saphan dry-run
Rehearses a command that would change the record, without making the change: saphan dry-run <command> [args...] runs the same checks the real command runs and shows what it would do, or the refusal it
Rehearses a command that would change the record, without making the change: saphan dry-run <command> [args...] runs the same checks the real command runs and shows what it would do, or the refusal it would print. Because it is a command prefix, a permission allowlist can permit saphan dry-run * while still denying the real commands.
It works only for commands that have a rehearsal of their own, among them gate, gate batch, accept, merge, land, teardown, teardown batch, claim --release, closure redrive, bridge init, bridge commit, round declare, round retip, seat auth-performed, refusal-class ratify, canon send, trust gate-epoch propose and the machine registry changes. Any other command, and any name that is not a command, is refused by name and is never run for real. A rehearsal asks for no owner code and never writes the act itself; some rehearsals, such as those of gate and teardown, still read fresh agent activity into the record first, as the real command does.
Global options apply to every command — see Every command.
saphan docs
Renders readable documents from a git checkout of your record documents: one train's chapter, or the whole body of work.
saphan egress-door
Runs one agent's egress door on a remote machine: it opens a SOCKS5 proxy on a unix socket that judges every outbound connection against the run's egress policy, runs the given command as its child, a