app.cli

The adriano command line (admin processes run as one-off commands).

Commands:

  • adriano check-config – load ADRIANO_CONFIG_FILE and print the registrations, the approval policy status, the RBAC roles, the authentication status (oidc, dev, oidc+dev or unconfigured) and every problem. Needs no database. Exit code 0 without errors (warnings allowed), 1 otherwise.

  • adriano poll [--source ID] – sync registrations into the database and poll every pollable registration (or one). Exit code 0 when every polled registration is ok, 1 when any is partial, failed or disabled, 2 for usage errors (unknown --source) or when the registrations cannot be synced.

  • adriano mint-dev-token --sub SUB [--name N] [--email E] [--roles a,b] [--minutes N] – print a dev-only HS256 access token signed with ADRIANO_DEV_SHARED_SECRET (exit code 2 when the secret is not set). Roles go to ADRIANO_OIDC_ROLES_CLAIM.

  • adriano seed-synthetic --records N --projects M --source-id ID [--seed 42] [--candidates-ratio 0.1] [--decisions-ratio 0.3] [--force] – generate and ingest a deterministic synthetic ADR corpus for benchmarking (see app.services.seed_synthetic). Refuses a database whose name does not look like dev/test/bench unless --force is given. Exit code 2 on usage or database errors.

  • adriano migrate – apply the database migrations (alembic upgrade head) under a PostgreSQL advisory lock, so concurrent runs (replicas, init containers) are safe. Exit code 0 on success, 2 when the database is unreachable or a migration fails.

  • adriano serve – the container command: when ADRIANO_MIGRATE_ON_START is true (the default), run the same locked migration first (exit code 2 if it fails), then replace this process with Uvicorn serving app.main:app on 0.0.0.0:8000 with ADRIANO_WORKERS workers (and ADRIANO_FORWARDED_ALLOW_IPS as --forwarded-allow-ips when set).

Outbound TLS: check-config, poll, seed-synthetic and serve build the shared outbound TLS context (app.tls) before doing anything else, so an unloadable ADRIANO_EXTRA_CA_CERTS entry stops them with exit code 2 (serve before migrating). migrate and mint-dev-token make no outbound HTTPS calls and do not load it: a broken CA mount must not block the schema migration (the server container still refuses to start). Every command except mint-dev-token logs to stderr at INFO, which includes the list of extra CA certificates.

Scheduling is external (cron, Kubernetes CronJob); see docs/developer/decisions/0008-external-poll-job.rst. This module only phrases results; the work is done by app.services.

Public API: main(), run().

app.cli.OUTBOUND_COMMANDS = frozenset({'check-config', 'poll', 'seed-synthetic', 'serve'})

Commands that can make outbound HTTPS calls (OIDC, network sources); they load the outbound TLS context first.

app.cli.SERVE_HOST = '0.0.0.0'

Address and port adriano serve binds (the image’s EXPOSE).

app.cli.uvicorn_argv(settings)

Build the Uvicorn command line of adriano serve.

Uvicorn runs with this interpreter, so it always comes from the same environment as the application.

Parameters:

settings (Settings) – Application settings.

Return type:

list[str]

Returns:

The argument vector, executable first.

app.cli.main(argv=None, *, settings=None, out=None)

Run the CLI.

Parameters:

  • argv (Sequence[str] | None) – Arguments without the program name (default: argv).

  • settings (Settings | None) – Settings override (default: from the environment).

  • out (TextIO | None) – Output stream (default: stdout).

Return type:

int

Returns:

Exit code.

app.cli.run()

Console-script entry point (adriano).

Return type:

None