diff --git a/README.md b/README.md index 0050c02..7d7df39 100644 --- a/README.md +++ b/README.md @@ -112,6 +112,21 @@ injected into workloads run by Agent Lab. See [Architecture](docs/architecture.md) for the complete data flow, state model, configuration authority, and control-plane/data-plane split. +## Experiments + +Agent Lab also has a separate v0alpha1 onboarding path for Experiments. An Experiment is authored as +one declarative `experiment.cue` file and can enter from a closed directory, a bounded ZIP archive, +or an exact commit in a supported public GitHub repository. Agent Lab snapshots the source, +validates it with the pinned CUE contract, resolves every image selector to an immutable subject, +freshly evaluates the install policy with Cedar, and, only on a permit, can retain the resulting +evidence in a private local Agent Lab home. + +This path stops at onboarding evidence. It does not run Experiment content, invoke Docker, acquire +image bytes, claim image admission, or create a workload network. Start with the +[Experiments guide](docs/experiments.md); use [Local installation](docs/installation.md) to prepare +the CLI and private home, and [Local image names](docs/images.md) for operator-managed image +mappings. + ## Controlled configuration The workload path exposes four primary adaptation seams, a persistence switch, and bounded @@ -149,9 +164,10 @@ See [Development and verification](docs/development.md) and [CI gate mapping](do ## Documentation -Use the [documentation map](docs/README.md) for the complete index. The three main paths are: +Use the [documentation map](docs/README.md) for the complete index. The four main paths are: - [Operate Agent Lab](docs/operations.md) +- [Author, check, and install Experiments](docs/experiments.md) - [Understand the architecture and security model](docs/architecture.md) - [Develop and verify the repository](docs/development.md) @@ -169,6 +185,8 @@ Formal hard stops and guarantees remain in [SECURITY.md](SECURITY.md) and audit before relying on the same boundary. - Browser automation, cloud infrastructure, and production deployment are outside the current guarantee. +- Experiment onboarding retains checked and authorized local evidence only. Experiment execution, + image acquisition and admission, start/stop, and stored-artifact uninstall are not implemented. Do not weaken containment to work around a failed command. A refusal or exit status 125 is evidence to diagnose, not permission to bypass the control. diff --git a/docs/README.md b/docs/README.md index 515d1ef..237d3ce 100644 --- a/docs/README.md +++ b/docs/README.md @@ -1,7 +1,7 @@ # Agent Lab documentation -This directory separates normal Agent Lab operation from repository development and from the formal -security model. Use the guide that matches the job you are doing. +This directory separates normal Agent Lab operation, Experiment onboarding, repository development, +and the formal security model. Use the guide that matches the job you are doing. ## I want to… @@ -14,12 +14,15 @@ security model. Use the guide that matches the job you are doing. | Permit a narrow set of outbound destinations | [Operations: egress](operations.md#enable-narrow-egress) | | Understand what persists and erase Agent Lab state | [Operations: state and cleanup](operations.md#state-and-cleanup) | | Diagnose a startup, mount, image, or network refusal | [Operations: troubleshooting](operations.md#troubleshooting) | +| Install the local CLI and initialize a private Agent Lab home | [Local installation](installation.md) | +| Author, check, authorize, install, or inspect an Experiment | [Experiments](experiments.md) | +| Manage shared local image names for Experiments | [Local image names](images.md) | | Develop this repository | [Development and verification](development.md) | | Configure Claude, Codex, or Grok for repository development | [Development-agent configuration](agent-config.md) | | Reproduce a GitHub check locally | [CI gate mapping](ci.md) | | Audit the security claims and residual risks | [Security policy](../SECURITY.md) and [threat model](../THREAT_MODEL.md) | -## Command map +## Runtime and verification command map | Command | Role | |---|---| @@ -38,6 +41,44 @@ The commands are not interchangeable. In particular, a successful `doctor`, Comp external acceptance request does not prove runtime containment. The Docker gate supplies that evidence. +## Experiments + +Experiment onboarding is a separate local control-plane workflow. Read these guides in order for a +first installation, or jump directly to the guide that owns the state you are changing: + +| Guide | Canonical subject | +|---|---| +| [Local installation](installation.md) | install the verified CLI bundle, initialize a private home, and provision pinned CUE and Cedar tools | +| [Experiments](experiments.md) | author, check, authorize, install, and inspect one declarative Experiment | +| [Local image names](images.md) | map an operator-owned name to an immutable OCI subject for use by Experiments | + +The current Experiment lifecycle stops after a permitted install stores verified onboarding +evidence. It does not run content, invoke Docker, acquire or admit image bytes, create a network, or +start a workload. Linux is the supported v0alpha1 host; see the Experiments guide for the +operation-specific limits. + +### Experiment command map + +These commands use the installed `agent-lab` CLI and its explicit or configured private home. They +are distinct from the `./scripts/agent` workload launcher above. + +| Command | Role | +|---|---| +| `agent-lab --home ABSOLUTE_HOME init` | initialize the private local control-plane home | +| `agent-lab --home ABSOLUTE_HOME tools provision` | acquire and verify the pinned CUE and Cedar tools | +| `agent-lab --home ABSOLUTE_HOME experiment check SOURCE` | validate and resolve one source without durable Experiment state | +| `agent-lab --home ABSOLUTE_HOME experiment authorize install SOURCE` | preview a fresh source- and plan-bound install decision | +| `agent-lab --home ABSOLUTE_HOME experiment install SOURCE` | freshly check and authorize, then retain a closed evidence envelope only on permit | +| `agent-lab --home ABSOLUTE_HOME experiment inspect NAME` | verify and report one retained Experiment without repair | +| `agent-lab --home ABSOLUTE_HOME image add NAME DIGEST_REF` | add an operator-local image-name mapping | +| `agent-lab --home ABSOLUTE_HOME image inspect NAME` | verify and report one image-name mapping | +| `agent-lab --home ABSOLUTE_HOME image list` | list active local image-name mappings | +| `agent-lab --home ABSOLUTE_HOME image remove NAME --expect ENTRY_DIGEST` | compare-and-swap remove one image-name mapping | + +Uppercase words are syntax placeholders. `SOURCE` is a directory, `--zip ARCHIVE`, or +`--git https://github.com/OWNER/REPOSITORY.git --commit COMMIT_ID`. The +[Experiments guide](experiments.md#source-formats) defines each form and its bounds. + ## Documentation ownership | Document | Canonical subject | @@ -50,6 +91,9 @@ evidence. | [Development](development.md) | maintainer workflow and local evidence | | [CI](ci.md) | required GitHub checks and exact replay model | | [Development-agent configuration](agent-config.md) | repository agent policy and adapters | +| [Local installation](installation.md) | verified local program bundle, private home, tools, and stored evidence layout | +| [Experiments](experiments.md) | authored format, source intake, planning, authorization, and onboarding lifecycle | +| [Local image names](images.md) | shared local Experiment image-name authority and mutation rules | Component READMEs document only their local implementation: diff --git a/docs/experiments.md b/docs/experiments.md index af7be1e..7536b45 100644 --- a/docs/experiments.md +++ b/docs/experiments.md @@ -1,11 +1,87 @@ # Experiments -An Experiment is authored as data in a directory containing exactly one file, `experiment.cue`, in a -bounded ZIP archive containing that exact sole member, or at one exact commit of a supported public -GitHub repository whose root tree contains that exact sole blob. The file defines one concrete value -named `experiment` in package `experiment`. Agent Lab snapshots the exact authored bytes privately -before evaluating them; extra entries, links, special files, suspicious modes, changing sources, -malformed CUE, and unknown schema fields are refused. +Experiments are Agent Lab's v0alpha1 format for accepting a declarative workload description as +data. Agent Lab snapshots the authored bytes, validates them with the