admin
temper admin
Administer the deployment — system settings, principals, machine clients, connections, and subscriptions
Usage: temper admin [OPTIONS] <COMMAND>
Commands:
settings Show system settings, or update them when any flag is provided
promote Promote a profile to system admin: grants principal-governance and, if needed, approved standing. Also adds an `owner` row on a team (defaults to the gating team) as a side effect
demote Demote a system admin — revoke its governance grant (the manual twin of `promote`)
access Admit, revoke, deactivate, or reactivate a principal's system access
requests Review pending join requests
reviews Read and close reconsideration requests from revoked principals
profiles The operator directory: who exists in this deployment, and their state. Lists denied principals (the default `needs-access` view) and resolves an email to a state card — the bridge into the strict-UUID admin acts
erasure Erase a resource or a principal, or scrub a resource's block history or one of its fields. Surveys by default; --execute acts. `retention` sets what a principal erasure keeps
ledger Read the admin ledger: who granted what, to whom, and when
saml SAML provisioning: generate keys + emit the consistent env bundle and SQL (operator tooling)
machine Register and rotate machine (client_credentials) principals
slack Administer Slack account links
team Administer teams: the acts only a system admin takes
connection Provision connections — temper's authed link to a remote system (GitHub, Linear)
subscription Manage subscriptions — a team/context/cogmap subscribes to a connection's events
reembed Re-embed chunks whose vectors were produced by an older model (the drain does the work)
reblock Run one bounded, resumable corpus re-blocking step: re-block resources under the current chunking policy
help Print this message or the help of the given subcommand(s)
Options:
--vault <VAULT> Path to vault (overrides TEMPER_VAULT and auto-detection)
--format <FORMAT> Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--embed-threads <N> ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR> Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
-h, --help Print helptemper admin settings
Show system settings, or update them when any flag is provided
Usage: temper admin settings [OPTIONS]
Options:
--gating-team <GATING_TEAM_SLUG> Gating team slug recorded in instance settings. Ownership of this team does NOT by itself confer system-admin: `is_system_admin` reads the principal-governance grant and nothing else
--vault <VAULT> Path to vault (overrides TEMPER_VAULT and auto-detection)
--format <FORMAT> Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--instance-name <INSTANCE_NAME> Human-facing instance name
--embed-threads <N> ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--terms-version <TERMS_VERSION> Terms-of-service version label
--color <COLOR> Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
--terms-uri <TERMS_RESOURCE_URI> Terms-of-service resource URI
-h, --help Print helptemper admin promote
Promote a profile to system admin: grants principal-governance and, if needed, approved standing. Also adds an `owner` row on a team (defaults to the gating team) as a side effect
Usage: temper admin promote [OPTIONS] <PROFILE>
Arguments:
<PROFILE> Profile ID (UUID) to promote
Options:
--team <TEAM> Team ref for the side-effect `owner` row (`+slug`, bare slug, or UUID); defaults to the gating team. Not what confers admin
--vault <VAULT> Path to vault (overrides TEMPER_VAULT and auto-detection)
--format <FORMAT> Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--embed-threads <N> ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR> Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
-h, --help Print helptemper admin demote
Demote a system admin — revoke its governance grant (the manual twin of `promote`)
Usage: temper admin demote [OPTIONS] <PROFILE>
Arguments:
<PROFILE> Profile ID (UUID) to demote
Options:
--vault <VAULT> Path to vault (overrides TEMPER_VAULT and auto-detection)
--format <FORMAT> Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--embed-threads <N> ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR> Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
-h, --help Print helptemper admin access
Admit, revoke, deactivate, or reactivate a principal's system access
Usage: temper admin access [OPTIONS] <COMMAND>
Commands:
approve Admit a principal directly (legal from denied, revoked, or requested)
revoke Revoke a principal's admission (legal only from approved)
deactivate Deactivate a principal (legal from any live state)
reactivate Reactivate a deactivated principal, restoring its prior standing
reconcile-auto-join Converge every auto-join team's roster to the standing-approved humans (never machines)
help Print this message or the help of the given subcommand(s)
Options:
--vault <VAULT> Path to vault (overrides TEMPER_VAULT and auto-detection)
--format <FORMAT> Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--embed-threads <N> ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR> Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
-h, --help Print helptemper admin access approve
Admit a principal directly (legal from denied, revoked, or requested)
Usage: temper admin access approve [OPTIONS] <PROFILE>
Arguments:
<PROFILE> Profile ID (UUID) to approve
Options:
--vault <VAULT> Path to vault (overrides TEMPER_VAULT and auto-detection)
--format <FORMAT> Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--embed-threads <N> ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR> Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
-h, --help Print helptemper admin access revoke
Revoke a principal's admission (legal only from approved)
Usage: temper admin access revoke [OPTIONS] --reason <REASON> <PROFILE>
Arguments:
<PROFILE> Profile ID (UUID) to revoke
Options:
--reason <REASON> Why — recorded on the ledger; a later review's reviewer needs it
--vault <VAULT> Path to vault (overrides TEMPER_VAULT and auto-detection)
--format <FORMAT> Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--embed-threads <N> ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR> Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
-h, --help Print helptemper admin access deactivate
Deactivate a principal (legal from any live state)
Usage: temper admin access deactivate [OPTIONS] <PROFILE>
Arguments:
<PROFILE> Profile ID (UUID) to deactivate
Options:
--vault <VAULT> Path to vault (overrides TEMPER_VAULT and auto-detection)
--format <FORMAT> Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--embed-threads <N> ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR> Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
-h, --help Print helptemper admin access reactivate
Reactivate a deactivated principal, restoring its prior standing
Usage: temper admin access reactivate [OPTIONS] <PROFILE>
Arguments:
<PROFILE> Profile ID (UUID) to reactivate
Options:
--vault <VAULT> Path to vault (overrides TEMPER_VAULT and auto-detection)
--format <FORMAT> Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--embed-threads <N> ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR> Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
-h, --help Print helptemper admin access reconcile-auto-join
Converge every auto-join team's roster to the standing-approved humans (never machines)
Repairs an instance that drifted while enrollment lived only on the request-review door: profiles approved out-of-band were absent from the `everyone` pool. Prints the outcome in the output format: the (team, profile) pairs it added, empty on a converged instance. Approved machine principals enroll like any other profile, so on a drifted instance a reconcile widens machine read reach — the report is the review artifact. On a team that also carries a SAML group mapping, the native rows this writes pre-empt later IdP role assertions for that pair (native-wins-skip); the verb warns when its report touches such teams.
