Work from the Griot CLI

The griot CLI is a native Rust executable. Its source is in cli/griot. The nonpublishing CI run passed build, tests, smoke, archive creation, and checksum verification on Linux x86-64, macOS Apple Silicon, and Windows x86-64. These are CI target results, not certification of older Linux distributions or other architectures. No archive has been signed or published for download. Build locally from a checkout with the CLI and matching generated API manifest:

cargo build --release --manifest-path cli/griot/Cargo.toml

The resulting executable is cli/griot/target/release/griot (griot.exe on Windows); put that directory on your PATH or invoke it by full path. This build needs Rust, but running the binary does not require Python or Node. Packaging scripts and install/uninstall instructions are in cli/griot/README.md in a checkout with the CLI distribution feature; verify an archive against a checksum from a trusted channel before installing. CI does not upload release artifacts.

Connect without putting a secret in command history

Set GRIOT_API_URL to the HTTPS API origin. For an interactive human session, run griot auth login --email YOUR_EMAIL --callback-url https://YOUR-TRUSTED-APP/auth/magic on a deployment with email delivery configured. Open the emailed link, copy only its one-time token query parameter, and paste it into the CLI's hidden prompt. The CLI verifies it through K01 and stores the session in the OS keychain for the selected profile. It does not scrape browser cookies or logs. Use --token-stdin only when a trusted process supplies that one-time token; on macOS/Linux --credential-file /private/path makes a new mode-0600 file if you deliberately prefer one. Do not use an untrusted callback URL.

Alternatively, issue a PAT through the workspace UI and load it into GRIOT_TOKEN using your shell's secret mechanism. Also set GRIOT_TENANT_ID to the tenant UUID. The CLI adds the tenant header for a gpat_ PAT. A session JWT carries its own tenant claim. A gak_ MCP agent key is not a REST credential.

griot auth status
griot operations --resource catalogs
griot resource catalogs list
griot resource domains list

Do not put a token in --body, --param, or a URL. The CLI persists a session only when you choose keychain or a private credential file during login; it does not write PAT environment values to disk. Named profiles use GRIOT_TOKEN_<PROFILE>, GRIOT_TENANT_ID_<PROFILE>, GRIOT_API_URL_<PROFILE>, and GRIOT_CREDENTIAL_FILE_<PROFILE>; they do not fall back to the default token. Environment credentials take precedence over a selected file, then the keychain. Interactive OAuth device/browser login is not implemented.

Find tables and buckets

griot tables list --limit 50
griot buckets list --catalog default --domain sales
griot buckets get --catalog default --domain sales --bucket imports

tables list/get addresses governed datasets. Bucket and explicit table-creation commands require the integrated catalog manifest; a binary built against an older server fails with a missing operation instead of guessing a route.

After building against the integrated catalog contract, upload original bytes to a bucket:

griot buckets files upload ./orders.csv \
  --catalog default --domain sales --bucket imports --path 2026/orders.csv

That command does not create a table. griot tables create --catalog default --domain sales --bucket imports --path 2026/orders.csv --table orders is a separate operation requiring a human steward session JWT. A PAT is rejected by the CLI before the request. Do not bypass that boundary by invoking a raw operation ID.

griot call <operation-id> reaches a declared public operation; griot operations lists the IDs in this build. Mutating DELETE, PATCH, and PUT calls require --yes. Downloads refuse to overwrite an existing file. JSON goes to stdout, diagnostics to stderr. This local-build interface is implemented but not yet a released cross-platform distribution.

The current CLI also has top-level jobs, runs, pipelines, sources, connections, models, reports, notebooks, and compute groups; governance and sharing resource/action groups; and workspace members|roles groups. These resolve operation IDs from the compiled manifest. If an operation is absent, the CLI refuses it rather than constructing a private route.