Daemon & fleet lifecycle
These commands run the steady-state Edge Agent and keep its binary and stores
current. The daemon (s9 run) is the long-lived process a host supervises; the
Fleet Releases commands (s9 fleet-releases …) install, verify, update, and
roll back the agent, including a fully offline route for air-gapped devices.
s9 run
Run the steady-state daemon loop. On boot it starts the periodic heartbeat and, by default, the local Model Serving IPC server and inbox watcher; other capture and forwarding behaviours are opt-in per deployment.
| Flag | Description |
|---|---|
--operational-endpoint <URL> | Override the operational gRPC endpoint. |
--heartbeat-interval-seconds <N> | Override the heartbeat interval. |
--max-heartbeats <N> | Exit after this many heartbeats (or local ticks, under the air-gapped posture) instead of looping forever: useful for smoke tests and CI. |
--no-https-fallback | Disable the HTTPS fallback driver even if the config declares an external endpoint. |
--no-model-serving | Do not start the Model Serving IPC server + inbox watcher (for telemetry-only hosts). |
--enable-sensor-capture | Arm autonomous sensor capture: each tick polls on-board sensors, signs a capture bundle, and submits it. Off by default. |
--capture-max-samples <N> | Max samples drained per sensor per capture tick (default 8). |
--enable-cognition-forward | Arm autonomous forwarding: each tick rides spooled cognition partials home. Off by default. |
--forward-utilization <F> | Projected utilisation driving the forward batch cap (default 0.2). |
--disable-alignment-policy | Turn off the alignment policy stage that judges the daemon's consequential actions. On by default; disabling it is an explicit operator act that changes what the device will refuse to do. |
# Foreground daemon with a 30s heartbeat
s9 run --heartbeat-interval-seconds 30
# Air-gapped device, bounded local ticks for a smoke test
s9 run --max-heartbeats 5
s9 heartbeat
Send a single heartbeat to the Edge Agent Gateway and exit, the one-shot form of
what s9 run does on a loop.
| Flag | Description |
|---|---|
--operational-endpoint <URL> | Override the operational gRPC endpoint. |
--battery-percent <N> | Report this battery percent (-1 for unknown). |
s9 heartbeat
s9 probe
Probe a Gateway endpoint for reachability and wire compatibility, with no side effects. Useful when diagnosing connectivity or a version-skew rejection.
| Argument / flag | Description |
|---|---|
<ENDPOINT> | HTTP(S) URL of the target Gateway endpoint. |
--timeout-secs <N> | TCP connect timeout (default 5). |
--json | Machine-readable output. |
s9 probe https://node-a.system9.local --json
s9 migrate
Run this device's outstanding store data passes. Use --dry-run first to see
what would change without writing anything.
| Flag | Description |
|---|---|
--dry-run | Report what would change and write nothing: safe on a production device. |
--json | Emit the report as JSON. |
s9 migrate --dry-run
s9 migrate
s9 fleet-releases
The Fleet Releases family: install the agent, check for and apply signed updates, roll back, freeze automatic updates, verify packages against trust roots, and (for air-gapped devices) apply a couriered bundle offline.
Lifecycle subcommands
| Subcommand | Description | Key flags |
|---|---|---|
install | Install the agent on this host (one-shot bootstrap). | --token <TOKEN> (required), --node-endpoint <URL>, --skip-start |
uninstall | Uninstall the agent (mirror of install). | --purge (wipe state dir) |
status | Current version, desired version, last apply outcome, freeze state, retained rollback target. | --json |
check-update | Probe the cell for a desired-state update and print it without acting. | --json |
apply-update | Apply the cell's currently-desired update (or a named package). | --package-id <ID>, --require-signature, --skip-prechecks |
rollback | Roll back to the previously retained binary. | --reason <TEXT> |
freeze / thaw | Set / clear the local freeze flag (no auto-apply). | --reason <TEXT>, --duration-seconds <N> |
verify | Verify a package on disk against the agent's trust roots. | --package-path <PATH> |
upload-evidence | Upload pending offline-apply evidence files to the cell. | --json |
# Check for, then apply, a signed update
s9 fleet-releases check-update
s9 fleet-releases apply-update --require-signature
# Freeze automatic updates during a maintenance window
s9 fleet-releases freeze --reason "change freeze 2026-09" --duration-seconds 86400
Offline (sneakernet) apply
apply-bundle is the air-gapped route: it verifies a couriered bundle against the
trust roots the device already holds and applies it with no network.
mint-bundle is its operator-side pair, run on a courier workstation to produce
the bundle.
| Subcommand | Description | Key flags |
|---|---|---|
apply-bundle | Apply a sneakernet bundle from a courier. | --bundle-path <PATH> (required), --evidence-out <PATH>, --require-transparency |
mint-bundle | Mint a sneakernet .qmbundle from local inputs (operator courier flow). | --wrapper-path, --out, --bundle-id, --package-id, --to-version, --binary-sha256, --key-id, --signing-key-path, plus optional transparency-proof inputs |
# On the air-gapped device: apply a couriered release bundle
s9 fleet-releases apply-bundle \
--bundle-path /media/usb/release.qmbundle \
--evidence-out /media/usb/apply-evidence.json
--require-transparency (on apply-bundle) and --require-signature (on
apply-update) can only raise the device's configured requirement for that one
apply, they never lower it, so a deployment that already demands proof keeps
demanding it.
s9 fleet-releases trust-roots
Inspect and refresh the agent's trust-root set, the keys package signatures are verified against.
| Subcommand | Description | Key flags |
|---|---|---|
show | Show the active trust-root set (one row per current key). | --json |
refresh | Refresh the trust-root set from the cell on demand. | |
list-keys | List every retained key with metadata (rotation history). | --include-expired, --json |
s9 fleet-releases trust-roots show --json
s9 fleet-releases service
Install, inspect, and repair the OS service entry (systemd unit, launchd plist,
or Windows SCM) that keeps s9 run supervised.
| Subcommand | Description |
|---|---|
install | Install the OS service entry. |
uninstall | Uninstall the OS service entry. |
render | Print the rendered unit / plist / SCM entry to stdout. |
status | Show the current service state. |
s9 fleet-releases service render # preview the unit before installing
s9 fleet-releases service install
s9 fleet-releases service status
Related topics
- Deployment topology, where the daemon runs among the deployment shapes.
- Security · Cryptography, the signing and trust-root model behind package verification.
- Governance, audit & telemetry, controlling what the daemon transmits.