CLI reference

bnlgit is the server binary. The ProofGit subcommands below sit alongside Gitea's own commands (web, admin, doctor, migrate, generate, and the rest), which are unchanged and documented by Gitea ↗.

These commands run on the instance, not on a developer workstation, and they are run by the instance's operator. On the hosted service that is us, and self-hosted ProofGit is not offered yet, so you will not run them yourself. There is no separate client CLI — day-to-day work happens through the web UI, the REST API, or MCP. The commands are documented so you can see exactly what the operator's side of the service does — the spend ceilings that apply to your work, for example, are the worker flags below.

bnlgit summaries

Run explicit BYOK summary work for a BNLRepo.

bnlgit summaries run                   # claim and generate one pending job
bnlgit summaries service               # the managed worker daemon
bnlgit summaries bakeoff               # run a model bake-off
bnlgit summaries backfill-embeddings   # index existing summaries for vector retrieval

run only picks up jobs that have actually been requested — see the mirror model on why a stale flag alone never spends anything.

service carries the budget and concurrency flags described in Managed worker and spend controls:

bnlgit summaries service \
  --max-run-cost-micro-usd 250000 \
  --max-org-cost-micro-usd 100000 \
  --max-org-cost-per-window-micro-usd 10000000 \
  --org-cost-window-hours 24

backfill-embeddings is what you run after enabling vector retrieval on a repository that already has summaries — new summaries index as they are generated, but existing ones need this pass. See Search.

bnlgit license

Ed25519 licence tooling.

bnlgit license status   # what this running instance currently believes
bnlgit license verify   # check a token against a public key
bnlgit license sign     # issue a licence (--org, --seats, --repos, --expires-days)
bnlgit license keygen   # generate an issuer keypair

status is the one an operator runs. sign and keygen are issuer-side tooling — they exist in every build, but only Blue Note Logic holds the issuer key that produces a licence an instance will accept.

Useful inherited commands

These are Gitea's, not ProofGit additions, but they come up often enough to be worth naming:

bnlgit doctor check                        # health checks, including SECRET_KEY hygiene
bnlgit admin user generate-access-token    # mint an API token for a user
bnlgit generate secret SECRET_KEY          # generate a value for any of this instance's secret keys

BYOK key rotation

bnlgit admin regenerate byok-credentials

Re-wraps stored connection secrets onto the current BYOK_SECRET_KEY. See BYOK connections and security.