---
title: "CLI commands"
summary: "Every ob command, its help text and its flags, taken from the binary itself."
status: shipped
generated: true
read_when:
  - "Looking up what a command does, or which flags it takes"
  - "Deciding whether a command contacts the server or changes it"
---

Generated from the binary, so it cannot describe a flag the CLI does not have.
`ob <command> --help` is the same text.

## Which command changes nothing

Many commands change nothing — `status`, `logs`, `audit`, `schema`, `version` and `canonical` all
just report. These five are the ones that get confused with each other, because each one
answers "would this deploy work?" from a different place.

| Command | Reads | Contacts the server |
| --- | --- | --- |
| `ob validate` | the project file | no |
| `ob preview` | the runtime it would generate | no |
| `ob doctor` | this runner, its local SSH agent, and the environment's policy | no |
| `ob preflight` | the server's readiness to accept a deploy | yes |
| `ob plan` | the project, the server, and writes a plan artifact | yes |

`ob plan` is the only one of the five that writes a file, and it writes it locally.

## ob

```
onebox (ob) — plan-before-apply production operations for one application on one server.

You describe what the application is in ob.yml (or ob.yaml); Onebox generates
the Compose runtime, the names, the routing and the supporting services.
Agentless over SSH, health-gated, journaled and fenced.

Usage:
  ob [flags]
  ob [command]

Available Commands:
  abort       revert an interrupted deploy to the previous release (migration-gated)
  approve     record a local human confirmation for one exact executable plan
  audit       who deployed what, when, from which SHA — incl. failed runs
  bootstrap   first contact: host setup, registry login, and supporting/data services
  canonical   print the canonical form Onebox understood, with where each value came from
  completion  Generate the autocompletion script for the specified shell
  deploy      show the plan, confirm, and release with health-gated zero downtime
  destroy     tear the app down (typed confirmation; volumes kept unless --volumes)
  doctor      check local runner provenance and deployment safety capabilities
  eject       write the generated runtime into the repository and hand it over for good
  exec        run a command inside a workload or service container
  help        Help about any command
  init        scaffold ob.yml from the compose file + rollability doctor
  job         plan and run a sealed one-shot manual job
  logs        compose logs from the current release
  plan        refresh → rendered diff + pinned images + command list → plan artifact
  preflight   ask the server whether this project could be deployed (changes nothing)
  preview     render the runtime the declarative contract generates (no target, no changes)
  proxy       manage the host-scoped proxy (proxy.managed: true)
  resume      continue an interrupted deploy from the journal (fences the old runner)
  rollback    re-release the previous release dir (pinned local image)
  schema      print the JSON Schema for the project file, for editors
  secrets     SOPS-encrypted secrets
  service     manage supporting and data services
  status      recorded versus actual state per workload and service
  validate    validate schema, workloads, and rollability — no side effects
  version     print version and build provenance

Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
  -h, --help            help for ob
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command
      --version         version for ob

Use "ob [command] --help" for more information about a command.
```

## ob abort

```
Revert an interrupted deploy to the release that was serving before it.

Gated on what the interrupted deploy already did: a migration whose effect
cannot be reversed by re-activating a directory refuses, because reverting
the containers would leave them running against data they do not match.

Usage:
  ob abort [flags]

Flags:
      --break-lock             break a stale operation lock after inspecting its holder
      --break-migration-gate   abort past a closed migration gate (you assert schema compatibility)
  -h, --help                   help for abort

Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command
```

## ob approve

```
Record a short-lived local confirmation bound to one exact plan and, when supplied, one exact backup report.

Prompts for confirmation, because approving is a human act: a routine plan
asks yes or no, and one that touches data asks for the release identifier to
be typed back. There is no flag to skip it. The artifact is tamper-evident but
is not an authenticated identity-provider signature. Contacts nothing.

Usage:
  ob approve [flags]

Flags:
      --backup-report string   backup report to bind into this local confirmation
  -h, --help                   help for approve
  -o, --out string             local confirmation artifact path (default "ob-approval.json")
      --plan string            executable plan artifact to approve

Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command
```

## ob audit

```
Who did what, when, and from which revision — including runs whose terminal
is long gone.

Reads the append-only journals on the host. One row per invocation, so a
rollback appears as its own event rather than hiding inside the release it
restored.

Usage:
  ob audit [flags]

Flags:
  -n, --count int   journals to show (default 10)
  -h, --help        help for audit

Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command
```

## ob bootstrap

```
Prepare a host: install what the deploy needs, create the layout, log in to
registries, start the proxy, and start supporting services.

Run once per host before the first deploy. It is safe to run again — each
step converges rather than repeats. Application images, source and environment
payloads are not required or staged; `ob deploy` binds and releases them.

Usage:
  ob bootstrap [flags]

Flags:
      --break-lock   break a stale bootstrap lock after inspecting its holder
  -h, --help         help for bootstrap

Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command
```

