bundle to trust for the operator-API TLS cert

–group="": group id (group-scoped secret shared by the group’s agents; mutually exclusive with –agent)

–help, -h: show help

–insecure-skip-verify: skip operator-API TLS verification (dev only)

–issuer="": OIDC issuer URL (required with –zitadel-key)

–token-file="": static bearer token file (alternative to –zitadel-key)

–value="": the secret bytes (a string)

–zitadel-key="": service-account key JSON for API auth (mints its own token)

help, h

Shows a list of commands or help for one command

delete

Delete a secret: dvx secret delete

–agent="": agent id (agent-scoped secret; mutually exclusive with –group)

–audience="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it

–broker-url="": broker operator-API base URL (the authenticated secret-authoring endpoint)

–ca-cert="": PEM CA bundle to trust for the operator-API TLS cert

–group="": group id (group-scoped secret shared by the group’s agents; mutually exclusive with –agent)

–help, -h: show help

–insecure-skip-verify: skip operator-API TLS verification (dev only)

–issuer="": OIDC issuer URL (required with –zitadel-key)

–token-file="": static bearer token file (alternative to –zitadel-key)

–zitadel-key="": service-account key JSON for API auth (mints its own token)

help, h

Shows a list of commands or help for one command

help, h

Shows a list of commands or help for one command

approvals

List and decide pending tool-call approvals (human-in-the-loop)

Shows a list of commands or help for one command

help, h

Shows a list of commands or help for one command

tunnel

Reach a running agent’s localhost services over WireGuard (SOCKS5 by default, or a single forwarded port)

–agent="": agent id (uid) to tunnel to

–audience="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it

–ca-cert="": PEM CA bundle to trust for the operator-API TLS cert

–controlplane="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves)

–help, -h: show help

–insecure-skip-verify: skip operator-API TLS verification (dev only)

–issuer="": OIDC issuer URL (required with –zitadel-key)

–local="": single-port mode: local listen address (host:port) (default: “127.0.0.1:8080”)

–local-tunnel-ip="": this end’s tunnel IP (default: “10.44.0.1”)

–org="": org id the agent belongs to

–relay-ca="": PEM CA file to trust for the relay’s serving cert (defaults to –ca-cert); set when the relay is fronted by a private CA

–relay-insecure: skip TLS verification of the relay’s serving cert (DEV ONLY; defaults to –insecure-skip-verify)

–remote-port="": single-port mode: fixed port on the agent’s localhost to reach (omit for SOCKS5) (default: 0)

–socks="": local SOCKS5 listen address (any agent port routes through it) (default: “127.0.0.1:1080”)

–terminator-pubkey="": pin the terminator’s WireGuard public key (base64); omit to learn it over the rendezvous key-exchange preamble (bd_2_0-kzb.2)

–terminator-tunnel-ip="": the terminator’s tunnel IP (default: “10.44.0.2”)

–token-file="": static bearer token file (alternative to –zitadel-key)

–zitadel-key="": service-account key JSON for API auth (mints its own token)

help, h

Shows a list of commands or help for one command

ssh

SSH into a running agent (file transfer + filesystem exploration) with a dvx-brokered cert

–agent="": agent id (uid) to SSH into

–audience="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it

–ca-cert="": PEM CA bundle to trust for the operator-API TLS cert

–controlplane="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves)

–help, -h: show help

–insecure-skip-verify: skip operator-API TLS verification (dev only)

–issuer="": OIDC issuer URL (required with –zitadel-key)

–local-port="": local port to forward to the agent’s sshd (0 = auto-pick) (default: 0)

–local-tunnel-ip="": this end’s tunnel IP (default: “10.44.0.1”)

–login-user="": login user on the agent sshd sidecar (default: “dvx”)

–org="": org id the agent belongs to

–relay-ca="": PEM CA file to trust for the relay’s serving cert (defaults to –ca-cert)