release-pinned CUE contract, +resolves image selectors to immutable OCI subjects, evaluates the release-pinned Cedar install +policy, and, only on a permit, can retain the resulting evidence in a private local home. + +> **Current boundary:** Experiment onboarding does not run source, invoke Docker, contact an image +> registry, acquire or admit image bytes, create a network, or start a workload. Start, stop, +> runtime removal, and stored-artifact uninstall are not implemented. + +The supported v0alpha1 host is Linux. Experiment installation and public Git intake require Linux; +local image-catalog mutations do as well. A policy `permit` is evidence for one exact candidate under +the current fixed local compatibility principal. It is not user authentication, human approval, +image admission, or a reusable installation capability. + +## Try the onboarding lifecycle + +This checkout-local walkthrough creates a disposable CLI prefix and Agent Lab home, then exercises +the complete supported directory-source onboarding path against the inert test fixture. A cold tool +cache requires network access for the explicit provisioning step. + +```bash +( +set -euo pipefail + +experiment_demo_root="$(mktemp -d)" +experiment_cli="$experiment_demo_root/prefix/bin/agent-lab" + +./scripts/install-local --prefix "$experiment_demo_root/prefix" +"$experiment_cli" --home "$experiment_demo_root/home" init +"$experiment_cli" --home "$experiment_demo_root/home" config check +"$experiment_cli" --home "$experiment_demo_root/home" tools provision + +"$experiment_cli" --home "$experiment_demo_root/home" \ + experiment check tests/experiment/fixtures/directories/minimal +"$experiment_cli" --home "$experiment_demo_root/home" \ + experiment authorize install tests/experiment/fixtures/directories/minimal +"$experiment_cli" --home "$experiment_demo_root/home" \ + experiment install tests/experiment/fixtures/directories/minimal +"$experiment_cli" --home "$experiment_demo_root/home" \ + experiment inspect first-experiment + +printf 'Demo state: %s\n' "$experiment_demo_root" +) +``` + +`tools provision` is the only command in this sequence that downloads tools. It acquires and +verifies the pinned CUE and Cedar releases. The remaining commands do not contact Docker or the +fixture's example registry. The final line prints the retained disposable state location. +The walkthrough intentionally leaves that isolated directory in place for inspection. Because the +retained records are read-only and no uninstall command exists, cleanup is an explicit host action. + +For persistent use, follow [Local installation](installation.md) to install the CLI, put its `bin` +directory on `PATH`, initialize an explicit private home, and provision the tools once. Normal +Experiment commands never download missing tools automatically. + +## Lifecycle and effects + +```text +directory | bounded ZIP | exact public Git commit + -> private source snapshot + -> pinned CUE validation and immutable image resolution + -> fresh Cedar install decision + -> on permit, closed local evidence envelope +``` + +Each source-taking command snapshots its own source; output from one command is never authority for +the next. + +| Stage | Command | Durable effect | +|---|---|---| +| Check | `experiment check` | none; emits source, plan, and applicable catalog evidence | +| Authorize preview | `experiment authorize install` | none; emits a fresh source- and plan-bound Cedar decision | +| Install | `experiment install` | freshly repeats check and authorization, then retains a closed evidence envelope only on permit | +| Inspect | `experiment inspect NAME` | none; verifies and reports one retained envelope without repair | + +The preview forms do not create durable Agent Lab state or execute Experiment content. Public Git +previews do perform the bounded network acquisition described under [Public Git](#public-git). + +## Author an Experiment + +A directory source contains exactly one file named `experiment.cue`. The file uses package +`experiment` and defines one concrete value named `experiment`: ```cue package experiment @@ -22,100 +98,164 @@ experiment: { } ``` -Check the artifact or preview its install authorization from the repository: +The schema is closed: unknown fields, incomplete values, mutable image