b10x-loom

Generated from the clap definition of the b10x-loom command line in crates/loom-cli/src/lib.rs by loom-docs. It lists only commands that exist.

Loom: route an intent and run it until it is blocked

b10x-loom --version prints its version, and --help after any command prints the text below.

Commands

Command	What it does
b10x-loom run	Run the slice on an intent until it is blocked, and say why it stopped
b10x-loom protocols	Install, inspect, or remove protocol definitions available to this host
b10x-loom protocols add	Validate and snapshot one protocol from a file or a pinned Git repository
b10x-loom protocols list	List bundled and installed definitions, provenance, and available execution bindings
b10x-loom protocols remove	Remove an installed definition; bundled definitions cannot be removed
b10x-loom evaluate	Decide a case snapshot and its evidence under a catalog protocol, and write the decision as JSON. It decides and never acts
b10x-loom plugin	Host a plugin, or print what it proposed. A plugin reads and proposes; it never sends
b10x-loom plugin run	Host a plugin: poll, classify and answer each new item in a governed read-only turn, and record one line per handled item. Nothing is sent
b10x-loom plugin report	Print one line per proposal a plugin recorded in its state directory: a proposed reply or a proposed case
b10x-loom agent	Check an agent defined as data, a loom.agent/1 spec, before anything runs
b10x-loom agent check	Say whether a loom.agent/1 spec can be served: refuse, naming the member and the reason, a spec that cannot. It runs nothing
b10x-loom agent serve	Host the agent a loom.agent/1 spec declares: poll its channel, answer each item in a governed turn, and send a reply only as the spec's writes admit
b10x-loom agent run	Run one turn of a loom.agent/1 spec on a task text, record it as agent serve records an item, send only as the spec's writes admit, and exit with how the turn ended
b10x-loom agent resume	Perform a held send after its approval, once
b10x-loom agent stage-files	Copy the keys of a mounted Secret volume into a directory this user owns, the directory mode 0700 and each file 0600
b10x-loom agent prepare-dirs	Make each directory one this user owns with mode exactly 0700, keeping what it holds
b10x-loom agent boundary	Serve the credential boundary of a credential-free agent pod: relay model, Connectors and git requests from loopback to their upstreams with a projected token the agent never holds
b10x-loom agent boundary-ready	Say whether every boundary port on 127.0.0.1 accepts a connection: the boundary's startup probe
b10x-loom approve	Approve the request a commission's Suspension holds: write a grant into the state directory. Approval performs nothing; resume does
b10x-loom resume	Continue a commission's suspended run after its approval: perform the suspended request once, release the Suspension, and run on until the run stops

