CLI

The CLI validates trusted configuration and manages bounded local runs. Install the loopwright command on your laptop first via Installation , then use it to prepare, inspect, resume, or reconcile work and audit capability closure.

Contents

• Step 1: Generate drafts
• Step 2: Approve bindings
• Step 3: Check configuration
• Step 4: Run work
• Step 5: Inspect recovery
• Step 6: Audit closure
• Command reference
• Exit codes

Step 1: Generate drafts

loopwright init --directory ./loopwright-config

The command creates controller.draft.yaml, registry.draft.yaml, and README.draft.md for Managed Controller workflows (for a complete populated setup, follow Managed Controller ). Note that loopwright init does not generate .loopwright/taskpack.yaml; to bootstrap or migrate a repository Taskpack interactively, use the llms.txt bootstrap prompt .

apiVersion: loopwright.dev/v1alpha1
kind: TrustedRegistry
metadata:
  name: operator-draft
spec:
  version: 1
  resourceVersion: context-draft
  handlers: []
  roleProfiles: []
  runtimeProfiles: []
  resources: []
  credentialBindings: []
  environmentBindings: []

• Draft: The excerpt shows the generated registry; controller.draft.yaml contains REVIEW_REQUIRED placeholders that must be replaced before execution.
• Authority: Keep approved registry bytes and run state outside the checkout.
• Context: proven_bound is the strict default; estimated guards require explicit immutable opt-in.

Step 2: Approve bindings

Review the task scope, exact installed profiles, handlers, credentials, and registry bytes. Replace every placeholder and calculate the SHA-256 of the final approved registry. The generated digest matches only the initial draft bytes.

Step 3: Check configuration

loopwright check --config CONFIG --registry REGISTRY --registry-sha256 DIGEST --json
loopwright run --dry-run --config CONFIG --registry REGISTRY --registry-sha256 DIGEST --json

Both commands validate and compile statically. Neither proves execution readiness, provider availability, or host qualification.

Step 4: Run work

loopwright run --config CONFIG --registry REGISTRY --registry-sha256 DIGEST --repo REPO --run-root TRUSTED_ROOT --run-id demo
loopwright resume --config CONFIG --registry REGISTRY --registry-sha256 DIGEST --repo REPO --run-root TRUSTED_ROOT --run-id demo

Use resume for an existing run with the same trusted identity and bindings. Do not replay an uncertain external effect.

run, resume, and reconcile accept --output-format <csv> with json, github-step-summary, markdown, and text. Use --step-summary-file <path> to select the summary file. With --json, stdout stays pure NDJSON. The CLI does not emit selected Markdown or text reports in this mode. Use --step-summary-file to write a separate Markdown summary. Without --json, selected reports go to stdout.

Step 5: Inspect recovery

loopwright status --run-root TRUSTED_ROOT --run-id demo --json
loopwright inspect --run-root TRUSTED_ROOT --run-id demo --output INSPECTION_DIR --json
loopwright reconcile --config CONFIG --registry REGISTRY --registry-sha256 DIGEST --repo REPO --run-root TRUSTED_ROOT --run-id demo --receipt RECEIPT --json

Inspect state and evidence before recovery. Reconcile an unknown external outcome with its matching authenticated receipt; absent evidence stays unknown.

Step 6: Audit closure

loopwright closure --verify-failures --json

Closure exits 0 for a valid report, 3 for falsification or unsupported capability, 4 for failure-matrix failure, and 8 for integrity failure. JSON output uses versioned envelopes with kind, sequence, run identity, and data.

Command reference

loopwright app-serve --config github-app.yaml --repo . --json

Set spec.listen.enabled: true first. The command exits 2 for disabled or invalid configuration, 130 on SIGINT, and 143 on SIGTERM. See GitHub App for configuration and host requirements.

Exit codes