The harness CLI is grouped: traust <group> <operation>, or
python3 -m traust.cli <group> <operation> from the harness venv. Both are the
same entry point ([project.scripts] traust = "traust.cli.__main__:main").
traust check skill-alignment
python3 -m traust.cli check skill-alignment # equivalent17 groups (plus the deprecated tools group below).
| Group | Description | Operations |
|---|---|---|
adapters |
Scanner adapters (deterministic pre-scans) | checkov, crypto-audit, crypto-probe, gitleaks, govulncheck, joern, opengrep, osv, yara |
admin |
Operator tooling | attest-target, checkpoint, countersign, query-index, scan-internal-refs, toolchain |
build |
Deterministic builders | cumulative, rescan-worklist, skills-reference, symbol-index |
check |
Deterministic gates | citations, content-licenses, docs-consistency, drift, fix-propagation, location-paths, reference-integrity, report-digests, skill-alignment, skill-security |
compliance |
Compliance reporting | dashboard, scope |
corpus |
Corpus management | finding-identity, findings-db, precedent, resolve, summary |
dashboard |
Dashboard rebuilds | refresh |
feeds |
Feed management | fetch, reconcile-cve-provenance |
impact |
Impact analysis | analyze, calibrate-rule-pack, cluster-state-diff, resolve-advisory-symbols, sweep |
ledger |
Ledger emission | doc-variance, emit-triage, emit-validation, emit-verification |
metrics |
Metrics & spend | attribute-spend, collect-spend, history, sla, spend |
portfolio |
Portfolio graph | artifacts, build, deps-multi, freshness, interfaces, parsers, query, stats, symbols |
registry |
Model/product registry | models, products |
reporting |
Report validation & rendering | lint, render, sarif, validate |
route |
Finding routing | impact-findings, regressions |
sweep |
Class-generalization sweep | benchmark, collect, draft, emit, mine, rule-lane, sweep |
util |
Utility commands | elf, redact, safe-exec |
Two older spellings still work and must not be used in docs, skills, or command wrappers:
| Form | Example | Use instead |
|---|---|---|
| Pre-grouping module invocation | python3 -m traust.cli.check_skill_alignment |
python3 -m traust.cli check skill-alignment |
tools group alias |
python3 -m traust.cli tools check-skill-alignment |
python3 -m traust.cli check skill-alignment |
The dot-separated form keeps working because each src/traust/cli/<module>.py
carries an __main__ delegate that forwards to the grouped parser — which is
exactly why a stale example drifts silently. src/traust/cli/groups/tools.py
self-describes as "deprecated aliases for migrated command groups".
Both are enforced: the CLI invocation syntax check in
check_docs_consistency.py fails
the docs gate on any dot-separated invocation in README.md, AGENTS.md,
PROCESS.md, docs/*.md, config/*, harnessing/*/SKILL.md, or
.claude/commands/*.md.
Not every
traust.cli.*module is a CLI.traust.cli.budget_shadow, for instance, has no argparse or__main__— refer to it as a module path, never aspython3 -m.
See tooling-and-structure-files.md for what each packaged CLI does, and skills.md for the skills that call them.