b10x-loom run

Run the slice on an intent until it is blocked, and say why it stopped

Usage: b10x-loom run [OPTIONS] <INTENT>

Argument	Required	Default	Meaning
--context-policy <CONTEXT_POLICY>	no	legacy	Keep the legacy rolling transcript, or opt into bounded working context and history lookup
--context-report <PATH>	no	none	Write payload-free measurements, including routing and startup failures
--confinement <CONFINEMENT>	no	substrate	Confine tests with Substrate, or explicitly run with the operator's rights
--cgroup-root <DIR>	no	none	An explicitly delegated cgroup v2 root for confined tests
--workspace <DIR>	no	none	Existing Git worktree for software changes; unnecessary for system queries
--test-cmd <CMD>	no	cargo test	The test command, run in the workspace without a shell: a program and its arguments, split at white space
--max-steps <N>	no	20	The most actions performed before the run stops
--catalog <PATH>	no	none	An llm catalog (llm.catalog/1 TOML) in a regular file; a named pipe such as <(cmd), a device or a directory is refused. With it, --model and --classifier-model each name a route alias of this catalog instead of a Codex model, both of them; an alias it does not declare, or a catalog that cannot be read, stops the run before any model call
--config <PATH>	no	none	A models configuration (YAML, a regular file): routes, the path of an llm.routes/1 document relative to the configuration's directory, and roles, a list of {role, model} giving the roles agent and classifier each a route or <endpoint>/<model-id> name of that document, whose credentials are its secret: references. With it, --model and --classifier-model have no default: given, each overrides its role with a name of the same document. A configuration that cannot be loaded, a role neither configured nor given, or a model that cannot take a forced tool call stops the run before any model call. Not with --catalog. With --state, the resume context keeps the configuration's absolute path, and resume continues on the model it serves the role agent
--model <ID>	no	gpt-5.6-sol	The model that selects actions and writes their arguments: a Codex model name, with --catalog a route alias of that catalog, or with --config a name of its routes document, overriding the role agent
--classifier-model <ID>	no	gpt-5.6-sol	The model that classifies the intent: a Codex model name, with --catalog a route alias of that catalog, or with --config a name of its routes document, overriding the role classifier
--threshold <X>	no	0.5	The confidence, from 0 to 1, below which the router refuses its pick
--risk <RISK>	no	standard	How much proof the change must carry, the software-change@1 case input risk: each level owes every obligation of the level below it and one more (tests, review, provenance, health). A protocol that declares no case input ignores it
--change-kind <KIND>	no	feature	What the change is, the software-change@1 case input change_kind. A bugfix edits the implementation (implementation.edit) only once a test failed on the current revision
--affects-security-boundary <BOOL>	no	false	Whether the change affects a security boundary, the software-change@1 case input affects_security_boundary. One that does is verified only once another principal approved its security review, which the slice never submits
--test-path <GLOB>	no	none	A test-path pattern, repeatable: tests.write changes only paths one of them matches, for every change kind; a path outside them refuses the action before anything is written. Relative to the workspace root; * within one path segment, ** across any number. Without one: tests/, /tests/, test/, /test/, **/_test., **/test_., **/.test. and **/.spec.
--regression-test-command <CMD>	no	none	The regression-test command, run in the workspace without a shell and split at white space, with {path} in at least one word. On a bugfix, after each tests.run that follows a tests.write that committed, it runs once per test path those writes committed, {path} filled, and only its result is a regression_test_result. Without it no run is one, so a bugfix's red_first.required stays open
--output <FORMAT>	no	human	What standard output carries: lines for a person, or one JSON record per line, the last one the terminal record with the stop reason and the exit status
--state <DIR>	no	none	Keep the run's case, its commission's Suspension and the commission's resume context in this directory, created when missing, so a run stopped for an approval leaves what a later resume continues from. Without it nothing outlives the run
--action-bindings <FILE>	no	none	A run configuration file (JSON, a regular file) binding an installed protocol's actions to commands: {"protocol": "@", "timeout_seconds": , "unconfined_bindings": <true|false>, "bindings": [{"action": "", "argv": ["", "", ...]}]}. A run of that protocol starts an admitted action's program without a shell, with the action's arguments as JSON on standard input, a cleared environment but PATH, and a timeout (60 s when absent); exit 0 is performed, with standard output, one JSON object, as the report; any other end is refused. A binding confers no authority. A file that names an action the protocol does not declare is refused before any model call; an action it binds no command to stops the run NoLocalExecutor, naming it. Substrate does not confine these commands, so the run is refused ConfinementUnavailable (CommandUnconfined), exit 3, before any model call unless --unconfined-bindings is given or the file sets "unconfined_bindings": true
--unconfined-bindings	no	false	Run the commands --action-bindings binds with the operator's rights, outside Substrate. Without it, and without "unconfined_bindings": true in that file, a run given --action-bindings is refused ConfinementUnavailable (CommandUnconfined). The flag wins over the file; standard error reports which one opted in
<INTENT>	yes	none	What to do, as given

With --state, only a run whose last line is `stopped: ApprovalRequired (<action>)` holds a
Suspension `approve` can approve.

Exit status:
  0  the query completed (Completed) or the run reached its human gate (ApprovalRequired)
  4  with --state, the run reached its human gate holding no Suspension:
     `stopped: ApprovalRequired (<action>), nothing suspended`; there is nothing to approve
  3  the run stopped for another reason (NothingAdmissible, StepBudget, NoLocalExecutor, Refused, ConfinementUnavailable)
  1  the run failed
  2  the command line is not valid

b10x-loom protocols

Install, inspect, or remove protocol definitions available to this host

Usage: b10x-loom protocols <COMMAND>

b10x-loom protocols add

Validate and snapshot one protocol from a file or a pinned Git repository

Usage: b10x-loom protocols add [OPTIONS] <NAME>

Argument	Required	Default	Meaning
<NAME>	yes	none	Registration identity, such as clock-check@1
--file <PATH>	no	none	Local YAML to validate and snapshot
--source <LOCATOR>	no	none	Git locator with a full commit pin: git+https://host/repo.git#
--path <RELATIVE_PATH>	no	none	Regular-file path inside the pinned Git commit
--replace	no	false	Explicitly replace an existing installed definition

b10x-loom protocols list

List bundled and installed definitions, provenance, and available execution bindings

