Every verb the binary carries.
This page is generated from the CLI itself — the same snapshot sporo docs --json emits, kept in sync by a build gate. Read the authoring rules with sporo genre.
sporo-recipe — the authoring skill
sporo init writes this skill into your agent. It walks the agent through the cycle below — reading the project's record, not its own memory — and leaves you one file to review.
sporo-seed — the seed-authoring skill
sporo init writes this skill alongside sporo-recipe. Where a recipe teaches an agent to build a capability, a seed teaches one to bring a named tool in and stand it up — detect it, install it from an origin the seed vouches for, prove it runs, and account for every move to the human. The skill drives the sporo seed verbs — read the tool's current truth and run the install, scaffold, gate against the genre, seal, export — and leaves you one file to review. The genre in full: what is a seed.
Write a recipe from the record — or a seed that brings a named tool in — gate it against its genre, seal it, and hand it over.
Write one recipe (or, with --bundle, a composed set) as a single self-contained file
--bundle=falsetreat <slug> as a bundle manifest and compose its members into one document--root=.project root (searched for this repo's own recipes before the official corpus)--stdout=falseprint the composed document to stdout instead of writing a file (for piping)File and list report-backs — the channel a recipe's next version comes from
Validate a reader's report-back against the protocol and file it (`-` reads stdin)
List the filed report-backs, per recipe
Gather a recipe's raw material from a revision range of the project's own record
--outwrite the harvest here (default: stdout)--root=.repository to harvest--sincestarting revision, exclusive (a tag: the release before the work)--until=HEADending revision, inclusiveCheck a recipe corpus against the genre — shape, acceptance, scars, and neutrality
--root=.project root (its config names the recipes home and the forbidden product vocabulary)List the recipes available here — this project's own, and the official corpus
--root=.project root (its own recipes are listed alongside the official corpus)Scaffold a draft recipe — coached section stubs, optionally pre-seeded from a harvest
--from-harvesta `sporo harvest --out` file; its scar candidates pre-seed the scars section--root=.project root (the draft lands in its recipes home)--titlethe recipe's title (defaults to a TODO)Build a self-contained review pack for any agent, and verify the verdicts it returns
--root=.project rootValidate returned verdicts and record the tally beside the recipe's seal
Record a recipe's version and content hash in the registry — a sealed recipe never silently mutates
--root=.project root (its registry records the seal)Author, check, seal and export install seeds — the recipe verbs, one kind over
Write one seed as a single self-contained install file — runner preamble first, then the seed
Check this project's seed corpus against the genre — shape, acceptance, neutrality, seals
List the seeds available here — this project's own, and the embedded corpus
Scaffold a draft seed — coached section stubs, born a draft
Record a seed's version and content hash in the registry — a sealed seed never silently mutates
The reader's side: record what you built from, and hold an output to a recipe's exact contracts.
Record a handed-over recipe this repository builds from — the reader-side seal
--root=.repository that adopts the recipe--sourcewhere pull re-fetches this recipe from later — a path or an http(s) URL (default: the file argument)Check an output file against a recipe's exact-bound contracts
--contract=0check against one exact contract by its index (default: all)--root=.project root (searched for the recipe when a slug is given)Verify a recipe is sealed and gate-passed, then open a corpus PR
--check=falseverify only (the CI/server semantic): print the one-line result and exit--root=.project rootCheck adopted recipes against their sources — loud when an exact contract moved
--apply=falserefresh the stored copy and record for each update (default: report only)--root=.repository whose adopted recipes are checkedPut the authoring surface into a repository and keep it current.
Print this binary's command surface — the source the docs page is built from
--json=falseemit the surface as JSON (what the docs page consumes)--outwrite the JSON snapshot to this file (used by `go generate`)Print the recipe genre spec — the authoring rules this binary enforces (`--seed` for seeds)
--seed=falseprint the SEED genre spec instead of the recipe genre--version=falseprint only the embedded genre spec versionInstall the recipe-authoring surface into this repository (skill, AGENTS.md block, seeds)
--root=.repository to initializeList the repositories on this machine that sporo was installed into
List every sealed recipe across the repos on this machine — id, version, and where
--adopted=falselist recipes this machine pulled IN (the reader-side ledger), not the ones it authored--all=falseinclude unsealed and draft recipes (scans each project's home, not just its registry)--json=falseemit the fleet index as JSON for scriptingRe-sync the managed authoring surface from this binary — never clobbering your edits
--root=.repository to updateKeep the tool itself up to date.
Update this binary to the latest release — then run `sporo update` in each repo
--check=falsereport the latest release and its notes; change nothingDon't take our word for it — verify the binary.
Every release is signed with cosign — keyless, so there's no signing key you have to trust — and carries a SLSA build-provenance attestation binding the binary to this repository's release workflow, plus a full SBOM. Confirm what you downloaded is really ours, offline, in two commands:
# build provenance — who built it, and from which commit
$ gh attestation verify \
sporo_…_linux_amd64.tar.gz \
-R ydnikolaev/sporo
✓ built by ydnikolaev/sporo · release.yml# signature — the keyless cosign bundle over checksums
$ cosign verify-blob \
--bundle checksums.txt.sigstore.json \
checksums.txt
Verified OKThe full policy, continuous-scan posture and vulnerability disclosure live on the security & provenance page.