Usage: temper admin access reconcile-auto-join [OPTIONS]
Options:
--vault <VAULT>
Path to vault (overrides TEMPER_VAULT and auto-detection)
--format <FORMAT>
Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--embed-threads <N>
ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR>
Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
-h, --help
Print help (see a summary with '-h')temper admin requests
Review pending join requests
Usage: temper admin requests [OPTIONS] <COMMAND>
Commands:
list List pending join requests for the gating team
review Approve or reject a join request
help Print this message or the help of the given subcommand(s)
Options:
--vault <VAULT> Path to vault (overrides TEMPER_VAULT and auto-detection)
--format <FORMAT> Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--embed-threads <N> ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR> Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
-h, --help Print helptemper admin requests list
List pending join requests for the gating team
Usage: temper admin requests list [OPTIONS]
Options:
--vault <VAULT> Path to vault (overrides TEMPER_VAULT and auto-detection)
--format <FORMAT> Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--embed-threads <N> ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR> Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
-h, --help Print helptemper admin requests review
Approve or reject a join request
Usage: temper admin requests review [OPTIONS] <ID>
Arguments:
<ID> Join request ID (UUID)
Options:
--approve Approve the request
--vault <VAULT> Path to vault (overrides TEMPER_VAULT and auto-detection)
--format <FORMAT> Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--reject Reject the request
--embed-threads <N> ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--note <NOTE> Optional decision note
--color <COLOR> Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
-h, --help Print helptemper admin reviews
Read and close reconsideration requests from revoked principals
Usage: temper admin reviews [OPTIONS] <COMMAND>
Commands:
list List undecided reconsideration requests, oldest first
close Record that a reconsideration was handled (grants nothing)
help Print this message or the help of the given subcommand(s)
Options:
--vault <VAULT> Path to vault (overrides TEMPER_VAULT and auto-detection)
--format <FORMAT> Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--embed-threads <N> ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR> Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
-h, --help Print helptemper admin reviews list
List undecided reconsideration requests, oldest first
Usage: temper admin reviews list [OPTIONS]
Options:
--vault <VAULT> Path to vault (overrides TEMPER_VAULT and auto-detection)
--format <FORMAT> Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--embed-threads <N> ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR> Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
-h, --help Print helptemper admin reviews close
Record that a reconsideration was handled (grants nothing)
Usage: temper admin reviews close [OPTIONS] <ID>
Arguments:
<ID> Review request ID (UUID)
Options:
--note <NOTE> Optional decision note, recorded against the review
--vault <VAULT> Path to vault (overrides TEMPER_VAULT and auto-detection)
--format <FORMAT> Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--embed-threads <N> ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR> Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
-h, --help Print helptemper admin profiles
The operator directory: who exists in this deployment, and their state. Lists denied principals (the default `needs-access` view) and resolves an email to a state card — the bridge into the strict-UUID admin acts
Usage: temper admin profiles [OPTIONS] <COMMAND>
Commands:
list List the operator directory. The default filter is `needs-access` — every non-approved admission state INCLUDING no standing row, i.e. the work queue of principals who lack access
show Show one principal's state card — by UUID, or by exact verified email. The card names the existing enablement commands; it never carries invitation tokens
help Print this message or the help of the given subcommand(s)
Options:
--vault <VAULT> Path to vault (overrides TEMPER_VAULT and auto-detection)
--format <FORMAT> Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--embed-threads <N> ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR> Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
-h, --help Print helptemper admin profiles list
List the operator directory. The default filter is `needs-access` — every non-approved admission state INCLUDING no standing row, i.e. the work queue of principals who lack access
Usage: temper admin profiles list [OPTIONS]
Options:
--standing <STANDING>
Filter by admission state: denied|requested|approved|revoked|deactivated|needs-access|all. Default `needs-access`; a principal with no standing row renders `denied`
--vault <VAULT>
Path to vault (overrides TEMPER_VAULT and auto-detection)
--email-contains <EMAIL_CONTAINS>
Literal case-insensitive substring over verified emails (`%`, `_` and `\` have no wildcard meaning). Rows carry `matched_email` — why this person was enumerated
--format <FORMAT>
Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--embed-threads <N>
ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--team <TEAM>
Restrict to members of this team (slug or UUID)
--color <COLOR>
Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
--limit <LIMIT>
Page size (server clamps: default 50, max 200)
--offset <OFFSET>
Page offset (server clamps: floor 0, cap 10000)
-h, --help
Print helptemper admin profiles show
Show one principal's state card — by UUID, or by exact verified email. The card names the existing enablement commands; it never carries invitation tokens
Usage: temper admin profiles show [OPTIONS] [PROFILE]
Arguments:
[PROFILE] Profile ID (UUID). Omit when resolving --email instead
Options:
--email <EMAIL> Exact verified email — the server resolves it to the single matching card. Zero matches → not found; two or more profiles verified-own the address → not found, with the collision named. The substring filter never resolves
--vault <VAULT> Path to vault (overrides TEMPER_VAULT and auto-detection)
--format <FORMAT> Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--embed-threads <N> ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR> Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
-h, --help Print helptemper admin erasure
Erase a resource or a principal, or scrub a resource's block history or one of its fields. Surveys by default; --execute acts. `retention` sets what a principal erasure keeps
Usage: temper admin erasure [OPTIONS] <COMMAND>
Commands:
retention The deployment's retention policy: what a person erasure keeps, by category, each with a stated basis and period. Empty by default, and the act then keeps nothing. Only free text and replay evidence can be kept; identifiers and credentials cannot
resource Erase a resource. The survey counts the blocks, revisions, chunks, artifacts and edges the act would reach, and names what it would leave as remainder
principal Erase a principal, named by its pseudonym UUID
block-history Scrub the revision history of named blocks of a resource
field Scrub the history of one field of a resource (its title, its origin URI, or a property family) while the resource survives. With no --field, list the fields and property families to choose from: handles, counts, dates, profile ids and the sensitivity sweep's flags, never a key or a value. Today's value is kept unless --clear says it is part of the leak
