cmd/

Command agentos is a compatibility shim for the AgentOS → Fenced rename.

Command fenced is the stable developer and operator workflow.

Command fenced-conformance certifies a running third-party adapter through the public Runtime Interface only.

Command fenced-orchestrator runs the durable workflow orchestrator: it decides which workflow steps execute when and creates ordinary Tasks for them.

Command fenced-pkg is the CI-facing Agent Package tool (ADR-010): it generates package-signing keys, signs canonical manifests, and verifies signed packages against a trust registry.

Command fenced-projector consumes canonical store events from JetStream and applies them to OpenSearch search projections.

Command fenced-svid generates the X.509-SVID identity material for the Secure Runtime boundary (ADR-011): a self-signed SPIFFE CA, a control plane SVID (with loopback IP SAN), and one worker SVID per runtime instance.

Package mtlsutil shares the mTLS client credential construction between the runtime worker commands (ADR-011 identity boundary).