Usage: b10x-loom protocols list

b10x-loom protocols remove

Remove an installed definition; bundled definitions cannot be removed

Usage: b10x-loom protocols remove <NAME>

Argument	Required	Default	Meaning
<NAME>	yes	none

b10x-loom evaluate

Decide a case snapshot and its evidence under a catalog protocol, and write the decision as JSON. It decides and never acts

Usage: b10x-loom evaluate [OPTIONS]

Argument	Required	Default	Meaning
--input <PATH>	no	none	Read the request from this regular file instead of standard input; a named pipe, a device or a directory is refused (pipe a request to standard input instead)

The request is one JSON object (loom.evaluation.EvaluationRequest):
  {"protocol": "<name>@<major>", "snapshot": {canon-case/1}, "evidence": [{canon-evidence/1}, ...], "at": "<RFC 3339>",
   "decisions": [{"decision": "<name>", "outcome": "<outcome>", "principal": "<who>", "case_revision": "<revision>"}, ...]}
`at` and `decisions` are optional. The protocol comes from this host's catalog (`protocols list`), never from the request.
`decisions` are the canon-decisions/1 explicit decisions taken for the case; one applies only at the snapshot's revision.
A record that is not a readable canon-evidence/1 record, or repeats an earlier record's id, is refused.
A readable record that does not apply to the case (an undeclared kind or subject, for instance) is set
aside, as the governor sets it aside, and the decision is made from the rest without listing it.
Unlike the governor, which sets an unreadable record and a repeated id aside (keeping the first) and
still decides, evaluate refuses both (a repeated id as duplicate-identifier, naming the later record).

Exit status:
  0  decided: standard output carries the decision (loom.evaluation.EvaluationDecision)
  3  refused: standard output carries the refusal (loom.evaluation.EvaluationRefusal), and standard error names the input
  1  the request or the protocol catalog cannot be read
  2  the command line is not valid

b10x-loom plugin

Host a plugin, or print what it proposed. A plugin reads and proposes; it never sends

Usage: b10x-loom plugin <COMMAND>

b10x-loom plugin run

Host a plugin: poll, classify and answer each new item in a governed read-only turn, and record one line per handled item. Nothing is sent

Usage: b10x-loom plugin run [OPTIONS] --config <PATH> --state <DIR> <PLUGIN>

Argument	Required	Default	Meaning
<PLUGIN>	yes	none	The plugin to host
--config <PATH>	yes	none	The plugin's JSON configuration file
--state <DIR>	yes	none	The plugin's state directory: its cursors and record. It must lie outside every workspace root and checkout the configuration names; one host holds it at a time
--once	no	false	Run one cycle and stop
--catalog <PATH>	no	none	An llm catalog (llm.catalog/1 TOML) in a regular file. With it, --model and --classifier-model each name a route alias of this catalog instead of a Codex model; an alias it does not declare, or a catalog that cannot be read, stops before any model call
--model <ID>	no	gpt-5.6-sol	The model each turn runs on: a Codex model name, or with --catalog a route alias
--classifier-model <ID>	no	gpt-5.6-sol	The model that classifies each item and picks a task's protocol: a Codex model name, or with --catalog a route alias

The configuration is the plugin's JSON configuration file. For slack-handler it is
loom.slack.SlackConfig: the host's plugin configuration under "plugin" (the connectors command line,
the data sources a turn may read, the objectives, the classification threshold, the poll interval),
the Slack adapter, connection and read operations, the bot's user id, min_age_minutes, the seed,
lookback_minutes and the objectives each channel serves. It is checked before anything runs.

Each cycle polls, classifies every new item, answers a question in a governed read-only turn over the
data sources and records the proposed reply, records a task's proposed case, and appends one line per
handled item to record.jsonl in the state directory. Nothing is sent. With --once it runs one cycle
and prints one line per proposal it recorded. Without it, it polls every poll_interval_seconds until
SIGTERM or SIGINT, which end it after the item being handled (a second one ends it at once, exit
status 130), and then prints one line per proposal it recorded.