help Print this message or the help of the given subcommand(s)
Options:
--vault <VAULT> Path to vault (overrides TEMPER_VAULT and auto-detection)
--format <FORMAT> Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--embed-threads <N> ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR> Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
-h, --help Print helptemper admin erasure retention
The deployment's retention policy: what a person erasure keeps, by category, each with a stated basis and period. Empty by default, and the act then keeps nothing. Only free text and replay evidence can be kept; identifiers and credentials cannot
Usage: temper admin erasure retention [OPTIONS] <COMMAND>
Commands:
list List the categories a person erasure keeps
set Keep a category, replacing the category's existing policy. The erasure record names it `retained under policy <name>`. Nothing deletes kept data when the period ends
remove Stop keeping a category
help Print this message or the help of the given subcommand(s)
Options:
--vault <VAULT> Path to vault (overrides TEMPER_VAULT and auto-detection)
--format <FORMAT> Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--embed-threads <N> ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR> Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
-h, --help Print helptemper admin erasure retention list
List the categories a person erasure keeps
Usage: temper admin erasure retention list [OPTIONS]
Options:
--vault <VAULT> Path to vault (overrides TEMPER_VAULT and auto-detection)
--format <FORMAT> Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--embed-threads <N> ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR> Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
-h, --help Print helptemper admin erasure retention set
Keep a category, replacing the category's existing policy. The erasure record names it `retained under policy <name>`. Nothing deletes kept data when the period ends
Usage: temper admin erasure retention set [OPTIONS] --name <NAME> --basis <BASIS> --period <PERIOD> <CATEGORY>
Arguments:
<CATEGORY> The category to keep [possible values: standing-reasons, governance-reasons, join-request-notes, review-request-notes, credential-replay-evidence, erasure-refusal-details]
Options:
--name <NAME> The policy's name: a slug (lower-case letters, digits, hyphens)
--vault <VAULT> Path to vault (overrides TEMPER_VAULT and auto-detection)
--basis <BASIS> The stated basis, e.g. "GDPR 17(3)(e) / CCPA 105(d)(1)"
--format <FORMAT> Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--embed-threads <N> ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--period <PERIOD> The period, as an interval, e.g. "1 year" or "90 days"
--color <COLOR> Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
-h, --help Print helptemper admin erasure retention remove
Stop keeping a category
Usage: temper admin erasure retention remove [OPTIONS] <CATEGORY>
Arguments:
<CATEGORY> The category to stop keeping [possible values: standing-reasons, governance-reasons, join-request-notes, review-request-notes, credential-replay-evidence, erasure-refusal-details]
Options:
--vault <VAULT> Path to vault (overrides TEMPER_VAULT and auto-detection)
--format <FORMAT> Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--embed-threads <N> ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR> Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
-h, --help Print helptemper admin erasure resource
Erase a resource. The survey counts the blocks, revisions, chunks, artifacts and edges the act would reach, and names what it would leave as remainder
Usage: temper admin erasure resource [OPTIONS] <RESOURCE>
Arguments:
<RESOURCE> The resource (UUID or decorated ref)
Options:
--also-strike-blob <ALSO_STRIKE_BLOBS>
A related blob to strike with the resource; it must be in the survey's remainder. Repeatable; only with --execute
--vault <VAULT>
Path to vault (overrides TEMPER_VAULT and auto-detection)
--execute
Erase the resource. Without it, the command only surveys
--format <FORMAT>
Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--embed-threads <N>
ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR>
Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
-h, --help
Print helptemper admin erasure principal
Erase a principal, named by its pseudonym UUID
Usage: temper admin erasure principal [OPTIONS] <SUBJECT>
Arguments:
<SUBJECT> The principal, as its pseudonym UUID
Options:
--request-reference <REQUEST_REFERENCE>
The operator's opaque request reference (the DSAR record's UUID). Required with --execute; a survey takes none
--vault <VAULT>
Path to vault (overrides TEMPER_VAULT and auto-detection)
--execute
Erase the principal. Without it, the command only surveys
--format <FORMAT>
Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--embed-threads <N>
ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR>
Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
-h, --help
Print helptemper admin erasure block-history
Scrub the revision history of named blocks of a resource
Usage: temper admin erasure block-history [OPTIONS] --block <BLOCKS> <RESOURCE>
Arguments:
<RESOURCE> The resource (UUID or decorated ref)
Options:
--block <BLOCKS> A block of the resource whose history is scrubbed. Repeatable; at least one
--vault <VAULT> Path to vault (overrides TEMPER_VAULT and auto-detection)
--execute Scrub the history. Without it, the command only surveys
--format <FORMAT> Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--embed-threads <N> ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR> Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
-h, --help Print helptemper admin erasure field
Scrub the history of one field of a resource (its title, its origin URI, or a property family) while the resource survives. With no --field, list the fields and property families to choose from: handles, counts, dates, profile ids and the sensitivity sweep's flags, never a key or a value. Today's value is kept unless --clear says it is part of the leak
Usage: temper admin erasure field [OPTIONS] <RESOURCE>
Arguments:
<RESOURCE> The resource (UUID or decorated ref)
Options:
--field <FIELD> The field: title, origin_uri, property (with --family) or properties (every family's prior history; never cleared). Without it, the command lists the families [possible values: title, origin_uri, property, properties]
--vault <VAULT> Path to vault (overrides TEMPER_VAULT and auto-detection)
--family <FAMILY> The property family's handle, from the listing. Only with --field property
--format <FORMAT> Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--clear Today's value is part of the leak: clear it first, then redact every value the field held. Without it, today's value is kept and only earlier values are redacted
--embed-threads <N> ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR> Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
--execute Scrub the field. Without it, the command only surveys
-h, --help Print helptemper admin ledger
Read the admin ledger: who granted what, to whom, and when
Exactly one axis. `--subject` asks what was done TO a thing; `--actor` asks what a principal DID. A refusal is a 404 by design — on this surface "you may not read that" and "there is nothing there" are deliberately indistinguishable.
