rlp CLI

rlp validates contracts, checks policy, runs the standard verbs for every component and scaffolds repos from templates. Local runs, act runs and CI runs all go through it, so they execute the same commands. Later slices add commands that drive the platform API.

It is published as the rlp-cli package (the rlp name on PyPI is taken); the command is rlp.

Install

Pick one:

The install scripts download the binary for your OS from the latest GitHub Release, check it against the release's SHA256SUMS, and put it on your PATH (~/.local/bin, or %LOCALAPPDATA%\rlp\bin on Windows). RLP_VERSION=v0.1.0 installs a specific release; RLP_INSTALL_DIR changes the location.

Binaries exist for Linux (x86_64, arm64), macOS (Apple silicon) and Windows (x86_64). On an Intel Mac, use the PyPI package.

Unsigned binaries. The binaries are not code-signed or notarized yet:

• macOS: Gatekeeper may say the binary "cannot be opened". The install script prints the fix: xattr -d com.apple.quarantine ~/.local/bin/rlp.
• Windows: SmartScreen may warn on first run. Choose More info, then Run anyway.

Besides itself, rlp needs only go-task (for verbs that run task <name>), git (for rlp new and rlp update with git templates) and, later, Docker. rlp policy check downloads the pinned conftest on first use into your user cache, checked against its published SHA256 (RLP_TOOLS_DIR overrides the location).

Commands

Verb overrides are split with POSIX shell rules on every OS and run without a shell: no pipes, globs or variable expansion. Put anything more complex in a Taskfile task. Write paths with forward slashes.

rlp new and rlp update refuse templates that run tasks or load Jinja extensions unless you pass --trust.

Output and exit codes

Every command takes --output json (or -o json, or RLP_OUTPUT=json) for agents and scripts. In JSON mode stdout holds exactly one JSON document with an ok field; the verbs' own output goes to stderr.

Development

From the repo root:

task test      # schemas, policy bundle and CLI tests (installs .venv and pinned tools)
task package   # wheel and sdist into dist/ with uv
task binary    # standalone binary for this OS into dist/ with PyInstaller

The CLI tests drive rlp as a subprocess. Set RLP_BIN=dist/rlp-<os>-<arch> to run the same suite against a built binary. The cli workflow runs the suite on Linux, Windows and macOS, against both the installed wheel and the binary, and tests the install scripts against that binary.

Cross-platform rules: pathlib for every path, subprocesses called with argument lists (never shell strings), no POSIX-only modules.

Releasing

Releases are cut by pushing a version tag that matches rlp_cli.__version__ (for example v0.1.0). The release workflow builds the wheel, sdist and per-OS binaries, tests each binary, attaches everything with SHA256SUMS to a GitHub Release, and publishes to PyPI through trusted publishing. PyPI publishing needs a one-time trusted-publisher setup on pypi.org (#23). Code signing is pending a decision (#24).