## NAME dvx - Daevix - execution-time control plane for autonomous agents ## SYNOPSIS dvx ``` [--help|-h] [--version|-v] ``` ## DESCRIPTION dvx is the single Daevix binary: it runs the server components (dvx serve controlplane|imds|broker|relay|gateway|llmproxy) and drives them as an authenticated operator client (agent, grant, policy, config, secret, enclaves, audit, ...). Conventions that hold across every command: - Environment: each flag also reads from a DVX_-prefixed variable (e.g. --addr from DVX_ADDR, --database-dsn from DVX_DATABASE_DSN). Precedence is flag > environment > default. - Server components are TLS-only: --tls-cert and --tls-key (PEM) are required to serve. - Errors returned by the servers are RFC 9457 problem documents. - Audit output is a first-class stream, separate from application logging; both go to stdout and are told apart by a top-level "stream" key. **Usage**: ``` dvx [GLOBAL OPTIONS] [command [COMMAND OPTIONS]] [ARGUMENTS...] ``` ## GLOBAL OPTIONS **--help, -h**: show help **--version, -v**: print the version ## COMMANDS ### serve Run a Daevix server component **--help, -h**: show help #### controlplane Run the controlplane (management plane; never handles sovereign data) **--addr**="": TLS listen address for the component API (default: ":8443") **--agent-token-issuer-url**="": public base URL the controlplane issues 60s agent-operator tokens as (bd_2_0-bvw.3): the iss claim + where discovery (/.well-known/openid-configuration) + JWKS (/.well-known/jwks.json) are served. Enabling it mounts the enclave agent-token mint endpoint; requires --oidc-issuer + a database **--agent-token-ttl**="": lifetime of a minted agent-operator token (bd_2_0-bvw.3); 0 uses the 60s default. NOT aligned with the 15-min SVID TTL on purpose: containment is enforced by levers (mint-gate, gateway drop, deny-all, grant deletion), not expiry (default: 0s) **--audit-capture-or-deny**: fail-closed durability for the AUTHORITY audit tier (bd_2_0-4p8.3, docs/audit-evidence-tiers.md): authority records are durably spooled to the WAL BEFORE the gated effect (denials returned, grants committed, credentials handed over), and the effect is REFUSED if that cannot happen within --audit-capture-timeout. ON by default; set false for best-effort recording (rungs 1+2, never refuses) **--audit-capture-timeout**="": how long an authority-gated path blocks for the audit WAL to accept the record before refusing the effect (capture-or-deny, bd_2_0-4p8.3) (default: 5s) **--audit-dsn**="": clickhouse-go DSN for the controlplane's OWN platform-audit store (bd_2_0-8kl.11); when set, audit -> ClickHouse instead of stdout. Empty leaves audit on stdout **--audit-wal-dir**="": on-disk WAL dir for the audit store (bd_2_0-8kl.10): durable across a ClickHouse outage/restart, replays on start. REQUIRED with --audit-dsn (fail-closed durability, bd_2_0-8kl.15) **--audit-wal-max-bytes**="": per-table on-disk WAL spool ceiling in BYTES (bd_2_0-8kl.16, durability rung 2): the durable buffer absorbing a ClickHouse outage. Size to a realistic outage window and BELOW the WAL disk capacity; past it audit drops (bounded, counted, alertable) rather than filling disk. 0 => the reviewed per-component default (internal/config, bd_2_0-4p8.1; see docs/runbooks/audit-durability.md) (default: 0) **--config-enclave-id**="": enclave the published config snapshot is scoped for (self-describing in the snapshot) **--config-org**="": the single org the target enclave serves (bd_2_0-j9r) for config scoping; snapshot carries the platform floor plus only this org. Empty = platform-only **--config-publish**="": local path to publish the config-value snapshot (bd_2_0-7ha) for one enclave's IMDS to resolve; requires a database **--config-publish-dir**="": directory to fan config values out to, one file per registered enclave (/.json), scoped from the enclave registry; requires a database **--database-dsn**="": PostgreSQL DSN; empty runs in skeleton mode (no DB) **--exec-access**: provision the interactive PTY/exec mode (no WireGuard); independent of --wireguard-access (bd_2_0-0f7.2) **--exec-session-ttl**="": lifetime of a minted exec-kind rendezvous session for interactive PTY/exec (bd_2_0-0f7.2); 0 uses the default (default: 0s) **--help, -h**: show help **--kms-config**="": opaque provider config JSON for --kms-provider (e.g. {"address":"http://vault:8200","token_path":"/etc/dvx/kms/token"}) **--kms-provider**="": operator at-rest key store backend (e.g. 'vault') for controlplane metadata encryption; empty stores policy values plaintext. The operator's provider, never a customer's **--log-format**="": application log format (json|text) (default: "json") **--log-level**="": application log level (debug|info|warn|error) (default: "info") **--metrics-addr**="": listen address for the dedicated TLS /metrics endpoint (Prometheus); empty disables it. Reuses --tls-cert/--tls-key; lock to the scraper with a network policy (bd_2_0-pmy) **--oidc-audience**="": expected token audience for the operator API; a token minted for another audience is rejected **--oidc-issuer**="": trusted OIDC issuer URL (self-hosted Zitadel); with a database, mounts the operator API behind OIDC auth + capability authorization **--policy-enclave-id**="": enclave the published snapshot is scoped for (self-describing in the snapshot) **--policy-org**="": the single org the target enclave serves (bd_2_0-j9r); the snapshot carries the platform floor plus only this org's policy. Empty = platform-only **--policy-publish**="": local path to publish the governance policy snapshot (platform/org/group/agent) for an enclave gateway to resolve out-of-band; requires a database **--policy-publish-dir**="": directory to fan the governance policy out to, one file per registered enclave (/.json), scoped from the enclave registry; requires a database **--reference-values**="": local path to publish the attestation policy (ReferenceValues JSON) for enclaves to read out-of-band **--rendezvous-signer-key**="": PEM file with the controlplane's rendezvous ECDSA private key; provisions the shared rendezvous transport all interactive-access modes ride (bd_2_0-0f7); requires a database **--ssh-cert-ttl**="": lifetime of a minted operator SSH cert + ssh-kind tunnel session (bd_2_0-0f7.3); 0 uses the default (default: 0s) **--tls-cert**="": path to the TLS certificate (PEM) **--tls-key**="": path to the TLS private key (PEM) **--token-endpoint-override**="": override the token endpoint the /oauth/token facade proxies to (default: derived from --oidc-issuer as /oauth/v2/token) **--tunnel-ticket-ttl**="": lifetime of a minted tunnel pairing ticket (the entitlement leash); 0 uses the default (default: 0s) **--wireguard-access**: provision the WireGuard access modes (localhost tunnel + SSH); set false to run exec-only with no tunnel/SSH endpoints (bd_2_0-0f7) **--zitadel-api-base**="": override the Zitadel management-API base URL (default: derived from --oidc-issuer) **--zitadel-key**="": path to a Zitadel service-account key JSON; enables provisioning the Zitadel mgmt API (org create/map) from the operator API ##### help, h Shows a list of commands or help for one command #### imds Run the IMDS node daemon (enclave satellite; hosts the agent-facing IMDS on a unix socket) **--addr**="": TLS listen address for the component API (default: ":8444") **--audit-capture-or-deny**: fail-closed durability for the AUTHORITY audit tier (bd_2_0-4p8.3, docs/audit-evidence-tiers.md): authority records are durably spooled to the WAL BEFORE the gated effect (denials returned, credentials handed over), and the effect is REFUSED if that cannot happen within --audit-capture-timeout. ON by default; set false for best-effort recording (rungs 1+2, never refuses) **--audit-capture-timeout**="": how long an authority-gated path blocks for the audit WAL to accept the record before refusing the effect (capture-or-deny, bd_2_0-4p8.3) (default: 5s) **--audit-dsn**="": clickhouse-go DSN for the in-enclave audit store (bd_2_0-8kl); when set, the enclave sends its audit to ClickHouse (not stdout) and (with --oidc-issuer) serves the audit query API. Empty leaves audit on stdout **--audit-wal-dir**="": on-disk WAL dir for the audit store (bd_2_0-8kl.10): durable across a ClickHouse outage/restart, replays on start. REQUIRED with --audit-dsn (fail-closed durability, bd_2_0-8kl.15) **--audit-wal-max-bytes**="": per-table on-disk WAL spool ceiling in BYTES (bd_2_0-8kl.16, durability rung 2): the durable buffer absorbing a ClickHouse outage. Size to a realistic outage window and BELOW the WAL disk capacity; past it audit drops (bounded, counted, alertable) rather than filling disk. 0 => the reviewed per-component default (internal/config, bd_2_0-4p8.1; see docs/runbooks/audit-durability.md) (default: 0) **--config-snapshot**="": local path to the published config-value snapshot (bd_2_0-7ha) the config-pull sidecar writes; the IMDS serves GET /v1/config from it. Empty disables config delivery **--database-dsn**="": PostgreSQL DSN; empty runs in skeleton mode (no DB) **--enclave-id**="": identifier for this enclave (sovereignty boundary) **--enclave-name**="": friendly UNIQUE enclave name for display + audit alongside --enclave-id (bd_2_0-49z.2); never an addressing coordinate **--help, -h**: show help **--imds-ca-cert**="": local path (file/ConfigMap) to the gateway CA public cert; served by the IMDS at GET /v1/ca as an on-demand CA fallback. Public cert only **--imds-socket**="": unix socket path for the IMDS-like metadata service agents mount (default: "/run/dvx/imds.sock") **--inject-cred**="": per-use credential rule 'name=destination=header=secret' (repeatable); IMDS lists these at /v1/credentials (bd_2_0-lai) **--kms-config**="": opaque provider config JSON for --kms-provider (e.g. {"address":"http://vault:8200","token":"..."}) **--kms-provider**="": at-rest key store backend for this enclave (e.g. 'vault'); empty disables sovereign data-at-rest encryption. Local deploy config, never sent to the controlplane **--log-format**="": application log format (json|text) (default: "json") **--log-level**="": application log level (debug|info|warn|error) (default: "info") **--metrics-addr**="": listen address for the dedicated TLS /metrics endpoint (Prometheus); empty disables it. Reuses --tls-cert/--tls-key; lock to the scraper with a network policy (bd_2_0-pmy) **--node-name**="": the node this enclave runs on (downward API spec.nodeName); the reconciler serves only mappings for this node **--oidc-audience**="": expected token audience for the audit query API; empty skips the aud check (dev only) **--oidc-issuer**="": trusted OIDC issuer (Zitadel) for the audit query API operator authenticator; empty leaves the query API unmounted (fail-closed) **--oidc-org-claim**="": token claim to read the caller's org scope from (default urn:dvx:org); set for IdPs that name it differently **--placement-driver**="": this imds's placement driver (mission bd_2_0-cwnz M3): empty/k8s = CRD registry + node matching; vm = local micro-VM driver (file registry, --vm-state-dir, --placement-id) **--placement-id**="": this instance's positive placement id the reconciler matches mappings against (fail-closed); with --placement-driver=vm (the local analog of the node name) **--policy-snapshot**="": local path to the published governance policy snapshot; the node tunnel terminator enforces tunnel.enabled + tunnel.ports locally from it (bd_2_0-kzb.3). Empty leaves the CP ticket gate + allow-all ports **--reference-values**="": local path (file/ConfigMap) to load the attestation policy from; empty uses the reduced-assurance SAMPLE dev policy **--registry-crd**: materialize agents by reconciling the broker-authored AgentMapping CRs for this node (durable HA registry); requires in-cluster RBAC **--registry-file**="": file-backed AgentMapping registry path (with --placement-driver=vm): the same file the local broker authors **--registry-namespace**="": namespace holding AgentMapping CRs; empty resolves the pod's ServiceAccount namespace **--relay-ca**="": PEM CA file the node tunnel terminator trusts for the relay's serving cert on its dial-out (bd_2_0-kzb.3); empty uses the system trust store. Set for a relay fronted by a private CA (dev's mkcert) **--relay-insecure**: skip TLS verification of the relay's serving cert on the node terminator's dial-out (DEV ONLY; overrides --relay-ca) **--rendezvous-sessions**="": local path to the pending-session snapshot (bd_2_0-kzb.2) a cp-pull sidecar writes; the node stands the right handler up per session for its Kata agents (WireGuard terminator for tunnel/ssh, exec bridge for exec). Requires --vsock-relay. Empty disables all interactive-access modes on the node **--secret-broker-ca**="": PEM