Operator reference

CLI flags reference

Identify which parser owns an option, find the command family you need, and preview mutation before changing a project or shared run state.

bootstrapproject installerruntime CLI

Command boundary

Choose the layer before the flag

The bootstrap, downloaded installer, and runtime CLI have different parsers. The shell bootstrap forwards unknown arguments, but that does not make every installer flag a bootstrap-native option.

01 / Bootstrap

install.sh

Find Python, authenticate or choose the source-available path, fetch and verify the installer.

02 / Project installer

install-trw.py

Install packages and merge selected client/project surfaces.

03 / Runtime CLI

trw-mcp

Serve MCP plus project, diagnostic, data, and maintenance commands.

Installation

Bootstrap-native options

These options are parsed by the public install.sh bootstrap itself. Other arguments are forwarded to the downloaded Python installer.

--api-key KEYInspect

Scope: install.sh
Purpose: Supplies a hosted API key without waiting for device authorization
Default or boundary: TRW_API_KEY or stored credential

--version VERInspect

Scope: install.sh
Purpose: Pins the release requested from the hosted installer endpoint
Default or boundary: TRW_VERSION or latest

--allow-unauthenticatedInspect

Scope: install.sh
Purpose: Installs the source-available package path without the hosted bundle
Default or boundary: off

--require-checksumInspect

Scope: install.sh
Purpose: Fails closed when the installer endpoint does not provide a checksum
Default or boundary: off

--allow-system-pythonInspect

Scope: both layers
Purpose: Explicitly permits the PEP 668 --break-system-packages fallback
Default or boundary: off; prefer pipx or a virtual environment

--help / -hInspect

Scope: install.sh
Purpose: Prints bootstrap-native options and forwarding behavior
Default or boundary: —

Flag	Scope	Purpose	Default or boundary
`--api-key KEY`	install.sh	Supplies a hosted API key without waiting for device authorization	TRW_API_KEY or stored credential
`--version VER`	install.sh	Pins the release requested from the hosted installer endpoint	TRW_VERSION or latest
`--allow-unauthenticated`	install.sh	Installs the source-available package path without the hosted bundle	off
`--require-checksum`	install.sh	Fails closed when the installer endpoint does not provide a checksum	off
`--allow-system-python`	both layers	Explicitly permits the PEP 668 --break-system-packages fallback	off; prefer pipx or a virtual environment
`--help / -h`	install.sh	Prints bootstrap-native options and forwarding behavior	—

Downloaded installer options

Run the downloaded installer with --help to confirm the release you actually received. The current source groups its options as follows.

target_dirInspect

Scope: project
Purpose: Selects the repository to initialize
Default or boundary: current directory

--scriptInspect

Scope: interaction
Purpose: Runs non-interactively; prompts use defaults and supplied values
Default or boundary: off

--name VALUEInspect

Scope: project
Purpose: Sets the installation ID written to project configuration
Default or boundary: derived

--ide LISTInspect

Scope: client surfaces
Purpose: Selects comma-separated client targets such as cursor-ide,codex
Default or boundary: prompted when interactive

--upgradeInspect

Scope: packages
Purpose: Upgrades the package without rerunning project bootstrap
Default or boundary: off

--ai / --no-aiInspect

Scope: packages
Purpose: Selects the optional AI/LLM extras
Default or boundary: prompt/profile dependent

--embeddings / --no-embeddingsInspect

Scope: packages
Purpose: Installs trw-memory[embeddings] and caches the configured embedding model; if that fails, the install exits non-zero. --no-embeddings installs keyword-only recall and records embeddings_enabled: false
Default or boundary: on; a prior opt-out is kept until --embeddings

--no-migrateInspect

Scope: project
Purpose: Leaves a checkout's .trw/memory/memory.db learnings in place. By default the installer runs trw-mcp memory migrate --to user --apply when that store still holds learnings, prints the manifest and rollback command, and exits non-zero if the move is refused or cannot finish
Default or boundary: migrate (an interactive run asks first)

--offlineInspect

Scope: packages
Purpose: Uses embedded wheels only; transitive dependencies must already be available
Default or boundary: off

--pip-target DIRInspect

Scope: packages
Purpose: Installs packages into a specific import directory
Default or boundary: site packages

--telemetry / --no-telemetryInspect

Scope: hosted connection
Purpose: Records explicit telemetry consent
Default or boundary: not inferred from an API key