references, duplicate member +names, and unsupported values are rejected. -```bash -./scripts/agent-lab experiment check ./my-experiment -./scripts/agent-lab experiment authorize install ./my-experiment -./scripts/agent-lab experiment check --zip ./my-experiment.zip -./scripts/agent-lab experiment authorize install --zip ./my-experiment.zip -./scripts/agent-lab experiment check --git https://github.com/owner/repository.git --commit <40 lowercase hex> -./scripts/agent-lab experiment authorize install --git https://github.com/owner/repository.git --commit <40 lowercase hex> +| Field | Contract | +|---|---| +| `apiVersion` | exactly `agent-lab/v0alpha1` | +| `kind` | exactly `Experiment` | +| `metadata.name` | 1–63 lowercase ASCII letters, digits, or hyphens; starts with a letter and ends with a letter or digit | +| `spec.members` | 1–16 members with unique names | +| `members[].name` | same bounded name grammar as the Experiment | +| `members[].image` | exactly one `digestRef` or `catalogName` selector | +| `members[].command` | optional; defaults to empty; at most 64 arguments of at most 1,024 characters without control, format, line-separator, or paragraph-separator characters | +| `members[].resourceClass` | optional; `small` by default, or `standard` | + +An Experiment supplies data only. It cannot select a contract, policy, principal, tool, catalog +path or mapping, source destination, concrete host resource limit, or runtime authority. Image +selection is limited to the two closed forms described below. + +## Check and authorize + +The installed CLI syntax for a directory source is: + +```text +agent-lab --home ABSOLUTE_HOME experiment check SOURCE_DIRECTORY +agent-lab --home ABSOLUTE_HOME experiment authorize install SOURCE_DIRECTORY ``` -The check and authorization forms are previews. They create no durable Agent Lab state and do not -invoke Docker or run Experiment content. Git previews do perform the bounded public acquisition -described below. `authorize install` freshly checks the same held source and emits decision evidence -bound to its source, plan, contract, and authorization identities. The decision is not an -installation capability. +Replace the uppercase placeholders; they are notation, not literal shell arguments. `check` emits +canonical JSON containing the exact source identity and resolved `RequestedExperimentPlan`. +`authorize install` independently snapshots and plans the source, then emits the Cedar decision +bound to the source, plan, contract, and authorization identities. -Install a freshly checked and permitted artifact, then inspect its stored identity: +The current policy uses the fixed unauthenticated local compatibility principal +`legacy-local-operator` with assurance `none`. A valid JSON deny decision returns status 1. Neither +a permit nor a prior check result can be passed to `install`; installation obtains a fresh decision +in the same process that holds the source snapshot. A denied install retains no Experiment state. -```bash -agent-lab [--home /absolute/private/home] experiment install ./my-experiment -agent-lab [--home /absolute/private/home] experiment install --zip ./my-experiment.zip -agent-lab [--home /absolute/private/home] experiment install --git https://github.com/owner/repository.git --commit <40 lowercase hex> -agent-lab [--home /absolute/private/home] experiment inspect example +## Install and inspect + +The installed CLI syntax is: + +```text +agent-lab --home ABSOLUTE_HOME experiment install SOURCE_DIRECTORY +agent-lab --home ABSOLUTE_HOME experiment inspect EXPERIMENT_NAME ``` -`install` takes one held source snapshot, derives the plan, and evaluates Cedar again in the same -operation without reopening the caller path. It does not accept a saved plan, decision, destination, -or name override. A permit is evidence for that exact candidate only; installation stores the -source, plan, decision, provenance, and receipt without running content, invoking Docker, acquiring -image bytes, or claiming runtime admission. The decision and receipt bind the same domain-separated -plan identity rather than an unframed hash of the JSON bytes. - -ZIP intake reads one stable archive into at most 1,048,576 bytes and accepts only stored or deflated -`experiment.cue` data that expands to at most 262,144 