–relay-insecure: skip TLS verification of the relay’s serving cert (DEV ONLY; defaults to –insecure-skip-verify)

–serve: keep the tunnel + ssh-agent up and print a ~/.ssh/config stanza (for VS Code Remote-SSH / sshfs / sftp), instead of opening an interactive session

–terminator-pubkey="": pin the terminator’s WireGuard public key (base64); omit to learn it over the rendezvous preamble

–terminator-tunnel-ip="": the terminator’s tunnel IP (default: “10.44.0.2”)

–token-file="": static bearer token file (alternative to –zitadel-key)

–zitadel-key="": service-account key JSON for API auth (mints its own token)

help, h

Shows a list of commands or help for one command

exec

Open an interactive PTY/exec into a running agent (kube-exec -it style)

–agent="": agent id (uid) to exec into

–audience="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it

–ca-cert="": PEM CA bundle to trust for the operator-API TLS cert

–controlplane="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves)

–help, -h: show help

–insecure-skip-verify: skip operator-API TLS verification (dev only)

–issuer="": OIDC issuer URL (required with –zitadel-key)

–org="": org id the agent belongs to

–relay-ca="": PEM CA file to trust for the relay’s serving cert (defaults to –ca-cert)

–relay-insecure: skip TLS verification of the relay’s serving cert (DEV ONLY; defaults to –insecure-skip-verify)

–token-file="": static bearer token file (alternative to –zitadel-key)

–tty, -t: allocate a pseudo-terminal (default true for an interactive shell)

–zitadel-key="": service-account key JSON for API auth (mints its own token)

help, h

Shows a list of commands or help for one command

rendezvous-sessions-pull

Actively pull this enclave’s pending tunnel sessions from the controlplane/broker (sidecar)

–ca-cert="": PEM CA bundle to trust for the controlplane TLS cert

–client-cert="": PEM client certificate to present for mutual TLS (when the source requires it, e.g. the broker)

–client-key="": PEM client private key for –client-cert

–controlplane="": controlplane/broker operator-API base URL to pull the tunnel-session snapshot from

–enclave-id="": this enclave’s id (the snapshot is scoped to it)

–help, -h: show help

–insecure-skip-verify: skip controlplane TLS verification (dev only)

–interval="": pull period (default: 10s)

–issuer="": OIDC issuer URL (Zitadel) for key-based auth; required with –zitadel-key

–no-events: disable the SSE nudge stream; poll on –interval only

–snapshot="": local path to write the tunnel-session snapshot to (a writable volume the imds terminator reads)

–token-file="": file holding a static bearer token (used only when –zitadel-key is unset)

–zitadel-key="": path to this enclave’s Zitadel service-account key JSON; the puller mints its own bearer (key-based auth, preferred)

help, h

Shows a list of commands or help for one command

refvalues-pull

Actively pull this enclave’s attestation reference values from the controlplane (sidecar)

–ca-cert="": PEM CA bundle to trust for the controlplane TLS cert

–client-cert="": PEM client certificate to present for mutual TLS (when the source requires it, e.g. the broker)

–client-key="": PEM client private key for –client-cert

–controlplane="": controlplane operator-API base URL (e.g. https://dvx-controlplane:8443)

–enclave-id="": this enclave’s id (used to authenticate the pull)

–help, -h: show help

–insecure-skip-verify: skip controlplane TLS verification (dev only)

–interval="": pull period (default: 30s)

–issuer="": OIDC issuer URL (Zitadel) for key-based auth; required with –zitadel-key

–no-events: disable the SSE nudge stream; poll on –interval only

–out="": local path to write the reference values to (a writable volume the enclave reads)

–token-file="": file holding a static bearer token (used only when –zitadel-key is unset)

–zitadel-key="": path to this enclave’s Zitadel service-account key JSON; the puller mints its own bearer (key-based auth, preferred)

help, h

Shows a list of commands or help for one command

wait-file

Block until a file exists and is non-empty (for init-container gating)

