`autonomy bundle`¶

Manage AutonomyOps bundles (pull, push, inspect, verify)

Synopsis¶

Commands for the full AutonomyOps bundle lifecycle: fetch, publish,
inspect, and verify bundle artifacts in OCI registries.

A bundle encapsulates a policy, optional model weights, and a runtime
configuration into a single versioned OCI artifact.

Typical operator workflow:
  autonomy bundle push  ./robot.tar  registry/robot-behavior:v1
  autonomy bundle verify registry/robot-behavior:v1 --pub-key ./cosign.pub
  autonomy bundle pull   registry/robot-behavior:v1 --out ./robot.tar
  autonomy bundle inspect registry/robot-behavior:v1

Options inherited from parent commands¶

      --require-signed-manifest   Refuse to start if the SHA256SUMS release manifest or its cosign signature is missing/invalid (Tier 2 binary-integrity check; default: build-time compile-in via -ldflags -X, build-hardened artifacts=true, all others=false)

Subcommands¶

autonomy bundle inspect — Display manifest metadata for a bundle
autonomy bundle pull — Pull a bundle artifact from an OCI registry
autonomy bundle push — Push a bundle tarball to an OCI registry
autonomy bundle stage — Stage a bundle tarball to the local bundle store (air-gapped)
autonomy bundle verify — Verify supply-chain integrity of a bundle (cosign + BLAKE3)