## ob canonical

```
Print the project as Onebox normalised it for an environment: shorthand
expanded, defaults filled, overrides applied.

Values you did not write are marked with their origin, because the difference
between a value someone chose and one that appeared by default is what a
person checking a production configuration needs to see.

Usage:
  ob canonical [flags]

Flags:
  -h, --help           help for canonical
      --origins-only   list every value's origin instead of the document

Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command
```

## ob deploy

```
Release: run pre-release jobs, replace workloads behind their health checks,
verify, and move the current symlink.

This is the only way an application reaches a host. It takes the deploy lock,
fences any older runner, journals every phase, drains connections before
stopping a container, and can roll back. Without --plan it plans inline and
asks for confirmation; with --plan it applies exactly what was reviewed.

If it is interrupted, `ob resume` finishes it and `ob abort` reverts it.

Usage:
  ob deploy [flags]

Flags:
      --approval string                    apply a plan-bound local confirmation artifact
      --backup-report string               apply the backup report bound into the local confirmation
      --break-lock                         break a stale deploy lock after inspecting its holder
  -h, --help                               help for deploy
      --image stringArray                  resolved image as workload=reference, for build-sourced workloads (repeatable)
      --no-rollback                        verify failures halt; never auto-rollback
      --override-migration-backup string   audited break-glass reason for proceeding without a required backup report (requires --approval)
      --plan string                        apply a saved plan artifact (binds config + host state; local confirmation is separate)
      --redeploy                           deploy even when nothing changed (fresh roll of identical content)
  -y, --yes                                skip the confirmation prompt

Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command
```

## ob destroy

```
Tear the application down: every container it owns, its scheduled timers, and
its state directory.

Requires the application name typed back. Volumes are kept unless --volumes,
and when they are kept the service credentials are kept with them — a volume
whose credential is gone cannot be opened by a new one. The host proxy survives
unless --proxy is supplied.

Usage:
  ob destroy [flags]

Flags:
  -h, --help      help for destroy
      --proxy     also remove this host's managed proxy
      --volumes   also remove named volumes (DATA LOSS)

Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command
```

## ob doctor

```
Check this runner and the safety capabilities of the environment it targets.

Reports the runner's provenance and whether it satisfies the environment's
minimum version and plan schema, and names every workload and service holding
durable data that has no backup — Onebox does not take backups, and silence
there would read as approval. In structured output, automation should gate on
the report status: data.status for pass or warn, and error.details.status for
a failing diagnosis.

Usage:
  ob doctor [flags]

Flags:
  -h, --help   help for doctor

Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command
```

## ob eject

```
Write the runtime Onebox generates into your repository as ordinary Compose,
and repoint the affected workloads at it.

This is one way. Onebox will not regenerate or reconcile those services
afterwards. The written file carries none of the identity or routing keys
Onebox adds, so it is a file you own rather than one it half-owns, and your
project file keeps its comments and ordering.

Usage:
  ob eject [flags]

Flags:
  -h, --help                help for eject
      --image stringArray   resolved image as workload=reference (repeatable)
  -o, --out string          repository path to write the runtime to (default: a free name beside the project)
      --overwrite           replace an existing file at the destination

Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command
```

## ob exec

```
Run a command inside a running container.

Names a workload or a supporting service. This is an escape hatch: it does not
claim convergence, rollback, idempotence, or output redaction. Onebox journals
the reason, target, target kind, operator, outcome, and command digest — never
the command bytes or passthrough output.

Arguments are passed as a literal vector, so a shell metacharacter is not
interpreted: write `ob exec --reason 'inspect queue' web -- sh -c 'a && b'`
rather than passing the pipeline as one word. Reasons are durable metadata; do
not put credentials or other sensitive values in them.

Usage:
  ob exec <workload|service> -- <command...> [flags]

Flags:
  -h, --help            help for exec
      --reason string   single-line operational justification (max 256 bytes; journaled)

Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command
```

## ob init

```
Scaffold `ob.yml` from the Compose file already in this repository.

A starting point, not permission to deploy: read what it inferred about
roles, persistence, health and job data effects before planning. Writes only
in this repository and contacts nothing.

Usage:
  ob init [flags]

Flags:
  -h, --help   help for init

Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command
```

## ob job

```
Plan and run one declared `when: manual` job against the current serving release.

The job remains in the release runtime but never runs during deploy. Saved plans
bind its release, runtime digest, immutable image and data effect so agents can
obtain a separate approval before execution.

Usage:
  ob job [flags]
  ob job [command]

Available Commands:
  plan        seal a current-release-bound one-shot job plan
  run         run one manual job from an inline or saved sealed plan

Flags:
  -h, --help   help for job

Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command

Use "ob job [command] --help" for more information about a command.
```

