dev & serve

raxit dev runs a local demo runtime for iterating on a policy — it streams decisions and prints an operator token, but exposes no /v1/reload route (restart to pick up changes). raxit serve runs the out-of-process decision daemon that run/apply/status/plan/ approvals/agent all attach to — this is what a real deployment runs.

raxit serve

serve refuses to start with the approvals API enabled on a non-loopback-only listener unless a token is supplied:

$ raxit serve --source .raxit/security.yaml
raxit serve: --approvals-token or RAXIT_APPROVALS_TOKEN must be set (approvals API is enabled and the listener is not loopback-only)

Correct startup, token via env, addr aligned to the client default:

$ RAXIT_APPROVALS_TOKEN=my-token raxit serve --source .raxit/security.yaml --addr localhost:8181
raxit: WARNING: audit log .raxit/var/daemon-audit.jsonl is UNSIGNED (no Ed25519 key found at --sign-key). Records are still hash-chained but carry no signature. Run `raxit keys init` for tamper-evident R5 evidence.
raxit serve: decision daemon on localhost:8181 (policy .raxit/security.yaml ve1096c1fd92d9c5f)

Both lines print to stderr. The "UNSIGNED audit log" warning is unconditional unless --sign-key is set (or raxit keys init has been run beforehand) — audit records are always hash-chained, but per-record Ed25519 signing is opt-in.

raxit dev

$ raxit dev --listen localhost:8282
operator token: bd8744f561f4817b8cc304bb43bcfa393d446150
raxit: WARNING: audit log .raxit/var/dev-audit.jsonl is UNSIGNED (no Ed25519 key found at --sign-key). Records are still hash-chained but carry no signature. Run `raxit keys init` for tamper-evident R5 evidence.
✓ Loaded .raxit/security.yaml
✓ Policy compiled in memory
✓ Watching payments-bot
✓ Listening localhost:8282

dev prints a freshly-generated operator token on every start — it is not the same value across runs; capture your own rather than reusing one from a doc or a previous session.

Flags

• --source <path> — security.yaml to load.
• --addr / --listen <host:port> — listener address (serve uses --addr, defaulting to :8080; dev uses --listen, defaulting to localhost:8181).
• --approvals-token <token> (or RAXIT_APPROVALS_TOKEN) — required by serve when the listener is not loopback-only and the approvals API is enabled.
• --sign-key <path> — enable Ed25519 signing of audit records (see raxit keys init).

Gotchas

• dev exposes no /v1/reload endpoint — raxit apply against a dev daemon compiles, tests, and records the policy locally but prints an honest "restart to activate" message rather than claiming a live swap happened.
• Neither dev nor serve writes a compiled .cedar file to disk by default in daemon-attached mode — the compiled policy lives in the daemon's memory; raxit status's local-file check can still show [--] even with a policy actively enforced (see status).