CLI reference

Run synthworld --help and the relevant subcommand --help for the installed version. Getting Started and Evaluating a system contain runnable examples; the root user guide is only a historical compatibility index.

The unified synthworld evaluate <task> command accepts agentic, broker, continuous-assurance, contextual-access, enterprise-agentic, generated-enterprise-agentic, extraction, entity-resolution, relationship, and risk. Some additional package surfaces remain Python-only; use the relevant contract rather than inferring a CLI.

Enterprise authorization currently has CLI commands only for scaffolding, validating, and compiling the identity/access import. Corpus construction, directory/RBAC, ABAC, ReBAC, composition, prediction, and scoring use the documented synthworld.enterprise.consumer Python API. See Build and score an enterprise authorization experiment.

Render the published Asteria authority world

Create a deterministic, self-contained public HTML view from a generated or reproduced Asteria Agentic v1 public package:

synthworld generate-agentic --output asteria-agentic-v1
synthworld visualize \
  --public-package asteria-agentic-v1/public \
  --view agent-authority \
  --output asteria-public.html

Reference truth is opt-in and must come from the separately verified evaluator tree:

synthworld visualize \
  --public-package asteria-agentic-v1/public \
  --evaluator-package asteria-agentic-v1/evaluator \
  --view agent-authority \
  --output asteria-evaluator.html

Evaluator output is visibly watermarked. The default --package-profile asteria accepts only the published Asteria v1 artifact-set digest and refuses to overwrite an existing file. It does not render enterprise authorization packages.

generate-enterprise-agentic preserves its fixed-reference default. Select a generated tier explicitly:

synthworld generate-enterprise-agentic \
  --profile generated \
  --tier smoke \
  --seed 20260814 \
  --output generated-enterprise-agentic

The generated choices are smoke, standard, and longitudinal. Smoke retains the released EnterpriseAgenticGenerationConfigV1 contract. Standard and longitudinal use the independently versioned EnterpriseAgenticGenerationConfigV2 family. The command writes separate public/ and evaluator/ trees and refuses to replace an existing output root. Pass a complete JSON configuration with --config; explicit --tier and --seed values override those two resolved fields. --public-only writes no evaluator directory. See Generate enterprise-agentic scale tiers.

Render a generated enterprise-agentic world

Select the generated package contract explicitly to render a verified generated public tree with the same shared Explorer renderer:

synthworld visualize \
  --public-package generated-enterprise-agentic/public \
  --view agent-authority \
  --package-profile generated-enterprise-agentic \
  --output generated-public.html

The public command reads only the public tree and never opens evaluator truth. Passing --evaluator-package generated-enterprise-agentic/evaluator as well verifies both trees, their digest cross-binding, and declared generator conformance before producing watermarked evaluator output. Unsupported generated tiers or package versions fail explicitly rather than rendering a partial view. Layout coordinates are computed deterministically from the projection alone, so the same verified package always produces the same HTML bytes.

The fixed and generated enterprise-agentic submissions are deliberately separate CLI tasks because they use different trace contracts. Reload and check a generated observed-action trace using only its public tree:

synthworld validate generated-enterprise-agentic-trace \
  --benchmark-root generated-enterprise-agentic \
  --predictions observed-actions.jsonl

Score it only after the complete root is available to the evaluator process:

synthworld evaluate generated-enterprise-agentic \
  --benchmark-root generated-enterprise-agentic \
  --predictions observed-actions.jsonl \
  --summary

Validation checks structure and action-event coverage; it does not claim the reported observations are correct. The generated benchmark guide defines the required event replay and public/evaluator separation.

See Run an enterprise agentic identity experiment for an end-to-end RBAC/ABAC/ReBAC pilot and explicit public projection, layout, evaluator-overlay, and HTML generation steps.

Agentic observation summaries

For evaluate agentic and evaluate generated-enterprise-agentic, --summary prefixes the metric table with non-null counts for every optional trace field. The denominator is submitted rows, not independently verified observations. Empty lists and explicit false values count as reported. Missing capabilities remain unmeasured even when their metric value is zero. The least-privilege warning is general interpretation guidance. JSON output and scoring contracts remain unchanged; retain the trace to interpret missing observations.