Index of Builder CLI commands used in the AI Fabrix integration lifecycle. Authoritative syntax, flags, and permissions live in Builder CLI help (aifabrix <command> --help) and the CLI workflow guide.
Platform setup: Set up a local platform. Assignment-scope configuration: Enable and verify Dimension ABAC, including the default-off and restart/redeploy boundary.
Agent Kit and onboarding
Fastest managed-workspace command:
aifabrix onboarding
The af alias is equivalent. The command needs no Controller URL because it
reads the administrator-provisioned ~/.aifabrix/config.yaml.
aifabrix onboarding [--coding <claude|codex|cursor>] [--name <folder>]
aifabrix onboarding --repo <owner/name>
aifabrix agent-kit setup <controllerUrl> [--repo owner/name]
aifabrix agent-kit init cust-<name> --host all --approve-all --yes
aifabrix agent-kit init cust-<name> --host all --remote --org <owner> --yes
aifabrix agent-kit install --host all --approve-all --yes
aifabrix agent-kit install --host claude --approve-all --yes
aifabrix agent-kit update --host all --approve-all --yes
aifabrix agent-kit status
aifabrix agent-kit validate
aifabrix agent-kit remote create --org <owner> --yes
aifabrix agent-kit start claude --remote-control --approve-all --yes
aifabrix agent-kit start claude --remote-control --detach
aifabrix agent-kit start codex
aifabrix agent-kit list [--json]
aifabrix agent-kit kill [name]
aifabrix onboarding prepares or resumes a workspace on an organization-managed SSH
host. The administrator-provisioned config supplies the Controller,
environment, and any configured default coding platform. --coding selects the
platform for this run and saves it only if no default is configured; an existing
default is preserved. --name selects a workspace folder, and --repo reuses, clones, or
creates a private GitHub repository. GitHub device sign-in can be completed in
a browser on your own computer.
setup guides portable Linux/macOS onboarding with Controller sign-in, a local workspace, and Codex; GitHub is optional unless --repo is supplied. init creates a new delivery workspace (skeleton + git + Agent Kit) for Cursor, Codex, or Claude Code; omit --host/--yes on a terminal to be prompted. The workspace name is authoritative — keep your organization's cust-* prefix. install / update / status / validate target an existing repo instead. update omits --host to keep the coding hosts already recorded — pass --host only to add or switch a host. --host claude or --host codex installs kit files for that coding host only. remote create runs from inside the workspace directory and creates a private GitHub remote by default — it does not select Cursor, Claude Code, or Codex. start opens Claude Code or Codex in tmux in the current git workspace without installing skills. Closing the terminal does not kill the session if you detach (Ctrl-b then d) or pass --detach. Claude uses its Remote Control workflow by default. Codex Remote Control requires the standalone managed daemon; an npm-installed CLI may need --no-remote-control. list shows tmux sessions and direct same-user Codex app servers; interactive kill can select either. Install the coding CLI once on the machine (claude auth login or codex login). Full flags: aifabrix agent-kit --help.
How-to: Prepare a managed coding workspace. Interactive onboarding --repo can create a private repository and push its initial commit; choose it only when that remote action is intended.
Authentication
aifabrix auth status
aifabrix login
Installation configuration
Inspect declared configuration for the exact environment and application owner:
aifabrix env secret list dev
aifabrix env secret list dev --app <appKey>
aifabrix env secret push dev --app <appKey> --dry-run
aifabrix env secret push dev --app <appKey> --key <ENV_VARIABLE_NAME>
Despite the command name, the list includes variables and secret configured
states. Only non-sensitive variable values are shown. Push reads an ignored
.env file and matches existing declarations; it does not create declarations.
Undeclared names are skipped. --key selects one environment-variable name;
--file selects another ignored input file. Never pass secret values as arguments.
A bulk push prompts in a terminal. Automation requires explicit authorization
and --yes; preview with --dry-run first. Inspect the configured-state list
afterward. A revision conflict requires a fresh read and review before retrying.
Standard provider references use openai/apiKey, azure-openai/apiKey,
azure-openai/endpoint and anthropic/apiKey; use declarations belonging to the
intended environment and owner, not an unrelated application's legacy key.
