CLI reference

The orkena CLI manages graphs, runs, policies, the ledger and evidence bundles. Install it from the release channel; it authenticates against your tenant.

Graph commands#

orkena graph list [--workspace ws]
orkena graph get refund-approval [--version v1.3]
orkena graph validate graph.yaml
orkena graph publish graph.yaml            # runs the eval gate
orkena graph activate refund-approval --version v1.3

Run commands#

orkena run start --graph refund-approval --input input.json
orkena run list [--workspace ws] [--status paused|running|done|denied]
orkena run status r_01J8F3T9K2
orkena run replay r_01J8F3T9K2            # deterministic replay
orkena run fork r_01J8F3T9K2 --at-seq 0121 --set amount=500

Policy commands#

orkena policy list
orkena policy validate pack.cedar
orkena policy whatif refund-guard-v1 --against-run r_01J8F3T9K2
orkena policy activate refund-guard --version v1 --workspace ws

Ledger and bundles#

orkena ledger tail [--workspace ws] [--limit 50]
orkena bundle export --run r_01J8F3T9K2 --out ./bundle.zip
orkena bundle verify ./bundle.zip

Incident commands#

orkena kill --level agent --agent refund_bot --reason "SOC-2026-042"
orkena kill --level graph --graph refund-approval --reason "SOC-2026-042"
orkena kill --level workspace --workspace ws --reason "..."
orkena kill --level org --reason "..."

Flags#

Flag	Meaning
--workspace	Target workspace
--version	Version pin
--out	Output path
--reason	Mandatory on destructive commands (recorded in the ledger)
--json	Machine-readable output

Every command that mutates state writes a ledger event. Graph and node config keys are documented in the DSL reference; policy grammar is in the Policy DSL reference; every error code the CLI can return is in Error codes.