Documentation Reference

CLI reference

The current command surface, with installation requirements and development status made explicit.

On this page

Local inspection commands

These commands inspect the CLI, host, or supplied files. They do not create a protected agent runtime.

Implemented CLI foundation
Command	What it does
`cella`, `cella --help`, `cella -h`	Print the available CLI commands.
`cella --version`, `cella -V`	Print the CLI version.
`cella info`	Print build-target and contract information.
`cella doctor --wall`	Inspect the exact host and runtime prerequisites. Missing dependencies produce a nonzero exit.
`cella setup --plan`	On the pinned Debian target, show candidate runtime artifact URLs and digests. Does not download or install.
`cella setup --verify <directory>`	Verify the size and digest of pinned local runtime artifacts. Does not install or grant release authorization.

Use ./target/debug/cella in place of cella when following the source-build quick start.

Bundled CLI alternative

Debian 13 x86-64 users may use ./install.sh --check and ./install.sh from an ordinary-user checkout. No Rust or C compiler is required. The SHA-256 checked unsigned alpha binary installs only to ~/.local/bin/cella; it does not install a runtime or enable Agent/Service Cells.

Signed first-install commands

Implemented code · release gate open

The signed-bundle installer is implemented, but the checkout has no pinned production release key and no production-signed release is published. Unsigned checkout builds refuse privileged installation. A user-local CLI bootstrap is not the complete Installation.

Release-gated setup commands
Command	Implemented contract
`cella setup`	Verify an adjacent signed release bundle, preview first-install changes, obtain explicit administrator authorization, and install identities, accounts, runtime, image, and services.
`cella setup --bundle <directory>`	Perform the same first-install transaction from an exact offline signed directory, subject to signature, artifact, host, and existing-state checks.
`cella setup --tpm2`	Optionally seal generated software identity keys using Linux TPM 2.0 and encrypted systemd credentials. Also supported with `--bundle`; this is not TPM-native non-exportable signing.

Target-host acceptance remains open. Setup is not a verified upgrade path; upgrade and rollback remain approved, unimplemented commands.

Installation and update contract

Commands that require an installation

These commands depend on an enrolled, administrator-provisioned cellad installation. A source build or CLI-only bootstrap alone does not provide it.

Enrolled controller commands
Command	Current behavior
`cella daemon status [--socket <absolute-path>]`	Query control health. Runtime readiness is reported separately.
`cella init [path]`	Register a minimal Project and ensure one configured logical Agent Cell exists, reusing it on later calls. Does not onboard providers, create a generation/runtime, or run code.
`cella create [name]`	Create a logical Agent Cell record. Does not create a generation, import source, or start an agent.

Offline shell candidate

cella shell requests a fresh offline Agent Cell and a bounded terminal stream. It needs the operator-provisioned image pin, candidate runtime, and explicit systemd configuration described in the runbook.

Development candidate

The path is wired, but target-host validation and protected-runtime qualification remain open. It provides no model-service connection and is not the complete coding-agent workflow.

Read the offline shell contract

Local development slices

The current source checkout includes these partial paths. They require an enrolled installation and applicable policy; the bundled CLI may predate them. Local tests do not establish a qualified protected workflow.

Private repository import. cella import PATH --cell ID --as primary imports a reviewed local snapshot into private custody without mounting or changing the host checkout.
Task records. The cella workstream commands create and inspect task identity, read a bounded journal, and record owner-authored handoff notes. Checkpoints and cross-agent continuation remain unavailable.
Project permissions. The current cella policy slice validates, simulates, explains, and explicitly adopts Project policy. Effects and runtime secrets still lack complete integrated enforcement.
A fixed no-secret service. cella service start, status, and stop operate the administrator-pinned echo service. This is not arbitrary application execution or a secret-bearing service.

A source-backed cella run --offline path is wired but fails closed without Wall protection proof. It does not launch a coding agent, call a model, or deliver a result to the host repository.

Current service development runbook

The remaining product workflow

Remote and multi-repository import, model-connected cella run, general Service Cell and secret operations, checkpoints, cross-agent handoff, candidate comparison, complete policy enforcement, Change Capsule delivery, upgrade, and rollback are part of the intended command surface.

Do not treat the design registry as release help. Its status column distinguishes implemented behavior from future commands.

Full canonical command registry