raxit status

raxit status is the one-shot health check: is a daemon reachable, is there a compiled policy, is enforce mode on, is the audit chain intact.

Usage

Before any daemon has been started:

$ raxit status
raxit status

Daemon:
  [--]  not reachable (localhost:8181) -- daemon may not be running

Local policy artifacts:
  [ok]  security.yaml present
  [--]  compiled policy present (governance.cedar)
        enforce mode: false

Audit log:
  [--]  audit file present

After a daemon is up but before any apply:

$ raxit status
raxit status

Daemon:
  [ok]  reachable (localhost:8181)
        pending approvals: 0

Local policy artifacts:
  [ok]  security.yaml present
  [--]  compiled policy present (governance.cedar)
        enforce mode: false

Audit log:
  [--]  audit file present

$ raxit status --json
{
  "daemon_reachable": true,
  "daemon_addr": "localhost:8181",
  "pending_approvals": 0,
  "enforce_mode": false,
  "security_yaml_present": true,
  "compiled_artifact_present": false,
  "audit_present": false
}

After raxit apply:

$ raxit status
raxit status

Daemon:
  [ok]  reachable (localhost:8181)
        pending approvals: 0

Local policy artifacts:
  [ok]  security.yaml present
  [--]  compiled policy present (governance.cedar)
        policy hash:  e1096c1fd92d9c5f
        enforce mode: true

Audit log:
  [ok]  audit file present
        records: 1
  [ok]  chain integrity OK

Version history: 1 snapshot(s) (raxit rollback --list)

Flags

--addr <host:port> — daemon to check (defaults to localhost:8181).
--json — machine-readable output, same fields shown above.

Gotchas

The "[--] compiled policy present (governance.cedar)" line checks for a local file, not the daemon's in-memory state — in daemon-attached mode, .raxit/governance.cedar is never written to disk even after a successful apply, so that line can keep showing [--] while policy hash:/enforce mode: (which come from the daemon, not the file) correctly report the live state. Don't read the dash as "nothing was applied."
status's daemon address default (localhost:8181) matches apply/plan/agent, not raxit serve's own bare default (:8080) — see the dev & serve gotcha if status reports "not reachable" against a daemon you know is running.

raxit status

Usage

Flags

Gotchas

On this page