Most users should use the GitHub Action. The native Rust agent exposes a narrow command-line interface for version inspection, support checks, deterministic plan rendering, and the trusted production lifecycle.
fence --version
fence check-support
fence render-plan --config policy.json
fence run --config /run/fence/example/config.jsonPrints the source-agent version. Cargo.toml is the version authority for source builds; a published bundle's schema-4 manifest is the bundled-agent version and provenance authority.
Reports the current host's operating system, architecture, and native-backend presence, and exposes the accepted hosted-runner fingerprint reference without comparing it to the live host. Fingerprint comparison is deferred to Action activation; this inspection result does not apply controls or claim active protection.
Parses strict JSON configuration and emits a deterministic native nftables preview without applying the production lifecycle:
fence render-plan --config policy.jsonThe configuration must satisfy the same schema and bounded policy validation used by the agent.
Production run is intentionally not a general-purpose root CLI. It accepts only /run/fence/<invocation-id>/config.json, requires pinned root-owned runtime directories and a root-owned 0600 regular configuration file, and validates that the process is the root MainPID of the matching fence-<invocation-id>.service transient unit.
An ordinary direct invocation fails with trusted_launcher_required before reading configuration:
fence run --config /run/fence/example/config.jsonUse the checked-in GitHub Action to create the protected launcher path and production lifecycle. See Architecture and Lifecycle for the full sequence and the configuration interface for the normative CLI contract.