CA to verify the broker's serving cert for secret reads (the published broker CA) **--secret-broker-client-cert**="": PEM client cert (broker-issued imds identity) presented for the secret-read mTLS **--secret-broker-client-key**="": PEM client key for --secret-broker-client-cert **--secret-broker-url**="": broker mTLS channel base URL to read SECRET config values through (bd_2_0-dy6); empty uses the deprecated local sovereign store **--tls-cert**="": path to the TLS certificate (PEM) **--tls-key**="": path to the TLS private key (PEM) **--vm-state-dir**="": the VM driver's per-agent VM state dir (with --placement-driver=vm); the imds serves each agent's vsock host socket from it **--vsock-dir**="": kata runtime state dir the vsock relay reads (per-sandbox clh sockets + pod namespace) (default: "/run/vc") **--vsock-relay**: serve the IMDS to Kata agent VMs over vsock (bd_2_0-aoq.7); requires the node kata state dir mounted ##### help, h Shows a list of commands or help for one command #### gateway Run the network gateway (sole egress path; mediates redirected agent traffic) **--agent-token-audience**="": audience the minted agent-operator tokens are scoped to; must equal the controlplane's --oidc-audience (its dvx authenticator enforces the same value). Empty uses the dvx-operator-api default (accepted by a controlplane with no pinned audience) (default: "dvx-operator-api") **--agent-token-broker-ca**="": PEM CA cert verifying the broker's local serving cert; required with --agent-token-broker-url **--agent-token-broker-client-cert**="": PEM client cert for the broker's local mTLS channel (the broker-minted dvx-gateway-broker-client identity); required with --agent-token-broker-url **--agent-token-broker-client-key**="": PEM client key for the broker's local mTLS channel; required with --agent-token-broker-url **--agent-token-broker-url**="": broker local mTLS channel base URL the gateway relays agent SVIDs to for token mints (bd_2_0-bvw.5), e.g. https://dvx-broker.dvx-enclave.svc.cluster.local:8450; required with --cp-api-host **--allow-dest**="": allowed destination host suffix (repeatable); non-empty enables default-deny governance **--assert-identity-dests**="": JSON array of structured in-cluster assert-identity destinations [{host,namespace,selector,port}] (bd_2_0-bwc/2ye); the gateway presents the agent's attested SVID over mTLS to each instead of injecting a credential. Requires --svid-dir + --k8s-attribution **--audit-capture-or-deny**: fail-closed durability for the AUTHORITY audit tier (bd_2_0-4p8.3, docs/audit-evidence-tiers.md): egress DENY rows and body-capture ALLOW rows are durably spooled to the WAL BEFORE the gated effect (the denial is returned / the captured exchange completes), and the effect is REFUSED if that cannot happen within --audit-capture-timeout. ON by default; set false for best-effort recording (rungs 1+2, never refuses) **--audit-capture-timeout**="": how long an authority-gated path blocks for the audit WAL to accept the record before refusing the effect (capture-or-deny, bd_2_0-4p8.3) (default: 5s) **--audit-dsn**="": clickhouse-go DSN for the in-enclave audit store (bd_2_0-8kl); when set, the gateway sends its audit events to ClickHouse instead of stdout. Empty leaves audit on stdout **--audit-header-hmac-salt-file**="": file holding the enclave-held salt that keyed-hashes SECRET header values in the capture (bd_2_0-xs0.3): lets an operator detect a credential repeating/rotating without disclosing it. Optional; use the SAME salt as llmproxy **--audit-wal-dir**="": on-disk WAL dir for the audit store (bd_2_0-8kl.10): durable across a ClickHouse outage/gateway restart, replays on start. REQUIRED with --audit-dsn (fail-closed durability, bd_2_0-8kl.15) **--audit-wal-max-bytes**="": per-table on-disk WAL spool ceiling in BYTES (bd_2_0-8kl.16, durability rung 2): the durable buffer absorbing a ClickHouse outage. Size to a realistic outage window and BELOW the WAL disk capacity; past it audit drops (bounded, counted, alertable) rather than filling disk. 0 => the reviewed per-component default (internal/config, bd_2_0-4p8.1; see docs/runbooks/audit-durability.md) (default: 0) **--ca-cert**="": gateway CA certificate (PEM); with --ca-key enables TLS termination (MITM) **--ca-key**="": gateway CA private key (PEM); never leaves the gateway **--cp-api-ca**="": CA that signed the controlplane's serving cert, verified on the CP-bound re-origination hop. The operator API is a named internal destination with its own anchor — set this whenever --upstream-ca's bundle does not already carry the CP root. Empty uses the system roots **--cp-api-host**="": operator-API host suffix (repeatable) whose agent egress gets a 60s agent-operator token INJECTED (bd_2_0-bvw.5): the gateway mints it via the broker relay, caches it, and presents the Authorization bearer itself — nothing is handed to the agent. Requires --agent-token-broker-url, a gateway CA (MITM), attribution, and --svid-dir **--dns-listen**="": local address for the transparent DNS forwarder (the VM driver's nftables rule steers agent udp/53 here): queries relay verbatim to the host resolver, answers spoof the original source. Requires CAP_NET_ADMIN **--enclave-id**="": identifier for this enclave (sovereignty boundary) **--enclave-name**="": friendly UNIQUE enclave name for display + audit alongside --enclave-id (bd_2_0-49z.2); never an addressing coordinate **--envoy-socket**="": unix socket the gateway listens on; Cilium's Envoy dials it (PROXY-protocol v2) (default: "/var/run/cilium/envoy/sockets/dvx-gateway.sock") **--help, -h**: show help **--http-capture**: record request/response line, headers and a size-capped BODY for MITM'd HTTP/1.x egress the gateway allows (bd_2_0-uwi); bodies sealed per-org like headers. ON by default, but a NO-OP unless the gateway holds a KMS Crypter (--kms-provider) since bodies must be sealable — so it activates exactly where header capture does. Disable with --http-capture=false **--http-capture-max-body**="": cap on PLAINTEXT bytes of each captured request/response body that are sealed (the full stream is still forwarded byte-exact); 0 uses the gateway default (16 KiB) (default: 0) **--inject-cred**="": egress-injection rule 'name=destination=header=secret' (repeatable); the gateway attaches a per-use header credential on a matched egress (bd_2_0-lai) **--k8s-attribution**: join source pod IP -> agent identity by listing CiliumEndpoints (in-cluster) **--kms-config**="": opaque provider config JSON for --kms-provider (e.g. {"address":"http://vault:8200","token_path":"/etc/dvx/kms/token"}) **--kms-provider**="": enclave KMS backend (e.g. vault) used to SEAL captured request headers on MITM'd HTTP egress (bd_2_0-xs0.3). OPTIONAL: without it the gateway audits flows as before and captures no headers (header capture is opt-in, since headers can carry sovereign data) **--llmproxy-addr**="": host:port of the llmproxy satellite; when set, classified LLM inference calls are force-routed there over mTLS presenting the agent SVID (bd_2_0-b06.1). Requires --ca-cert/--ca-key, --svid-dir, --k8s-attribution **--llmproxy-ca**="": PEM CA bundle to verify llmproxy's serving cert on the routed mTLS hop (default: system roots) **--llmproxy-host**="": SNI the gateway presents to llmproxy and verifies its serving cert against; empty derives it from --llmproxy-addr **--log-format**="": application log format (json|text) (default: "json") **--log-level**="": application log level (debug|info|warn|error) (default: "info") **--metrics-addr**="": listen address for the dedicated TLS /metrics endpoint (Prometheus); empty disables it. Lock to the scraper with a network policy (bd_2_0-pmy) **--metrics-tls-cert**="": PEM serving cert for the /metrics endpoint (required to enable --metrics-addr) **--metrics-tls-key**="": PEM serving key for the /metrics endpoint **--policy-snapshot**="": path to a published hierarchical governance policy snapshot (platform/org/group/agent); supersedes --allow-dest **--svid-dir**="": node-local directory of per-agent SVIDs the enclave mints (bd_2_0-bwc); the gateway reads held credentials from here for the assert-identity tunnel and the LLM force-route **--tcp-listen**="": local address for the transparent TCP datapath (the VM driver's nftables TPROXY target; mission bd_2_0-cwnz M4): agent VM egress redirected here is mediated like the Envoy path - MITM, policy, audit - with the original destination preserved. Requires CAP_NET_ADMIN **--udp-listen**="": local address for the transparent UDP/QUIC datapath (TPROXY target); enables HTTP-3 termination. Requires --ca-cert/--ca-key **--upstream-ca**="": PEM CA bundle to validate upstream server certs on re-origination (default: system roots); for private/test upstream CAs **--vm-attribution-file**="": path to the VM driver's file-backed registry (mappings.json): mediation attribution joins the connection's source IP to the agent from the driver's VM→IP records (no Cilium). Mutually exclusive with --k8s-attribution ##### help, h Shows a list of commands or help for one command #### broker Run the enclave broker (central control node; sole controlplane egress; re-serves metadata locally) **--addr**="": TLS listen address for the component API (default: ":8450") **--advertise-broker-url**="": the enclave's CLIENT-REACHABLE broker base URL (for an operator on the same network); announced alongside the relay URL (bd_2_0-cal.2) **--advertise-relay-url**="": the enclave's CLIENT-REACHABLE relay base URL; announced up to the controlplane so operators can discover it (bd_2_0-cal.2). Empty disables announcing **--assert-identity-dests**="": JSON array of structured in-cluster assert-identity destinations [{host,namespace,selector,port}] (bd_2_0-2ye); the broker authors the per-agent egress-redirect + gateway egress CiliumNetworkPolicies that make each reachable. Same value as the gateway's. **--audit-capture-or-deny**: fail-closed durability for the AUTHORITY audit tier (bd_2_0-4p8.3, docs/audit-evidence-tiers.md): enclave grant authoring + denied authoring attempts are durably spooled to the WAL BEFORE the gated effect (the grant commits, the denial is returned), and the effect is REFUSED if that cannot happen within --audit-capture-timeout. ON by default; set false for best-effort recording (rungs 1+2, never refuses) **--audit-capture-timeout**="": how long an authority-gated path blocks for the audit WAL to accept the record before refusing the effect (capture-or-deny, bd_2_0-4p8.3) (default: 5s) **--audit-dsn**="": clickhouse-go DSN for the enclave audit store (bd_2_0-8kl.11); when set, the broker routes its own audit there AND serves the org-scoped audit query API on the operator listener. Empty leaves audit on stdout + the query API unmounted **--audit-wal-dir**="": on-disk WAL dir for the audit store (bd_2_0-8kl.10): durable across a ClickHouse outage/restart, replays on start. REQUIRED with --audit-dsn (fail-closed durability, bd_2_0-8kl.15) **--audit-wal-max-bytes**="": per-table on-disk WAL spool ceiling in BYTES (bd_2_0-8kl.16, durability rung 2): the durable buffer absorbing a ClickHouse outage. Size to a realistic outage window and BELOW the WAL disk capacity; past it audit drops (bounded, counted, alertable) rather than filling disk. 0 => the reviewed per-component default (internal/config, bd_2_0-4p8.1; see docs/runbooks/audit-durability.md) (default: 0) **--ca-cert**="": PEM CA bundle to trust for the controlplane TLS cert **--client-service**="": an enclave service to issue a local client identity for (repeatable), e.g. dvx-imds, dvx-gateway **--controlplane**="": controlplane operator-API base URL to pull metadata from (the enclave's sole CP egress) **--database-dsn**="": PostgreSQL DSN; empty runs in skeleton mode (no DB) **--dev-agent-specs**="": Phase-1 dev seam: a JSON array of desired agents the reconcile engine provisions, bypassing the AUTHENTICATED controlplane agents channel (dev only; requires --dev-mode) **--dev-mode**: acknowledge this is a DEV broker: permit dev-only seams (currently --dev-agent-specs) that bypass a production control. Never set in production (bd_2_0-ib4.2) **--enclave-id**="": identifier for this enclave (sovereignty boundary) **--enclave-name**="": friendly UNIQUE enclave name for display + audit alongside --enclave-id (bd_2_0-49z.2); never an addressing coordinate **--help, -h**: show help **--insecure-skip-verify**: skip controlplane TLS verification for the pull (dev only) **--issuer**="": OIDC issuer URL (Zitadel) the broker mints its pull bearer against; required with --zitadel-key **--issuer-state-dir**="": deliver local-issuer material as FILES under this dir instead of Kubernetes Secrets (host-process enclave shape); requires --local-issuer **--kms-config**="": opaque KMS provider config JSON/DSN passed verbatim to the provider **--kms-provider**="": enclave at-rest KMS backend for the sovereign-secret store (e.g. vault); empty disables the store + secret API (bd_2_0-dy6) **--local-issuer**: act as the enclave's local mTLS issuer: mint per-service client identities + require a client cert on the local channel (bd_2_0-aoq.5) **--log-format**="": application log format (json|text) (default: "json") **--log-level**="": application log level (debug|info|warn|error) (default: "info") **--metrics-addr**="": listen address for the dedicated TLS /metrics endpoint (Prometheus); empty disables it. Reuses --tls-cert/--tls-key; lock to the scraper with a network policy (bd_2_0-pmy) **--namespace**="": namespace the broker writes its CA + per-service client Secrets to; empty resolves the pod's ServiceAccount namespace **--operator-addr**="": TLS listen address for the operator secret-authoring API, separate from the mTLS satellite channel (bearer auth); empty leaves it unmounted (bd_2_0-dy6) **--operator-audience**="": expected audience of operator tokens on the secret API (OIDC aud) **--operator-org-claim**="": token claim the operator's org scope is read from (default urn:dvx:org) **--operator-require-client-cert**: require a broker-minted client cert (mTLS) on the operator listener so it is reachable ONLY through the enclave relay (bd_2_0-ib4.1); requires --local-issuer **--owning-org**="": the enclave's owning-org coordinate; with --seed-admin, the broker seeds an initial org-admin enclave grant at provisioning time (bd_2_0-bs1.3) **--placement-driver**="": this enclave's placement driver (mission bd_2_0-cwnz): empty/k8s = in-cluster CRD registry; vm = local micro-VM driver (file registry, --vm-*) **--platform-image**="": dvx image the kata imds-shim sidecar runs when provisioning kata-grade (node-cvm-class) agents (default localhost/dvx:dev) **--pull-interval**="": fallback re-pull cadence between SSE nudges (0 uses the default) (default: 0s) **--registry-namespace**="": control namespace the broker writes AgentMapping CRs to; empty resolves the pod's ServiceAccount namespace **--seed-admin**="": initial org-admin principal for the enclave's OWN ACL store, e.g. user: _{or group::; idempotently seeded at broker start with --owning-org (bd_2_0-bs1.3). Empty leaves no initial admin (fail-closed) **--server-dns**="": a DNS SAN for the broker's minted serving cert (repeatable), e.g. its svc DNS name **--sshd-image**="": Debian-based dvx image the in-Kata sshd sidecar runs (bd_2_0-0f7.3) (default localhost/dvx-sshd:dev) **--tls-cert**="": path to the TLS certificate (PEM) **--tls-key**="": path to the TLS private key (PEM) **--vm-bridge**="": the persistent host bridge the agent taps enslave to (default dvx-br0). With --vm-net **--vm-dns-tproxy-addr**="": the gateway's transparent DNS listener agent DNS is steered to (default 127.0.0.1:9453; must match the gateway's --dns-listen). With --vm-net **--vm-gateway-ca-pub**="": gateway MITM CA public cert (PEM), injected into every agent rootfs trust store so MITM'd egress verifies with zero payload-side configuration **--vm-helper-bin**="": dvx binary the root helper is invoked as (default: this broker's own executable) **--vm-instance-id**="": this host's placement id (the local analog of the K8s node name); defaults to the hostname. With --placement-driver=vm **--vm-kernel**="": the guest kernel bzImage (kata 6.18) for direct kernel boot. With --placement-driver=vm **--vm-net**: enable the mediated egress datapath (persistent bridge + per-agent taps + nftables TPROXY steering into the gateway's transparent listener). Off = identity-only shape (agents get no network device) **--vm-podman-bin**="": podman binary the rootfs pipeline uses (default: podman on PATH). With --placement-driver=vm **--vm-state-dir**="": the VM driver's local state dir (registry/, images/, agents/, vms/); MUST be on ext4, never /tmp. With --placement-driver=vm **--vm-subnet**="": the agent network (the bridge owns its first host as gateway/DNS). Default 172.16.60.0/24. With --vm-net **--vm-tproxy-addr**="": the gateway's transparent TCP listener the TPROXY rules steer agent egress to (default 127.0.0.1:9443; must match the gateway's --tcp-listen). With --vm-net **--vm-vmm-bin**="": the cloud-hypervisor binary path (static v51.1+). With --placement-driver=vm **--zitadel-key**="": path to the enclave's Zitadel service-account key JSON (its broker identity); mints the CP pull bearer ##### help, h Shows a list of commands or help for one command #### relay Run the enclave edge relay (fronts the private broker's operator API; broker stays dial-out-only) **--addr**="": TLS listen address for the component API (default: ":8452") **--broker-ca**="": PEM CA to verify the broker's serving cert on the proxied hop (the broker-published local CA, dvx-broker-ca) **--broker-client-cert**="": PEM client cert (the broker-minted dvx-relay-broker-client identity) presented on the mTLS hop to the broker **--broker-client-key**="": PEM client key for --broker-client-cert **--broker-url**="": base URL of the private broker's operator listener to proxy allow-listed routes to (e.g. https://dvx-broker.dvx-enclave.svc.cluster.local:8451) **--database-dsn**="": PostgreSQL DSN; empty runs in skeleton mode (no DB) **--enclave-id**="": identifier for this enclave (sovereignty boundary; health + audit attribution) **--enclave-name**="": friendly UNIQUE enclave name for display + audit alongside --enclave-id (bd_2_0-49z.2); never an addressing coordinate **--help, -h**: show help **--issuer**="": OIDC issuer URL (Zitadel) the relay validates operator tokens against at the edge; required (fail-closed) **--log-format**="": application log format (json|text) (default: "json") **--log-level**="": application log level (debug|info|warn|error) (default: "info") **--metrics-addr**="": listen address for the dedicated TLS /metrics endpoint (Prometheus); empty disables it. Reuses --tls-cert/--tls-key; lock to the scraper with a network policy (bd_2_0-pmy) **--operator-audience**="": expected audience of operator tokens (OIDC aud); empty accepts any token from the issuer (dev) **--operator-org-claim**="": token claim the operator's org scope is read from (default urn:dvx:org) **--rendezvous**: mount the mode-neutral operator<->agent rendezvous WSS surface (bd_2_0-0f7); hosts pairing for every interactive-access mode (tunnel, SSH, exec); off by default (operational kill-switch, not the per-scope capability) **--rendezvous-idle-timeout**="": tear a rendezvous session down after this long with no frame in either direction (default: 0s) **--rendezvous-join-timeout**="": how long the first rendezvous peer waits for its partner before the half-open session is torn down (default: 0s) **--rendezvous-max-lifetime**="": absolute cap on a rendezvous session regardless of activity (the transport-level leash) (default: 0s) **--rendezvous-ticket-pubkey**="": PEM file with the controlplane's rendezvous ECDSA public key; when set the relay requires a valid CP-minted ticket on every peer (production) **--tls-cert**="": path to the TLS certificate (PEM) **--tls-key**="": path to the TLS private key (PEM) ##### help, h Shows a list of commands or help for one command #### llmproxy Run the enclave LLM inference gateway satellite (verifies force-routed agent SVIDs; forwards inference to upstreams) **--addr**="": TLS listen address for the component API (default: ":8480") **--agent-ca**="": PEM agent-identity trust bundle a presented SVID must chain to (hot-reloaded; fail-closed) **--allow-unattested-host**: opt out of the default fail-closed posture: permit a force-routed call lacking the gateway's PROXY-v2 SNI preamble to fall back to the agent Host header (bd_2_0-1c0). Default off (strict) — leave off on gateway-fronted deployments **--audit-capture-or-deny**: fail-closed durability for the sovereign received body (bd_2_0-8kl.19): spool the request record to the WAL before forwarding and DENY the inference if it cannot be durably captured within --audit-capture-timeout, rather than silently lose it. ON by default; set false for best-effort recording (rungs 1+2, never denies) **--audit-capture-timeout**="": how long the request path blocks for the audit WAL to accept the sovereign record before denying (capture-or-deny, bd_2_0-8kl.19) (default: 5s) **--audit-dsn**="": clickhouse-go DSN enabling the inference-audit producer (epic bd_2_0-8kl.6): one encrypted inference_request per forwarded call. Empty leaves it off **--audit-header-hmac-salt-file**="": file holding the enclave-held salt that keyed-hashes SECRET header values in the audit capture (bd_2_0-xs0.2): lets an operator detect a credential repeating/rotating without disclosing it. Optional - empty still captures+seals+redacts headers, just omits the hash **--audit-wal-dir**="": on-disk WAL dir for the audit store (bd_2_0-8kl.10): durable across a ClickHouse outage/restart. REQUIRED with --audit-dsn (fail-closed durability, bd_2_0-8kl.15) **--audit-wal-max-bytes**="": per-table on-disk WAL spool ceiling in BYTES (bd_2_0-8kl.16, durability rung 2): the durable buffer absorbing a ClickHouse outage. Size to a realistic outage window and BELOW the WAL disk capacity; past it audit drops (bounded, counted, alertable) rather than filling disk. 0 => the reviewed per-component default (internal/config, bd_2_0-4p8.1; see docs/runbooks/audit-durability.md) (default: 0) **--database-dsn**="": PostgreSQL DSN; empty runs in skeleton mode (no DB) **--enclave-id**="": identifier for this enclave (sovereignty boundary; audit attribution) **--enclave-name**="": friendly UNIQUE enclave name for display + audit alongside --enclave-id (bd_2_0-49z.2); never an addressing coordinate **--escalation-timeout**="": how long a held (escalated) response waits for a decision before the fail-closed deny reaches the agent (default 5m) (default: 0s) **--help, -h**: show help **--inspection-disclosure**="": what the AGENT sees when the response-inspection pipeline rejects/denies/times out: "detailed" (default) names the reason, "opaque" sends a generic problem. Operators and the audit always see the detail **--kms-config**="": opaque provider config JSON for --kms-provider (e.g. {"address":"http://vault:8200","token_path":"/etc/dvx/kms/token"}) **--kms-provider**="": enclave KMS backend (e.g. vault) used to SEAL inference bodies per-org before storage; REQUIRED with --audit-dsn (no plaintext bodies, bd_2_0-8kl.6.2) **--log-format**="": application log format (json|text) (default: "json") **--log-level**="": application log level (debug|info|warn|error) (default: "info") **--metrics-addr**="": listen address for the dedicated TLS /metrics endpoint (Prometheus); empty disables it. Reuses --tls-cert/--tls-key; lock to the scraper with a network policy (bd_2_0-pmy) **--min-tier**="": minimum attested assurance tier an agent must present (e.g. node-cvm); empty admits any verified SVID **--policy-snapshot**="": path to a published governance policy snapshot; resolves per-agent->org credential_mode + upstream override + model allow/blocklist (bd_2_0-b06.3/.4/.6). Empty leaves the satellite ungoverned (passthrough + provider defaults, no model gating) **--secret-broker-ca**="": PEM CA to verify the broker's serving cert on the secret/policy pull hop **--secret-broker-client-cert**="": PEM client cert (the broker-issued llmproxy identity) presented on the mTLS pull hop **--secret-broker-client-key**="": PEM client key for --secret-broker-client-cert **--secret-broker-url**="": broker mTLS base URL to pull the sovereign llm.api_key from in inject mode (bd_2_0-b06.4); empty leaves inject unavailable (fail-closed) **--tls-cert**="": path to the TLS certificate (PEM) **--tls-key**="": path to the TLS private key (PEM) **--translate**: enable cross-format translation: a request whose client wire format (anthropic-messages / openai-chat / openai-responses) differs from the resolved upstream's expected format is translated via internal/translation, and the response/stream/error translated back into the client's format. Same-format traffic stays byte-transparent; off (default) forwards every call byte-unchanged **--translate-upstream-format**="": with --translate, force the EXPECTED wire format of the upstreams (e.g. openai-responses for a Responses-API upstream); empty derives each provider's expected format from the llmreg registry **--upstream-ca**="": PEM CA bundle validating the provider's serving cert on the direct egress hop (default: system roots) **--upstream-default**="": catch-all upstream base URL (absolute https) for requests whose provider is not path-resolvable; empty fails closed on an unresolvable upstream ##### help, h Shows a list of commands or help for one command #### forensics Run the forensic-capture node daemon (enclave satellite; snapshots a contained agent's Kata VM state for evidence) **--enclave-id**="": identifier for this enclave (sovereignty boundary); agent namespaces are parsed with the broker's naming.AgentNamespace rule (<12-hex prefix>-) **--help, -h**: show help **--log-format**="": log format (json|text) (default: "json") **--log-level**="": log level (debug|info|warn|error) (default: "info") **--poll-interval**="": how often to re-check the cluster's containment policies (default: 30s) **--proc-dir**="": the /proc filesystem to scan for the VMM's RAM fds (the DaemonSet mounts the HOST /proc at /host/proc) (default: "/proc") **--run-dir**="": this enclave's node run dir (/run/dvx/ subtree); snapshots land under forensics/ (default: "/run/dvx") **--vc-dir**="": the node's kata runtime dir (/run/vc): per-sandbox persist.json + CLH control sockets (default: "/run/vc") ##### help, h Shows a list of commands or help for one command #### companion Run the keyless in-Kata tunnel pipe (splice host->guest connections to the agent's localhost) **--help, -h**: show help **--pipe-port**="": AF_VSOCK port to accept host->guest tunnel connections on (default: 1401) ##### help, h Shows a list of commands or help for one command #### sshd Run the in-guest stock-OpenSSH supervisor for operator SSH into the agent **--agent-id**="": the agent this sshd fronts (binds certs by principal) **--ca-pubkey**="": per-enclave SSH CA public key file (TrustedUserCAKeys), delivered by the controlplane (default: "/etc/dvx/ssh-ca/ca.pub") **--exec-port**="": localhost port for the interactive PTY/exec host (bd_2_0-0f7.2); 0 uses the default (default: 2223) **--help, -h**: show help **--login-user**="": unprivileged account operators authenticate as (holds NOPASSWD sudo for nsenter) (default: "dvx") **--port**="": localhost port to bind sshd on (default: 2222) ##### help, h Shows a list of commands or help for one command #### terminator Run the trusted node-local tunnel terminator (terminate WireGuard on the host; forward into the agent guest over vsock) **--agent-namespace**="": target agent's pod namespace; the guest sandbox is resolved under --vc-dir (preferred over --guest-vsock) **--allow-port**="": restrict to these agent localhost ports (repeatable); omit to allow all **--guest-vsock**="": override: target guest's hybrid-vsock socket (e.g. /run/vc/vm//clh.sock) **--help, -h**: show help **--operator-pubkey**="": pin the operator WireGuard public key (base64); omit to learn it over the rendezvous preamble **--pipe-port**="": AF_VSOCK pipe port the in-guest companion listens on (default: 1401) **--private-key**="": pin the terminator's WireGuard private key (base64); omit to mint an ephemeral one and exchange keys over the rendezvous preamble **--relay-ca**="": PEM CA file to trust for the relay's serving cert on the dial-out; empty uses the system trust store (bd_2_0-kzb.3) **--relay-insecure**: skip TLS verification of the relay's serving cert (DEV ONLY; overrides --relay-ca) **--relay-url**="": relay base URL (wss://...) **--session**="": rendezvous session id **--ticket**="": enclave-role pairing ticket (empty in dev) **--tunnel-ip**="": terminator's tunnel IP (the operator dials this on any port) (default: "10.44.0.2") **--vc-dir**="": kata runtime state dir for sandbox resolution (default: "/run/vc") ##### help, h Shows a list of commands or help for one command #### help, h Shows a list of commands or help for one command ### net-helper Root helper: manage the VM driver's bridge/tap/nft datapath (run via `sudo -n dvx net-helper ...`; the only privileged dvx surface) **--help, -h**: show help #### ensure-bridge ensure-bridge — create + bring up the persistent bridge with its gateway address **--help, -h**: show help ##### help, h Shows a list of commands or help for one command #### ensure-tap ensure-tap — create a per-agent tap and enslave it to the bridge **--help, -h**: show help ##### help, h Shows a list of commands or help for one command #### remove-tap remove-tap — delete a per-agent tap **--help, -h**: show help ##### help, h Shows a list of commands or help for one command #### ensure-nft ensure-nft — install the TPROXY steering rules (tcp -> gateway listener, udp/53 -> gateway DNS forwarder) **--help, -h**: show help ##### help, h Shows a list of commands or help for one command #### remove-nft remove-nft — remove the dvx nftables table + policy-routing entries **--help, -h**: show help ##### help, h Shows a list of commands or help for one command #### teardown teardown — remove the whole datapath (nft + taps + bridge); zero residue **--help, -h**: show help ##### help, h Shows a list of commands or help for one command #### help, h Shows a list of commands or help for one command ### agent Create and manage agents via the controlplane operator API (the operator never touches K8s) **--help, -h**: show help #### create Create (or replace) a desired agent; the enclave broker provisions it **--audience**="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it **--ca-cert**="": PEM CA bundle to trust for the operator-API TLS cert **--command**="": container entrypoint override token (repeatable; optional) **--controlplane**="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves) **--enclave**="": enclave id to place the agent in **--group**="": governance group id (optional; must belong to --org) **--help, -h**: show help **--image**="": agent container image (BYO) **--insecure-skip-verify**: skip operator-API TLS verification (dev only) **--issuer**="": OIDC issuer URL (required with --zitadel-key) **--name**="": human-facing agent name; defaults to the (generated) uid **--org**="": org id the agent belongs to **--policy-pack**="": policy pack (shared catalog) to install at this agent's scope in the same create call (repeatable; requires policy:write at the org) **--token-file**="": static bearer token file (alternative to --zitadel-key) **--uid**="": stable unique agent id (names its namespace + IMDS socket); omit to auto-generate a memorable one (e.g. nostalgic-otter) **--zitadel-key**="": service-account key JSON for API auth (mints its own token) ##### help, h Shows a list of commands or help for one command #### list List an org's desired agents **--audience**="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it **--ca-cert**="": PEM CA bundle to trust for the operator-API TLS cert **--controlplane**="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves) **--help, -h**: show help **--insecure-skip-verify**: skip operator-API TLS verification (dev only) **--issuer**="": OIDC issuer URL (required with --zitadel-key) **--org**="": org id **--token-file**="": static bearer token file (alternative to --zitadel-key) **--zitadel-key**="": service-account key JSON for API auth (mints its own token) ##### help, h Shows a list of commands or help for one command #### get Show one desired agent **--audience**="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it **--ca-cert**="": PEM CA bundle to trust for the operator-API TLS cert **--controlplane**="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves) **--help, -h**: show help **--insecure-skip-verify**: skip operator-API TLS verification (dev only) **--issuer**="": OIDC issuer URL (required with --zitadel-key) **--org**="": org id **--token-file**="": static bearer token file (alternative to --zitadel-key) **--uid**="": agent id **--zitadel-key**="": service-account key JSON for API auth (mints its own token) ##### help, h Shows a list of commands or help for one command #### delete Withdraw a desired agent; the enclave broker tears it down **--audience**="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it **--ca-cert**="": PEM CA bundle to trust for the operator-API TLS cert **--controlplane**="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves) **--help, -h**: show help **--insecure-skip-verify**: skip operator-API TLS verification (dev only) **--issuer**="": OIDC issuer URL (required with --zitadel-key) **--org**="": org id **--token-file**="": static bearer token file (alternative to --zitadel-key) **--uid**="": agent id **--zitadel-key**="": service-account key JSON for API auth (mints its own token) ##### help, h Shows a list of commands or help for one command #### contain Contain an agent: freeze it IN PLACE (deny all egress + LLM inference, revoke agent-operator authority); the VM keeps running so evidence is preserved **--audience**="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it **--ca-cert**="": PEM CA bundle to trust for the operator-API TLS cert **--controlplane**="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves) **--help, -h**: show help **--insecure-skip-verify**: skip operator-API TLS verification (dev only) **--issuer**="": OIDC issuer URL (required with --zitadel-key) **--org**="": org id **--token-file**="": static bearer token file (alternative to --zitadel-key) **--uid**="": agent id **--zitadel-key**="": service-account key JSON for API auth (mints its own token) ##### help, h Shows a list of commands or help for one command #### release Release a contained agent: restore its prior policy surface and agent-operator authority **--audience**="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it **--ca-cert**="": PEM CA bundle to trust for the operator-API TLS cert **--controlplane**="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves) **--help, -h**: show help **--insecure-skip-verify**: skip operator-API TLS verification (dev only) **--issuer**="": OIDC issuer URL (required with --zitadel-key) **--org**="": org id **--token-file**="": static bearer token file (alternative to --zitadel-key) **--uid**="": agent id **--zitadel-key**="": service-account key JSON for API auth (mints its own token) ##### help, h Shows a list of commands or help for one command #### help, h Shows a list of commands or help for one command ### grant Create and manage grants (role/capability bindings) via the controlplane operator API **--help, -h**: show help #### create Bind a principal to a role or capability in an org (homes a user principal to the org's dvx:org claim) **--audience**="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it **--ca-cert**="": PEM CA bundle to trust for the operator-API TLS cert **--capability**="": direct capability to grant (mutually exclusive with --role) **--controlplane**="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves) **--group**="": optional: narrow the grant to one group within the org **--help, -h**: show help **--insecure-skip-verify**: skip operator-API TLS verification (dev only) **--issuer**="": OIDC issuer URL (required with --zitadel-key) **--org**="": org id the grant is scoped to **--principal**="": principal to bind, e.g. user: or group:: **--role**="": role to assign, e.g. admin | member (mutually exclusive with --capability) **--token-file**="": static bearer token file (alternative to --zitadel-key) **--zitadel-key**="": service-account key JSON for API auth (mints its own token) ##### help, h Shows a list of commands or help for one command #### list List an org's grants **--audience**="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it **--ca-cert**="": PEM CA bundle to trust for the operator-API TLS cert **--controlplane**="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves) **--help, -h**: show help **--insecure-skip-verify**: skip operator-API TLS verification (dev only) **--issuer**="": OIDC issuer URL (required with --zitadel-key) **--org**="": org id **--token-file**="": static bearer token file (alternative to --zitadel-key) **--zitadel-key**="": service-account key JSON for API auth (mints its own token) ##### help, h Shows a list of commands or help for one command #### delete Revoke a grant by id **--audience**="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it **--ca-cert**="": PEM CA bundle to trust for the operator-API TLS cert **--controlplane**="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves) **--help, -h**: show help **--id**="": grant id **--insecure-skip-verify**: skip operator-API TLS verification (dev only) **--issuer**="": OIDC issuer URL (required with --zitadel-key) **--org**="": org id the grant is scoped to **--token-file**="": static bearer token file (alternative to --zitadel-key) **--zitadel-key**="": service-account key JSON for API auth (mints its own token) ##### help, h Shows a list of commands or help for one command #### help, h Shows a list of commands or help for one command ### policy Author governance policy via the controlplane operator API **--help, -h**: show help #### destination Set destination allow/deny