### ob job plan

```
Observe the current serving release and write a short-lived executable job plan.

The plan binds the exact runtime digest, digest-pinned image, job data effect,
target and expiry. It reads the target and writes only the local plan artifact.

Usage:
  ob job plan <id> [flags]

Flags:
      --backup-report-out string   write a plan-bound backup report template when migration protection is required
  -h, --help                       help for plan
  -o, --out string                 job plan artifact path (default "ob-job-plan.json")

Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command
```

### ob job run

```
Run one manual job through the canonical lock, fence, local-confirmation and journal boundary.

Humans may pass an id and confirm interactively. Automation should supply a
saved --plan and its separately created local-confirmation artifact through
--approval; migration plans may also require the exact plan-bound --backup-report.

Usage:
  ob job run [id] [flags]

Flags:
      --approval string                    apply a plan-bound local confirmation artifact
      --backup-report string               apply the backup report bound into the local confirmation
      --break-lock                         break a stale operation lock after inspecting its holder
  -h, --help                               help for run
      --override-migration-backup string   audited break-glass reason (requires --approval)
      --plan string                        apply a saved job plan artifact

Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command
```

## ob logs

```
Stream logs from one workload or Onebox-run supporting service. Reads only.

Log bytes are operator-controlled and may contain secrets; Onebox does not claim
to redact passthrough output.

Usage:
  ob logs <workload|service> [flags]

Flags:
  -f, --follow     stream
  -h, --help       help for logs
      --tail int   lines per service (default 100)

Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command
```

## ob plan

```
Read the target's current state, render the runtime, pin every image to a
digest, and write a plan artifact.

Reads the target but changes nothing there. The plan binds the configuration,
the rendered runtime, the host state and the pinned images, and expires after
15 minutes — so a tag that moves afterwards cannot change what is deployed.
Approve it with `ob approve --plan`, apply it with `ob deploy --plan`.

Usage:
  ob plan [flags]

Flags:
      --backup-report-out string   write a plan-bound backup report template when migration protection is required
  -h, --help                       help for plan
      --image stringArray          resolved image as workload=reference, for build-sourced workloads (repeatable)
  -o, --out string                 plan artifact path (default "ob-plan.json")

Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command
```

## ob preflight

```
Render the project locally, then ask the server what would stand in the way:
a missing container runtime, a base path this account cannot write, a derived
name already held by something Onebox does not own, a missing ingress network.

Every problem is reported at once rather than the first one, and nothing is
created, renamed or removed.

Usage:
  ob preflight [flags]

Flags:
  -h, --help   help for preflight

Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command
```

## ob preview

```
Load an onebox.run/v1 project, resolve the environment's overrides, and print
the Compose runtime Onebox would generate, with its content digest.

Nothing is contacted and nothing is written. Environment values are redacted:
a preview must never put a secret on a terminal.

Usage:
  ob preview [flags]

Flags:
      --digest-only         print the content digest and nothing else
  -h, --help                help for preview
      --image stringArray   resolved image for a build-sourced workload, as workload=reference (repeatable)
      --raw                 do not redact environment values
      --release string      release identity to stamp (default "preview")

Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command
```

## ob proxy

```
Manage the host-scoped proxy owned by this host's sole Onebox application.

The proxy outlives application releases and holds the public ports and
certificates. A different application identity is refused before mutation.

Usage:
  ob proxy [flags]
  ob proxy [command]

Available Commands:
  apply       converge the host proxy — diff shown; unchanged config never touches the container (ACME-safe)

Flags:
  -h, --help   help for proxy

Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command

Use "ob proxy [command] --help" for more information about a command.
```

### ob proxy apply

```
Reconfigure the host proxy from the sole owning application's routes.

Taken under the host lock because the proxy belongs to the box rather than to
a release. Cross-application route merging is not supported.

Usage:
  ob proxy apply [flags]

Flags:
      --break-lock   break a stale host lock after inspecting its holder
  -h, --help         help for apply

Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command
```

## ob resume

```
Continue a deploy that was interrupted, from the journal.

Fences the runner that stopped so it cannot wake up and act on stale state,
then carries on from the last completed phase. Use when the interruption was
the runner's — a lost connection, a killed process — rather than the
release's.

Usage:
  ob resume [flags]

Flags:
  -h, --help   help for resume

Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command
```