bytes. ZIP64, multidisk archives, encryption, -comments, extra fields, alternate paths, extra members, special file types, inconsistent headers, -bad CRC or lengths, truncated streams, and trailing bytes are rejected before CUE evaluation. Agent -Lab never extracts the archive or chooses a destination from caller data. The normalized source -digest is identical to directory intake for identical authored bytes; installation provenance also -records the raw archive byte count and SHA-256 digest. Archive identity does not affect the plan, -authorization binding, installation key, or idempotent cross-transport retry. -Regular-file attributes are interpreted only for Unix and DOS-compatible FAT, NTFS, and VFAT -creator systems; other creator systems are rejected when their member type cannot be proven. - -Git intake is Linux-only in this version. It accepts only a normalized, unauthenticated -`https://github.com//.git` URL and one exact lowercase 40-hex SHA-1 commit object -ID. A fixed credential-free GitHub Git Data API client reads that commit, its exact root tree, and -the bound blob under one five-second deadline and a 1,048,576-byte aggregate response cap. It uses -explicit system trust, identity encoding, fixed headers, a private process group, and zero temporary -files. The TLS-authenticated fixed GitHub API is the trust binding from the requested commit ID to -the returned root-tree ID: the response must echo the requested commit, and Agent Lab independently -recomputes the returned tree and blob Git object IDs before accepting their bytes. Redirects, -credentials, mutable refs, alternate protocols or authorities, extra tree entries, and changed bound -objects fail closed. Agent Lab never runs Git, creates a repository, checks out content, follows -submodules, or executes repository data. Provenance records the canonical URL, provider-bound commit -ID, independently verified tree/blob IDs, bounded acquisition facts, and the independent framed -SHA-256 source digest. Git object identity does not replace source identity or change cross-transport -retry. +`install` takes one held source snapshot, derives and resolves the plan, and evaluates Cedar again. +Only a permit publishes the artifact, plan, decision, provenance, and receipt without replacement. +It accepts no saved plan, saved decision, destination, or name override. See +[Installed Experiment evidence](installation.md#installed-experiment-evidence) for the stored layout +and verification rules. An exact retry freshly validates and authorizes again, verifies the complete installed envelope, and returns `changed:false` with the same `installationKey` and `receiptDigest`. The same requested -name with a different installation identity conflicts without overwrite. `inspect` is read-only: it -verifies and reports one installed identity, but never reconciles staging or repairs state. A later -effectful install may recover only recognized, bounded staging left by an interrupted publication; -unknown or ambiguous residue remains in place and returns infrastructure uncertainty. +name with a different installation identity conflicts without overwrite. `inspect` is read-only and +does not reconcile staging or repair state. -These preview, install, and inspect commands work from a local installation after `agent-lab init` -and explicit `agent-lab tools provision`. Installed execution verifies and uses its release bundle -and the effective home's pinned tool cache; it does not depend on a source checkout. +There is currently no Experiment list, update, delete, or uninstall command. Release garbage +collection and in-place home-layout migration are also not implemented. Stored state is +tamper-evident for a cooperative local account, not immutable against another process running as +that same user. -Each member selects either an exact digest-pinned OCI reference with `digestRef` or a shared name -with `catalogName`. Shared names have exactly two bounded lowercase components, `.`. -The `agent-lab.