policy at a scope (platform/org/group/agent) **--agent**="": agent id (requires --org; cannot be locked) **--allow**="": allowed destination host suffix (repeatable) **--audience**="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it **--ca-cert**="": PEM CA bundle to trust for the operator-API TLS cert **--controlplane**="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves) **--deny**="": denied destination host suffix (repeatable) **--deny-reason**="": reason recorded on --deny rules (surfaced in audit) **--group**="": group id (requires --org) **--help, -h**: show help **--insecure-skip-verify**: skip operator-API TLS verification (dev only) **--issuer**="": OIDC issuer URL (required with --zitadel-key) **--lock**: lock so more-specific scopes cannot override (refused at agent scope) **--org**="": org id (omit for platform scope) **--token-file**="": static bearer token file (alternative to --zitadel-key) **--zitadel-key**="": service-account key JSON for API auth (mints its own token) ##### help, h Shows a list of commands or help for one command #### llm Author LLM governance policy (credential mode, model + provider allow/blocklist, upstream override) **--help, -h**: show help ##### credential-mode Set upstream-auth mode: passthrough (agent's own auth) or inject (sovereign key) **--agent**="": agent id (requires --org; cannot be locked) **--audience**="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it **--ca-cert**="": PEM CA bundle to trust for the operator-API TLS cert **--controlplane**="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves) **--group**="": group id (requires --org) **--help, -h**: show help **--insecure-skip-verify**: skip operator-API TLS verification (dev only) **--issuer**="": OIDC issuer URL (required with --zitadel-key) **--lock**: lock so more-specific scopes cannot override (refused at agent scope) **--mode**="": passthrough|inject **--org**="": org id (omit for platform scope) **--token-file**="": static bearer token file (alternative to --zitadel-key) **--zitadel-key**="": service-account key JSON for API auth (mints its own token) ###### help, h Shows a list of commands or help for one command ##### models Set the model allow/blocklist (ratchet: deny unions, each allow is an independent gate) **--agent**="": agent id (requires --org; cannot be locked) **--allow**="": allowed model name/glob (repeatable) **--audience**="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it **--ca-cert**="": PEM CA bundle to trust for the operator-API TLS cert **--controlplane**="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves) **--deny**="": denied model name/glob (repeatable) **--group**="": group id (requires --org) **--help, -h**: show help **--insecure-skip-verify**: skip operator-API TLS verification (dev only) **--issuer**="": OIDC issuer URL (required with --zitadel-key) **--lock**: lock so more-specific scopes cannot override (refused at agent scope) **--org**="": org id (omit for platform scope) **--token-file**="": static bearer token file (alternative to --zitadel-key) **--zitadel-key**="": service-account key JSON for API auth (mints its own token) ###### help, h Shows a list of commands or help for one command ##### upstream Force a provider's upstream base URL (repeatable --set provider=https://...) **--agent**="": agent id (requires --org; cannot be locked) **--audience**="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it **--ca-cert**="": PEM CA bundle to trust for the operator-API TLS cert **--controlplane**="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves) **--group**="": group id (requires --org) **--help, -h**: show help **--insecure-skip-verify**: skip operator-API TLS verification (dev only) **--issuer**="": OIDC issuer URL (required with --zitadel-key) **--lock**: lock so more-specific scopes cannot override (refused at agent scope) **--org**="": org id (omit for platform scope) **--set**="": provider=https://base-url (repeatable) **--token-file**="": static bearer token file (alternative to --zitadel-key) **--zitadel-key**="": service-account key JSON for API auth (mints its own token) ###### help, h Shows a list of commands or help for one command ##### providers Restrict which known providers a scope may reach (ratchet: deny unions, each allow is a gate) **--agent**="": agent id (requires --org; cannot be locked) **--allow**="": allowed provider name/glob, e.g. hetzner (repeatable) **--audience**="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it **--ca-cert**="": PEM CA bundle to trust for the operator-API TLS cert **--controlplane**="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves) **--deny**="": denied provider name/glob (repeatable) **--group**="": group id (requires --org) **--help, -h**: show help **--insecure-skip-verify**: skip operator-API TLS verification (dev only) **--issuer**="": OIDC issuer URL (required with --zitadel-key) **--lock**: lock so more-specific scopes cannot override (refused at agent scope) **--org**="": org id (omit for platform scope) **--token-file**="": static bearer token file (alternative to --zitadel-key) **--zitadel-key**="": service-account key JSON for API auth (mints its own token) ###### help, h Shows a list of commands or help for one command ##### inspection Set the response-inspection policy (inspectors + rules the enclave llmproxy pipeline runs) **--agent**="": agent id (requires --org; cannot be locked) **--audience**="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it **--ca-cert**="": PEM CA bundle to trust for the operator-API TLS cert **--controlplane**="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves) **--file**="": path to the inspection policy JSON (LLMInspectionPolicy: inspectors + rules); '-' reads stdin **--group**="": group id (requires --org) **--help, -h**: show help **--insecure-skip-verify**: skip operator-API TLS verification (dev only) **--issuer**="": OIDC issuer URL (required with --zitadel-key) **--lock**: lock so more-specific scopes cannot override (refused at agent scope) **--org**="": org id (omit for platform scope) **--token-file**="": static bearer token file (alternative to --zitadel-key) **--zitadel-key**="": service-account key JSON for API auth (mints its own token) ###### help, h Shows a list of commands or help for one command ##### help, h Shows a list of commands or help for one command #### tunnel Enable or disable interactive agent access (tunnel/SSH/PTY) at a scope **--help, -h**: show help ##### enable Enable interactive access at a scope (platform/org/group/agent) **--agent**="": agent id (requires --org; cannot be locked) **--audience**="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it **--ca-cert**="": PEM CA bundle to trust for the operator-API TLS cert **--controlplane**="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves) **--group**="": group id (requires --org) **--help, -h**: show help **--insecure-skip-verify**: skip operator-API TLS verification (dev only) **--issuer**="": OIDC issuer URL (required with --zitadel-key) **--lock**: lock so more-specific scopes cannot override (refused at agent scope) **--org**="": org id (omit for platform scope) **--token-file**="": static bearer token file (alternative to --zitadel-key) **--zitadel-key**="": service-account key JSON for API auth (mints its own token) ###### help, h Shows a list of commands or help for one command ##### disable Disable interactive access at a scope (platform/org/group/agent) **--agent**="": agent id (requires --org; cannot be locked) **--audience**="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it **--ca-cert**="": PEM CA bundle to trust for the operator-API TLS cert **--controlplane**="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves) **--group**="": group id (requires --org) **--help, -h**: show help **--insecure-skip-verify**: skip operator-API TLS verification (dev only) **--issuer**="": OIDC issuer URL (required with --zitadel-key) **--lock**: lock so more-specific scopes cannot override (refused at agent scope) **--org**="": org id (omit for platform scope) **--token-file**="": static bearer token file (alternative to --zitadel-key) **--zitadel-key**="": service-account key JSON for API auth (mints its own token) ###### help, h Shows a list of commands or help for one command ##### help, h Shows a list of commands or help for one command #### tunnel-ports Set the interactive-access (tunnel) port allow-list at a scope **--help, -h**: show help ##### set Set the allowed agent-localhost ports at a scope (platform/org/group/agent) **--agent**="": agent id (requires --org; cannot be locked) **--audience**="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it **--ca-cert**="": PEM CA bundle to trust for the operator-API TLS cert **--clear**: author an empty list (deny all ports) instead of an allow-list **--controlplane**="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves) **--group**="": group id (requires --org) **--help, -h**: show help **--insecure-skip-verify**: skip operator-API TLS verification (dev only) **--issuer**="": OIDC issuer URL (required with --zitadel-key) **--lock**: lock so more-specific scopes cannot override (refused at agent scope) **--org**="": org id (omit for platform scope) **--port**="": an allowed agent-localhost port (repeatable) **--token-file**="": static bearer token file (alternative to --zitadel-key) **--zitadel-key**="": service-account key JSON for API auth (mints its own token) ###### help, h Shows a list of commands or help for one command ##### help, h Shows a list of commands or help for one command #### ssh Enable or disable operator SSH access into an agent (filesystem + exec) at a scope **--help, -h**: show help ##### enable Enable operator SSH access at a scope (platform/org/group/agent) **--agent**="": agent id (requires --org; cannot be locked) **--audience**="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it **--ca-cert**="": PEM CA bundle to trust for the operator-API TLS cert **--controlplane**="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves) **--group**="": group id (requires --org) **--help, -h**: show help **--insecure-skip-verify**: skip operator-API TLS verification (dev only) **--issuer**="": OIDC issuer URL (required with --zitadel-key) **--lock**: lock so more-specific scopes cannot override (refused at agent scope) **--org**="": org id (omit for platform scope) **--token-file**="": static bearer token file (alternative to --zitadel-key) **--zitadel-key**="": service-account key JSON for API auth (mints its own token) ###### help, h Shows a list of commands or help for one command ##### disable Disable operator SSH access at a scope (platform/org/group/agent) **--agent**="": agent id (requires --org; cannot be locked) **--audience**="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it **--ca-cert**="": PEM CA bundle to trust for the operator-API TLS cert **--controlplane**="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves) **--group**="": group id (requires --org) **--help, -h**: show help **--insecure-skip-verify**: skip operator-API TLS verification (dev only) **--issuer**="": OIDC issuer URL (required with --zitadel-key) **--lock**: lock so more-specific scopes cannot override (refused at agent scope) **--org**="": org id (omit for platform scope) **--token-file**="": static bearer token file (alternative to --zitadel-key) **--zitadel-key**="": service-account key JSON for API auth (mints its own token) ###### help, h Shows a list of commands or help for one command ##### help, h Shows a list of commands or help for one command #### exec Enable or disable operator PTY/exec access into an agent (kube-exec over WSS) at a scope **--help, -h**: show help ##### enable Enable operator exec access at a scope (platform/org/group/agent) **--agent**="": agent id (requires --org; cannot be locked) **--audience**="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it **--ca-cert**="": PEM CA bundle to trust for the operator-API TLS cert **--controlplane**="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves) **--group**="": group id (requires --org) **--help, -h**: show help **--insecure-skip-verify**: skip operator-API TLS verification (dev only) **--issuer**="": OIDC issuer URL (required with --zitadel-key) **--lock**: lock so more-specific scopes cannot override (refused at agent scope) **--org**="": org id (omit for platform scope) **--token-file**="": static bearer token file (alternative to --zitadel-key) **--zitadel-key**="": service-account key JSON for API auth (mints its own token) ###### help, h Shows a list of commands or help for one command ##### disable Disable operator exec access at a scope (platform/org/group/agent) **--agent**="": agent