--skip-authInspect

Scope: hosted connection
Purpose: Skips device authorization when credentials or non-hosted setup make it unnecessary
Default or boundary: off; implicit in script mode

--with-proprietaryInspect

Scope: licensed packages
Purpose: Adds licensed TRW packages when entitlement is available
Default or boundary: off

--license-key KEYInspect

Scope: licensed packages
Purpose: Overrides automatic entitlement derivation
Default or boundary: TRW_LICENSE_KEY or derived entitlement

--proprietary-version PKG==VERInspect

Scope: licensed packages
Purpose: Pins one licensed package; repeat for multiple packages
Default or boundary: release-selected versions

--backend-url URLInspect

Scope: testing
Purpose: Overrides the entitlement endpoint for controlled testing
Default or boundary: api.trwframework.com

Flag	Scope	Purpose	Default or boundary
`target_dir`	project	Selects the repository to initialize	current directory
`--script`	interaction	Runs non-interactively; prompts use defaults and supplied values	off
`--name VALUE`	project	Sets the installation ID written to project configuration	derived
`--ide LIST`	client surfaces	Selects comma-separated client targets such as cursor-ide,codex	prompted when interactive
`--upgrade`	packages	Upgrades the package without rerunning project bootstrap	off
`--ai / --no-ai`	packages	Selects the optional AI/LLM extras	prompt/profile dependent
`--embeddings / --no-embeddings`	packages	Installs trw-memory[embeddings] and caches the configured embedding model; if that fails, the install exits non-zero. --no-embeddings installs keyword-only recall and records embeddings_enabled: false	on; a prior opt-out is kept until --embeddings
`--no-migrate`	project	Leaves a checkout's .trw/memory/memory.db learnings in place. By default the installer runs trw-mcp memory migrate --to user --apply when that store still holds learnings, prints the manifest and rollback command, and exits non-zero if the move is refused or cannot finish	migrate (an interactive run asks first)
`--offline`	packages	Uses embedded wheels only; transitive dependencies must already be available	off
`--pip-target DIR`	packages	Installs packages into a specific import directory	site packages
`--telemetry / --no-telemetry`	hosted connection	Records explicit telemetry consent	not inferred from an API key
`--skip-auth`	hosted connection	Skips device authorization when credentials or non-hosted setup make it unnecessary	off; implicit in script mode
`--with-proprietary`	licensed packages	Adds licensed TRW packages when entitlement is available	off
`--license-key KEY`	licensed packages	Overrides automatic entitlement derivation	TRW_LICENSE_KEY or derived entitlement
`--proprietary-version PKG==VER`	licensed packages	Pins one licensed package; repeat for multiple packages	release-selected versions
`--backend-url URL`	testing	Overrides the entitlement endpoint for controlled testing	api.trwframework.com

Runtime CLI

Global trw-mcp options

Place global options before the subcommand. With no subcommand, trw-mcp starts the stdio server. Use trw-mcp --help as the authoritative view for the installed version.

--version / -VInspect

Scope: process
Purpose: Prints the version and exits
Default: —

--debugInspect

Scope: logging
Purpose: Enables debug logging to stderr and .trw/logs
Default: off

--verbose / -vInspect

Scope: logging
Purpose: Raises verbosity; repeat for debug plus a log file
Default: 0

--quiet / -qInspect

Scope: logging
Purpose: Suppresses output below warning
Default: off

--log-level LEVELInspect

Scope: logging
Purpose: Sets an explicit level and overrides verbosity/debug selection
Default: automatic

--log-jsonInspect

Scope: logging
Purpose: Forces structured JSON output instead of TTY detection
Default: automatic

--allow-unsignedInspect

Scope: MCP security
Purpose: Allows peers absent from the signed registry and emits audit events
Default: off

Flag	Scope	Purpose	Default
`--version / -V`	process	Prints the version and exits	—
`--debug`	logging	Enables debug logging to stderr and .trw/logs	off
`--verbose / -v`	logging	Raises verbosity; repeat for debug plus a log file	0
`--quiet / -q`	logging	Suppresses output below warning	off
`--log-level LEVEL`	logging	Sets an explicit level and overrides verbosity/debug selection	automatic
`--log-json`	logging	Forces structured JSON output instead of TTY detection	automatic
`--allow-unsigned`	MCP security	Allows peers absent from the signed registry and emits audit events	off

Command map

52 commands, grouped by intent

This map is faster to scan than a mixed flag dump. Ask a command for its own help before mutation: trw-mcp <command> --help.