Exit status:
  0  the cycles ran
  1  the configuration, the models or the state directory cannot be used, or the last cycle's poll
     failed (a failed poll is otherwise retried after poll_interval_seconds)
  2  the command line is not valid (an unknown plugin name among them)
  130  a second SIGTERM or SIGINT ended it at once

b10x-loom plugin report

Print one line per proposal a plugin recorded in its state directory: a proposed reply or a proposed case

Usage: b10x-loom plugin report --state <DIR> <PLUGIN>

Argument	Required	Default	Meaning
<PLUGIN>	yes	none	The plugin whose record is read
--state <DIR>	yes	none	The plugin's state directory

b10x-loom agent

Check an agent defined as data, a loom.agent/1 spec, before anything runs

Usage: b10x-loom agent <COMMAND>

b10x-loom agent check

Say whether a loom.agent/1 spec can be served: refuse, naming the member and the reason, a spec that cannot. It runs nothing

Usage: b10x-loom agent check --spec <FILE>

Argument	Required	Default	Meaning
--spec <FILE>	yes	none	The loom.agent/1 document, YAML or JSON, in a regular file; a named pipe, a device or a directory is refused

The spec is checked against the plugin catalog, which holds inbound-answer@1 and operator-reply@1.
The first refusal is the answer, in this order: the text is not one YAML document (Malformed); a string of
it holds a credential, a URL with a user name or a query, or a token prefix such as xoxb- or sk-
(SecretLiteral; the value is never repeated); the decoder refuses a value, the first in its one walk
of the document: format is not loom.agent/1 (UnknownFormat), a text member is empty or blank
(BlankText), a bearer_env is not an environment variable name (NotAVariableName; never repeated), a
port is outside 1 to 65535 (PortOutOfRange), an allow_paths entry is not a plain path
(NotAPlainPath), a deadline is not an RFC 3339 instant (NotAnInstant), or the document does not
decode otherwise (Malformed); the inner loop's protocol is not in the catalog, or
states are declared with no inner loop (UnknownProtocol); a state names an action its protocol lacks
(UnknownAction); a state, the outer loop or the channel names a source no binding declares
(UnboundSource); an http binding's method is not GET (HttpMethod); reply.send is a capability while
writes are none or undeclared (SendWithoutWrites); the channel allows no channel id
(EmptyChannelAllow). Nothing runs and nothing but the spec is read.

Exit status:
  0  serveable: standard output carries "checked <agent>: <n> states, <m> bindings, protocol <protocol>"
     (protocol none without loops)
  3  refused: standard error carries "refused: <reason> at <member>: <detail>"
  1  the file cannot be read
  2  the command line is not valid

b10x-loom agent serve

Host the agent a loom.agent/1 spec declares: poll its channel, answer each item in a governed turn, and send a reply only as the spec's writes admit

Usage: b10x-loom agent serve [OPTIONS] --spec <FILE>

Argument	Required	Default	Meaning
--spec <FILE>	yes	none	The loom.agent/1 document, YAML or JSON, in a regular file
--state <DIR>	no	none	The host's state directory: its cursors, record, cases, Suspensions, grants and send counter. One host holds it at a time. Without it, the spec's runtime.state_dir
--once	no	false	Run one cycle and stop
--catalog <PATH>	no	none	An llm catalog (llm.catalog/1 TOML) in a regular file, instead of the spec's models: --model and --classifier-model then each name a route alias of it
--model <ID>	no	none	The model each turn runs on: a name the spec's routes document serves, or with --catalog a route alias. By default the spec's agent role
--classifier-model <ID>	no	none	The model that classifies each item: a name the spec's routes document serves, or with --catalog a route alias. By default the spec's classifier role
--a2a-address <IP>	no	0.0.0.0	The address the A2A listener binds when the spec declares expose.a2a, on its port

The spec is checked as `agent check` does before anything runs. The host is the plugin host over
the spec: it polls the channel binding's channels that channel.allow lists (a message anywhere else is
no item), classifies each new item, runs a turn on the inner loop's protocol under the state whose
`when` names the item's intent, with the spec's capabilities as its authority, and records one line
per handled item in record.jsonl in the state directory. reply.send is a governed write of the recorded
proposal to the item's channel, at most writes.max_per_hour an hour (sends.jsonl). In writes.mode
approval a send is held: the turn ends proposed naming its commission, the case and the Suspension
stay in the state directory, and `b10x-loom approve <COMMISSION> reply.send --state <DIR>` grants it;
the host performs it at its next poll, or `agent resume` performs it now. writes.mode auto is not
served yet; none sends nothing.