id (requires --org; cannot be locked) **--audience**="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it **--ca-cert**="": PEM CA bundle to trust for the operator-API TLS cert **--controlplane**="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves) **--group**="": group id (requires --org) **--help, -h**: show help **--insecure-skip-verify**: skip operator-API TLS verification (dev only) **--issuer**="": OIDC issuer URL (required with --zitadel-key) **--lock**: lock so more-specific scopes cannot override (refused at agent scope) **--org**="": org id (omit for platform scope) **--token-file**="": static bearer token file (alternative to --zitadel-key) **--zitadel-key**="": service-account key JSON for API auth (mints its own token) ###### help, h Shows a list of commands or help for one command ##### help, h Shows a list of commands or help for one command #### pack Define and install reusable policy packs (bd_2_0-apa.8) **--help, -h**: show help ##### define Define (upsert) a named pack in the shared catalog **--allow**="": allowed destination host suffix (repeatable) **--audience**="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it **--ca-cert**="": PEM CA bundle to trust for the operator-API TLS cert **--controlplane**="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves) **--deny**="": denied destination host suffix (repeatable) **--deny-reason**="": reason recorded on --deny rules **--help, -h**: show help **--insecure-skip-verify**: skip operator-API TLS verification (dev only) **--issuer**="": OIDC issuer URL (required with --zitadel-key) **--name**="": pack name **--token-file**="": static bearer token file (alternative to --zitadel-key) **--zitadel-key**="": service-account key JSON for API auth (mints its own token) ###### help, h Shows a list of commands or help for one command ##### install Install a defined pack at an org/group/agent scope **--agent**="": agent id (requires --org; cannot be locked) **--audience**="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it **--ca-cert**="": PEM CA bundle to trust for the operator-API TLS cert **--controlplane**="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves) **--group**="": group id (requires --org) **--help, -h**: show help **--insecure-skip-verify**: skip operator-API TLS verification (dev only) **--issuer**="": OIDC issuer URL (required with --zitadel-key) **--name**="": pack name **--org**="": org id (omit for platform scope) **--token-file**="": static bearer token file (alternative to --zitadel-key) **--zitadel-key**="": service-account key JSON for API auth (mints its own token) ###### help, h Shows a list of commands or help for one command ##### uninstall Remove a pack install at an org/group/agent scope **--agent**="": agent id (requires --org; cannot be locked) **--audience**="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it **--ca-cert**="": PEM CA bundle to trust for the operator-API TLS cert **--controlplane**="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves) **--group**="": group id (requires --org) **--help, -h**: show help **--insecure-skip-verify**: skip operator-API TLS verification (dev only) **--issuer**="": OIDC issuer URL (required with --zitadel-key) **--name**="": pack name **--org**="": org id (omit for platform scope) **--token-file**="": static bearer token file (alternative to --zitadel-key) **--zitadel-key**="": service-account key JSON for API auth (mints its own token) ###### help, h Shows a list of commands or help for one command ##### help, h Shows a list of commands or help for one command #### help, h Shows a list of commands or help for one command ### policy-pull Actively pull this enclave's governance snapshot from the controlplane (sidecar) **--ca-cert**="": PEM CA bundle to trust for the controlplane TLS cert **--client-cert**="": PEM client certificate to present for mutual TLS (when the source requires it, e.g. the broker) **--client-key**="": PEM client private key for --client-cert **--controlplane**="": controlplane operator-API base URL (e.g. https://dvx-controlplane:8443) **--enclave-id**="": this enclave's id (the snapshot is scoped to it) **--help, -h**: show help **--insecure-skip-verify**: skip controlplane TLS verification (dev only) **--interval**="": pull period (default: 30s) **--issuer**="": OIDC issuer URL (Zitadel) for key-based auth; required with --zitadel-key **--no-events**: disable the SSE nudge stream; poll on --interval only **--snapshot**="": local path to write the snapshot to (a writable volume the gateway reads) **--token-file**="": file holding a static bearer token (used only when --zitadel-key is unset) **--zitadel-key**="": path to this enclave's Zitadel service-account key JSON; the puller mints its own bearer (key-based auth, preferred) #### help, h Shows a list of commands or help for one command ### config Author agent config values via the controlplane operator API **--help, -h**: show help #### set Set a config value at a scope: dvx config set --value **--agent**="": agent id (requires --org; cannot be locked) **--audience**="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it **--ca-cert**="": PEM CA bundle to trust for the operator-API TLS cert **--controlplane**="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves) **--group**="": group id (requires --org) **--help, -h**: show help **--insecure-skip-verify**: skip operator-API TLS verification (dev only) **--issuer**="": OIDC issuer URL (required with --zitadel-key) **--lock**: lock so more-specific scopes cannot override (refused at agent scope) **--org**="": org id (omit for platform scope) **--secret**: declare a SOVEREIGN secret (bd_2_0-7ha.2): no bytes cross the controlplane; inject them enclave-side with `dvx secret set` **--token-file**="": static bearer token file (alternative to --zitadel-key) **--value**="": the config value; raw JSON, or a bare string (auto-quoted). Omit with --secret **--zitadel-key**="": service-account key JSON for API auth (mints its own token) ##### help, h Shows a list of commands or help for one command #### delete Delete a config value at a scope: dvx config delete **--agent**="": agent id (requires --org; cannot be locked) **--audience**="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it **--ca-cert**="": PEM CA bundle to trust for the operator-API TLS cert **--controlplane**="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves) **--group**="": group id (requires --org) **--help, -h**: show help **--insecure-skip-verify**: skip operator-API TLS verification (dev only) **--issuer**="": OIDC issuer URL (required with --zitadel-key) **--org**="": org id (omit for platform scope) **--token-file**="": static bearer token file (alternative to --zitadel-key) **--zitadel-key**="": service-account key JSON for API auth (mints its own token) ##### help, h Shows a list of commands or help for one command #### help, h Shows a list of commands or help for one command ### config-pull Actively pull this enclave's config-value snapshot from the controlplane/broker (sidecar) **--ca-cert**="": PEM CA bundle to trust for the controlplane TLS cert **--client-cert**="": PEM client certificate to present for mutual TLS (when the source requires it, e.g. the broker) **--client-key**="": PEM client private key for --client-cert **--controlplane**="": controlplane/broker operator-API base URL to pull the config snapshot from **--enclave-id**="": this enclave's id (the snapshot is scoped to it) **--help, -h**: show help **--insecure-skip-verify**: skip controlplane TLS verification (dev only) **--interval**="": pull period (default: 30s) **--issuer**="": OIDC issuer URL (Zitadel) for key-based auth; required with --zitadel-key **--no-events**: disable the SSE nudge stream; poll on --interval only **--snapshot**="": local path to write the config snapshot to (a writable volume the IMDS reads) **--token-file**="": file holding a static bearer token (used only when --zitadel-key is unset) **--zitadel-key**="": path to this enclave's Zitadel service-account key JSON; the puller mints its own bearer (key-based auth, preferred) #### help, h Shows a list of commands or help for one command ### secret Author sovereign secret bytes via the broker API (bd_2_0-dy6) **--help, -h**: show help #### set Set a secret's bytes: dvx secret set --value **--agent**="": agent id (agent-scoped secret; mutually exclusive with --group) **--audience**="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it **--broker-url**="": broker operator-API base URL (the authenticated secret-authoring endpoint) **--ca-cert**="": PEM CA bundle to trust for the operator-API TLS cert **--group**="": group id (group-scoped secret shared by the group's agents; mutually exclusive with --agent) **--help, -h**: show help **--insecure-skip-verify**: skip operator-API TLS verification (dev only) **--issuer**="": OIDC issuer URL (required with --zitadel-key) **--token-file**="": static bearer token file (alternative to --zitadel-key) **--value**="": the secret bytes (a string) **--zitadel-key**="": service-account key JSON for API auth (mints its own token) ##### help, h Shows a list of commands or help for one command #### delete Delete a secret: dvx secret delete **--agent**="": agent id (agent-scoped secret; mutually exclusive with --group) **--audience**="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it **--broker-url**="": broker operator-API base URL (the authenticated secret-authoring endpoint) **--ca-cert**="": PEM CA bundle to trust for the operator-API TLS cert **--group**="": group id (group-scoped secret shared by the group's agents; mutually exclusive with --agent) **--help, -h**: show help **--insecure-skip-verify**: skip operator-API TLS verification (dev only) **--issuer**="": OIDC issuer URL (required with --zitadel-key) **--token-file**="": static bearer token file (alternative to --zitadel-key) **--zitadel-key**="": service-account key JSON for API auth (mints its own token) ##### help, h Shows a list of commands or help for one command #### help, h Shows a list of commands or help for one command ### approvals List and decide pending tool-call approvals (human-in-the-loop) **--help, -h**: show help #### list List pending and recently resolved approvals **--audience**="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it **--broker-url**="": broker operator-API base URL (directly at :8451, or through the relay at :8452) **--ca-cert**="": PEM CA bundle to trust for the operator-API TLS cert **--help, -h**: show help **--insecure-skip-verify**: skip operator-API TLS verification (dev only) **--issuer**="": OIDC issuer URL (required with --zitadel-key) **--token-file**="": static bearer token file (alternative to --zitadel-key) **--zitadel-key**="": service-account key JSON for API auth (mints its own token) ##### help, h Shows a list of commands or help for one command #### get Show one approval by id **--audience**="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it **--broker-url**="": broker operator-API base URL (directly at :8451, or through the relay at :8452) **--ca-cert**="": PEM CA bundle to trust for the operator-API TLS cert **--help, -h**: show help **--insecure-skip-verify**: skip operator-API TLS verification (dev only) **--issuer**="": OIDC issuer URL (required with --zitadel-key) **--token-file**="": static bearer token file (alternative to --zitadel-key) **--zitadel-key**="": service-account key JSON for API auth (mints its own token) ##### help, h Shows a list of commands or help for one command #### approve Approve a pending approval (the held response reaches the agent) **--audience**="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it **--broker-url**="": broker operator-API base URL (directly at :8451, or through the relay at :8452) **--ca-cert**="": PEM CA bundle to trust for the operator-API TLS cert **--help, -h**: show help **--insecure-skip-verify**: skip operator-API TLS verification (dev only) **--issuer**="": OIDC issuer URL (required with --zitadel-key) **--token-file**="": static bearer token file (alternative to --zitadel-key) **--zitadel-key**="": service-account key JSON for API auth (mints its own token) ##### help, h Shows a list of commands or help for one command #### deny Deny a pending approval (the agent gets an error) **--audience**="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it **--broker-url**="": broker operator-API base URL (directly at :8451, or through the relay at :8452) **--ca-cert**="": PEM CA bundle to trust for the operator-API TLS cert **--help, -h**: show help **--insecure-skip-verify**: skip operator-API TLS verification (dev only) **--issuer**="": OIDC issuer URL (required with --zitadel-key) **--token-file**="": static