–help, -h: show help

–path="": file to wait for

–poll="": poll period (default: 2s)

–timeout="": give up after this long (default: 10m0s)

help, h

Shows a list of commands or help for one command

enclaves

Manage the controlplane enclave registry via the operator API (discover, register, delete)

–token-file="": static bearer token file (alternative to –zitadel-key)

–zitadel-key="": service-account key JSON for API auth (mints its own token)

help, h

Shows a list of commands or help for one command

delete

Delete an enclave from the registry (via the operator API)

–audience="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it

–ca-cert="": PEM CA bundle to trust for the operator-API TLS cert

–controlplane="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves)

–enclave-id="": canonical enclave id; or use –name

–help, -h: show help

–insecure-skip-verify: skip operator-API TLS verification (dev only)

–issuer="": OIDC issuer URL (required with –zitadel-key)

–name="": enclave friendly name (resolved to its id); or use –enclave-id

–token-file="": static bearer token file (alternative to –zitadel-key)

–zitadel-key="": service-account key JSON for API auth (mints its own token)

help, h

Shows a list of commands or help for one command

set-class

Author an enclave’s requested isolation class (mission bd_2_0-cwnz.6, VAL-ISO-002)

–audience="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it

–ca-cert="": PEM CA bundle to trust for the operator-API TLS cert

–class="": the requested isolation class (plain|vm|node-cvm|per-agent-tee)

–controlplane="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves)

–enclave-id="": canonical enclave id; or use –name

–help, -h: show help

–insecure-skip-verify: skip operator-API TLS verification (dev only)

–issuer="": OIDC issuer URL (required with –zitadel-key)

–name="": enclave friendly name (resolved to its id); or use –enclave-id

–token-file="": static bearer token file (alternative to –zitadel-key)

–zitadel-key="": service-account key JSON for API auth (mints its own token)

help, h

Shows a list of commands or help for one command

get-class

Read an enclave’s requested isolation class (mission bd_2_0-cwnz.6)

–audience="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it

–ca-cert="": PEM CA bundle to trust for the operator-API TLS cert

–controlplane="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves)

–enclave-id="": canonical enclave id; or use –name

–help, -h: show help

–insecure-skip-verify: skip operator-API TLS verification (dev only)

–issuer="": OIDC issuer URL (required with –zitadel-key)

–name="": enclave friendly name (resolved to its id); or use –enclave-id

–token-file="": static bearer token file (alternative to –zitadel-key)

–zitadel-key="": service-account key JSON for API auth (mints its own token)

help, h

Shows a list of commands or help for one command

help, h

Shows a list of commands or help for one command

internal

In-boundary admin/break-glass tools that bypass the operator API (direct DB writes; Zitadel service-account admin)

–help, -h: show help

bootstrap

Seed the platform org, platform-ops org, and first platform-operator grant into the controlplane DB (in-boundary)

–database-dsn="": controlplane database DSN

–help, -h: show help

–ops-org="": platform-ops org coordinate id to seed (a normal, data-bearing org) (default: “platform-ops”)

–ops-org-name="": display name for the platform-ops org (default: “Platform Ops”)

–org="": platform org coordinate id to seed (default: “platform”)

–org-name="": display name for the platform org (default: “Platform”)

–subject="": the Zitadel sub of the platform operator (becomes the ‘user:_{’ grant principal)}

help, h

Shows a list of commands or help for one command

register

–database-dsn="": controlplane database DSN

–enclave-id="": explicit canonical enclave id override; empty mints a random one (bootstrap/tests)

–help, -h: show help

–name="": friendly, UNIQUE enclave name operators address it by (e.g. daevix-dev)

–owning-org="": owning org id (required: one enclave, one org)

–subject="": service-account subject bound to this enclave (its metadata pull identity); empty keeps any existing binding

help, h

Shows a list of commands or help for one command

serviceaccount

Diagnostics for the controlplane’s Zitadel service account

–help, -h: show help

check

Mint a service-account token and (optionally) provision + call the operator API

–api-base="": override the management API base (default: issuer)

