Reference
Every command
The whole command surface: every noun, its subcommands, and where each one is documented.
Saphan Studio is driven by one command, saphan. Every command below is
a noun: it names the thing you are acting on, and its subcommands name what
you are doing to it. Ask any of them for --help to get the same text this
page was built from.
This reference covers 61 commands, 104 subcommands and 487 command flags, plus the 10 global options listed at the bottom of this page.
Commands
| Command | What it does |
|---|---|
saphan actor | Signing actors: the workspace key identity and the actor registry |
saphan board | Board exports over the persisted fleet record |
saphan bridge | Bridge generation: instantiate a project command deck |
saphan build-orchestrate | Run the project's platform builds sequentially with emulator lifecycle and own-PID kill discipline |
saphan bus | Fleet bus: reconcile channel artifacts into the session registry |
saphan canon | Carry the canon a seat must obey — signed, deterministic, no git |
saphan capture | Sign and index one capture — the shared capture→sign→store→ACK primitive (STOP1_PLAN) |
saphan ceremony | Owner team-birth: mint the ROOT (paper) and the intermediate (device-born) keys |
saphan certify | Certify the current trunk tip at one immutable SHA |
saphan channel | Inspect channel documents in the store |
saphan checks | The track's deterministic-task catalog (build/test/lint/importcheck/plugin-compile) as proc-runs, never an LLM turn |
saphan claim | Atomically claim a stream for one actor |
saphan config | Mint and inspect ~/.saphan/config, the canonical identity file (config-mint) |
saphan confine-exec | Apply this host's filesystem confinement and exec the command (far-side confinement) |
saphan console | The owner's console surface: the master-admin credential behind /console |
saphan cost | Per-stream cost rollup from the record — one run or a sum of continuations |
saphan discover | Discover a workspace and propose its configuration |
saphan dispatch | Generate an executor-MD (five dispatch rules as refusing format invariants) |
saphan doc | Document contract validation (EXEC-STATUS-V1 and successors) |
saphan dry-run | Rehearse a write verb through its OWN rehearsal path, under a prefix a permission class can allow independently of the verb itself |
saphan egress-door | Serve this run's SOCKS5 egress door on a unix socket and run the command under it (far-side egress) |
saphan fleet | Fleet views over the session registry |
saphan gate | Record a HUMAN gate decision for a stream (the only fleet_gate writer, §3.2) |
saphan gates | Read the fleet_gate log with a per-row signature verdict (read-only, no database client) |
saphan golden-delivery | Copy artifacts into the goldens repo per stream (refusing unmapped/ambiguous streams) + README scaffold |
saphan grammar | Read generated wire grammars carried by this binary |
saphan hook | Install repository admission hooks |
saphan identity | Seed, edit and project the signed identity store (import | export | enroll | revoke) |
saphan init | Grant each backend's measured-minimum permissions at <workspace>/.claude/settings.json (interactive; law #35) |
saphan knowledge | The seat knowledge bundle carried inside this binary: what it holds, and whether it is intact |
saphan laws | The LAWS MANIFEST: ratified Class-L standing-law documents |
saphan ledger | Show or export the cost ledger |
saphan lib | Library utilities |
saphan machine | The machine registry: admitted hosts, slots, and their executor identities |
saphan merge | Conflict-probe and land a gated stream in one serialized engine act |
saphan order | Order sidecars: sign a document under a delegate (or root) key |
saphan owner-block-discharge | An owner act that writes off R21's debt (and any open owner-block tile) on a stream with no live leg, with a recorded ground |
saphan owner-block-settle | Land a well-formed owner-block-v1 envelope into the record with no spawn, settling R21's debt |
saphan pr-preflight | Run PR pre-flight checks (branch, status, log, behind-base, submodule, build, scoped-test) and emit a STOP list |
saphan refusal-class | Ratify a refusal class, and read every class's ratification state |
saphan return | Bring a stream's status, branch, and review artifacts home, with proof |
saphan review | Gate a STOP-2 return structurally and parameterize the Review prompt |
saphan route | Answer the routing decision for a step; optionally request a model-capable client context |
saphan run | Spawn one mandated run through the engine's spawn door (runner-v1; operator verb) |
saphan say | Compose a validated owner-block-v1 alert, open item, or explicit none |
saphan seat | A seat's own acts: what the record says about its credential, and the repair that follows |
saphan serve | Serve the embedded web configurator |
saphan server | Serve the record's read-only projection: MCP (stdio + HTTP), static HTML, and the /console shell |
saphan serverd | Run the metering daemon: lifecycle skeleton + manual trigger (order serverd-w1 P2) |
saphan show | Return a registered order's exact bytes from its recorded commit |
saphan task | Generate task specs from genre manifests |
saphan teardown | Archive a stream's channel files, then record the teardown gate accept (one verb, refusal-first) |
saphan trust | The signed-instruction-provenance root: mint, delegate, and health-check |
saphan verify | Verify a registered order reference or a signed instruction path |
saphan verify-affected | Advisory: run the suite for changed packages and their reverse dependencies |
saphan verify-deploy | Verify a deploy: before-digest, build, digest-diff, rollout, live HTTP proof |
saphan verify-stream | Deterministic, zero-LLM verification of a stream's worktree (build/vet/test/gofmt) |
saphan verify-union | Advisory: run the suite on the branch merged onto current trunk in a detached worktree |
saphan version | Print build information |
saphan wave | Wave views: branch / gate / merge state of the fleet's streams |
saphan workspace | Per-machine workspace registry (Phase-1): the workspaces this machine's daemon serves |
Global options
These may be given to any command.
| Option | Type | Default | Description |
|---|---|---|---|
--color | string | auto | color output: auto|always|never |
--json | bool | false | machine-readable output with stable field names |
--merged-ref | string | unset | merged-probe truth ref (default: each stream's base ref, local form — adr-0018) |
--output-format | string | unset | output format: text|json (default: text; --json is a permanent alias for --output-format json) |
--project | string | unset | project within the workspace |
--state-dir | string | unset | engine state dir (default: <workspace>/.saphan/state) |
--system | bool | false | resolve daemon paths for a system-wide install (FHS /etc,/run,/var); default is a per-user install (§B0.2 — explicit flag beats euid auto-detect) |
--text | bool | false | force plain text output (no color), regardless of TTY detection |
--verbose | bool | false | verbose output, incl. config provenance |
--workspace | string | unset | workspace root (default: walk up from CWD) |