bearer token file (alternative to --zitadel-key) **--zitadel-key**="": service-account key JSON for API auth (mints its own token) ##### help, h Shows a list of commands or help for one command #### stream Live-tail approvals (SSE) until interrupted **--audience**="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it **--broker-url**="": broker operator-API base URL (directly at :8451, or through the relay at :8452) **--ca-cert**="": PEM CA bundle to trust for the operator-API TLS cert **--help, -h**: show help **--insecure-skip-verify**: skip operator-API TLS verification (dev only) **--issuer**="": OIDC issuer URL (required with --zitadel-key) **--token-file**="": static bearer token file (alternative to --zitadel-key) **--zitadel-key**="": service-account key JSON for API auth (mints its own token) ##### help, h Shows a list of commands or help for one command #### help, h Shows a list of commands or help for one command ### tunnel Reach a running agent's localhost services over WireGuard (SOCKS5 by default, or a single forwarded port) **--agent**="": agent id (uid) to tunnel to **--audience**="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it **--ca-cert**="": PEM CA bundle to trust for the operator-API TLS cert **--controlplane**="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves) **--help, -h**: show help **--insecure-skip-verify**: skip operator-API TLS verification (dev only) **--issuer**="": OIDC issuer URL (required with --zitadel-key) **--local**="": single-port mode: local listen address (host:port) (default: "127.0.0.1:8080") **--local-tunnel-ip**="": this end's tunnel IP (default: "10.44.0.1") **--org**="": org id the agent belongs to **--relay-ca**="": PEM CA file to trust for the relay's serving cert (defaults to --ca-cert); set when the relay is fronted by a private CA **--relay-insecure**: skip TLS verification of the relay's serving cert (DEV ONLY; defaults to --insecure-skip-verify) **--remote-port**="": single-port mode: fixed port on the agent's localhost to reach (omit for SOCKS5) (default: 0) **--socks**="": local SOCKS5 listen address (any agent port routes through it) (default: "127.0.0.1:1080") **--terminator-pubkey**="": pin the terminator's WireGuard public key (base64); omit to learn it over the rendezvous key-exchange preamble (bd_2_0-kzb.2) **--terminator-tunnel-ip**="": the terminator's tunnel IP (default: "10.44.0.2") **--token-file**="": static bearer token file (alternative to --zitadel-key) **--zitadel-key**="": service-account key JSON for API auth (mints its own token) #### help, h Shows a list of commands or help for one command ### ssh SSH into a running agent (file transfer + filesystem exploration) with a dvx-brokered cert **--agent**="": agent id (uid) to SSH into **--audience**="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it **--ca-cert**="": PEM CA bundle to trust for the operator-API TLS cert **--controlplane**="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves) **--help, -h**: show help **--insecure-skip-verify**: skip operator-API TLS verification (dev only) **--issuer**="": OIDC issuer URL (required with --zitadel-key) **--local-port**="": local port to forward to the agent's sshd (0 = auto-pick) (default: 0) **--local-tunnel-ip**="": this end's tunnel IP (default: "10.44.0.1") **--login-user**="": login user on the agent sshd sidecar (default: "dvx") **--org**="": org id the agent belongs to **--relay-ca**="": PEM CA file to trust for the relay's serving cert (defaults to --ca-cert) **--relay-insecure**: skip TLS verification of the relay's serving cert (DEV ONLY; defaults to --insecure-skip-verify) **--serve**: keep the tunnel + ssh-agent up and print a ~/.ssh/config stanza (for VS Code Remote-SSH / sshfs / sftp), instead of opening an interactive session **--terminator-pubkey**="": pin the terminator's WireGuard public key (base64); omit to learn it over the rendezvous preamble **--terminator-tunnel-ip**="": the terminator's tunnel IP (default: "10.44.0.2") **--token-file**="": static bearer token file (alternative to --zitadel-key) **--zitadel-key**="": service-account key JSON for API auth (mints its own token) #### help, h Shows a list of commands or help for one command ### exec Open an interactive PTY/exec into a running agent (kube-exec -it style) **--agent**="": agent id (uid) to exec into **--audience**="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it **--ca-cert**="": PEM CA bundle to trust for the operator-API TLS cert **--controlplane**="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves) **--help, -h**: show help **--insecure-skip-verify**: skip operator-API TLS verification (dev only) **--issuer**="": OIDC issuer URL (required with --zitadel-key) **--org**="": org id the agent belongs to **--relay-ca**="": PEM CA file to trust for the relay's serving cert (defaults to --ca-cert) **--relay-insecure**: skip TLS verification of the relay's serving cert (DEV ONLY; defaults to --insecure-skip-verify) **--token-file**="": static bearer token file (alternative to --zitadel-key) **--tty, -t**: allocate a pseudo-terminal (default true for an interactive shell) **--zitadel-key**="": service-account key JSON for API auth (mints its own token) #### help, h Shows a list of commands or help for one command ### rendezvous-sessions-pull Actively pull this enclave's pending tunnel sessions from the controlplane/broker (sidecar) **--ca-cert**="": PEM CA bundle to trust for the controlplane TLS cert **--client-cert**="": PEM client certificate to present for mutual TLS (when the source requires it, e.g. the broker) **--client-key**="": PEM client private key for --client-cert **--controlplane**="": controlplane/broker operator-API base URL to pull the tunnel-session snapshot from **--enclave-id**="": this enclave's id (the snapshot is scoped to it) **--help, -h**: show help **--insecure-skip-verify**: skip controlplane TLS verification (dev only) **--interval**="": pull period (default: 10s) **--issuer**="": OIDC issuer URL (Zitadel) for key-based auth; required with --zitadel-key **--no-events**: disable the SSE nudge stream; poll on --interval only **--snapshot**="": local path to write the tunnel-session snapshot to (a writable volume the imds terminator reads) **--token-file**="": file holding a static bearer token (used only when --zitadel-key is unset) **--zitadel-key**="": path to this enclave's Zitadel service-account key JSON; the puller mints its own bearer (key-based auth, preferred) #### help, h Shows a list of commands or help for one command ### refvalues-pull Actively pull this enclave's attestation reference values from the controlplane (sidecar) **--ca-cert**="": PEM CA bundle to trust for the controlplane TLS cert **--client-cert**="": PEM client certificate to present for mutual TLS (when the source requires it, e.g. the broker) **--client-key**="": PEM client private key for --client-cert **--controlplane**="": controlplane operator-API base URL (e.g. https://dvx-controlplane:8443) **--enclave-id**="": this enclave's id (used to authenticate the pull) **--help, -h**: show help **--insecure-skip-verify**: skip controlplane TLS verification (dev only) **--interval**="": pull period (default: 30s) **--issuer**="": OIDC issuer URL (Zitadel) for key-based auth; required with --zitadel-key **--no-events**: disable the SSE nudge stream; poll on --interval only **--out**="": local path to write the reference values to (a writable volume the enclave reads) **--token-file**="": file holding a static bearer token (used only when --zitadel-key is unset) **--zitadel-key**="": path to this enclave's Zitadel service-account key JSON; the puller mints its own bearer (key-based auth, preferred) #### help, h Shows a list of commands or help for one command ### wait-file Block until a file exists and is non-empty (for init-container gating) **--help, -h**: show help **--path**="": file to wait for **--poll**="": poll period (default: 2s) **--timeout**="": give up after this long (default: 10m0s) #### help, h Shows a list of commands or help for one command ### enclaves Manage the controlplane enclave registry via the operator API (discover, register, delete) **--help, -h**: show help #### list List the enclaves serving your org and how to reach them (relay + broker URLs) **--audience**="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it **--ca-cert**="": PEM CA bundle to trust for the operator-API TLS cert **--controlplane**="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves) **--help, -h**: show help **--insecure-skip-verify**: skip operator-API TLS verification (dev only) **--issuer**="": OIDC issuer URL (required with --zitadel-key) **--token-file**="": static bearer token file (alternative to --zitadel-key) **--zitadel-key**="": service-account key JSON for API auth (mints its own token) ##### help, h Shows a list of commands or help for one command #### refresh Refresh the local enclave profile cache (~/.config/dvx/profile.json) from the controlplane **--audience**="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it **--ca-cert**="": PEM CA bundle to trust for the operator-API TLS cert **--controlplane**="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves) **--help, -h**: show help **--insecure-skip-verify**: skip operator-API TLS verification (dev only) **--issuer**="": OIDC issuer URL (required with --zitadel-key) **--token-file**="": static bearer token file (alternative to --zitadel-key) **--zitadel-key**="": service-account key JSON for API auth (mints its own token) ##### help, h Shows a list of commands or help for one command #### register-broker Register an enclave by minting its broker identity+key via the operator API (bd_2_0-aoq.2) **--audience**="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it **--ca-cert**="": PEM CA bundle to trust for the operator-API TLS cert **--controlplane**="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves) **--enclave-id**="": explicit canonical enclave id override; empty mints a random one **--help, -h**: show help **--insecure-skip-verify**: skip operator-API TLS verification (dev only) **--issuer**="": OIDC issuer URL (required with --zitadel-key) **--name**="": friendly, UNIQUE enclave name operators address it by (e.g. daevix-dev) **--out**="": file to write the minted broker key JSON (0600); required **--owning-org**="": owning org id (required: one enclave, one org) **--token-file**="": static bearer token file (alternative to --zitadel-key) **--zitadel-key**="": service-account key JSON for API auth (mints its own token) ##### help, h Shows a list of commands or help for one command #### delete Delete an enclave from the registry (via the operator API) **--audience**="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it **--ca-cert**="": PEM CA bundle to trust for the operator-API TLS cert **--controlplane**="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves) **--enclave-id**="": canonical enclave id; or use --name **--help, -h**: show help **--insecure-skip-verify**: skip operator-API TLS verification (dev only) **--issuer**="": OIDC issuer URL (required with --zitadel-key) **--name**="": enclave friendly name (resolved to its id); or use --enclave-id **--token-file**="": static bearer token file (alternative to --zitadel-key) **--zitadel-key**="": service-account key JSON for API auth (mints its own token) ##### help, h Shows a list of commands or help for one command #### set-class Author an enclave's requested isolation class (mission bd_2_0-cwnz.6, VAL-ISO-002) **--audience**="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it **--ca-cert**="": PEM CA bundle to trust for the operator-API TLS cert **--class**="": the requested isolation class (plain|vm|node-cvm|per-agent-tee) **--controlplane**="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves) **--enclave-id**="": canonical enclave id; or use --name **--help, -h**: show help **--insecure-skip-verify**: skip operator-API TLS verification (dev only) **--issuer**="": OIDC issuer URL (required with --zitadel-key) **--name**="": enclave friendly name (resolved to its id); or use --enclave-id **--token-file**="": static bearer token file (alternative to --zitadel-key) **--zitadel-key**="": service-account key JSON for API auth (mints its own token) ##### help, h Shows a list of commands or help for one command #### get-class Read an enclave's requested isolation class (mission bd_2_0-cwnz.6) **--audience**="": project id to request as an additional token audience (bd_2_0-8kl.11); the target API pins DVX_OIDC_AUDIENCE to it **--ca-cert**="": PEM CA bundle to trust for the operator-API TLS cert **--controlplane**="": controlplane operator-API base URL (authoring goes through the