raxit run

raxit run executes an agent command under governance with zero code changes — it auto-patches the detected framework's tool-dispatch path so every tool call routes through a decision before it executes.

Usage

$ RAXIT_AGENT_ID=default-agent raxit run --addr localhost:8181 -- python agent.py
raxit run: using existing daemon at http://localhost:8181
raxit run: posture — identity=adopted daemon (identity posture owned by that daemon) · credential-broker=off · ambient=present (NOT stripped) · enforce=enforce
[raxit] waiting for human approval (up to 120s)… approval id dt_1373bb3e0bcf139d

[raxit PENDING] 'post_to_webhook' deferred — waiting for human approval (up to 120s).
  Token:   dt_1373bb3e0bcf139d
  Approve: raxit approvals approve dt_1373bb3e0bcf139d
  Deny:    raxit approvals deny dt_1373bb3e0bcf139d
[raxit] approval expired (id dt_1373bb3e0bcf139d)

>>> agent calls calc({'expression': '21 * 2'})
<<< result: 42

>>> agent calls read_customer_db({'query': 'select * from customers limit 1'})
<<< result: row1: name=Jane Doe, email=jane@example.com, ssn=123-45-6789

>>> agent calls post_to_webhook({'url': 'https://example.com/hook', 'payload': 'hi'})
<<< [raxit BLOCKED] 'post_to_webhook' denied (reason: deny.approval_expired). The operation was not executed. Details: raxit explain d867c63661454e8497369a08ebaec35d

calc and read_customer_db permit and execute normally. post_to_webhook matched a review rule, deferred for human approval, and — unapproved within the timeout — was denied with deny.approval_expired. The denial carries a raxit explain <call_id> follow-up so you can go straight from a blocked call to its full decision trace.

If a human runs raxit approvals approve dt_1373bb3e0bcf139d while the call is pending, the same run permits instead:

[raxit] approval approved (id dt_28930b3bf7da664a)

>>> agent calls post_to_webhook({'url': 'https://example.com/hook', 'payload': 'hi'})
[webhook] would POST to https://example.com/hook: hi
<<< result: ok

Flags

• --agent-id <id> (or RAXIT_AGENT_ID) — the identity bound to every governed call.
• --addr <host:port> — daemon to attach to; if none is reachable, run starts its own in-process engine instead of failing.
• --strip-ambient (or RAXIT_STRIP_AMBIENT=1) — strip ambient cloud/secret env vars (AWS_*, VAULT_*, GOOGLE_*, GITHUB_TOKEN, …) from the spawned agent's environment before exec. Off by default because the agent commonly needs its own credential (e.g. its own LLM API key) just to run.
• -- <command...> — the agent process to launch, unmodified.

Gotchas

• The posture line (identity=… · credential-broker=off · ambient=present (NOT stripped) · enforce=…) is printed unprompted on every run — read it before assuming ambient credentials are being stripped or a broker is active.
• Framework autopatch can self-report a degraded confidence state without failing open, e.g.: raxit: live-wire canary INCONCLUSIVE for langchain (could not drive a sentinel through the public dispatch path); destructive-only drift detection remains active for it. The canary is a startup self-check that drives a test call — the "sentinel" — through the framework's real dispatch path to prove interception is live; this message means that self-check couldn't fully verify the patched dispatch path, not that governance failed.
• A denied tool call raises RaxitDenied in the SDK; the harness process itself still exits 0 if your agent code catches it. Denial stopping a tool from executing is not the same as the agent process crashing.