Discovery, catalog & field manuals
The Edge Agent can act as a delegated discovery leaf, scanning file shares and sources on the device's side of the boundary, cataloguing what it finds into a vendor-neutral model, and shipping signed inventory bundles home. It also admits signed catalog objects couriered in, and carries the standing orders ("field manual") the agent operates under.
s9 discovery-mapping
The Discovery & Mapping family, register this device as a scanning leaf, run
scans under a policy, and move catalog data across an air gap as signed bundles.
All subcommands accept --format plain|json|table.
Register and scan
| Subcommand | Description | Key flags |
|---|---|---|
register | Register this device as a discovery leaf with the trunk. | --workspace-id (required), --node-endpoint (required), --device-entity-id (required on an unenrolled device), --capability-tier, --leaf-id |
deregister | Deregister this leaf. | --wipe-local (wipe the local micro-catalog) |
status | Show local discovery status. | --detailed (full row-count breakdown by object kind) |
scan | Run a scan against a configured source. | --workspace-id, --source, --policy, --one-in-n, --max-bytes-per-file, --out, --leaf-id |
add-source | Propose a new candidate source to the trunk. | --workspace-id, --proposal-id, --source-kind, --uri, --rationale |
list-scans / list-sources | List recent scans / known sources. | --workspace-id, --limit |
Scan policy (--policy) is one of edge_full, edge_summary (default),
edge_sample (with --one-in-n), or central_only. Passing --leaf-id on a
scan authors the result as a signed leaf inventory delta, every discovered
object is mapped to the vendor-neutral model, signed with the device's persisted
authoring key, and sequenced from the device's own durable watermark so it keeps
counting across reboots and couriers.
s9 discovery-mapping register --workspace-id ws-acme --node-endpoint https://node-a.system9.local
s9 discovery-mapping scan --workspace-id ws-acme --source /mnt/share --policy edge_summary
Move catalog data across the gap
| Subcommand | Description | Key flags |
|---|---|---|
export-bundle | Export the leaf's outbound queue as a sneakernet bundle (.tar.zst). | --out (required), --workspace-id (required), --leaf-id |
ingest-canonical-bundle | Ingest a canonical-update bundle from a courier. | --bundle <PATH> |
frontend | Start the offline catalog-browser frontend (local HTTP server). | --bind (default 127.0.0.1:9090) |
# Export a signed bundle for ride-home ingest, browse the catalog offline
s9 discovery-mapping export-bundle --workspace-id ws-acme --out /media/usb/leaf.tar.zst
s9 discovery-mapping frontend --bind 127.0.0.1:9090
s9 catalog
Signed catalog objects, admit a courier-delivered object (a hook, mask, or transform) after verifying it, and list what this device has admitted.
| Subcommand | Description | Key flags |
|---|---|---|
apply-object | Verify and admit a signed catalog object from removable media. | --bundle-path (required), --dry-run |
list | List the catalog objects this device has admitted. | --kind <KIND> (e.g. hook) |
s9 catalog apply-object --bundle-path /media/usb/hook.bundle --dry-run
s9 catalog list --kind hook
s9 briefing
The field-manual briefing, the agent's authored standing orders. status
shows what the device is briefed with; apply-bundle is the air-gapped delivery
route, verifying a signed bundle off removable media with no network.
| Subcommand | Description | Key flags |
|---|---|---|
status | Show the field manual this device is currently briefed with. | |
apply-bundle | Verify and apply a signed field-manual bundle from removable media. | --bundle-path (required), --dry-run |
s9 briefing apply-bundle --bundle-path /media/usb/acme.fmbundle
s9 briefing status
Related topics
- Data Platform · Catalog & Lineage, the catalog these leaf inventories converge into.
- Data Platform · Governance, the classification model that scan policies respect.
- Governance, audit & telemetry, proving what a scan or apply did.