Command reference

Inspect the version and capabilities

lumenlan version
lumenlan capabilities
lumenlan env probe --tool git

version reports the tool version and build provenance. capabilities lists the verification and workspace abilities visible through the current interface. env probe checks only tools in its registry; it does not execute an arbitrary command supplied by the caller. Results are one JSON document on stdout, while human guidance and diagnostics go to stderr.

Strict verification

lumenlan run spec.json
cat spec.json | lumenlan run -

The input must be a registered, versioned verification ActionSpec. This entry point rejects arbitrary commands, shells, terminals, and dynamic scripts. The same input and tool version should produce the same result structure. When the environment cannot run the action, the outcome is blocked and retains the reason.

To submit artifacts to one-time upload destinations in the same operation, use:

lumenlan evidence upload request.json

It runs the strict specification, materializes the artifact, calculates SHA-256, uploads it, and returns a receipt in one process. The upload destination is not echoed into normal results or diagnostics, and an upload failure cannot rewrite the execution as a pass.

Grant-bound workspace

lumenlan workspace process request.json
lumenlan workspace script request.json
lumenlan workspace adapter request.json

process starts a no-shell process in the permitted scope. script runs a project script with a fixed digest. adapter invokes a registered, digest-pinned capability adapter. Requests need a valid signed grant and must satisfy local ExecutionPolicy. Arguments cannot elevate verification into workspace or escape the permitted actor, project, machine, tool, path, expiration, and revocation boundaries.

Use lumenlan --help or a subcommand’s --help for syntax. Action exit codes are fixed: 0 completed and passed, 1 completed with a failed check, 2 blocked by prerequisites, and 3 invalid request or boundary. Automation should read both the exit code and JSON outcome rather than deriving a verdict from stderr text.