The command line, as the code reads it.

This page lists every subcommand and flag of six entry points: the lens command, the development driver, and four Python modules. Each row comes from the argument parser or the dispatch code in the file named in its section. Where a help text or a module comment disagrees with the code, this page follows the code.

For Docker administration, use ./lens graph and ./lens connectors for the two Python modules, or ./lens exec -- python -m ... for any module; the lens command section lists the tree. ./lens uploads host files given with --file, --mapping, --fixture or --enrolment, and copies a host file given with --out back after the command succeeds. Upload any other input file on standard input first, then pass its containerContainerA running program with its own packaged software and isolated environment, managed by Docker on the host. path:

./lens exec -- sh -c 'cat > /tmp/answers.json' < answers.json

GraphGraphA model made of units and links between them. In NovusLens it records teams, services and their dependencies. materialise and requeue commands need --host mesh-0 in Docker. Pass --viewer with the account chosen during setup when a command requires an operator.

Use ./lens run -- <command> for a fresh CLICLICommand-line interface: commands you type into a terminal to operate software. container, or ./lens exec -- <command> in a running service. Both use the installation configuration.

./lens

The one entry point for an installation, its running services and the developer checks, at the repository root. It needs Python 3.9 or newer; Preparing deletion needs no Docker. Other commands except help, version, doctor and some dev scripts need Docker. The ./ops and installer script entry points hand their arguments to it. The operator shell how-to shows it in use.

Usage: ./lens [global options] <command> [options] [arguments]. Run ./lens <command> --help for one command. For graph and connectors, put --directory and --version after the command and before the verb, as in ./lens graph --directory /srv/lens create-viewer --help. Everything after the verb belongs to the command.

Every command runs the release that .novuslens.env records. A --version in a different mode, such as dev on a ghcr installation, is refused; change the mode with start --init.

The commands that run in a service read .novuslens.env from the --directory option, then the NOVUSLENS_INSTALL_DIR variable, then the directory that holds ./lens. They copy a host file given with --file, --mapping, --fixture or --enrolment into the service’s /tmp and pass the new path on. A host path given with --out is written in the service, then copied back to the host when the command succeeds.

Without --install-colima or --install-docker, ./lens prints the install commands and asks before running them. Without a terminal it refuses and names the flag. It never pipes a downloaded script to a shell.

./lens ops

The development driver, at the repository root. It is contributor tooling. It stops any mesh processes it finds, resets the read modelRead modelThe database tables used by the map, Ask and Find. NovusLens rebuilds these tables from its history of recorded changes. between runs, and runs the sidecarSidecarA separate supporting process that runs beside the application. Here it runs Mycelium and exposes the gateway that NovusLens calls. without persistence. Use the Compose installation commands for customer data.

Usage: ./lens ops --version dev <subcommand>. An unknown subcommand exits with code 64.

Only --version dev needs a source checkout. Any other version runs in its ops container from the source in that image, so a lens copied alone onto a host can run ./lens ops kit. That lens keeps the image’s controller files in .novuslens-ops/<version>/.

Most subcommands take no arguments. test accepts test paths. gates accepts a named group or --list. answers passes its arguments to scripts/answer_eval.py.

The runner takes the first free port from 3112 and prints its address. Every command in that runner uses the same port. Set NOVUSLENS_GATE_UI_PORT to a free port from 1 to 65535 when another demo uses it. Browser tests follow the selected port. UI cleanup checks the command and worktree before stopping a server; it refuses a Docker port forwarder or another worktree’s UI.

./lens graph

SourceSourceA document, interview statement, measurement or export that supports a value. Each source has a date and a stated scope.: apps/graph/src/conway_graph/__main__.py. It migrates the database, materialises the read model from the mesh log, computes the twin, and administers viewers and organisations.

The database comes from DATABASE_URL. The customer profile refuses to start without it. A database that is down answers in plain words, not a traceback.

No top-level flags. Each subcommand takes its own.

Every subcommand also takes an output flag. --rich, the default, formats the result and colours it on a terminal. --plain prints the same lines with no colour or layout. Scripts that read the output use it. --json prints one JSONJSONJavaScript Object Notation: a text format for data, using named fields, lists and values. Configuration files and service messages use it. document with ok and command keys. A refusal under --json is a document with ok: false and an error. --wizard asks for each flag in turn, offering the value given or the flag’s default. It asks on standard error and needs a terminal. Without one it exits 2 with a usage message, as a bad flag does, even under --json. Messages name the command as you ran it, so a repair that ./lens graph prints starts with ./lens graph.

./lens connectors

Source: apps/connectors/src/conway_connectors/__main__.py. It brings evidence into the twin from feeds, cloud inventories, operational systems, documents and an estate’s boundary feedBoundary feedRecords supplied by the customer’s own systems about activity at the edge of an agent or service. NovusLens reads those records; it does not watch the agent., and it runs the corrector.

The top-level flags go before the subcommand.

The subcommands are grouped below. Each row names its flags.

Feeds and correction

Operational systems

Acquire flags

Estate boundary

Assurance

Assurance inputs are one scope, one period, with coverageCoverageWhat the available records cover, and what is missing. A count such as “3 of 5 dependencies measured” names the measured portion and the gap. stated. They are never an opinion.

Notices

Notices tell a recipient when a finding opens. They are oversight, never control: a notice carries no action.

Agent evidence sources

Source enrolment flags

Domain model and documents

Document flags

./lens exec: reasoning service

Source: apps/reasoning/src/conway_reasoning/serve.py. It runs the reasoning service, which the browser reaches through the Next.jsNext.jsThe web framework used to build and run the NovusLens interface. It provides pages, server code and request handlers. proxy. It takes no subcommands.

Behaviour that depends on the profile:

• In the customer profile the service refuses to start without CONWAY_SERVICE_TOKEN and MYCELIUM_GATEWAY_TOKEN.
• In the customer profile the analysis tools are not registered on the mesh gateway, because a gateway bearerBearer tokenA secret value sent with a request to prove that the caller holds it. Anyone who obtains it can use it, so it must be protected. does not identify a viewer. Set NOVUSLENS_MCP_EXPOSE=1 to register them anyway.
• In the customer profile every route requires the service tokenService tokenA secret value sent with requests between NovusLens services. The receiving service refuses requests with a missing or wrong value. header, except /health and /ready, which carry only liveness and the projectionProjectionThe regular pass that brings the read model up to date with the canonical log. It runs every 30 seconds by default. age. Requests reach the service only through the UI.

./lens exec: projection worker

Source: apps/reasoning/src/conway_reasoning/project.py. It is the projection loop. It advances the read model at regular intervals, so the picture moves when the log moves rather than when a user clicks. Compose runs it as the projector service. It takes no subcommands.

Each pass, for each organisation, retries quarantined entries and materialises new commits. It then delivers the agent-evidence outboxOutboxA database list of saved messages waiting to be published. A message stays on the list until its progress is recorded. and refreshes the engines, but only when the pass applied or retried something. Every pass is recorded in projection_runs, and every surface reads the latest row as its “records as of” time. A database outage is retried with a backoffBackoffA delay before retrying a failed operation. The delay usually grows after repeated failures to avoid making an outage worse. from 5 seconds, doubling to 60 seconds. The loop does not exit on it.