Commands

doss COMMAND [flags] · vault location: $DOSS_HOME, default ~/.doss

Reference

Command	What it does
`doss init`	Create a new vault, or attach this device to an existing cloud vault. Auto-registers the device, installs a GitHub deploy key when needed, and runs `connect` unless `--no-connect` is passed.
`doss connect`	Wire the vault into installed agents’ global instruction files. Use `--file PATH` for an unknown agent; `--remove` to undo.
`doss check`	Validate vault files. `--changed` checks files touched since the last commit, including `local/access.yaml` when present.
`doss sync`	Validate, commit, pull, and push. Invalid state does not leave the machine.
`doss doctor`	Show vault health: stats, sync state, agent wiring, hooks, devices, and tidy hints. `--fix` repairs wiring. Alias: `status`.
`doss devices`	List synced device registrations, marking current device and active vs. deactivated status.
`doss deactivate`	Choose a non-current device, revoke its recorded GitHub deploy key when present, then mark it inactive. Scripts may pass `doss deactivate DEVICE_ID`.
`doss view`	Generate a requester-scoped redacted context view with `self/`, `access.json`, and `manifest.json`. Use `doss view cleanup --dir PARENT` to remove expired views.
`doss tidy`	Print stale facts, unconfirmed guesses, rough-shared facts missing rough values, and notes backlog. Read-only.
`doss log`	Record or read the disclosure ledger. `--record --to VERIFIED_ID --shared TOPIC --level rough or full` notes a disclosure.
`doss uninstall`	Unwire agents and delete the local vault. It refuses unsafe deletion unless forced.
`doss hook`	Harness endpoint for `post-edit` and `stop`; wired by `connect`, not run by hand.

Setup Variants

Command	Use when
`doss init`	Main human path: guided setup for a new vault.
`doss init --from owner/repo`	Attach another device to an existing GitHub vault.
`doss init --from GIT_URL`	Attach another device from an arbitrary git remote URL.
`doss init --github`	Create a new private GitHub cloud copy using the default repo name.
`doss init --github --repo NAME`	Create a new private GitHub cloud copy with a specific repo name.
`doss init --remote GIT_URL`	Create a vault and connect it to an existing remote.
`doss init --git-name "Owner Name" --git-email owner@example.com`	Non-interactive setup where an agent supplies commit identity after asking the owner.
`doss init --dir PATH`	Initialize a vault outside the default `~/.doss` location.
`doss init --no-connect`	Initialize without wiring agent instruction files.

doss deactivate blocks future Doss-managed GitHub sync when the device has recorded deploy-key metadata. It cannot erase an already cloned local plaintext vault, and it cannot revoke separate owner account credentials such as GitHub sessions, PATs, or personal SSH keys.

Who Runs What

Agents, after editing memory: doss check --changed, then fix any precise errors.
Agents, at wrap-up: doss sync.
Agents, after allowed disclosure: doss log --record --to VERIFIED_ID --shared TOPIC --level rough or full.
Hosts / serving layers, before an external request: doss view --for VERIFIED_ID --out DIR.
Owners: init, devices, deactivate, doctor, tidy, uninstall, and policy edits.

Frontmatter Fields

Valid metadata keys for Markdown memory files:

Field	Values	Meaning
`source`	owner / imported / inferred / peer	where it came from
`status`	active / suggested	suggested = unconfirmed and never disclosed
`confidence`	high / medium / low, or 0-1	how sure
`tags`	list of strings	free grouping
`verify_by`	YYYY-MM-DD	freshness contract; past due appears in `tidy`
`evidence`	string	pointer to where this was learned
`rough`	string	required only for rough-shared `self/` topics; owner-authored coarse value for rough disclosure