raxit plan

raxit plan shows the rule-level decision diff your current .raxit/security.yaml would produce, before you run apply — read-only, nothing is changed.

Usage

plan behaves differently depending on what's already enforced.

Fresh init, nothing applied yet:

$ raxit plan
raxit plan: 4 changes vs empty baseline (nothing applied yet)
  + calc              (agent default-agent): (new) -> allow  [permit]
  + post_to_webhook   (agent default-agent): (new) -> allow  [permit]
  + read_customer_db  (agent default-agent): (new) -> allow  [permit]
  default: (unset) -> block
  0 removed · 0 unchanged
Run `raxit apply` to enforce.

Right after apply, nothing edited since:

$ raxit plan
no changes. policy e1096c1fd92d is up to date.

After editing a rule, against a live daemon:

$ raxit plan
raxit plan: 1 change vs running policy e1096c1fd92d (daemon localhost:8181)
  ~ post_to_webhook  (agent default-agent): allow -> review [defer]
  0 removed · 2 unchanged
Run `raxit apply` to enforce.

plan compares against the running daemon's policy when one is attached, and against the last-applied local state otherwise — the header line always names which baseline it diffed against.

--imports

raxit plan --imports previews what a security.yaml import: list would add or shadow, without touching anything. On a project with no imports it's a no-op:

$ raxit plan --imports
Import impact: adds 0 rules, shadows 0 existing rules, affects 0 resources

Imports:
  (none)
Changes:
  (no changes)
0 added, 3 unchanged, 0 shadowed

With real import: entries the counts reflect rules the imported policy pack would add versus rules it would shadow (override) in your local file.

Flags

• --imports — preview import/merge impact instead of the enforced-policy diff.
• --addr <host:port> — daemon to diff against (defaults to localhost:8181, matching apply/status/agent — see the dev & serve gotcha if you started serve on its own bare default).

Gotchas

• plan is always read-only — it never compiles a new policy artifact or touches the daemon. Nothing is "planned" as a file; it's a live diff computed on each invocation.
• The three output shapes (empty baseline / no changes / diff vs running policy) are distinct states, not formatting variants — the header line tells you which baseline was used.