## ob rollback

```
Re-activate the previous release from the directory still on the host.

Nothing is pulled and nothing is rebuilt: the previous release's images are
already there, which is what makes this fast and available when a registry is
not. Refused when there is no previous release, or when its snapshot is
unavailable or unusable. Supporting services are not rolled back, so a
migration a job already applied stays applied — moving the symlink does
not undo it.

Usage:
  ob rollback [flags]

Flags:
  -h, --help   help for rollback

Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command
```

## ob schema

```
Write the JSON Schema for the `onebox.run/v1` project file.

Reference it from the first line of a project so an editor can offer
completion, hover documentation and inline errors:

  # yaml-language-server: $schema=https://raw.githubusercontent.com/labstack/onebox/main/docs/onebox.run-v1.schema.json

Or keep a copy in the repository with --out, which is what an editor
needs when the machine is offline.

Usage:
  ob schema [flags]

Flags:
  -h, --help         help for schema
  -o, --out string   write to this path instead of standard output

Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command
```

## ob secrets

```
SOPS-encrypted secrets for this project.

`list` names every value-free declaration and its stable entry ID. `edit`
decrypts the selected source to a temporary file, opens an editor, and re-encrypts.
`push` renders the decrypted values into the current release on the host
and restarts what reads them. Plaintext never enters the project file, the
generated runtime, or any plan.

Usage:
  ob secrets [flags]
  ob secrets [command]

Available Commands:
  edit        open one encrypted source in $EDITOR via sops
  list        list value-free secret declarations and stable entry IDs
  push        re-render secrets into the live release and restart workloads if changed

Flags:
  -h, --help   help for secrets

Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command

Use "ob secrets [command] --help" for more information about a command.
```

### ob secrets edit

```
Decrypt the secrets file, open it in $EDITOR, and re-encrypt on save.

Plaintext exists only in a temporary file for the life of the editor. It
never enters the project file, the generated runtime, or any plan.

Usage:
  ob secrets edit [entry-id] [flags]

Flags:
  -h, --help   help for edit

Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command
```

### ob secrets list

```
List the encrypted secret declarations active in the selected environment.

The result contains stable entry IDs, source paths, scopes, output paths, and
affected workloads, but never decrypted values. Pass an ID to `ob secrets edit`
when more than one editable source exists.

Usage:
  ob secrets list [flags]

Flags:
  -h, --help   help for list

Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command
```

### ob secrets push

```
Render the complete decrypted secret graph into the current release on the host and
replace every workload that reads the declared secret graph when any value changes.

The payload is uploaded and compared on the host even for a no-op; unchanged values do
not replace or restart workloads. Refused when secret declarations differ from the
deployed release, or when that release predates opaque secret generations. In either
case, deploy first.

Usage:
  ob secrets push [flags]

Flags:
  -h, --help   help for push

Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command
```

## ob service

```
Manage the supporting services this project declares.

They run in their own Compose projects, so no deploy and no rollback can
stop them or remove their volumes. `apply` converges them to what the
project declares; a major version change a driver cannot perform in place
is refused rather than attempted.

Usage:
  ob service [flags]
  ob service [command]

Available Commands:
  apply       planned service convergence — diff shown, destructive mounts refused without --allow-destructive-mounts

Flags:
  -h, --help   help for service

Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command

Use "ob service [command] --help" for more information about a command.
```

### ob service apply

```
Converge the supporting services to what the project declares.

Each runs in its own Compose project, so this never touches a release and a
release never touches it. A change a driver can apply in place is applied; a
major version change it cannot — a data directory the new version could not
open — is refused with what to do instead, rather than replacing the
container and leaving the data intact and unreachable.

Usage:
  ob service apply [flags]

Flags:
      --allow-destructive-mounts   permit only the mount detachments named in the service plan
      --break-lock                 break a stale operation lock after inspecting its holder
  -h, --help                       help for apply

Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command
```

## ob status

```
Compare what the host records against what it is actually running, per
workload and service.

Reads only. Reports the recorded release, each container's release label and
health, replica shortfalls, the proxy, and any incomplete deploy. Exits
non-zero on divergence so a script can branch on it.

Usage:
  ob status [flags]

Flags:
  -h, --help   help for status

Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command
```

## ob validate

```
Load the project, expand shorthand, apply defaults and the environment's
overrides, and check every rule the contract states.

Contacts nothing and writes nothing. Build metadata is valid before CI supplies
a release image; plan and deploy require that image via `--image`. A failure
names the field, the line and the constraint; `ob canonical` shows what was
understood.

Usage:
  ob validate [flags]

Flags:
  -h, --help   help for validate

Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command
```

## ob version

```
Print the version and build provenance of this binary.

Environment policy can require a released runner, so a commit-derived or
dirty build is reported as such rather than as a version.

Usage:
  ob version [flags]

Flags:
  -h, --help   help for version

Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command
```