The state directory is --state, or without it the spec's runtime.state_dir (a relative one is relative to the
working directory), so a program reading the same document, such as a delivery run, shares the root.

The models are the spec's `model` section (its routes document, relative to the spec, and the
`agent` and `classifier` roles), or with --catalog the route aliases --model and --classifier-model
name. With --once it runs one cycle and prints one line per proposal it recorded; without it, it
polls every poll_interval_seconds until SIGTERM or SIGINT (a second one exits 130 at once).

An http binding reads an https endpoint trusting the webpki roots and, when LOOM_HTTP_CA_FILE names a
PEM file, its certificates beside them (a cluster CA). The file is read once, before anything runs;
the host refuses to start, naming the variable and never printing the file, when it cannot be read,
holds more than 1048576 bytes, holds no certificate or holds any block a TLS client does not take as
a root (all or nothing: one such block refuses the whole file). Model calls, the connectors command
line and the A2A listener are not given these roots.

With expose.a2a the agent also answers A2A on --a2a-address and expose.a2a.port, beside the poll:
the agent card at /.well-known/agent-card.json, and at expose.a2a.path JSON-RPC SendMessage, one
turn on inbound-answer@1 answered with its record (nothing is sent through A2A), and GetTask. Every
request but GET /ready and GET /live needs `Authorization: Bearer` with the token LOOM_A2A_BEARER
holds (a trailing newline or blank is dropped); the host refuses to start without it. The
listener stops when the host does. A spec with expose.a2a and no channel polls nothing: the
listener is the host, until SIGTERM or SIGINT, and --once is refused. A spec with neither is
refused.

Exit status:
  0  the cycles ran
  1  the spec, the models, LOOM_HTTP_CA_FILE or the state directory cannot be used, or the last
     cycle's poll failed
  2  the command line is not valid
  3  the spec cannot be served
  130  a second SIGTERM or SIGINT ended it at once

b10x-loom agent run

Run one turn of a loom.agent/1 spec on a task text, record it as agent serve records an item, send only as the spec's writes admit, and exit with how the turn ended

Usage: b10x-loom agent run [OPTIONS] --spec <FILE>

Argument	Required	Default	Meaning
--spec <FILE>	yes	none	The loom.agent/1 document, YAML or JSON, in a regular file
--state <DIR>	no	none	The state directory: the record, cases, Suspensions, grants and send counter, as agent serve keeps them. One host holds it at a time. Without it, the spec's runtime.state_dir
--input <FILE>	no	none	The task text of the turn, in a regular UTF-8 file. Without it the run is refused (exit status 1)
--catalog <PATH>	no	none	An llm catalog (llm.catalog/1 TOML) in a regular file, instead of the spec's models: --model and --classifier-model then each name a route alias of it
--model <ID>	no	none	The model the turn runs on: a name the spec's routes document serves, or with --catalog a route alias. By default the spec's agent role
--classifier-model <ID>	no	none	The model that classifies the task text: a name the spec's routes document serves, or with --catalog a route alias. By default the spec's classifier role

The spec is checked as `agent check` does, then --input is read: a regular file of UTF-8 text, at
most 1048576 bytes, not empty or only whitespace. Both are decided before any model call, read or
record. The spec needs neither a channel nor expose.a2a: nothing is polled and no A2A is answered.

The text is one item, classified and answered in one governed turn as `agent serve` answers a polled
item: the state whose `when` names its intent is the projection, the spec's capabilities are the
authority and its inner loop's step_budget and model_budget bound the turn. The item's id is `run-`
and the run's instant, so each run is an item of its own. The turn is recorded as one line in
record.jsonl in the state directory, the item kept as handled, and one line per proposal is printed.
Standard error carries one line per step, before any other: `step <n>: <action> <outcome>[:
<reason>]; <s> steps and <m> model calls left`, the outcome performed, pending, refused, failed or
not_invoked, and `no action` when the model selected none.

When the channel binding declares a write, a proposed reply may be sent to the first channel of
channel.allow, as reply.send of a served turn: writes.mode auto sends it in the turn, approval holds it
for `b10x-loom approve` and `agent resume`, none sends nothing, and at most writes.max_per_hour sends
are made an hour (sends.jsonl). Without a write the turn runs on inbound-answer@1 and sends nothing.

The state directory is --state, or without it the spec's runtime.state_dir. The models are the spec's
`model` section, or with --catalog the route aliases --model and --classifier-model name.

