raxit apply

raxit apply validates .raxit/security.yaml, runs its own tests: block against the compiled policy, and — only if both pass — pushes the result live to any attached daemon.

Usage

Against a daemon already governing the same agent id:

$ raxit apply
✓ Policy compiled + tested (.raxit/security.yaml)
✓ Enforce mode: on
✓ applied. policy e1096c1fd92d -> e1096c1fd92d (daemon confirmed)

After editing a rule and re-applying, the policy hash changes and the daemon round-trip confirms it:

$ raxit apply
✓ Policy compiled + tested (.raxit/security.yaml)
✓ Enforce mode: on
✓ applied. policy e1096c1fd92d -> 49e46c6a8600 (daemon confirmed)

The pipeline, in order, fails closed at every step (the last-applied policy keeps enforcing on any failure):

validate + compile security.yaml — refuse on error
run the tests: block against the compiled policy — refuse on any failing case
if a daemon is live for this project: authenticated POST /v1/reload, then read back the daemon's returned policy version and confirm it matches the locally computed hash

Refused on a failing test

$ raxit apply
FAIL 1 - calc should be denied but rule says allow (intentional failure): got "permit", want "deny"

0/1 passed, 1 failed: calc should be denied but rule says allow (intentional failure)
apply refused (tests): raxit test: 1 test case(s) failed
(no changes made; the last-applied policy is still enforced)
$ echo $?
1

Refused against a daemon governing a different agent

If a daemon on the target address is already governing a different agent id, apply will not push to it — it still compiles, tests, and records the policy locally, to take effect on the next run/serve for this project:

$ raxit apply
! daemon at localhost:8181 governs agent "default-agent", not "payments-bot" -- not pushing to it.
✓ Policy compiled + tested (.raxit/security.yaml)
✓ Enforce mode: on
policy hash: b9f3ff3d83cc
  state recorded; the new policy is enforced by the next `raxit run`/`raxit serve` for this project.
$ echo $?
0

This exits 0 — it's a deliberate no-push, not a failure.

Flags

--addr <host:port> — daemon to push to (defaults to localhost:8181).
--source <path> — explicit security.yaml path (default .raxit/security.yaml).

Gotchas

raxit serve defaults its own --addr to :8080, while apply (like status/plan/agent) defaults to localhost:8181. If you started serve bare, apply will report "not reachable" against a daemon that is, in fact, running. Always pass a matching --addr on both sides — either serve --addr localhost:8181 or apply --addr :8080.

The tests: gate is enforced client-side, inside apply. A bare authenticated POST /v1/reload against the daemon (bypassing apply) loads and validates Cedar syntax but does not run the policy's own tests — it can activate a policy that would have failed its declared tests: block. Always ship changes through raxit apply, not a direct reload call.
--watch (an explicit dev inner-loop, re-applying on file change) is a documented follow-up, not implemented.
Dev daemons (raxit dev, as opposed to serve) expose no /v1/reload route at all — apply detects the 404 and prints an honest "restart to activate" message rather than pretending the swap happened.