autonomy policy inspect

Inspect a policy bundle (.tar.gz, directory, or built-in)

Synopsis

Inspect a policy bundle and print its manifest fields and rego file list.

Pair any path with --show-source to print the full Rego content of each
file (in canonical bundle-hash order). For --bundle the rego is verified
against the manifest bundle_hash first, so you read the exact rules the
runtime loaded — closing the decision → policy_ref → actual-Rego loop.

Canonical path (--bundle):
  Reads manifest.json from a .tar.gz archive (the canonical MVP format
  produced by "autonomy policy build").

Built-in path (--embedded):
  Inspects the policy bundle compiled into this autonomy binary — the
  same one that drives "autonomy demo openclaw" and "autonomy demo
  policy".  Useful when you have a single binary and want to see exactly
  which rules produced the decisions in your local WAL, with no checkout
  or network round-trip.  Pair with --show-source to print the full
  Rego content alongside the manifest.

Legacy path (--dir):
  Reads manifest.json (preferred) or manifest.toml (legacy fallback) from
  a directory.  Use --bundle for canonical inspection.

Exactly one of --bundle, --embedded, or --dir may be specified.

Usage

autonomy policy inspect [flags]

Options

      --bundle string   path to .tar.gz bundle archive (canonical format, preferred)
      --dir string      [DEPRECATED] directory containing manifest.json or manifest.toml; prefer --bundle for .tar.gz
      --embedded        inspect the policy bundle compiled into this binary (the one that drives autonomy demo openclaw and demo policy)
      --show-source     print the full Rego source of each file (works with --bundle, --embedded, and --dir)

Options inherited from parent commands

      --require-signed-manifest   Refuse to start if the SHA256SUMS release manifest or its cosign signature is missing/invalid (Tier 2 binary-integrity check; default: build-time compile-in via -ldflags -X, build-hardened artifacts=true, all others=false)

See also