Generate and model
aifabrix create <systemKey> --type external
aifabrix integration-definition validate <file> [--fix-hash]
aifabrix integration-definition apply <file> [--dry-run] [--force] [--output-dir <dir>]
aifabrix wizard [systemKey]
aifabrix wizard --config <file>
aifabrix repair <systemKey> [--dry-run] [--auth apikey] [--rbac] [--expose]
aifabrix json <systemKey>
aifabrix json <appKey> --resource-group <resourceGroup> --env dev
aifabrix build <appKey> --env dev
aifabrix download <systemKey>
Author an upsert candidate only from existing create/update capabilities and
mapped business identity:
aifabrix datasource capability upsert <file-or-key> --dry-run --json
Candidate generation is not write-readiness proof. Review the proposed lookup
and identity before applying it, then validate and run the full datasource E2E
scenario, including lookup, repeat write and cleanup. Do not filter that proof
to only the upsert operation. --test needs supplied case data; it does not
invent safe vendor records.
Validate and test
aifabrix validate <systemKey|file> [--cert-sync]
aifabrix test <systemKey>
aifabrix datasource test <datasourceKey> --app <systemKey>
aifabrix test-integration <systemKey>
aifabrix datasource test-integration <datasourceKey> --app <systemKey>
aifabrix test-e2e <systemKey>
aifabrix datasource test-e2e <datasourceKey> [capabilityKey] --app <systemKey> [--debug <summary|full|raw>] [--json]
aifabrix role-assistant test <bareRoleKey> [--env <dev|tst|pro>] [--case …] [--suite …] [--from-dataplane] [--json] [--verbose] [--debug]
Role Assistant package commands use ra-<roleKey>; role-assistant test and
copy use the bare key. For example, upload with
aifabrix upload ra-sales-representative --env dev, then test with
aifabrix role-assistant test sales-representative --env dev.
For CI, add --json; add --fail-fast when a suite should stop after its first
hard failure. Exit 2 means a hard assertion failed. Exit 0 means no blocking
assertion remains, but warning rows created by expected.soft: true still need
review before the run is used as release evidence.
For one failing case, combine --json --verbose --debug: verbose adds the full
lifecycle report to JSON, while debug writes local CLI logs under
role-assistant/<roleKey>/logs/. CLI debug does not enable deployed Runtime,
capability, or prompt traces; those are environment settings in
role-assistant.yaml.
Use --subject-email or --subject-user-id (exactly one) to run a Role
Assistant test as that isolated subject through an asynchronous Dataplane job.
When a case cannot answer a required question, repeats an answered question or
fails while responding, the CLI stops polling and reports pollStopped with a
reason. Inspect the case answers and execution before rerunning; an early stop
is not business success.
Search (read-only)
Ad-hoc retrieve for a Role Assistant assigned to your login. Same governed search as Work Hub retrieve cases — not a second engine and not a work start.
aifabrix search
aifabrix search --role ra-<roleKey> --resource-type <type> --operation list [--json]
aifabrix search --role ra-<roleKey> --resource-type <type> --operation list --graph --query "<text>" --knowledge-key <key>
aifabrix search skills --role ra-<roleKey>
Interactive pickers run in a terminal when flags are omitted. Scripts and CI must pass --role (and type/operation when required) or the command fails closed. --json / --output write the payload; a terminal table prints unless --json. --graph includes one level of related records on the returned rows — it is not multi-hop traversal or a generic corpus search. --query supplies the semantic hop text and only applies when --graph is set; --knowledge-key is repeatable and scopes the retrieve to specific knowledge keys. Full flags: aifabrix search --help.
Publish
aifabrix upload <systemKey> [--dry-run] [--verbose] [--gate <gates>] [--no-wait]
aifabrix upload <systemKey> --resume <jobId>
aifabrix deploy <systemKey> [--probe]
aifabrix show <systemKey> --online
For Connected Systems, upload submits durable candidate qualification and waits by default. --no-wait returns the job id; --resume follows that existing job without another submission. Ctrl-C or a CLI --timeout detaches but does not cancel server work. --gate operations,trust,governance or --gate full selects optional checks on upload; --probe is an optional post-publish runtime check, not a preflight. Deploy promotes qualified current input; deploy --gate is a compatibility no-op. Changed content needs another upload and requalification before promotion.
Role Assistant packages (settings + Evidence; upload ≡ deploy with --env):
aifabrix download ra-<roleKey>
aifabrix validate ra-<roleKey>
aifabrix upload ra-<roleKey> --env <dev|tst|pro>
aifabrix role-assistant test <bareRoleKey> [--env <dev|tst|pro>] [--case …] [--suite …] [--from-dataplane] [--json] [--verbose] [--debug]
aifabrix role-assistant copy <bareRoleKey> --suite <suiteId> --reference <executionId>
validate checks every governed file in the package (settings, YAML cases, Evidence, Knowledge). copy writes one local YAML case from a completed Work Hub execution — it does not invent a prompt. Live capture requires the platform copy route; if copy cannot materialize, author YAML by hand. Flags: aifabrix role-assistant copy --help.