Serve

serve

Run the stdio MCP server; also the no-subcommand default

Project setup

init-projectupdate-projectuninstalltrust-codex-hooks

Create, refresh, or remove project-managed surfaces

Inspect

auditdoctorconfig-referencecheck-instructionstendenciesversion-statusprofiletelemetry

Read configuration, installation health, instruction integrity, version drift, the resolved profile and tool surface, and read-only telemetry: session events, surface diffs, security status, channel stats, and pipeline health

Data movement

exportimport-learningssession-changelog

Move explicit records or render a run changelog

Local ceremony

localgchook-flagsruninstructionsdecision

Use fallback ceremony operations, inspect and sweep stale run state, publish the resolved hook flags, move a run's pin to a named session, sync TRW guidance into the client's instruction file, or resolve a pending blocked decision

Coordination

dispatchformationplanhandoff

Run a supported coding-agent CLI for a bounded second opinion, create/brief/report a formation and propose/review peer work plans within it, or validate/seal/render a handoff record

Code intelligence

code

Build the local code index and read the ranked file-level risk report

Delivery and experimentation

deliveryprobemeta-tune

Recover a stale or crashed delivery, run a sandboxed probe that settles a plan assumption, or promote/rollback a SAFE-001 self-modification candidate (Linux only)

Shared server

swapstatusenv

Point a shared server env at another trw-mcp and hot-swap it, read shared-server status, or create an env's memory directory

Channels and access

authassessconfigchannel-doctortierfeedback

Manage hosted authentication, channel hygiene, and entitlements, set one public config key safely or run the dispatch setup step, and list or resend the feedback reports kept in the local outbox

Memory maintenance

learn-drainmaintain-verifymemorymodelsbackup

Flush pending write-ahead learn records on demand, re-verify stored learnings that carry assertions, mint this checkout's per-namespace daemon grant, download or refresh the local embedding and re-ranker models, and back up or restore the memory store

Team sync

sync

Pull team learnings on demand and resume an incomplete replay

Requirements

prdprd-stateprd-epoch

Generate a PRD or diff two, move a PRD through the WIP-limited scheduling ledger's execution states, and advance the registry evaluation epoch so expiry can be evaluated

Release engineering

build-releaseprepare-candidatecommit-candidaterecover-candidate

Build a bundled-data release artifact, publish an isolated candidate commit without touching shared checkout state, or recover an interrupted candidate transaction

Subcommands

Every subcommand, from the parser

Generated from trw-mcp's own argument parser on every build, so this list cannot fall behind the CLI. Each command also answers --help.

trw-mcp assess configureInspect

What it does: Store the OpenRouter key in ~/.trw/jev.env (0600) and enable trw_assess for every project

trw-mcp assess install-checkInspect

What it does: Installer step: inherit the machine key, or offer to promote one

trw-mcp assess statusInspect

What it does: Show which layer enables trw_assess and supplies its key (never the key)

trw-mcp auth loginInspect

What it does: Authenticate via device authorization flow

trw-mcp auth logoutInspect

What it does: Remove stored API key

trw-mcp auth promoteInspect

What it does: Copy this project's key to ~/.trw/credentials.yaml so every project on this computer uses it

trw-mcp auth statusInspect

What it does: Show current authentication status

trw-mcp backup createInspect

What it does: Create a local gzip archive; uploads it too when backup_remote_enabled is true

trw-mcp backup restoreInspect

What it does: Restore the store from 'latest' remote backup (network) or a local archive path (offline drill)

trw-mcp channel-doctor cleanInspect

What it does: Remove orphaned locks older than --max-age-hours

trw-mcp channel-doctor initInspect

What it does: Create .trw/channels/ directory and empty manifest if absent

trw-mcp channel-doctor scanInspect

What it does: Scan for orphaned locks and stale state files

trw-mcp channel-doctor statsInspect

What it does: Show per-channel correlation + throttle stats (meta-tune consumer)

trw-mcp channel-doctor validateInspect

What it does: Validate .trw/channels/manifest.yaml schema (exits 1 on error)

trw-mcp code indexInspect

What it does: Build the local code index that search and symbol lookup read

trw-mcp code riskInspect

What it does: Read the ranked file-level composite-risk report for the current SHA

trw-mcp config dispatchInspect

What it does: Installer step: offer trw_dispatch and pin per-client model and effort

