RiskDemandMgmt CLI

riskdemand-cli is the Windows 10/11 command-line client for RiskDemandMgmt and requires Python >= 3.12. It is a thin HTTP/JSON client: authentication, permissions, validation, revisions, workflow state, and every business rule remain on the server.

Install and upgrade

After a release is available on official PyPI, install it in an isolated pipx environment:

pipx install riskdemand-cli
pipx upgrade riskdemand-cli
rdm --help

Repository version 0.1.2 is unreleased. Publishing it to PyPI requires separate exact release authorization; the released 0.1.1 history remains unchanged.

Read-only diagnostics

rdm doctor --help
rdm doctor --json

Doctor is read-only. It never repairs state, authenticates, logs out, changes a file, issues or revokes a token, or calls a business write API. Interpret its overall result as:

• pass / exit 0: the runtime, binding, instance, and authentication checks pass;
• action_required / exit 0: the user still needs to set up or log in, or the token expired;
• fail / exit 1: a real runtime, local-state, network, TLS, server, or protocol failure occurred.

Manual authentication boundary

The user runs these commands in their own terminal and enters credentials only into the interactive prompt:

rdm setup <server-url>
rdm auth login

Agent must never handle a username, password, or token. Agents may use JSON commands after the user completes authentication, subject to the canonical Skill's confirmation and permission rules.

Requirement links and write results

Successful requirement-associated results contain data.links.web_detail; requirement items in lists and tasks use item-level links.web_detail. The CLI generates this URL from the currently bound instance. It may be presented unchanged, but must not be synthesized, joined, or rewritten. It is navigation metadata, not proof of visibility or edit permission; Web authentication and server-side permissions remain authoritative after opening it.

Interpret the six business write commands—create, update, attachment upload/link/delete, and submit—using only existing fields, in this order:

1. ok=true and data.recovered_replay=true: confirmed after recovery.
2. Any other ok=true: directly confirmed.
3. error.details.outcome=needs_review or error.details.reuse_request_id=true: the result is unknown; stop and do not automatically retry the business write. Reuse the same create request ID only if the user later explicitly asks to recover it.
4. Any other ok=false: report the failure and do not automatically retry the business write.

One bundled Skill, installed manually

The distribution contains one canonical Skill. The user locates it in the pipx environment and manually copies it to an existing .agents or .claude Skill directory; the CLI and the Agent do not modify those directories:

$pipxVenvs = pipx environment --value PIPX_LOCAL_VENVS
$skillSource = Join-Path $pipxVenvs "riskdemand-cli\skills\riskdemandmgmt-cli\SKILL.md"
Test-Path -LiteralPath $skillSource

Compatibility and authority

Compatibility is determined by the server-advertised protocol_version, not by matching the CLI package version to a system release Tag. The server remains authoritative for authentication, scopes, object permissions, validation, revisions, state transitions, and all high-impact action boundaries.

Documentation

• Repository and current user guide
• Phase 1 CLI design
• Phase 2 PyPI and doctor design