CLI reference

Every command accepts explicit global paths:

opsctl \
  --registry /srv/server-registry \
  --state-dir /var/lib/opsctl \
  <command> --json

Status and diagnosis

opsctl status --json
opsctl services --json
opsctl ports --json
opsctl doctor --json
opsctl scan --json
opsctl audit --json

Registry and drift

opsctl registry validate --json
opsctl registry drift list --json
opsctl registry drift explain <drift-id> --json
opsctl registry drift cleanup-request progress <request.yml> --json

Plan and deploy

opsctl analyze <project-root> --json
opsctl plan <project-root> --json
opsctl preflight <plan.yml> --json
opsctl snapshot <plan.yml> --dry-run --json
opsctl deploy <plan.yml> --dry-run --json

Backup and recovery

opsctl backup doctor --json
opsctl backup readiness --json
opsctl backup history --json
opsctl backup plan <service-id> --dry-run --json
opsctl backup restore-plan <service-id> --help
opsctl backup volume-protect lab-qualify --json

Evidence and governance

opsctl registry drift cleanup-request audit-verify --json
opsctl registry drift cleanup-request evidence-key-status --json
opsctl registry drift cleanup-request evidence-verify-all --json
opsctl backup volume-protect retention-status --json
opsctl backup volume-protect archive-drill-status --json
opsctl backup volume-protect key-dr-status --json
opsctl backup volume-protect slo --json

Human interfaces

opsctl tui
opsctl tui --dump --json
opsctl mcp

Confirm before execution

--execute mutates state. First run the same parameters without it, inspect targets, paths, limitations, and approval token, then enter a maintenance window.