trw-mcp config setInspect

What it does: Set one public config key in the project or machine config.yaml

trw-mcp config unsetInspect

What it does: Remove a config key (or FIELD.SUBKEY) from the project or machine config.yaml; retired keys too

trw-mcp decision resolveInspect

What it does: Resolve a pending blocked decision; state-changing, refused in unattended lanes (advisory)

trw-mcp delivery recoverInspect

What it does: Recover a stale or crashed delivery; state-changing

trw-mcp env createInspect

What it does: create an env's memory dir (grants copied, store empty)

trw-mcp env gcInspect

What it does: remove version venvs no env uses (dry run unless --apply)

trw-mcp feedback flushInspect

What it does: Resend pending reports, oldest first

trw-mcp feedback listInspect

What it does: Show pending and sent reports, without their bodies (read-only)

trw-mcp formation add-orchestratorInspect

What it does: Make this orchestrator session an addressable member of its formation

trw-mcp formation add-slotInspect

What it does: Add pending slots (optionally admitting a candidate to each)

trw-mcp formation admitInspect

What it does: Admit an announced candidate to a pending slot

trw-mcp formation briefInspect

What it does: Render a member's brief from the manifest

trw-mcp formation comms-rollbackInspect

What it does: Restore the pre-upgrade backup if nothing was written since

trw-mcp formation comms-upgradeInspect

What it does: Upgrade this formation's v3, v4 or v5 comms mailbox to v6

trw-mcp formation initInspect

What it does: Write a formation manifest under an orchestrator run

trw-mcp formation mergeInspect

What it does: Owned merge queue; never targets default branch; lead fast-forwards main

trw-mcp formation merge enqueueInspect

What it does: Orchestrator: approve immutable branch/SHA and build receipt

trw-mcp formation merge listInspect

What it does: List durable approvals and outcomes without mutation

trw-mcp formation merge run-oneInspect

What it does: Merge one item into an un-checked-out integration branch, never default

trw-mcp formation pauseInspect

What it does: Pause the formation; members ack with trw_inbox(action='ack_pause')

trw-mcp formation remove-slotInspect

What it does: Remove a slot that never joined

trw-mcp formation resumeInspect

What it does: End the active pause

trw-mcp formation set-statusInspect

What it does: Record that a member was abandoned or reassigned

trw-mcp formation statusInspect

What it does: Read-only member roll-up

trw-mcp formation watchInspect

What it does: Print one body-free line when this member's mail or status changes

trw-mcp handoff briefInspect

What it does: Project a record (draft or sealed) into one read-only sweep brief per item: commit, objective.paths and constraints carried verbatim, a fixed item ledger and the return schema; never truncates

trw-mcp handoff brief-checkInspect

What it does: Check helper results against the same items: one row per id, allowed status and label, every cited line present in scope exactly as quoted; anything else is inconclusive. Exit 1 unless every item is citation_valid and no row names an unknown item (citation_valid is not a judgement that the answer is right)

trw-mcp handoff checkInspect

What it does: Receiver pre-flight: digest, validity, expiry, supersession, pointer digests and git state; JSON on stdout, summary on stderr, exit 1 on any finding

trw-mcp handoff digestInspect

What it does: Print the RFC 8785 sha256 digest of an AHR file

trw-mcp handoff newInspect

What it does: Write a DRAFT handoff: ids, times, git state and pointer digests filled in, judgement fields as TODO(handoff): sentinels

trw-mcp handoff readback-newInspect

What it does: Write a DRAFT read-back for a handoff: id, author, time, handoff digest and pointer checks filled in, restatements and re-verification results as TODO(handoff): sentinels

trw-mcp handoff renderInspect

What it does: Print the Markdown view of a valid handoff record (the JSON stays normative)

trw-mcp handoff sealInspect

What it does: Write integrity.digest into an AHR file; refuses a record that fails validation

trw-mcp handoff validateInspect

What it does: Check one AHR file at L1; prints findings as JSON lines, exit 1 on any finding

trw-mcp instructions checkInspect

What it does: Read-only: report what sync would change; exit 1 if anything would (writes nothing)

trw-mcp instructions syncInspect

What it does: Sync TRW protocol + ceremony guidance into the client's instruction file; state-changing

