Commands

stratos init

Set up this node: a persistent identity (keys generated locally, written 0600 — the private half never leaves the machine) and a default workspace. Idempotent: re-running reuses the identity; it never rotates keys.

stratos init [workspace]   # default workspace name: local

stratos doctor

Read-only health report: runtime, identity, workspaces, receipt chain (fail-closed verify), model gateway. Suggests the exact next command for anything not green; never fixes, never writes.

stratos doctor

stratos workspace · task · capture

The deterministic core: create a workspace, scaffold a task (8 canonical entries), classify and persist a context record. No LLM, no network.

stratos workspace create <name>
stratos task create <ws/proj/wf/task>
stratos capture <ws/proj/wf/task> "<text>"

stratos complete

A real local completion through YOUR gateway, with a PQC-signed receipt. Point STRATOS_GATEWAY_URL at any OpenAI-compatible endpoint and name a model your server actually has.

STRATOS_GATEWAY_URL=http://127.0.0.1:11434/v1/chat/completions \
  stratos complete <ws/proj/wf/task> "your prompt" --model gemma2:2b

stratos trace · eval

trace runs start → steps → end with a signed receipt spine; eval scores the trace against the deterministic rubric (weighted, trace-integrity counts double).

stratos trace <ws/proj/wf/task>
stratos eval <ws/proj/wf/task>

stratos receipt

Export a signed receipt JSONL as a self-contained bundle (public key embedded), and verify any bundle — offline, public key only, exact break index on tamper.

stratos receipt export <receipts.jsonl> --out bundle.json
stratos receipt verify bundle.json

stratos skill · route

skill imports/exports SKILL.md files (untrusted by default — capabilities must be granted). route prints the local-default routing decision and the why, without making a call.

stratos skill import <file.md>
stratos route "<prompt>" [--privacy]