–controlplane="": if set, GET /api/v1/whoami as the service principal

–create-org="": if set, create a Zitadel Organization with this name and print its id

–help, -h: show help

–username="": machine-user login name

help, h

Shows a list of commands or help for one command

help, h

Shows a list of commands or help for one command

audit-reveal

Decrypt sealed HTTP-capture rows (network_flow bodies/headers) for forensic review (bd_2_0-uwi); in-boundary, KMS-backed

–agent="": narrow to one agent id (e.g. droid)

–audit-dsn="": clickhouse-go DSN for the enclave audit store

–headers: also print the sealed (decrypted) request headers

–help, -h: show help

–kms-config="": opaque provider config JSON for –kms-provider

Show the caller’s identity + effective capabilities from the controlplane

–controlplane="": controlplane base URL (e.g. https://localhost:8443)

–help, -h: show help

–insecure-skip-verify: skip controlplane TLS verification (dev only)

–oidc-audience="": controlplane API audience to request in the token

–oidc-client-id="": public device-flow client id registered in Zitadel

–oidc-issuer="": OIDC issuer URL (the self-hosted Zitadel)

help, h

Shows a list of commands or help for one command

audit

Query the audit store (enclave sovereign audit or controlplane audit)

–help, -h: show help

events

Fetch a filtered page of audit events

–action="": filter by audit action (e.g. gateway.egress, secret.write)

–agent="": filter by agent id

–ca-cert="": PEM CA bundle to trust for the audit API TLS cert

–controlplane="": controlplane base URL for –source controlplane, and for discovering enclaves when –enclave is not given (e.g. https://localhost:8443)

–dst-host="": filter by destination host

–enclave="": enclave audit base URL for –source enclave (overrides discovery); point at the relay (:8452) or the broker (:8451) - both serve the same /api/v1/audit/* routes

–enclave-id="": select a discovered enclave by its id OR its friendly name (from the profile cache) instead of passing –enclave; requires –controlplane for discovery (bd_2_0-cal.3)

–help, -h: show help

–insecure-skip-verify: skip audit API TLS verification (dev only)

–limit="": max rows to return (<=1000) (default: 100)

–offset="": pagination offset (default: 0)

–oidc-audience="": token audience to request

–oidc-client-id="": public device-flow client id

–oidc-issuer="": OIDC issuer URL (for the cached device-flow credential)

–outcome="": filter by outcome (allow|deny|error)

–proto="": filter by protocol (tcp|udp)

–scope="": filter by scope (platform|agent)

–since="": only events at/after this RFC3339 time

–source="": which plane’s audit to query: enclave | controlplane (default: “enclave”)

–token="": bearer token to present (overrides the cached device-flow credential)

–until="": only events at/before this RFC3339 time

help, h

Shows a list of commands or help for one command

stream

Live-tail audit events (SSE) until interrupted

–action="": filter by audit action (e.g. gateway.egress, secret.write)

–agent="": filter by agent id

–ca-cert="": PEM CA bundle to trust for the audit API TLS cert

–controlplane="": controlplane base URL for –source controlplane, and for discovering enclaves when –enclave is not given (e.g. https://localhost:8443)

–dst-host="": filter by destination host

–enclave="": enclave audit base URL for –source enclave (overrides discovery); point at the relay (:8452) or the broker (:8451) - both serve the same /api/v1/audit/* routes

–enclave-id="": select a discovered enclave by its id OR its friendly name (from the profile cache) instead of passing –enclave; requires –controlplane for discovery (bd_2_0-cal.3)

–help, -h: show help

–insecure-skip-verify: skip audit API TLS verification (dev only)

–oidc-audience="": token audience to request

–oidc-client-id="": public device-flow client id

–oidc-issuer="": OIDC issuer URL (for the cached device-flow credential)

Shows a list of commands or help for one command

help, h

Shows a list of commands or help for one command