trw-mcp local checkpointInspect

What it does: Save progress checkpoint

trw-mcp local deliverInspect

What it does: Mark the active local run delivered

trw-mcp local feedbackInspect

What it does: Submit feedback without MCP transport

trw-mcp local initInspect

What it does: Create a run directory

trw-mcp local learnInspect

What it does: Persist a learning without MCP transport

trw-mcp local recallInspect

What it does: Recall learnings without MCP transport

trw-mcp local statusInspect

What it does: Show active local run status

trw-mcp memory migrateInspect

What it does: Move this checkout's project store into the user store

trw-mcp memory reembedInspect

What it does: Re-encode this checkout's vectors outside the daemon's active embedding space

trw-mcp memory repair-anchorsInspect

What it does: Rewrite or drop this checkout's machine-path anchors until the repair completes

trw-mcp memory tokenInspect

What it does: Mint a daemon token granted this checkout's project namespace and user:local

trw-mcp meta-tune proposeInspect

What it does: Promote a candidate through sandbox and review

trw-mcp meta-tune rollbackInspect

What it does: Restore a promoted proposal's prior content

trw-mcp models fetchInspect

What it does: Download the daemon's models into the local cache (runtime loads never download)

trw-mcp plan precheckInspect

What it does: Who declares these paths? Advisory only.

trw-mcp plan proposeInspect

What it does: Emit a canonical, digest-bound plan proposal

trw-mcp plan reviewInspect

What it does: Verify a received proposal and emit a review

trw-mcp plan verifyInspect

What it does: Is a received review about the plan you hold?

trw-mcp prd createInspect

What it does: Generate a PRD from a feature description and write it to disk

trw-mcp prd diffInspect

What it does: Diff two PRD files' requirements, metrics, and acceptance gates

trw-mcp prd validateInspect

What it does: Score a PRD against the validation suite (same engine as trw_prd_validate); not read-only: it caches the result under .trw/ for the next validate and records ceremony progress

trw-mcp probe budgetInspect

What it does: Report a run's probe budget usage; read-only

trw-mcp probe runInspect

What it does: Run a sandboxed probe; gated by TRW_PROBE_ENABLED

trw-mcp profile explainInspect

What it does: Show which config layer set each profile field, and the resolved tool surface

trw-mcp run adoptInspect

What it does: Transfer an existing run's pin to a named session; state-changing

trw-mcp run evidence-packInspect

What it does: Export one run's evidence pack for readiness review; writes one file

trw-mcp sync pullInspect

What it does: Pull and merge new team learnings now; --full replays every one from sequence 0

trw-mcp sync pushInspect

What it does: Push this host's unsynced learnings now; exits 1 with the server's reason if the push fails

trw-mcp sync statusInspect

What it does: Last push and pull, failures, pending and rejected counts (no network)

trw-mcp telemetry channel-statsInspect

What it does: Per-channel push->outcome correlation (read-only)

trw-mcp telemetry classifyInspect

What it does: Classify a path as SAFE-001 control or advisory (read-only)

trw-mcp telemetry eventsInspect

What it does: Merged cross-emitter event view for a session (read-only)

trw-mcp telemetry pipeline-healthInspect

What it does: Report the four compounding-pipeline health signals

trw-mcp telemetry securityInspect

What it does: MCP security/trust-boundary status (read-only)

trw-mcp telemetry surface-diffInspect

What it does: Diff two recorded surface snapshots (read-only)