See Manage Role Assistant packages,
Role Assistant tests (prove catalog),
Test Role Assistants (package),
Author Role Assistant Evidence, and
Author Role Assistant Knowledge.
Assistant channels
Communication channels (Slack, Teams, Copilot, ChatGPT) use Connected Systems — not controller app deploy:
aifabrix channel add
aifabrix channel add <target> --name "Elsa" [--probe]
One command scaffolds, uploads when needed, and installs. --force refreshes the local package and re-uploads.
Targets: teams-bot, slack, microsoft-copilot, chatgpt (web-embed experimental with --allow-experimental).
How-tos: Deliver assistant channels.
Enterprise AI Certification
Use these commands to inspect individual certification pillars or a lifecycle report. For qualification of changed content, select required gates on upload rather than rerunning the ladder in the deploy client:
aifabrix verify-operations <systemKey>
aifabrix verify-trust <systemKey>
aifabrix verify-governance <systemKey> [--subject-email <email>]
aifabrix lifecycle <systemKey>
| Command | Pillar |
|---|---|
verify-operations |
Operations — validate, test, integration, E2E |
verify-trust |
Agent metadata trust — business metadata for AI |
verify-governance |
Governance — ABAC visibility per subject |
lifecycle |
Combined certification report |
See Certification for the full ladder and Validation and certification for business context.
Datasource commands
Use aifabrix datasource (shorthand aifabrix ds) when you iterate on one datasource without re-uploading the entire external system. Commands below match the installed Builder CLI — run aifabrix datasource --help if a flag differs in your version.
Validate, list, and compare
aifabrix datasource validate <file-or-directory>
aifabrix datasource list [prefix]
aifabrix datasource diff <file1> <file2>
validate— offline schema and semantic checks on YAML/JSON (or a folder of datasource files)list— datasources registered in the configured environmentdiff— compare two datasource files before publish
Publish and test
aifabrix datasource upload <file-or-key>
aifabrix datasource test <datasourceKey> --app <systemKey>
aifabrix datasource test-integration <datasourceKey> --app <systemKey>
aifabrix datasource test-e2e <datasourceKey> [capabilityKey] --app <systemKey> [--debug <summary|full|raw>] [--json]
aifabrix datasource verify-audit <datasourceKey> --app <systemKey> [--json]
upload— publish one datasource by file path or datasource key underintegration/<systemKey>/test— structural/policy validation on the dataplanetest-integration— integration validation on the dataplanetest-e2e— end-to-end validation against live or sandbox APIs; a positional capability key focuses the reportverify-audit— recheck E2E audit evidence without calling the vendor again
System-level equivalents remain aifabrix upload, aifabrix test-integration, and aifabrix test-e2e when you publish or test every datasource at once.
Logs and fixtures (optional)
aifabrix datasource log-test <datasourceKey> [--app <systemKey>]
aifabrix datasource log-integration <datasourceKey> [--app <systemKey>]
aifabrix datasource log-e2e <datasourceKey> [--app <systemKey>]
aifabrix datasource log-trust <datasourceKey> [--app <systemKey>]
aifabrix datasource load <datasourceKey> [--app <systemKey>] [--file <fixture-file>]
aifabrix datasource export <datasourceKey> [--app <systemKey>] [--file <path>]
aifabrix datasource clean-logs --app <systemKey> [--type <test|integration|e2e|trust|all>] [--dry-run]
Use log commands after failed test, test-integration, test-e2e, or verify-trust --debug runs. load and export move fixture or governed records for sandbox workflows — confirm environment before upload-style commands.
Lifecycle maintenance
aifabrix repair <systemKey> [--dry-run]
aifabrix delete <systemKey>
Narrative docs (prefer over this index)
For business context and phase order, use:
- Create an enterprise external system
- Apply an integration definition
- CLI workflow
- Connected System tests
- Role Assistant tests
- Test Role Assistants (package)
- Certification
Limits
Command names and flags evolve with Builder releases. If a command fails, run aifabrix <command> --help and validate against your installed CLI version.
Related
- Quickstart: new external system
- Developer workstation setup (Agent Kit workspace bootstrap)
- Schema reference