cmd/

Command apply-catalog-delta verifies a signed delta against an exact base generation and writes the next immutable catalog.

Command asor-projection-probe projects an ASOR delegation chain (draft-asor-wimse-agent-delegation-chain-02) onto CLC grants and runs the chain authorization.

Command authorize-chain-vectors-run reads the CLC-D §13.11 AuthorizeWithChain vectors (rev CLC-1.13) and runs them against the semantics package.

Command constraint-union-vectors-run reads the CLC-v1 §7.1 ConstraintUnion vectors (rev CLC-1.12) and runs them against the semantics package.

Command contains-crosswalk-run runs the CLC-D containment cross-walk corpus: a native representation from another ecosystem is mapped into a CLC grant by a pinned profile on each side, and semantics.Contains decides the (parent, child) pair.

Command contains-vectors-run reads CLC-D containment vectors (draft-wei-clc-ext-00 §7) and runs them against semantics.Contains.

Command crosswalk-vectors-run runs the cross-walk corpus: native capability representations from other ecosystems mapped into CLC grants by a pinned profile, decided by the same CLC core.

Command emilia-projection-probe maps EMILIA's evidence-side objects into the CLC evidence projection and evaluates them, so the mapping is tested rather than asserted.

Command evidence-vectors-run runs the CLC-E evidence-side conformance corpus (capability/data/_vectors/clc-v1/evidence-vectors.json) and exits non-zero on any mismatch, mirroring cmd/vectors-run for the authorization side.

extension-parity-run emits the Go result for the shared three-language canonical parity fixture.

gen-backfill fills params_schema_digest into capability data files.

Command gen-catalog validates one capability catalog and writes its deterministic JCS form.

Command gen-rule turns a validated capability claims file (the minimal set produced by gen-capability and consumed by `aic issue --from-claims`) into rule files for the execution layer.

Command gilda-projection-probe projects an audit record from draft-gilda-wimse-agent-audit-record-02 onto the CLC result vocabulary.

Command mode-lattice-vectors-run runs the AIC-JWT DA delegation-mode pre-check corpus (core §13.4.5).

Command oasnt-projection-probe projects an OASNT approval token (draft-thallapelly-oasnt-02) onto the CLC evidence projection.

Command param-bounds-meet-vectors-run reads the CLC-v1 §6.6 BoundMeet vectors (rev CLC-1.14) and runs them against the semantics package.

Command param-bounds-vectors-run reads the CLC-v1 §6.5 extended parameter bound vectors (rev CLC-1.10) and runs them against the semantics package.

Command rar-projection-probe projects OAuth Rich Authorization Requests (RFC 9396 authorization_details) onto CLC grants and evaluates operations.

Command reason-collapse-vectors-run validates the CLC-D reason-code collapse policy vectors (capability-language-core-v1 §13.5) and then cross-checks them against the relation-level corpora: every code the policy declares non-collapsible MUST still be surfaced by the containment and cross-walk corpora, so "stays distinguishable" is observable by a third party, not just asserted in prose (CL 13.10.6).

Command record turns a CLC decision into a Decision Record, and checks one back.

Command resolve-vectors-run reads the CLC-v1 §8.5 Resolve vectors (rev CLC-1.11) and runs them against the semantics package.

Command scheme-admin is the deployer-side confirmation path for varwof/scheme-admin-v1.

Command sign-catalog produces the detached PKCS#7 signature for one catalog file.

Command size-report prints the byte budget of the evidence artifacts this module produces, so a change to a record, envelope or challenge shape can be compared against the numbers recorded in the wire-size budget note that accompanies the language revision (capability `docs/`), so the figures stay reviewable next to the specification they belong to.

Command vectors-run reads CLC-v1 test vectors and runs them against the semantics package.

Command verify-catalog is the deployer admission path for a capability catalog.