trw-mcp tier issueInspect

What it does: Generate a signed entitlement YAML

trw-mcp tier showInspect

What it does: Print resolved tier + status from .trw/entitlements.yaml

trw-mcp tier statusInspect

What it does: Print tier entitlement status as an auditable table

Command	What it does
`trw-mcp assess configure`	Store the OpenRouter key in ~/.trw/jev.env (0600) and enable trw_assess for every project
`trw-mcp assess install-check`	Installer step: inherit the machine key, or offer to promote one
`trw-mcp assess status`	Show which layer enables trw_assess and supplies its key (never the key)
`trw-mcp auth login`	Authenticate via device authorization flow
`trw-mcp auth logout`	Remove stored API key
`trw-mcp auth promote`	Copy this project's key to ~/.trw/credentials.yaml so every project on this computer uses it
`trw-mcp auth status`	Show current authentication status
`trw-mcp backup create`	Create a local gzip archive; uploads it too when backup_remote_enabled is true
`trw-mcp backup restore`	Restore the store from 'latest' remote backup (network) or a local archive path (offline drill)
`trw-mcp channel-doctor clean`	Remove orphaned locks older than --max-age-hours
`trw-mcp channel-doctor init`	Create .trw/channels/ directory and empty manifest if absent
`trw-mcp channel-doctor scan`	Scan for orphaned locks and stale state files
`trw-mcp channel-doctor stats`	Show per-channel correlation + throttle stats (meta-tune consumer)
`trw-mcp channel-doctor validate`	Validate .trw/channels/manifest.yaml schema (exits 1 on error)
`trw-mcp code index`	Build the local code index that search and symbol lookup read
`trw-mcp code risk`	Read the ranked file-level composite-risk report for the current SHA
`trw-mcp config dispatch`	Installer step: offer trw_dispatch and pin per-client model and effort
`trw-mcp config set`	Set one public config key in the project or machine config.yaml
`trw-mcp config unset`	Remove a config key (or FIELD.SUBKEY) from the project or machine config.yaml; retired keys too
`trw-mcp decision resolve`	Resolve a pending blocked decision; state-changing, refused in unattended lanes (advisory)
`trw-mcp delivery recover`	Recover a stale or crashed delivery; state-changing
`trw-mcp env create`	create an env's memory dir (grants copied, store empty)
`trw-mcp env gc`	remove version venvs no env uses (dry run unless --apply)
`trw-mcp feedback flush`	Resend pending reports, oldest first
`trw-mcp feedback list`	Show pending and sent reports, without their bodies (read-only)
`trw-mcp formation add-orchestrator`	Make this orchestrator session an addressable member of its formation
`trw-mcp formation add-slot`	Add pending slots (optionally admitting a candidate to each)
`trw-mcp formation admit`	Admit an announced candidate to a pending slot
`trw-mcp formation brief`	Render a member's brief from the manifest
`trw-mcp formation comms-rollback`	Restore the pre-upgrade backup if nothing was written since
`trw-mcp formation comms-upgrade`	Upgrade this formation's v3, v4 or v5 comms mailbox to v6
`trw-mcp formation init`	Write a formation manifest under an orchestrator run
`trw-mcp formation merge`	Owned merge queue; never targets default branch; lead fast-forwards main
`trw-mcp formation merge enqueue`	Orchestrator: approve immutable branch/SHA and build receipt
`trw-mcp formation merge list`	List durable approvals and outcomes without mutation
`trw-mcp formation merge run-one`	Merge one item into an un-checked-out integration branch, never default
`trw-mcp formation pause`	Pause the formation; members ack with trw_inbox(action='ack_pause')
`trw-mcp formation remove-slot`	Remove a slot that never joined
`trw-mcp formation resume`	End the active pause
`trw-mcp formation set-status`	Record that a member was abandoned or reassigned
`trw-mcp formation status`	Read-only member roll-up
`trw-mcp formation watch`	Print one body-free line when this member's mail or status changes
`trw-mcp handoff brief`	Project a record (draft or sealed) into one read-only sweep brief per item: commit, objective.paths and constraints carried verbatim, a fixed item ledger and the return schema; never truncates
`trw-mcp handoff brief-check`	Check helper results against the same items: one row per id, allowed status and label, every cited line present in scope exactly as quoted; anything else is inconclusive. Exit 1 unless every item is citation_valid and no row names an unknown item (citation_valid is not a judgement that the answer is right)
`trw-mcp handoff check`	Receiver pre-flight: digest, validity, expiry, supersession, pointer digests and git state; JSON on stdout, summary on stderr, exit 1 on any finding
`trw-mcp handoff digest`	Print the RFC 8785 sha256 digest of an AHR file
`trw-mcp handoff new`	Write a DRAFT handoff: ids, times, git state and pointer digests filled in, judgement fields as TODO(handoff): sentinels
`trw-mcp handoff readback-new`	Write a DRAFT read-back for a handoff: id, author, time, handoff digest and pointer checks filled in, restatements and re-verification results as TODO(handoff): sentinels