Usage: temper admin ledger [OPTIONS]
Options:
--subject <SUBJECT>
Subject axis: `<kind>:<uuid>`, e.g. `kb_resources:0199c3f1-...`
--vault <VAULT>
Path to vault (overrides TEMPER_VAULT and auto-detection)
--actor <ACTOR>
Actor axis: a profile UUID. Your own acts are always readable; another's is an audit and requires admin
--format <FORMAT>
Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--embed-threads <N>
ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--limit <LIMIT>
Page size (server clamps to 200)
--color <COLOR>
Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
--offset <OFFSET>
-h, --help
Print help (see a summary with '-h')temper admin saml
SAML provisioning: generate keys + emit the consistent env bundle and SQL (operator tooling)
Usage: temper admin saml [OPTIONS] <COMMAND>
Commands:
provision Generate the AS signing key + reconcile secret and emit the env bundle + kb_saml_idp SQL
map-group Map an IdP group to a role on a team (a system admin's act, recorded on the admin ledger)
unmap-group Remove an IdP group's mapping onto a team (a system admin's act, recorded on the admin ledger). Memberships the mapping already conferred are left in place: the IdP reconcile removes those no remaining mapping confers, at each member's next login
verify Verify a provisioned instance: AS metadata reachable, caller is a system admin (governance grant + approved standing), and — with --db — one active kb_saml_idp row
help Print this message or the help of the given subcommand(s)
Options:
--vault <VAULT> Path to vault (overrides TEMPER_VAULT and auto-detection)
--format <FORMAT> Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--embed-threads <N> ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR> Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
-h, --help Print helptemper admin saml provision
Generate the AS signing key + reconcile secret and emit the env bundle + kb_saml_idp SQL.
Interactive by default; pass --no-interactive with the flags below for scripted runs. Emits to stdout unless --env-out / --sql-out are given; --apply runs the SQL via psql.
Usage: temper admin saml provision [OPTIONS]
Options:
--no-interactive
--vault <VAULT>
Path to vault (overrides TEMPER_VAULT and auto-detection)
--format <FORMAT>
Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--instance-url <INSTANCE_URL>
--api-origin <API_ORIGIN>
API origin the AS calls for reconcile (defaults to --instance-url)
--embed-threads <N>
ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR>
Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
--idp-key <IDP_KEY>
--idp-cert-file <IDP_CERT_FILE>
Path to the IdP signing certificate (PEM)
--idp-sso-url <IDP_SSO_URL>
--idp-entity-id <IDP_ENTITY_ID>
--nameid-format <NAMEID_FORMAT>
[default: urn:oasis:names:tc:SAML:2.0:nameid-format:persistent]
--email-attr <EMAIL_ATTR>
[default: email]
--stable-id-attr <STABLE_ID_ATTR>
[default: uid]
--groups-attr <GROUPS_ATTR>
Assertion attribute carrying the group list (omit for authn-only)
--kid <KID>
Override the signing key id (default `as-<YYYY-MM>`)
--client <CLIENTS>
Repeatable `client_id=redirect_uri` for AS_CLIENTS (e.g. `temper-cli=https://host/api/auth/cli-callback`)
--env-out <ENV_OUT>
Write the env bundle here instead of stdout (chmod 0600 — contains the private key)
--sql-out <SQL_OUT>
Write the SQL here instead of stdout
--apply
Run the kb_saml_idp SQL against $DATABASE_URL via psql (default: emit only)
-h, --help
Print help (see a summary with '-h')temper admin saml map-group
Map an IdP group to a role on a team (a system admin's act, recorded on the admin ledger).
At each login the IdP reconcile gives everyone the IdP puts in `group` that role on the team. Onto temper-system or the gating team only `watcher` is accepted; a higher role there is added directly by a system admin (`temper team add-member`). Elsewhere the ceiling is `maintainer`: an `owner` role, or an owner, maintainer or member role onto a team with the gating team or an auto-join team beneath it, is refused unless `--confirm-elevated` is passed. A watcher mapping never is.
