Lumenlan CLI

Lumenlan CLI is the deterministic action layer on an agent’s target machine. The agent still handles judgment and tradeoffs. Work that is already defined and must run the same way with a reviewable result is given to lumenlan.

It keeps two execution profiles separate:

• verification runs only registered, versioned specifications for environment probes, file manifests, and formal checks. It does not accept ad-hoc commands or dynamic scripts. Missing prerequisites produce an explicit blocked result, never a false pass.
• workspace runs project processes, digest-pinned project scripts, or registered adapters. Every call must be allowed by both an ExecutionGrant and local policy. Tools, paths, and actions outside that grant are rejected.

The same execution core is available to local agents through stdio MCP. There is no network listener by default. Remote machine selection, transport, approval, and revocation remain outside the CLI.

Start here

1. Use Installation and upgrades for an automatic or manual installation.
2. Run lumenlan version and lumenlan capabilities to inspect the installed build and local abilities.
3. Choose a strict verification or grant-bound workspace entry in the Command reference.
4. To connect a desktop agent, continue with MCP setup.

The CLI writes exactly one contract JSON document to stdout. Help, warnings, logs, and diagnostics go to stderr. Exit codes are fixed: 0 passed, 1 failed, 2 blocked, and 3 invalid, so people and automation can use the same outcome rules.

Review the Security boundaries before enabling workspace work. For installation or runtime problems, see Troubleshooting.