tai config env
Read and update the stored env overrides.
tai config env get
Read the stored env config and the operator’s secret-key marks.
Example: tai config env get
tai config env set
Merge KEY=VALUE env overrides and hot-reload the process config.
Values may come from command-line KEY=VALUE arguments, --env-file, and
--stdin combined; at least one assignment is required. The same key from
more than one source (or twice in one source) is an error — no silent
precedence. Argv exposes a value via ps/shell history, so a secret should
ride --env-file or --stdin.
Example: tai config env set LOG_LEVEL=debug --env-file secrets.env
tai config lint
Lint config OFFLINE: a manifest file’s shape plus required-settings resolution.
Validates the manifest file against the Manifest model (a broken manifest
fails loudly with the model error) and checks that every required registered
setting resolves from the environment. No server is started.
Example: tai config lint config/manifest.yml
tai config mode
Read the active config backend mode (file or an external provider’s mode).
Example: tai config mode
tai config profile
Manage versioned settings profiles.
tai config profile apply
Apply a profile — replace the stored env with its band, reload, and recycle the
fleet. Prints the {hot, recycle, refused, fanout} report plus the per-kind
fresh list (names + worker identities only, never env values). DESTRUCTIVE: it
replaces the whole stored env band.
Example: tai config profile apply staging
tai config profile delete
Soft-delete a profile, keeping its version history for audit.
Example: tai config profile delete staging
tai config profile diff
Preview a profile against the CURRENT stored env — {added, removed, changed, recycle_keys, refused_keys} with real values (a preview, not the apply report).
Example: tai config profile diff staging
tai config profile list
List the settings profiles (reserved @ snapshots excluded).
Example: tai config profile list
tai config profile rollback
Re-point a profile’s active version to version (a store re-point; the live
process is realigned by a later apply, not by this).
Example: tai config profile rollback staging 2
tai config profile set
Create or update a profile (whole-body replace). The env band is the given
KEY=VALUE entries; --secret-key marks which keys are secret. A reserved
@-prefixed name is rejected up front.
The band may come from command-line KEY=VALUE arguments, --env-file, and
--stdin combined; with no source at all the band is empty (a whole-body
replace clears the stored env), but a given --env-file or --stdin that
yields no assignment is an error. The same key from more than one source (or
twice in one source) is an error — no silent precedence. Argv exposes a value
via ps/shell history, so a secret should ride --env-file or --stdin.
Example: tai config profile set staging LOG_LEVEL=debug --env-file secrets.env --secret-key API_KEY
tai config profile show
Show a profile’s active body — {description, env, secret_keys} with real
env values (this authed door round-trips values; masking is display-side only).
Example: tai config profile show staging
tai config profile versions
List a profile’s version history, or — with --version — show one version’s
full body (real env values; this door is secret-fenced).
Example: tai config profile versions staging / ... versions staging --version 3
tai config reload
Soft-restart this process from its manifest, fanning out to every worker.
Refreshes env, resets settings caches, and re-initializes from the manifest
in-process (no pod restart), then propagates to the fleet; --target restricts
the fan-out to named workers.
Example: tai config reload
tai config settings-schema
List the registered settings groups with their resolved field values.
Example: tai config settings-schema --json