v1.2.5

Guided CLI

A focused public-API walkthrough from the terminal. Use the dedicated tutorial when you want the full operator narrative.

Purpose

The first kavach command is intentionally a guided product experience, not a second control plane. kavach walkthrough governed-replay records observed prompt and model evidence, selects an immutable dataset and replayable execution, inspects existing evaluation and decision evidence, and prepares a replay.

Every operation uses the same versioned REST endpoints available to Studio and external producers. The command then prints links back to Studio for visual inspection.

Run the walkthrough

From a repository clone, start the supported local stack and run the golden path. The local seed provides the immutable dataset, source execution, evaluation evidence, and governance decision used by the scenario.

bash

./kavach.sh
uv run kavach walkthrough governed-replay

The command prints the actual IDs and Studio deep links created or selected during the run. For a complete explanation of every step and expected result, use the Governed Replay Walkthrough tutorial.

Authentication

No manual bearer-token export is required. In Keycloak mode, the CLI exchanges KAVACH_OAUTH_* client credentials for a short-lived token in memory. ./kavach.sh generates local OAuth configuration in .env.oauth.generated; it is ignored by Git and never printed by the CLI.

A pre-obtained bearer token is supported only through an explicit --token argument. The walkthrough intentionally ignores a shell KAVACH_TOKEN export so stale credentials cannot silently override its service identity.

Automation and manifests

The path is deterministic today. Use --non-interactive to make that explicit in CI and --output-json to emit the complete run manifest on stdout.

bash

uv run kavach walkthrough governed-replay \
  --non-interactive \
  --output-json \
  --manifest artifacts/governed-replay-manifest.json

A manifest records the actual tenant, selected and created asset IDs, step outcomes, API version, and Studio URLs. This makes the walkthrough useful for onboarding, repeatable demos, CI smoke tests, and release validation without inventing a separate demo database contract.

bash

uv run kavach walkthrough governed-replay \
  --non-interactive \
  --output-json \
  --manifest artifacts/governed-replay-manifest.json

The JSON manifest is checkpointed after every successful step. It records selected and created IDs, outcome, API version, and Studio URLs; it is suitable for CI smoke tests and release validation. The detailed tutorial covers restart behavior and safe local manifest cleanup.

Product boundary

The CLI never calls repositories directly, inspects SQLite, or contains governance logic. It also never claims a completed replay, evaluation, or drift result before the standard worker lifecycle produces one. Ontology projection may be pending; the manifest records that state and links to the graph rather than fabricating lineage.

The scenario is versioned with its fixtures in examples/governed-replay/scenario.yaml. Read the replay-management tutorial for the worker lifecycle and the observed-assets guide for producer integration.