`trw-mcp handoff render`	Print the Markdown view of a valid handoff record (the JSON stays normative)
`trw-mcp handoff seal`	Write integrity.digest into an AHR file; refuses a record that fails validation
`trw-mcp handoff validate`	Check one AHR file at L1; prints findings as JSON lines, exit 1 on any finding
`trw-mcp instructions check`	Read-only: report what sync would change; exit 1 if anything would (writes nothing)
`trw-mcp instructions sync`	Sync TRW protocol + ceremony guidance into the client's instruction file; state-changing
`trw-mcp local checkpoint`	Save progress checkpoint
`trw-mcp local deliver`	Mark the active local run delivered
`trw-mcp local feedback`	Submit feedback without MCP transport
`trw-mcp local init`	Create a run directory
`trw-mcp local learn`	Persist a learning without MCP transport
`trw-mcp local recall`	Recall learnings without MCP transport
`trw-mcp local status`	Show active local run status
`trw-mcp memory migrate`	Move this checkout's project store into the user store
`trw-mcp memory reembed`	Re-encode this checkout's vectors outside the daemon's active embedding space
`trw-mcp memory repair-anchors`	Rewrite or drop this checkout's machine-path anchors until the repair completes
`trw-mcp memory token`	Mint a daemon token granted this checkout's project namespace and user:local
`trw-mcp meta-tune propose`	Promote a candidate through sandbox and review
`trw-mcp meta-tune rollback`	Restore a promoted proposal's prior content
`trw-mcp models fetch`	Download the daemon's models into the local cache (runtime loads never download)
`trw-mcp plan precheck`	Who declares these paths? Advisory only.
`trw-mcp plan propose`	Emit a canonical, digest-bound plan proposal
`trw-mcp plan review`	Verify a received proposal and emit a review
`trw-mcp plan verify`	Is a received review about the plan you hold?
`trw-mcp prd create`	Generate a PRD from a feature description and write it to disk
`trw-mcp prd diff`	Diff two PRD files' requirements, metrics, and acceptance gates
`trw-mcp prd validate`	Score a PRD against the validation suite (same engine as trw_prd_validate); not read-only: it caches the result under .trw/ for the next validate and records ceremony progress
`trw-mcp probe budget`	Report a run's probe budget usage; read-only
`trw-mcp probe run`	Run a sandboxed probe; gated by TRW_PROBE_ENABLED
`trw-mcp profile explain`	Show which config layer set each profile field, and the resolved tool surface
`trw-mcp run adopt`	Transfer an existing run's pin to a named session; state-changing
`trw-mcp run evidence-pack`	Export one run's evidence pack for readiness review; writes one file
`trw-mcp sync pull`	Pull and merge new team learnings now; --full replays every one from sequence 0
`trw-mcp sync push`	Push this host's unsynced learnings now; exits 1 with the server's reason if the push fails
`trw-mcp sync status`	Last push and pull, failures, pending and rejected counts (no network)
`trw-mcp telemetry channel-stats`	Per-channel push->outcome correlation (read-only)
`trw-mcp telemetry classify`	Classify a path as SAFE-001 control or advisory (read-only)
`trw-mcp telemetry events`	Merged cross-emitter event view for a session (read-only)
`trw-mcp telemetry pipeline-health`	Report the four compounding-pipeline health signals
`trw-mcp telemetry security`	MCP security/trust-boundary status (read-only)
`trw-mcp telemetry surface-diff`	Diff two recorded surface snapshots (read-only)
`trw-mcp tier issue`	Generate a signed entitlement YAML
`trw-mcp tier show`	Print resolved tier + status from .trw/entitlements.yaml
`trw-mcp tier status`	Print tier entitlement status as an auditable table

Mutation safety

Preview the exact scope

These commands do not carry the same risk. Review what each one changes rather than applying a blanket “commit and restore” recovery recipe in a shared worktree.

01 / --dry-run

update-project

Merges framework-managed project and client surfaces

Review the preview and concurrent worktree ownership before running without dry-run.

02 / --dry-run

uninstall

Removes managed TRW surfaces; never the shared memory store. --delete-memory also deletes this checkout's own namespace from it

Everything under the project's .trw/ is removed (except the learning corpus with --keep-memory). Use --keep-memory when the learning corpus must survive. Do not combine --yes with an unreviewed scope.

03 / default / --dry-run

gc

--no-dry-run marks stale active runs abandoned

It changes run state, not source files. Confirm staleness and session ownership first.

Diagnostics

Increase signal deliberately

Start with doctor for read-only installation diagnostics. Add logging only when you need a trace, and keep global logging options before the command.

trw-mcp doctor

Read-only checks for environment, config, MCP registration, profiles, instructions, and memory.

trw-mcp --debug serve

Debug output to stderr and the project log surface.

trw-mcp -vv audit

Repeated verbosity enables debug-level detail plus a log file.