*` namespace belongs to the release-owned bundled catalog; the catalog is initially -empty. Other valid namespaces belong to the operator-local catalog shared by every Experiment using -the same effective home: +## Source formats -```bash -agent-lab image add vendor.image registry.example/team/image@sha256:<64 lowercase hex> -agent-lab image inspect vendor.image -agent-lab image list [--all] -agent-lab image remove vendor.image --expect sha256: +The lifecycle commands accept three source forms. The forms below are syntax notation; replace the +uppercase placeholders. + +| Source | Argument form | +|---|---| +| Directory | `SOURCE_DIRECTORY` | +| ZIP | `--zip ARCHIVE` | +| Public Git | `--git https://github.com/OWNER/REPOSITORY.git --commit COMMIT_ID` | + +For example, each form can be checked with: + +```text +agent-lab --home ABSOLUTE_HOME experiment check SOURCE_DIRECTORY +agent-lab --home ABSOLUTE_HOME experiment check --zip ARCHIVE +agent-lab --home ABSOLUTE_HOME experiment check --git https://github.com/OWNER/REPOSITORY.git --commit COMMIT_ID ``` -Add records a mapping only. Same-subject add is idempotent; a different subject never overwrites. -Remove uses the active entry digest as a compare-and-swap token, creates a generation-two tombstone, -and makes the name non-reusable in v0. A local name is resolved from one held, verified catalog -snapshot. The plan binds only the selected entry digest, generation, and immutable subject; checked -evidence separately records the held snapshot revision and digest. An unrelated catalog change -therefore changes catalog evidence without changing the selected plan identity. +Use the same source form after `authorize install` or `install`. + +### Directory + +The source must be one stable, non-symlink directory containing only `experiment.cue`. The authored +file must be a regular non-symlink with one hard link, no executable bit, no group/world write bit, +and at most 262,144 bytes. Agent Lab refuses identity or content changes observed while it takes the +private snapshot. + +### ZIP + +The archive must be one stable regular file of at most 1,048,576 bytes. It may contain only the +exact member `experiment.cue`, stored or deflated, expanding to at most 262,144 bytes. Agent Lab +rejects ZIP64, multiple disks, encryption, comments, extra fields, alternate paths, extra members, +special types, inconsistent headers, invalid checksums or lengths, truncated streams, and trailing +bytes before CUE evaluation. It never extracts the archive or accepts a caller-selected destination. +Member type metadata is accepted only when a regular file can be proved for Unix or DOS-compatible +FAT, NTFS, and VFAT creator systems; other creator systems fail closed. + +ZIP provenance records the raw archive size and SHA-256 digest. The normalized source identity is +still derived from the authored `experiment.cue` bytes, so equivalent directory and ZIP sources +converge on the same source and plan identities. + +### Public Git + +Git intake is Linux-only. It accepts one normalized unauthenticated +`https://github.com/OWNER/REPOSITORY.git` URL and one exact lowercase 40-hex SHA-1 commit object ID. +The commit's root tree must contain only the mode-`100644` regular blob `experiment.cue`. + +A fixed credential-free GitHub Git Data API client reads the commit, tree, and blob under one +five-second deadline and a 1,048,576-byte aggregate response cap. The response must echo the +requested commit; Agent Lab independently recomputes the returned tree and blob Git object IDs. +Redirects, credentials, mutable refs, alternate protocols or authorities, extra tree entries, and +changed bound objects fail closed. + +Git acquisition does not invoke Git, create a repository, check out content, follow submodules, or +execute repository data. The fixed acquisition worker creates no temporary files; the common CUE +planning path evaluates the held snapshot in its private temporary workspace. Identical authored +bytes converge on the same source and plan identities across directory, ZIP, and Git; transport +provenance remains distinct. + +## Select images + +Each member selects exactly one image form: + +- `digestRef`: an immutable OCI reference ending in one lowercase `sha256` digest; +- `catalogName`: one bounded lowercase `.` name resolved to an immutable subject. + +The `agent-lab.