Usage: temper admin saml map-group [OPTIONS] --idp-key <IDP_KEY> [GROUP] [TEAM]
Arguments:
[GROUP]
The IdP-asserted group value. Required unless `--from-seen`
[TEAM]
Team to map into: a slug (optionally `+`-prefixed) or a UUID. Required unless `--from-seen`
Options:
--idp-key <IDP_KEY>
--vault <VAULT>
Path to vault (overrides TEMPER_VAULT and auto-detection)
--format <FORMAT>
Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--role <ROLE>
owner, maintainer, member or watcher. `owner` needs `--confirm-elevated`
[default: member]
--confirm-elevated
Confirm a mapping above the ceiling: an `owner` role, or an authoring role onto a team with a pool beneath it. It does not lift the watcher-only rule on temper-system or the gating team. Ignored otherwise
--embed-threads <N>
ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR>
Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
--from-seen
Instead of creating a mapping, list groups the IdP has actually asserted (reads kb_saml_seen_groups via psql; needs DATABASE_URL)
-h, --help
Print help (see a summary with '-h')temper admin saml unmap-group
Remove an IdP group's mapping onto a team (a system admin's act, recorded on the admin ledger). Memberships the mapping already conferred are left in place: the IdP reconcile removes those no remaining mapping confers, at each member's next login
Usage: temper admin saml unmap-group [OPTIONS] --idp-key <IDP_KEY> <GROUP> <TEAM>
Arguments:
<GROUP> The group value, exactly as the mapping holds it
<TEAM> The mapping's team: a slug (optionally `+`-prefixed) or a UUID
Options:
--idp-key <IDP_KEY>
--vault <VAULT> Path to vault (overrides TEMPER_VAULT and auto-detection)
--format <FORMAT> Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--embed-threads <N> ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR> Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
-h, --help Print helptemper admin saml verify
Verify a provisioned instance: AS metadata reachable, caller is a system admin (governance grant + approved standing), and — with --db — one active kb_saml_idp row
Usage: temper admin saml verify [OPTIONS] --instance-url <INSTANCE_URL>
Options:
--instance-url <INSTANCE_URL> Instance base URL to probe (e.g. <https://temper.acme.com>)
--vault <VAULT> Path to vault (overrides TEMPER_VAULT and auto-detection)
--db Also check kb_saml_idp via psql (needs DATABASE_URL)
--format <FORMAT> Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--embed-threads <N> ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR> Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
-h, --help Print helptemper admin machine
Register and rotate machine (client_credentials) principals
Usage: temper admin machine [OPTIONS] <COMMAND>
Commands:
provision Register a machine principal: creates its agent profile, emitters, and the reach you specify — no other team membership. Run this BEFORE the machine's first call
rebind Point a fresh client id at an existing agent profile, preserving its authorship history. Revokes the old client unless --no-revoke-old
issue Issue a temper-minted machine credential (client_credentials on temper's own AS). temper mints the client id and a secret; the secret is printed once
rotate-secret Rotate a temper-issued secret. The previous secret stays valid for a grace window
list List registered machine clients
show Show one machine client
revoke Revoke a machine client. Denies authentication; grants and memberships survive
help Print this message or the help of the given subcommand(s)
Options:
--vault <VAULT> Path to vault (overrides TEMPER_VAULT and auto-detection)
--format <FORMAT> Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--embed-threads <N> ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR> Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
-h, --help Print helptemper admin machine provision
Register a machine principal: creates its agent profile, emitters, and the reach you specify — no other team membership. Run this BEFORE the machine's first call.
System admin only. Refused on an instance that runs temper's own authorization server, where an externally issued client id could never authenticate: use `issue` there.
Usage: temper admin machine provision [OPTIONS] --client-id <CLIENT_ID> --label <LABEL>
Options:
--client-id <CLIENT_ID>
The IdP client id (Auth0 M2M application client id)
--vault <VAULT>
Path to vault (overrides TEMPER_VAULT and auto-detection)
--format <FORMAT>
Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--label <LABEL>
Human-facing label
--embed-threads <N>
ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--owner-team <OWNER_TEAM>
Team recorded as this machine's OWNER. Not its reach
--color <COLOR>
Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
--team <TEAMS>
Team to enroll in, as `<ref>` or `<ref>:<role>` (`member` by default, and the highest a machine may hold — `maintainer`/`owner` are refused). Repeatable. Reach is plural and never inferred from --owner-team
--cogmap <COGMAPS>
Cogmap to grant, as `<ref>` or `<ref>:ro` (defaults to read+write). Repeatable
-h, --help
Print help (see a summary with '-h')temper admin machine rebind
Point a fresh client id at an existing agent profile, preserving its authorship history. Revokes the old client unless --no-revoke-old
Usage: temper admin machine rebind [OPTIONS] --client-id <CLIENT_ID> --label <LABEL> <FROM>
Arguments:
<FROM> The machine client being rotated away from (its `id`, from `list`)
Options:
--client-id <CLIENT_ID> The new IdP client id
--vault <VAULT> Path to vault (overrides TEMPER_VAULT and auto-detection)
--format <FORMAT> Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--label <LABEL> Label for the new registration
--embed-threads <N> ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--no-revoke-old Leave both credentials live for an overlap window
--color <COLOR> Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
-h, --help Print helptemper admin machine issue
Issue a temper-minted machine credential (client_credentials on temper's own AS). temper mints the client id and a secret; the secret is printed once
Usage: temper admin machine issue [OPTIONS] --label <LABEL>
Options:
--label <LABEL> Human-facing label
--vault <VAULT> Path to vault (overrides TEMPER_VAULT and auto-detection)
--format <FORMAT> Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--owner-team <OWNER_TEAM> Team recorded as this machine's OWNER. Not its reach
--embed-threads <N> ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--team <TEAMS> Team to enroll in, as `<ref>` or `<ref>:<role>` (`member` by default, and the highest a machine may hold — `maintainer`/`owner` are refused). Repeatable