Exit status:
  0  the turn answered: it proposed (and sent or held its reply), declined, or proposed a case
  4  the turn ended without an answer: stopped (a budget spent, no state for the intent) or unclassified
  3  refused: the spec cannot be served (standard error carries the refusal `agent check` gives), or
     the turn's send was refused (SendRefused, naming RateLimited, WritesNone, OutsideAllowList or the
     write's refusal); the turn is recorded
  1  --input is absent, cannot be read or holds no text; or the spec, the models, LOOM_HTTP_CA_FILE,
     the state directory or a service the turn needs cannot be used
  2  the command line is not valid

b10x-loom agent resume

Perform a held send after its approval, once

Usage: b10x-loom agent resume [OPTIONS] --spec <FILE> <COMMISSION>

Argument	Required	Default	Meaning
<COMMISSION>	yes	none	The commission whose held send was approved, as the record line names it
--spec <FILE>	yes	none	The loom.agent/1 document the host served
--state <DIR>	no	none	The host's state directory. Without it, the spec's runtime.state_dir

Performs the send the commission's Suspension holds, once, after `b10x-loom approve <COMMISSION>
reply.send --state <DIR>` wrote its grant: the write goes through the connectors command line with the
idempotency key derived from the admitted request and the grant file as its proof, the Suspension is
released, and the send is counted. A serving host performs granted sends itself at its next poll.

The state directory is --state, or without it the spec's runtime.state_dir.

Exit status:
  0  the send was performed; standard output says what Connectors answered
  1  the spec or a store cannot be used, or the resume failed
  2  the command line is not valid
  3  no send of the commission is held in the state directory
  4  the send is not granted yet; nothing was performed
  5  the resume was refused (in doubt, the case moved), or the send was refused; nothing was sent

b10x-loom agent stage-files

Copy the keys of a mounted Secret volume into a directory this user owns, the directory mode 0700 and each file 0600

Usage: b10x-loom agent stage-files --from <DIR> --to <DIR>

Argument	Required	Default	Meaning
--from <DIR>	yes	none	The mounted Secret volume
--to <DIR>	yes	none	The directory the keys are copied into

The kubelet owns a Secret volume's files, so a reader that refuses a file another user owns or that its
group or others may read refuses them. b10x-loom-operator runs this in the init container
stage-secret-files for spec.secretFiles. Each entry of --from whose name does not start with `..` and
that resolves to a regular file inside --from is copied, in name order, to --to/<name>, mode 0600, as
a new file (one left by an earlier run is replaced, never followed); --to is created when absent and
set to mode 0700, and must not be a link.

Exit status:
  0  the keys were staged; standard output says how many
  1  --from cannot be read, --to is not a directory, or a key cannot be copied
  2  the command line is not valid

b10x-loom agent prepare-dirs

Make each directory one this user owns with mode exactly 0700, keeping what it holds

Usage: b10x-loom agent prepare-dirs --dir <DIR>

Argument	Required	Default	Meaning
--dir <DIR>	yes	none	A directory to prepare; give one or more

Kubernetes makes an emptyDir's root mode 0777 (setgid with fsGroup), and a non-root container cannot
change it, so a reader that refuses a file under a directory its group or others may write refuses
every file there. b10x-loom-operator runs this in the init container prepare-writable-dirs of a
Command pod and mounts the directories at /tmp and HOME. Each --dir is created when absent, kept
with what it holds when present, and set to mode 0700 with setgid and sticky cleared; it must not
be a link, and only its owner can set its mode.

Exit status:
  0  every directory was prepared; standard output says how many
  1  a directory is a link, is not a directory, or cannot be made or set to 0700
  2  the command line is not valid

b10x-loom agent boundary

Serve the credential boundary of a credential-free agent pod: relay model, Connectors and git requests from loopback to their upstreams with a projected token the agent never holds

Usage: b10x-loom agent boundary [OPTIONS] <--model-upstream <URL>|--connectors-upstream <URL>|--git-upstream <URL>>

