KTAPEOUTCLI reference
The public CLI is the Rust ktape binary. The command contract is recorded in spec/KTAPEOUT_0.5.0_COMMAND_CONTRACTS.json; this page summarizes the safe entry points.
| Command family | Purpose | Network effect |
|---|---|---|
ktape init | Create a local project and workflow | None |
ktape dev workflow | Validate a local manifest and lock | None |
ktape package build | Build a deterministic KTAPEOUT-STATIC-RUNTIME-MANIFEST-V1 runtime package that the Shell loads directly | Local files; no upload or signing |
ktape profile | Inspect, search, compose, lock and verify packages | None |
ktape artifact | Select, build, inspect, verify, reproduce and simulate artifacts | None |
ktape name | Normalize names and create unsigned plans | None or read-only evidence |
ktape resource | Produce deterministic resource projections | None |
ktape operation recover | Assess resumable operation state | Read-only |
ktape evidence private-directory-tree-v2-verify <INPUT.ndjson> | Recompute a bounded decrypted private-directory V2 Root/Page/Object tree (local candidate; - reads stdin) | Read-only |
ktape release | Validate unsigned release, maintenance and migration plans | None |
ktape release maintenance-verify | Verify a maintenance plan and optional genesis/rebuild/readback evidence | None |
ktape genesis-provenance | Compose or verify unsigned genesis provenance and optional rebuild/readback evidence | None |
ktape dev genesis-* | Validate or compose genesis provenance material | None |
ktape dev studio-* | Verify a bounded Studio handoff or build a local runtime bundle | None |
ktape doctor | Diagnose bounded failure conditions | None |
Commands that produce a plan, hash, receipt or UI result do not automatically sign or broadcast. A live write requires an explicitly authorized external provider and the required evidence/readback boundary.
ktape app content-preflight ARTIFACT.json verifies a bounded local OnChainContentV1 artifact. An optional package-local discovery/media.json can describe icon/card images. Studio generates it from optional image inputs and includes the descriptor and bytes in the ordinary content roots. The CLI checks its schema, role budgets and declared path, MIME type, length and SHA-256 against the verified artifact files; it does not decode image formats, publish the artifact, or prove a current Registry/name binding. Browser display must verify actual bytes and decode dimensions. Omit media when it adds no value; media has no separate Profile, publication path or authority model. For the complete author-to-directory workflow, see the Application discovery images guide.
Python CLI modules remain conformance-only. They must not be presented as a second public signing CLI.
For Profile composition, the Rust CLI fills a capability requirement when exactly one selected package provides it; missing or ambiguous providers are reported for an explicit developer decision. Typed interface bindings require matching definitions committed in both verified packages. Their current status is STATIC_ONLY: compatible declarations do not prove cross-application L1 execution. Python reference tooling reports typed or external dependency composition as UNSUPPORTED_IN_REFERENCE.
The release and developer commands are local preflight operations. They do not execute migrations, sign, broadcast, or assert live-chain evidence.
evidence private-directory-tree-v2-verify is included in this source preview as a local structural verifier. It accepts one bounded NDJSON stream from a file or stdin (-): a KTAPEOUT-PRIVATE-DIRECTORY-TREE-V2-VERIFY-HEADER record with a decrypted V2 root, followed by sorted KTAPEOUT-PRIVATE-DIRECTORY-TREE-V2-VERIFY-PAGE records. It checks the complete Root-to-Page-to-Object graph, canonical page digest, object-set commitments, reference equality, ordering, reachability and hard size/count bounds. This is structural verification only: receipt_authentication=NOT_PERFORMED and chain_inclusion=NOT_PROVEN. Callers must separately use the existing action-specific Rust transaction verifier and trusted Host Operation/Receipt and predecessor checks. Do not pass this result as a production marker authorization or treat the locally built binary as an official release.
maintenance-verify and genesis-provenance verify accept evidence produced by an external adapter, but only validate its declared bindings locally. Supplying evidence does not turn a receipt into consensus finality, signer authority or L1 admission.
Local runtime packaging
ktape package build creates a deterministic runtime package from a local source directory. It writes a KTAPEOUT-STATIC-RUNTIME-MANIFEST-V1 manifest and the files at their original paths under runtime/<network>/<namespace>/<slug>/<release_id>/, enforces the browser verifier limits and rejects hidden files, key material and source maps. It performs no upload, signing, broadcast, locator publication, or activation. See Build a local runtime package for the command example and limits.