autonomy release activate

One command: stand up a signed release locally and return the active lock_fingerprint

Synopsis

Bootstrap a complete signed-release + active-lock environment locally, in one
command, and return the active lock_fingerprint — collapsing the manual
registry / cosign / attach / sign / verify / orchestrator / release dance.

Steps (each reuses the corresponding autonomy primitive):
  1. start a local Zot registry (docker compose)
  2. generate a cosign keypair
  3. push a test artifact
  4. attach a policy sidecar + build the BLAKE3 lock
  5. attach the lock + sign (image + lock + policy)
  6. verify the signature chain
  7. start autonomy-orchestrator
  8. POST /v1/releases with the lock fingerprint

On success it prints the active lock_fingerprint and the exact 'autonomy run'
command to start a runtime that adopts it. Requires docker, cosign, and
autonomy-orchestrator on PATH (checked up front with actionable errors).

Example:
  autonomy release activate --local
  autonomy release activate --local --channel canary --work-dir ./.rel --registry-port 5001

Usage

autonomy release activate --local [flags]

Options

      --channel string               release channel to publish under (default "stable")
      --image string                 repo:tag for the demo artifact (under the local registry) (default "demo-agent:v0.1.0")
      --keep                         leave the registry + orchestrator running (the runtime needs them); --keep=false tears down (default true)
      --local                        run the whole bootstrap locally (currently required)
      --notes string                 release notes (default "local bootstrap via `autonomy release activate --local`")
      --orchestrator-listen string   address the orchestrator listens on (default "127.0.0.1:8888")
      --poll-interval string         poll interval printed in the runtime start command (default "10s")
      --registry-port int            local registry port (default 5000)
      --work-dir string              scratch dir for keys, compose files, lock, and orchestrator data (default ".autonomy-release")

Options inherited from parent commands

      --require-signed-manifest   Refuse to start if the SHA256SUMS release manifest or its cosign signature is missing/invalid (Tier 2 binary-integrity check; default: build-time compile-in via -ldflags -X, build-hardened artifacts=true, all others=false)

See also