Argument	Required	Default	Meaning
--model-upstream <URL>	no	none	The model upstream (an llm gateway), a plain http:// URL; relayed on 127.0.0.1:8401
--model-token <FILE>	no	none	The file holding the model upstream's projected service-account token, read on every request
--connectors-upstream <URL>	no	none	The Connectors upstream, a plain http:// URL; relayed on 127.0.0.1:8402
--connectors-token <FILE>	no	none	The file holding the Connectors upstream's projected service-account token, read on every request
--operation <ID>	no	none	An operation POST /v1alpha2/invoke admits; give one or more
--git-upstream <URL>	no	none	The git smart-HTTP upstream, a plain http:// URL whose path is the base the repositories sit under; relayed on 127.0.0.1:8403
--git-token <FILE>	no	none	The file holding the git upstream's projected service-account token, read on every request
--repository <OWNER/REPO>	no	none	A repository the git relay serves, <owner>/<repo> without .git; give one or more

b10x-loom-operator runs this as the sidecar `boundary` of a pod whose LoomAgent declares
spec.boundary, as another user than the agent container. The agent holds no credential and calls the
boundary on loopback; the boundary holds only kubelet-projected service-account tokens, one file per
upstream. Each declared upstream gets one listener on 127.0.0.1, and nothing else is bound:
  8401  --model-upstream: any request under /v1/, the response streamed back
  8402  --connectors-upstream: GET /v1/describe and POST /v1alpha2/invoke, an invoke admitted only for
        an --operation (its body at most 65536 bytes, one JSON object naming its operation once)
  8403  --git-upstream: git smart-HTTP (info/refs, git-upload-pack, git-receive-pack) for each
        --repository
Each relayed request reads its token file again, so a rotation is picked up, drops the agent's
credential and hop-by-hop headers and adds `Authorization: Bearer <token>`; with no usable token it
answers 503 and sends nothing. Anything else is refused locally and never reaches the upstream.
Upstreams are plain http:// URLs. Standard error gets one line per request (service, method, path,
status); the token is never printed. SIGTERM or SIGINT ends it.

Exit status:
  0  SIGTERM or SIGINT ended it
  1  a port cannot be bound
  2  the command line is not valid: a relay group incomplete or none given, an upstream that is not a
     plain http:// URL (https, user information, a query or a fragment), or an operation or
     repository out of shape; the message names the flag, never its value

b10x-loom agent boundary-ready

Say whether every boundary port on 127.0.0.1 accepts a connection: the boundary's startup probe

Usage: b10x-loom agent boundary-ready --port <PORT>

Argument	Required	Default	Meaning
--port <PORT>	yes	none	A port on 127.0.0.1 that must accept a connection; give one or more

b10x-loom-operator runs this as the exec startup probe of the sidecar `boundary`, with one --port
per declared relay. Each port is tried on 127.0.0.1 for at most one second.

Exit status:
  0  every 127.0.0.1:<PORT> accepts a TCP connection
  1  one does not; standard error names it
  2  the command line is not valid

b10x-loom approve

Approve the request a commission's Suspension holds: write a grant into the state directory. Approval performs nothing; resume does

Usage: b10x-loom approve [OPTIONS] --state <DIR> <COMMISSION> <CAPABILITY>

Argument	Required	Default	Meaning
<COMMISSION>	yes	none	The commission whose Suspension is approved: the id its resume context and Suspension carry
<CAPABILITY>	yes	none	The capability approved; it must be the one the suspended request needs
--state <DIR>	yes	none	The state directory run --state kept the commission in. It must exist
--mandate <FILE>	no	none	The host-trusted Mandate file (loom.authority.MandateHost): also record a Mandate approval of the request, by the file's approver, in the state directory's approval log; the grant names it, and resume --mandate clears it through Mandate

Approval performs nothing. It reads the commission's Suspension in the state directory and
writes a grant (intake.routing.Grant) for the one request it holds, which `resume` reads; a later
approval of the commission's next Suspension replaces it. The capability must be the one the
suspended request needs, as `run` or `resume` named it when it stopped.

Only a stop line `stopped: ApprovalRequired (<action>)` of `run --state` or `resume` leaves a
Suspension to approve. `stopped: ApprovalRequired (<action>), nothing suspended` leaves none, and
`stopped: MergeHandedOff (<request>, HEAD <sha>)` says that HEAD was already handed off: a merge the
agent proposed again at it holds no Suspension, so approving it is refused NothingSuspended, and only
new work, a new HEAD, is approved again.

With --mandate FILE (loom.authority.MandateHost, a host-trusted JSON file), approval also records a
Mandate approval of the request in the state directory's approval log (mandate-approvals.jsonl): the
file's approver approves the capability on the case for the file's verified subject, expiring
approval_seconds later; the approver is neither the verified subject nor its actor. The grant names
it (mandate_approval), and only `resume --mandate` clears it: `resume` without --mandate refuses it.

