raxit add

raxit add <ref> appends a version-pinned registry ref to the import: list in .raxit/security.yaml — it only edits the file; it does not compile, test, or enforce anything. Run raxit plan / raxit apply afterward to see and push the effect.

Usage

$ raxit add raxit/baseline-pii@1.2.0
added import: raxit/baseline-pii@1.2.0

Adding a ref that's already present is a no-op:

$ raxit add raxit/baseline-pii@1.2.0
already imported: raxit/baseline-pii@1.2.0

@latest and unpinned refs are rejected outright — every ref must be pkg@version:

$ raxit add raxit/baseline-pii@latest
raxit add: invalid ref: registry ref "raxit/baseline-pii@latest": @latest is not allowed; pin an explicit version

Trust model

Every pack add resolves goes through the same admission path used at load time: the artifact must carry a valid Ed25519 signature from a key in the trusted keyring (registry.VerifyingResolver) before it's trusted at all, and is then content-scanned (registry.ScanArtifact) as an independent defense against a trusted-but-compromised publisher shipping hostile-but-validly-signed content. @latest and unpinned refs are rejected at parse time — every import is an explicit version pin. And regardless of trust or scan results, an imported pack can only ever contribute rules: (and the resources/tests it declares) — it cannot touch budgets:, egress:, credentials:, sandbox:, tenants:, audit:, delegation:, or the other base-owned blocks of your security.yaml; those stay whatever the local file says, no matter what an imported pack contains.

Flags

• --source <file> — security.yaml to edit (default .raxit/security.yaml).
• --registry <dir> — local registry catalog dir used for the pre-flight admission scan (default registry-catalog).
• --keyring <dir> — infra-side trust keyring dir; defaults to <registry>/keys (co-located, deprecated — see the startup warning if you hit it).
• --insecure — skip signature verification (dev only).
• --skip-admission — unsafe: bypass the pre-flight content scan. Dev/testing only.

Gotchas

• add runs a pre-flight admission scan for fast feedback, but it isn't the only gate: the same scan re-runs every time the pack is actually resolved (raxit dev/raxit apply/ raxit check), regardless of when it was added. A pack that passes add can still be rejected later if the registry catalog or keyring changes.
• If no local registry catalog is present at --registry, add can't scan before writing and says so instead of silently skipping the check:

  warning: no local catalog at registry-catalog; admission scan deferred -- the pack will be
  admission-scanned when resolved by dev/apply/check

• add never resolves, compiles, or merges the import — use raxit check to validate the merged document compiles, and raxit plan to see what rules the pack would actually add or shadow (raxit plan --imports).