--cogmap <COGMAPS> Cogmap to grant, as `<ref>` or `<ref>:ro` (defaults to read+write). Repeatable
--color <COLOR> Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
-h, --help Print helptemper admin machine rotate-secret
Rotate a temper-issued secret. The previous secret stays valid for a grace window
Usage: temper admin machine rotate-secret [OPTIONS] <ID>
Arguments:
<ID> The machine client to rotate (its `id`, from `list`)
Options:
--grace <GRACE_SECONDS> Seconds the previous secret stays valid after rotation (default 86400 = 24h) [default: 86400]
--vault <VAULT> Path to vault (overrides TEMPER_VAULT and auto-detection)
--format <FORMAT> Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--embed-threads <N> ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR> Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
-h, --help Print helptemper admin machine list
List registered machine clients
Usage: temper admin machine list [OPTIONS]
Options:
--include-revoked Include revoked clients
--vault <VAULT> Path to vault (overrides TEMPER_VAULT and auto-detection)
--format <FORMAT> Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--embed-threads <N> ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR> Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
-h, --help Print helptemper admin machine show
Show one machine client
Usage: temper admin machine show [OPTIONS] <ID>
Arguments:
<ID>
Options:
--vault <VAULT> Path to vault (overrides TEMPER_VAULT and auto-detection)
--format <FORMAT> Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--embed-threads <N> ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR> Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
-h, --help Print helptemper admin machine revoke
Revoke a machine client. Denies authentication; grants and memberships survive
Usage: temper admin machine revoke [OPTIONS] <ID>
Arguments:
<ID>
Options:
--vault <VAULT> Path to vault (overrides TEMPER_VAULT and auto-detection)
--format <FORMAT> Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--embed-threads <N> ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR> Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
-h, --help Print helptemper admin slack
Administer Slack account links
Usage: temper admin slack [OPTIONS] <COMMAND>
Commands:
disconnect Disconnect a Slack principal from its temper profile. Idempotent
help Print this message or the help of the given subcommand(s)
Options:
--vault <VAULT> Path to vault (overrides TEMPER_VAULT and auto-detection)
--format <FORMAT> Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--embed-threads <N> ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR> Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
-h, --help Print helptemper admin slack disconnect
Disconnect a Slack principal from its temper profile. Idempotent
Usage: temper admin slack disconnect [OPTIONS] <PRINCIPAL>
Arguments:
<PRINCIPAL>
Options:
--vault <VAULT> Path to vault (overrides TEMPER_VAULT and auto-detection)
--format <FORMAT> Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--embed-threads <N> ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR> Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
-h, --help Print helptemper admin team
Administer teams: the acts only a system admin takes
Usage: temper admin team [OPTIONS] <COMMAND>
Commands:
auto-join Set, change or clear a team's auto-join role
help Print this message or the help of the given subcommand(s)
Options:
--vault <VAULT> Path to vault (overrides TEMPER_VAULT and auto-detection)
--format <FORMAT> Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--embed-threads <N> ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR> Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
-h, --help Print helptemper admin team auto-join
Set, change or clear a team's auto-join role
With a role set, every approved person (never a machine) is enrolled at it and reads everything attached to the team and its ancestors (listed in the output). Existing memberships are never changed. Refused on temper-system, the gating team and personal teams.
Usage: temper admin team auto-join [OPTIONS] <TEAM> <ROLE>
Arguments:
<TEAM>
Team slug (optionally `+`-prefixed) or UUID
<ROLE>
member | watcher | none (none clears it)
Options:
--vault <VAULT>
Path to vault (overrides TEMPER_VAULT and auto-detection)
--format <FORMAT>
Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--embed-threads <N>
ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR>
Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
-h, --help
Print help (see a summary with '-h')temper admin connection
Provision connections — temper's authed link to a remote system (GitHub, Linear)
Usage: temper admin connection [OPTIONS] <COMMAND>
Commands:
provision Provision a connection: creates its profile, its `<handle>@webhook` emitter entity, and the context that homes it. Born `needs_credential` — attach the credential separately
list List connections
show Show one connection
attach-credential Attach the credential. This is what flips `needs_credential` off — the state is derived from the column being non-NULL, never from a status flag
set-webhooks Register the remote event types this connection receives. Non-empty ⇒ LEDGER-CAPABLE: events land, facts accrue
set-tools Declare the read-only remote tools. Non-empty ⇒ REACH-CAPABLE: agents can read the remote back, so judgment becomes possible
revoke Revoke a connection. Its profile, emitter entity, and home context survive — events already attributed to the emitter must keep resolving
grant-reach Grant a TEAM read-reach on this connection. Owning a connection is NOT reaching it — this writes an access grant so the team's members inherit read on what the connection receives. Reach is read-only; it confers no write
revoke-reach Revoke a team's read-reach on this connection. Idempotent — an absent grant is a no-op
help Print this message or the help of the given subcommand(s)
Options:
--vault <VAULT> Path to vault (overrides TEMPER_VAULT and auto-detection)
--format <FORMAT> Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--embed-threads <N> ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR> Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
-h, --help Print helptemper admin connection provision
Provision a connection: creates its profile, its `<handle>@webhook` emitter entity, and the context that homes it. Born `needs_credential` — attach the credential separately.
Declaring the reach is not overhead, it IS the declaration. A connector is a reach declaration: you cannot have 50 teams with 50 distinct reaches and fewer than 50 declarations. Silence must never encode absence of capability — and never excess of it.
