Purpose and boundary
Map the complete host-owned CLI surface and route each command family to one bounded issue or an explicit deferred decision.
ADR 19 — CLI owns the accepted grammar, exit/error behavior, and destructive safeguards. This issue is a navigation and decomposition map; it is not a second CLI specification and not one implementation assignment.
The CLI is an operator projection over owned application services. It must not become a second orchestration kernel, configuration language, migration authority, or extension callback host.
Current command families
Related host responsibilities
Those issues may expose CLI journeys, but their system truth remains with their named owner rather than moving into this master.
Surface still to decompose
Create bounded child issues only when the corresponding application contract is ready:
- Run submission with an exact Scroll/Composition revision, authority, budget, and idempotency identity.
- Run list/show/cancel and event inspection without leaking secrets or private payloads.
- Service/capability inspection, with observed readiness kept distinct from configured intent.
- Configuration validate/diff/apply journeys using immutable generations.
- Extension/package inspect and lifecycle operations without dynamic Click callback injection.
- Machine-readable output, stable exit codes, non-interactive operation, redaction, and shell completion.
Shared CLI laws
- Root grammar and command ownership remain Core-owned and collision-free.
- Commands call typed application services; they do not reach directly into database sessions, registries, systemd, or provider SDKs.
- Human output and machine-readable output carry the same truth and stable failure classification.
- Destructive operations require explicit scope and confirmation; automation gets an equally explicit non-interactive contract.
- Ordinary failures do not disclose tracebacks, credentials, secret values, private prompts, or client material.
- Each effectful command records enough identity for reconciliation and safe retry.
- Extension contributions may expose inert typed operation metadata only through an admitted host-owned surface; arbitrary command callbacks remain closed.
Completion condition
Close this master when every supported root command family has one canonical owner, bounded issue or explicit deferral; the operator journeys are discoverable; and maintained tests cover grammar, structured output, exit behavior, redaction, destructive safeguards, and service-boundary delegation.
Closure means the CLI map is coherent. It does not mean every future operator command has shipped.
Purpose and boundary
Map the complete host-owned CLI surface and route each command family to one bounded issue or an explicit deferred decision.
ADR 19 — CLI owns the accepted grammar, exit/error behavior, and destructive safeguards. This issue is a navigation and decomposition map; it is not a second CLI specification and not one implementation assignment.
The CLI is an operator projection over owned application services. It must not become a second orchestration kernel, configuration language, migration authority, or extension callback host.
Current command families
Related host responsibilities
Those issues may expose CLI journeys, but their system truth remains with their named owner rather than moving into this master.
Surface still to decompose
Create bounded child issues only when the corresponding application contract is ready:
Shared CLI laws
Completion condition
Close this master when every supported root command family has one canonical owner, bounded issue or explicit deferral; the operator journeys are discoverable; and maintained tests cover grammar, structured output, exit behavior, redaction, destructive safeguards, and service-boundary delegation.
Closure means the CLI map is coherent. It does not mean every future operator command has shipped.