Exit status:
  0   the grant is written
  10  NothingSuspended: the commission holds no Suspension
  11  InDoubt: the commission's Suspension is being resumed, so its request may have been performed
  19  OtherCapability: the suspended request needs another capability than the one given
  23  AlreadyHandedOff: the suspended repository.merge would hand off a HEAD the commission already handed off
  1   the state directory or the Mandate file cannot be used, or Mandate recorded no approval
  2   the command line is not valid

b10x-loom resume

Continue a commission's suspended run after its approval: perform the suspended request once, release the Suspension, and run on until the run stops

Usage: b10x-loom resume [OPTIONS] --state <DIR> <COMMISSION>

Argument	Required	Default	Meaning
<COMMISSION>	yes	none	The commission whose suspended run is continued
--state <DIR>	yes	none	The state directory run --state kept the commission in, and approve wrote its grant into. It must exist; the merge hand-off is recorded there
--mandate <FILE>	no	none	The host-trusted Mandate file (loom.authority.MandateHost): perform the request only when Mandate's check_with_approval clears and consumes the approval the grant names, keeping the consumption in the state directory's approval log first

The run is rebuilt from the commission's resume context: the same intent, route, workspace (validated
again), test command, step budget, confinement and agent model; the route is used only when the intent,
the protocol catalog and the context policy are still the ones it was accepted for. The workspace's HEAD
is reported to the case first, so a commit made since the Suspension is refused CaseMoved. The grant
`approve` wrote allows only the request the commission's Suspension holds, and only while it is held. A
granted repository.merge is performed as a merge hand-off: a record of the commission, the request, the
workspace and its HEAD (intake.routing.MergeHandoff, merge-<hex of the request id>.json in the state
directory), only at the HEAD the case holds and once per HEAD of a commission. No Git ref moves; merging
happens outside Loom. The request is performed once, the Suspension is released, and the run goes on as
`run` does. The model does not see the steps before the Suspension.

With --mandate FILE (loom.authority.MandateHost), the request is performed only when Mandate's
check_with_approval clears the approval the grant names (`approve --mandate`), for the file's verified
subject, the capability and the case; its consumption is appended to the state directory's approval
log before anything is performed. A grant naming no approval, an expired, consumed or foreign
approval, or any other Mandate refusal is NotGranted, and nothing is performed. Without --mandate, a
grant naming a Mandate approval (`approve --mandate`) is NotGranted and nothing is performed: only
Mandate clears it.

When the resumed run reaches its human gate again, its last line says what is left to approve:
  stopped: ApprovalRequired (<action>)                    a Suspension `approve` can approve
  stopped: ApprovalRequired (<action>), nothing suspended  nothing to approve
  stopped: MergeHandedOff (<request>, HEAD <sha>)          the case is at a HEAD this commission
                                                           already handed off; nothing to approve

Exit status:
  0   the resumed run reached its human gate again (ApprovalRequired, or MergeHandedOff)
  4   the resumed run reached its human gate holding no Suspension (ApprovalRequired, nothing suspended)
  3   the resumed run stopped for another reason (NothingAdmissible, StepBudget, NoLocalExecutor, ConfinementUnavailable)
  10  NothingSuspended: the commission holds no Suspension, or another resume took and released it first
  11  InDoubt: a resume took the Suspension and did not release it; its request is never performed again
  12  OtherRequest: the Suspension is now held for another request than the one revalidated
  13  OtherCommission: the Suspension or its run names another commission, case or run revision
  14  CaseMoved: the case is no longer at the revision the request was suspended at
  15  NotAdmitted: the current frontier refuses the request's action
  16  NotGranted: no grant allows the request, the grant names a Mandate approval and --mandate is
      not given, or with --mandate Mandate did not clear its approval
  17  NotPerformed: nothing performs the request's action
  18  RunNotSuspended: the run store does not hold the run suspended
  20  the suspension store could not be read; nothing was resumed
  21  the governor could not answer before the run resumed; nothing was resumed
  22  the run could not be resumed, the Suspension could not be taken or released, or the resumed
      loop stopped without a run outcome
  1   anything else failed: the state directory, the resume context, the workspace, the models
  2   the command line is not valid
Nothing is performed on any status from 10 to 21.