Usage: temper admin connection provision [OPTIONS] --provider <PROVIDER> --name <NAME>
Options:
--provider <PROVIDER>
The remote system: `github` | `linear`
--vault <VAULT>
Path to vault (overrides TEMPER_VAULT and auto-detection)
--format <FORMAT>
Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--name <NAME>
Human-facing name. The addressable slug is derived from it
--embed-threads <N>
ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--owner-team <OWNER_TEAM>
Team recorded as this connection's OWNER. Not its reach. Omitting it means teamless, which is admin-only and fails closed
--color <COLOR>
Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
--reach <REACH>
The grain the credential is scoped at, in the PROVIDER's terms: `org` | `workspace` | `installation` | `repo-set` | `project`
--covers <COVERS>
What the credential can ACTUALLY see, in provider terms (e.g. `acme/temper`)
-h, --help
Print help (see a summary with '-h')temper admin connection list
List connections
Usage: temper admin connection list [OPTIONS]
Options:
--include-revoked Include revoked connections
--vault <VAULT> Path to vault (overrides TEMPER_VAULT and auto-detection)
--format <FORMAT> Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--embed-threads <N> ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR> Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
-h, --help Print helptemper admin connection show
Show one connection
Usage: temper admin connection show [OPTIONS] <ID>
Arguments:
<ID>
Options:
--vault <VAULT> Path to vault (overrides TEMPER_VAULT and auto-detection)
--format <FORMAT> Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--embed-threads <N> ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR> Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
-h, --help Print helptemper admin connection attach-credential
Attach the credential. This is what flips `needs_credential` off — the state is derived from the column being non-NULL, never from a status flag.
No secret is stored: `--broker` names the implementation behind the seam and `--connector` identifies a connector THAT BROKER holds the secret for. The connector id lives on the row, per instance — which is what lets a self-hosted operator use their own connectors.
Usage: temper admin connection attach-credential [OPTIONS] --broker <BROKER> --connector <CONNECTOR> <ID>
Arguments:
<ID>
Options:
--broker <BROKER>
The implementation behind the broker seam, e.g. `vercel-connect`. Never a connector id
--vault <VAULT>
Path to vault (overrides TEMPER_VAULT and auto-detection)
--connector <CONNECTOR>
The broker's identifier for this connector
--format <FORMAT>
Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--embed-threads <N>
ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--installation <INSTALLATION>
The specific installation, where the provider has that concept (a GitHub App installation)
--color <COLOR>
Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
-h, --help
Print help (see a summary with '-h')temper admin connection set-webhooks
Register the remote event types this connection receives. Non-empty ⇒ LEDGER-CAPABLE: events land, facts accrue.
Replaces the registered set wholesale — it mirrors what the remote is actually configured to send, and a merge would let a stale entry outlive the webhook it names.
Usage: temper admin connection set-webhooks [OPTIONS] --event <EVENTS> <ID>
Arguments:
<ID>
Options:
--event <EVENTS>
A remote event type, e.g. `pull_request`. Repeatable
--vault <VAULT>
Path to vault (overrides TEMPER_VAULT and auto-detection)
--format <FORMAT>
Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--embed-threads <N>
ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR>
Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
-h, --help
Print help (see a summary with '-h')temper admin connection set-tools
Declare the read-only remote tools. Non-empty ⇒ REACH-CAPABLE: agents can read the remote back, so judgment becomes possible.
Not decorative — the manifest is the evidence the provider is admissible at all. An empty manifest means judgment is IMPOSSIBLE, not merely unconfigured.
Usage: temper admin connection set-tools [OPTIONS] --tool <TOOLS> <ID>
Arguments:
<ID>
Options:
--tool <TOOLS>
A read-only remote tool name. Repeatable
--vault <VAULT>
Path to vault (overrides TEMPER_VAULT and auto-detection)
--format <FORMAT>
Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--embed-threads <N>
ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR>
Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
-h, --help
Print help (see a summary with '-h')temper admin connection revoke
Revoke a connection. Its profile, emitter entity, and home context survive — events already attributed to the emitter must keep resolving
Usage: temper admin connection revoke [OPTIONS] <ID>
Arguments:
<ID>
Options:
--vault <VAULT> Path to vault (overrides TEMPER_VAULT and auto-detection)
--format <FORMAT> Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--embed-threads <N> ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR> Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
-h, --help Print helptemper admin connection grant-reach
Grant a TEAM read-reach on this connection. Owning a connection is NOT reaching it — this writes an access grant so the team's members inherit read on what the connection receives. Reach is read-only; it confers no write
Usage: temper admin connection grant-reach [OPTIONS] --team <TEAM> <ID>
Arguments:
<ID> The connection id (a bare UUID, as printed by `connection list`/`show`)
Options:
--team <TEAM> The team receiving read-reach: a slug, a decorated `slug-<uuid>` ref, or a team UUID
--vault <VAULT> Path to vault (overrides TEMPER_VAULT and auto-detection)
--affirm-reach <AFFIRM_REACH> Affirm that binding this connection's coarse remote reach to the team is intentional — REQUIRED when the connection declares a reach; the value is the stated reason. Granting without it FAILS rather than proceeding silently. It records the intent for review; it does NOT make the connection's coarse remote reach any narrower
--format <FORMAT> Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--embed-threads <N> ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR> Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
-h, --help Print helptemper admin connection revoke-reach
Revoke a team's read-reach on this connection. Idempotent — an absent grant is a no-op
Usage: temper admin connection revoke-reach [OPTIONS] --team <TEAM> <ID>
Arguments:
<ID> The connection id (a bare UUID, as printed by `connection list`/`show`)
Options:
--team <TEAM> The team whose read-reach is revoked: a slug, a decorated `slug-<uuid>` ref, or a UUID
--vault <VAULT> Path to vault (overrides TEMPER_VAULT and auto-detection)