authenticated API, which publishes + nudges enclaves) **--enclave-id**="": canonical enclave id; or use --name **--help, -h**: show help **--insecure-skip-verify**: skip operator-API TLS verification (dev only) **--issuer**="": OIDC issuer URL (required with --zitadel-key) **--name**="": enclave friendly name (resolved to its id); or use --enclave-id **--token-file**="": static bearer token file (alternative to --zitadel-key) **--zitadel-key**="": service-account key JSON for API auth (mints its own token) ##### help, h Shows a list of commands or help for one command #### help, h Shows a list of commands or help for one command ### internal In-boundary admin/break-glass tools that bypass the operator API (direct DB writes; Zitadel service-account admin) **--help, -h**: show help #### bootstrap Seed the platform org, platform-ops org, and first platform-operator grant into the controlplane DB (in-boundary) **--database-dsn**="": controlplane database DSN **--help, -h**: show help **--ops-org**="": platform-ops org coordinate id to seed (a normal, data-bearing org) (default: "platform-ops") **--ops-org-name**="": display name for the platform-ops org (default: "Platform Ops") **--org**="": platform org coordinate id to seed (default: "platform") **--org-name**="": display name for the platform org (default: "Platform") **--subject**="": the Zitadel `sub` of the platform operator (becomes the 'user:' grant principal) ##### help, h Shows a list of commands or help for one command #### register Register or update an enclave directly in the DB (bootstrap seam; names its single owning org, bd_2_0-j9r) **--database-dsn**="": controlplane database DSN **--enclave-id**="": explicit canonical enclave id override; empty mints a random one (bootstrap/tests) **--help, -h**: show help **--name**="": friendly, UNIQUE enclave name operators address it by (e.g. daevix-dev) **--owning-org**="": owning org id (required: one enclave, one org) **--subject**="": service-account subject bound to this enclave (its metadata pull identity); empty keeps any existing binding ##### help, h Shows a list of commands or help for one command #### serviceaccount Diagnostics for the controlplane's Zitadel service account **--help, -h**: show help ##### check Mint a service-account token and (optionally) provision + call the operator API **--api-base**="": override the management API base (default: issuer) **--controlplane**="": if set, GET /api/v1/whoami as the service principal **--create-org**="": if set, create a Zitadel Organization with this name and print its id **--help, -h**: show help **--insecure-skip-verify**: skip controlplane TLS verification (dev only) **--issuer**="": Zitadel issuer URL **--key**="": path to the Zitadel service-account key JSON **--operator-create-org**="": if set (with --controlplane), POST an org create to the operator API as the service principal (needs platform:orgs + drives the provisioner) **--print-token**: print the minted Zitadel id_token (dev only; for scripting authenticated calls) **--scope**="": override the token request scope (e.g. to request an extra project audience) **--token-endpoint**="": override the token endpoint (default: /oauth/v2/token) ###### help, h Shows a list of commands or help for one command ##### ensure-project Idempotently ensure a Zitadel project exists and print its id (dvx-platform audience, bd_2_0-8kl.11) **--api-base**="": override the management API base **--help, -h**: show help **--issuer**="": Zitadel issuer URL **--key**="": path to the Zitadel service-account key JSON **--name**="": project name (default: "dvx-platform") **--token-endpoint**="": override the token endpoint ###### help, h Shows a list of commands or help for one command ##### set-metadata Set a Zitadel user metadata key (management API). Run with a NON-admin key to verify a principal cannot self-write (bd_2_0-8kl.11 guardrail) **--api-base**="": override the management API base **--help, -h**: show help **--issuer**="": Zitadel issuer URL **--key**="": path to the Zitadel service-account key JSON **--meta-key**="": metadata key **--meta-value**="": metadata value **--token-endpoint**="": override the token endpoint **--user**="": target user id (defaults to the caller's own sub, for the self-write guardrail test) ###### help, h Shows a list of commands or help for one command ##### inspect GET a Zitadel management-API path and print the JSON (discovery for action flow/trigger types) **--api-base**="": override the management API base **--help, -h**: show help **--issuer**="": Zitadel issuer URL **--key**="": path to the Zitadel service-account key JSON **--path**="": management API path, e.g. /management/v1/flows/_types **--token-endpoint**="": override the token endpoint ###### help, h Shows a list of commands or help for one command ##### ensure-org-claim-action Install the Zitadel Action that projects dvx:org/dvx:groups/dvx:kind user metadata into the urn:dvx:org, urn:dvx:groups and urn:dvx:actor-kind token claims (bd_2_0-8kl.11, bd_2_0-ugb.2). The controlplane also reconciles this action at boot; this command is for explicit/manual use **--api-base**="": override the management API base **--decode**: base64-decode the metadata value in the action (use if the raw claim comes out base64) **--help, -h**: show help **--issuer**="": Zitadel issuer URL **--key**="": path to the Zitadel service-account key JSON **--token-endpoint**="": override the token endpoint ###### help, h Shows a list of commands or help for one command ##### provision-operator Create an org-scoped operator machine user (dvx:org metadata) and output its key JSON (bd_2_0-8kl.11) **--api-base**="": override the management API base **--help, -h**: show help **--issuer**="": Zitadel issuer URL **--key**="": path to the Zitadel service-account key JSON **--org**="": the dvx org id to scope this operator to (dvx:org metadata) **--out**="": write the key JSON here ('-' = stdout) (default: "-") **--token-endpoint**="": override the token endpoint **--username**="": machine-user login name ###### help, h Shows a list of commands or help for one command ##### help, h Shows a list of commands or help for one command #### audit-reveal Decrypt sealed HTTP-capture rows (network_flow bodies/headers) for forensic review (bd_2_0-uwi); in-boundary, KMS-backed **--agent**="": narrow to one agent id (e.g. droid) **--audit-dsn**="": clickhouse-go DSN for the enclave audit store **--headers**: also print the sealed (decrypted) request headers **--help, -h**: show help **--kms-config**="": opaque provider config JSON for --kms-provider **--kms-provider**="": enclave KMS backend (e.g. vault) that sealed the bodies **--limit**="": max exchanges to reveal (newest first) (default: 10) **--org**="": narrow to one org id **--trace-id**="": reveal a single captured exchange by its trace id ##### help, h Shows a list of commands or help for one command #### help, h Shows a list of commands or help for one command ### login Authenticate the CLI against the OIDC issuer via the device flow **--help, -h**: show help **--oidc-audience**="": controlplane API audience to request in the token **--oidc-client-id**="": public device-flow client id registered in Zitadel **--oidc-issuer**="": OIDC issuer URL (the self-hosted Zitadel) #### help, h Shows a list of commands or help for one command ### logout Clear the cached CLI credentials **--help, -h**: show help #### help, h Shows a list of commands or help for one command ### whoami Show the caller's identity + effective capabilities from the controlplane **--controlplane**="": controlplane base URL (e.g. https://localhost:8443) **--help, -h**: show help **--insecure-skip-verify**: skip controlplane TLS verification (dev only) **--oidc-audience**="": controlplane API audience to request in the token **--oidc-client-id**="": public device-flow client id registered in Zitadel **--oidc-issuer**="": OIDC issuer URL (the self-hosted Zitadel) #### help, h Shows a list of commands or help for one command ### audit Query the audit store (enclave sovereign audit or controlplane audit) **--help, -h**: show help #### events Fetch a filtered page of audit events **--action**="": filter by audit action (e.g. gateway.egress, secret.write) **--agent**="": filter by agent id **--ca-cert**="": PEM CA bundle to trust for the audit API TLS cert **--controlplane**="": controlplane base URL for --source controlplane, and for discovering enclaves when --enclave is not given (e.g. https://localhost:8443) **--dst-host**="": filter by destination host **--enclave**="": enclave audit base URL for --source enclave (overrides discovery); point at the relay (:8452) or the broker (:8451) - both serve the same /api/v1/audit/* routes **--enclave-id**="": select a discovered enclave by its id OR its friendly name (from the profile cache) instead of passing --enclave; requires --controlplane for discovery (bd_2_0-cal.3) **--help, -h**: show help **--insecure-skip-verify**: skip audit API TLS verification (dev only) **--limit**="": max rows to return (<=1000) (default: 100) **--offset**="": pagination offset (default: 0) **--oidc-audience**="": token audience to request **--oidc-client-id**="": public device-flow client id **--oidc-issuer**="": OIDC issuer URL (for the cached device-flow credential) **--outcome**="": filter by outcome (allow|deny|error) **--proto**="": filter by protocol (tcp|udp) **--scope**="": filter by scope (platform|agent) **--since**="": only events at/after this RFC3339 time **--source**="": which plane's audit to query: enclave | controlplane (default: "enclave") **--token**="": bearer token to present (overrides the cached device-flow credential) **--until**="": only events at/before this RFC3339 time ##### help, h Shows a list of commands or help for one command #### stream Live-tail audit events (SSE) until interrupted **--action**="": filter by audit action (e.g. gateway.egress, secret.write) **--agent**="": filter by agent id **--ca-cert**="": PEM CA bundle to trust for the audit API TLS cert **--controlplane**="": controlplane base URL for --source controlplane, and for discovering enclaves when --enclave is not given (e.g. https://localhost:8443) **--dst-host**="": filter by destination host **--enclave**="": enclave audit base URL for --source enclave (overrides discovery); point at the relay (:8452) or the broker (:8451) - both serve the same /api/v1/audit/* routes **--enclave-id**="": select a discovered enclave by its id OR its friendly name (from the profile cache) instead of passing --enclave; requires --controlplane for discovery (bd_2_0-cal.3) **--help, -h**: show help **--insecure-skip-verify**: skip audit API TLS verification (dev only) **--oidc-audience**="": token audience to request **--oidc-client-id**="": public device-flow client id **--oidc-issuer**="": OIDC issuer URL (for the cached device-flow credential) **--outcome**="": filter by outcome (allow|deny|error) **--proto**="": filter by protocol (tcp|udp) **--scope**="": filter by scope (platform|agent) **--since**="": only events at/after this RFC3339 time **--source**="": which plane's audit to query: enclave | controlplane (default: "enclave") **--token**="": bearer token to present (overrides the cached device-flow credential) **--until**="": only events at/before this RFC3339 time ##### help, h Shows a list of commands or help for one command #### help, h Shows a list of commands or help for one command ### imds-shim In-guest bridge: present the IMDS unix socket inside a Kata VM, proxy to the host over vsock **--help, -h**: show help **--host-cid**="": vsock context id of the host (2 = VMADDR_CID_HOST) (default: 2) **--port**="": vsock port the host relay listens on (default: 1400) **--socket**="": unix socket to present inside the guest (the path the agent dials) (default: "/run/dvx/imds.sock") #### help, h Shows a list of commands or help for one command ### echo-verify Verifying destination for the agent-identity tunnel (bd_2_0-bwc): mTLS-verify a presented SVID and echo the attested identity **--addr**="": TLS listen address (default: ":8480") **--agent-ca**="": agent-identity trust bundle (ca.crt the enclave publishes); a presented SVID must chain to it **--help, -h**: show help **--log-format**="": application log format (json|text) (default: "json") **--log-level**="": application log level (debug|info|warn|error) (default: "info") **--min-tier**="": minimum attestation tier to accept (none|node-cvm|per-agent-tee); empty accepts any **--tls-cert**="": the destination's own TLS serving certificate (PEM) **--tls-key**="": the destination's TLS serving key (PEM) #### help, h Shows a list of commands or help for one command ### help, h Shows a list of commands or help for one command}