*` namespace is release-owned; its bundled catalog is currently empty. Other valid +names are operator-owned within one initialized Agent Lab home. Use the [Local image names](images.md) +guide to add, inspect, list, or remove those mappings. + +A catalog mapping is naming metadata only. It does not contact a registry, acquire or inspect image +bytes, prove that an image is runnable, or perform admission. Installation rechecks a selected local +entry under the catalog lock and holds that authority through publication; an installed plan never +re-resolves the name. + +## Result meanings + +| Exit | Meaning | +|---|---| +| `0` | the command completed successfully; authorization status 0 means permit | +| `1` | stable invalid input, denial, conflict, or not-found result | +| `2` | invalid command usage | +| `125` | acquisition, trusted input, tool, filesystem, lock, publication, or cleanup uncertainty | +| `128 + signal` | a managed subprocess path was terminated by a signal | + +Status 125 is not a rejection or a successful security decision. Diagnose the missing or uncertain +infrastructure; do not reinterpret it as a deny or bypass the failed control. -After a fresh install permit, every selected local entry is checked again under the stable shared -catalog lock. That lock remains held while the Experiment store lock is acquired and through durable -publication. Removal therefore cannot make the selected entry stale during installation. Direct -digest selectors and release-owned bundled names do not open the local catalog on this path. +## Related documentation -Catalog membership is naming only, not image presence, admission, safety, or runnable status. See -[`images.md`](images.md) for the exact namespace, mutation, persistence, and failure contract. +- [Local installation](installation.md): CLI bundle, private home, tool provisioning, and evidence + layout +- [Local image names](images.md): catalog names, immutable subjects, mutation rules, and stored + authority +- [Architecture](architecture.md#experiment-planning-and-installed-evidence): trust flow and + control-plane boundaries +- [Security](../SECURITY.md) and [threat model](../THREAT_MODEL.md): formal hard stops, assumptions, + and residual risk diff --git a/docs/images.md b/docs/images.md index 6b07222..2bd8240 100644 --- a/docs/images.md +++ b/docs/images.md @@ -1,12 +1,15 @@ # Local image names -Agent Lab can assign one operator-local name to an already immutable OCI subject: +Agent Lab can assign one operator-local name to an already immutable OCI subject. The following +block is syntax notation; replace uppercase placeholders and either supply the optional home prefix +or omit it consistently: -```bash -agent-lab [--home ABSOLUTE_HOME] image add VENDOR.IMAGE DIGEST_REF -agent-lab [--home ABSOLUTE_HOME] image inspect VENDOR.IMAGE -agent-lab [--home ABSOLUTE_HOME] image list [--all] -agent-lab [--home ABSOLUTE_HOME] image remove VENDOR.IMAGE --expect ENTRY_DIGEST +```text +agent-lab --home ABSOLUTE_HOME image add VENDOR.IMAGE DIGEST_REF +agent-lab --home ABSOLUTE_HOME image inspect VENDOR.IMAGE +agent-lab --home ABSOLUTE_HOME image list +agent-lab --home ABSOLUTE_HOME image list --all +agent-lab --home ABSOLUTE_HOME image remove VENDOR.IMAGE --expect ENTRY_DIGEST ``` This catalog is shared by every Experiment using the same initialized Agent Lab home. It stores diff --git a/docs/installation.md b/docs/installation.md index a15c93a..cda95c6 100644 --- a/docs/installation.md +++ b/docs/installation.md @@ -46,11 +46,13 @@ in-place home-layout migration. After initialization and tool provisioning, install or inspect an Experiment with the same local program bundle: -```bash -agent-lab --home /absolute/private/home experiment install ./my-experiment -agent-lab --home /absolute/private/home experiment install --zip ./my-experiment.zip -agent-lab --home /absolute/private/home experiment install --git https://github.com/owner/repository.git --commit <40 lowercase hex> -agent-lab --home /absolute/private/home experiment inspect NAME +The following block is syntax notation; replace the uppercase placeholders before use: + +```text +agent-lab --home ABSOLUTE_HOME experiment install SOURCE_DIRECTORY +agent-lab --home ABSOLUTE_HOME experiment install --zip ARCHIVE +agent-lab --home ABSOLUTE_HOME experiment install --git https://github.com/OWNER/REPOSITORY.git --commit COMMIT_ID +agent-lab --home ABSOLUTE_HOME experiment inspect EXPERIMENT_NAME ``` The configured experiments component is private `0700` state. Each successful first install