--format <FORMAT> Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--embed-threads <N> ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR> Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
-h, --help Print helptemper admin subscription
Manage subscriptions — a team/context/cogmap subscribes to a connection's events
Usage: temper admin subscription [OPTIONS] <COMMAND>
Commands:
create Create a subscription. The authz gate (authoring-team manage-capable, a reach grant held on the connection, and authorship of a context or map subscriber) runs server-side
list List subscriptions visible to the caller
show Show one subscription
revoke Revoke a subscription. Rows are never deleted — a revoked subscription stops matching but stays resolvable for the delivery row's research-corpus property
help Print this message or the help of the given subcommand(s)
Options:
--vault <VAULT> Path to vault (overrides TEMPER_VAULT and auto-detection)
--format <FORMAT> Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--embed-threads <N> ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR> Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
-h, --help Print helptemper admin subscription create
Create a subscription. The authz gate (authoring-team manage-capable, a reach grant held on the connection, and authorship of a context or map subscriber) runs server-side
Usage: temper admin subscription create [OPTIONS] --subscriber-table <SUBSCRIBER_TABLE> --subscriber-id <SUBSCRIBER_ID> --authoring-team-id <AUTHORING_TEAM_ID> --connection-id <CONNECTION_ID> --selector <SELECTOR>
Options:
--subscriber-table <SUBSCRIBER_TABLE>
The subscriber kind: `kb_contexts` | `kb_cogmaps` | `kb_teams`
--vault <VAULT>
Path to vault (overrides TEMPER_VAULT and auto-detection)
--format <FORMAT>
Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--subscriber-id <SUBSCRIBER_ID>
The subscriber row id (UUID)
--authoring-team-id <AUTHORING_TEAM_ID>
The team whose manage-capable role authorizes this subscription (UUID). For `kb_teams` subscribers, this must equal `--subscriber-id`
--embed-threads <N>
ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR>
Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
--connection-id <CONNECTION_ID>
The connection id (UUID)
--selector <SELECTOR>
The selector: a JSON string, or `@file.json` to read from a file. The shape is the `SubscriptionSelector` enum (`{"kind": "git_hub_repository", "repo": "acme/temper", ...}`)
-h, --help
Print helptemper admin subscription list
List subscriptions visible to the caller
Usage: temper admin subscription list [OPTIONS]
Options:
--include-revoked Include revoked subscriptions
--vault <VAULT> Path to vault (overrides TEMPER_VAULT and auto-detection)
--connection-id <CONNECTION_ID> Optional: filter to subscriptions against this connection (UUID)
--format <FORMAT> Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--embed-threads <N> ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR> Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
-h, --help Print helptemper admin subscription show
Show one subscription
Usage: temper admin subscription show [OPTIONS] <ID>
Arguments:
<ID>
Options:
--vault <VAULT> Path to vault (overrides TEMPER_VAULT and auto-detection)
--format <FORMAT> Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--embed-threads <N> ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR> Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
-h, --help Print helptemper admin subscription revoke
Revoke a subscription. Rows are never deleted — a revoked subscription stops matching but stays resolvable for the delivery row's research-corpus property
Usage: temper admin subscription revoke [OPTIONS] <ID>
Arguments:
<ID>
Options:
--vault <VAULT> Path to vault (overrides TEMPER_VAULT and auto-detection)
--format <FORMAT> Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--embed-threads <N> ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR> Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
-h, --help Print helptemper admin reembed
Re-embed chunks whose vectors were produced by an older model (the drain does the work)
Nothing is destroyed: a stale vector stays searchable until a fresh one replaces it. Staleness is derived, not marked, so this is idempotent and safe to re-run. Start with --dry-run.
Usage: temper admin reembed [OPTIONS]
Options:
--resource <RESOURCE>
Re-embed just this resource (UUID or decorated ref)
--vault <VAULT>
Path to vault (overrides TEMPER_VAULT and auto-detection)
--context <CONTEXT>
Re-embed every stale resource in this context (`@me/slug`, `+team/slug`, or UUID)
--format <FORMAT>
Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--all
Re-embed everything stale. Must be asked for by name — never the default
--embed-threads <N>
ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR>
Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
--limit <LIMIT>
Max resources to enqueue in this call (walk the index in bounded steps)
--dry-run
Report what is stale without enqueuing anything
-h, --help
Print help (see a summary with '-h')temper admin reblock
Run one bounded, resumable corpus re-blocking step: re-block resources under the current chunking policy
Survey first with --dry-run, then run without it, then survey again to verify. Exactly one scope: --resource re-blocks one resource, --context every candidate homed in that context you can read, --all the whole deployment (requires system-administrator standing, and must be asked for by name — never the default). Prints the receipt: one outcome row per candidate, per-class counts, the batch correlation id, and the resume cursor.
Usage: temper admin reblock [OPTIONS]
Options:
--resource <RESOURCE>
Re-block just this resource (UUID or decorated ref)
--vault <VAULT>
Path to vault (overrides TEMPER_VAULT and auto-detection)
--context <CONTEXT>
Re-block every candidate homed in this context (`@me/slug`, `+team/slug`, or UUID)
--format <FORMAT>
Output format: json | toon (default: toon on a TTY, json otherwise). Precedence: --format → TEMPER_FORMAT → cli.format config → TTY default
--all
Re-block deployment-wide. Requires system-administrator standing. Must be asked for by name — never the default
--embed-threads <N>
ONNX intra-op threads for embedding. `0` = let ONNX Runtime decide. Default: this machine's performance-core count (NOT its total core count — efficiency cores measurably slow the batch down). Precedence: --embed-threads → TEMPER_ONNX_INTRA_THREADS → detected → 1
--color <COLOR>
Color output: auto | always | never (default: auto). Precedence: --color → TEMPER_COLOR → cli.color config → NO_COLOR → auto
--dry-run
Survey what would change without changing anything
--limit <LIMIT>
Max candidates this call considers (a conservative default applies; walk in bounded steps)
--after-id <AFTER_ID>
Resume from the previous receipt's cursor (the candidate id to start after)
-h, --help
Print help (see a summary with '-h')Modified at 2026-11-15 01:09:04