hoziron-cli package

Package authoring — scaffold, build, inspect, lint, verify, and publish .hpkg packages.

Synopsis

hoziron-cli package <subcommand> [options]

Subcommands

There is no hoziron-cli package sign or hoziron-cli package keygen — the registry signs the package at publish time, using its own key, and records the authenticated publisher identity. package verify --provenance checks that registry signature, not a local one.

hoziron-cli package init

Scaffold a new package directory with MANIFEST.toml template. name is a positional argument, not a --name flag.

hoziron-cli package init --type <type> <name> [--contract <variant>] [--json]

Package Types

Flags

Examples

$ hoziron-cli package init --type competency claims-intake
✓ Created claims-intake/
  ├── MANIFEST.toml
  └── payload/
      └── COMPETENCY.md

$ hoziron-cli package init --type skill pdf-extractor
✓ Created pdf-extractor/
  ├── MANIFEST.toml
  └── payload/
      └── SKILL.md

$ hoziron-cli package init --type integration salesforce-connector
✓ Created salesforce-connector/
  ├── MANIFEST.toml
  └── payload/
      └── mcp.json

# Integration package with an explicit contract variant (ADR-057) —
# scaffolds adapter.json + Starlark transform templates instead of mcp.json
$ hoziron-cli package init --type integration --contract rest-soap legacy-billing-adapter
✓ Created legacy-billing-adapter/
  ├── MANIFEST.toml
  └── payload/
      ├── adapter.json
      └── transforms/
          ├── _template_build_body.star
          └── _template_extract.star

# Contract package (ADR-066) — schema-bearing [implements.<name>] artifact
$ hoziron-cli package init --type contract claims-write
✓ Created claims-write/
  ├── MANIFEST.toml
  └── payload/
      └── CONTRACT.json

hoziron-cli package build

Build a .hpkg archive from a package directory.

hoziron-cli package build <path> [--output <dir>] [--json]

Flags

Example

$ hoziron-cli package build ./claims-intake/
✓ Built: claims-intake-1.0.0.hpkg (24 KB)
  Output: ./claims-intake-1.0.0.hpkg

$ hoziron-cli package build ./claims-intake/ --output /tmp/packages/
✓ Built: claims-intake-1.0.0.hpkg (24 KB)
  Output: /tmp/packages/claims-intake-1.0.0.hpkg

hoziron-cli package inspect

Display manifest and payload structure without installing.

hoziron-cli package inspect <path> [--json]

Example

$ hoziron-cli package inspect ./claims-intake/
Package: claims-intake
Title: Claims Intake
Type: competency
Version: 1.0.0
License: MIT
Min Platform: 0.5.0

Dependencies:
  document-ocr: ^1.0
  claims-core-adapter: ^2.0
  email-skill: ^1.2

Payload:
  COMPETENCY.md (12.4 KB)
  references/
    claims-guide.md (8.4 KB)
    coverage-rules.md (3.2 KB)

Signing: unsigned
Content Hash: sha256:a1b2c3...

hoziron-cli package verify

Verify package integrity — recomputes the SHA-256 Merkle root of the payload and compares it to the hash recorded in MANIFEST.toml at build time.

hoziron-cli package verify <path> [--provenance] [--registry <url>] [--json]

Flags

Examples

# Local-only content-hash check (no network access needed)
$ hoziron-cli package verify ./claims-intake/
✓ Package integrity verified
  Content hash: sha256:a1b2c3d4... (valid)

# With registry provenance — also checks the registry's signature
$ hoziron-cli package verify ./claims-intake/ --provenance
✓ Package integrity verified
  Content hash: sha256:a1b2c3d4... (valid)

  Provenance:
    Publisher:  discovery-insure
    Signature:  ✓ valid
    Signed by:  registry-key-01 (2026-06-01T10:00:00Z)

$ hoziron-cli package verify ./claims-intake/ --provenance --json
{
  "content_hash_valid": true,
  "content_hash": "sha256:a1b2c3d4...",
  "provenance": {
    "publisher_id": "discovery-insure",
    "registry_signature_valid": true,
    "registry_key_id": "registry-key-01",
    "signed_at": "2026-06-01T10:00:00Z"
  }
}

# Failed local verification (tampered payload)
$ hoziron-cli package verify ./tampered-package/
Error: content hash mismatch — payload does not match MANIFEST.toml

hoziron-cli package lint

Validate manifest and payload structure against packaging rules.

hoziron-cli package lint <path> [--json]

Example

$ hoziron-cli package lint ./claims-intake/
✓ MANIFEST.toml valid
✓ Package name format (kebab-case, 3–64 chars)
✓ Version is valid semver
✓ License is valid SPDX identifier
✓ Dependencies use semver ranges
✓ Payload COMPETENCY.md exists
✓ Frontmatter valid (description, skills present)

All checks passed (7/7)

# With errors
$ hoziron-cli package lint ./bad-package/
✓ MANIFEST.toml valid
✗ Package name format: "Bad Package!" contains invalid characters (expected kebab-case)
✗ Dependencies: "document-ocr: latest" is not a valid semver range
✗ SKILL.md: 'description' is required in frontmatter

3 errors found (4/7 passed)

hoziron-cli package publish

Runs the full pipeline: lint → build → upload to registry. The registry signs the package at publish time — no local signing step, and no --key flag.

hoziron-cli package publish <path> [--registry <name>] [--skip-lint] --notes <text> \
    [--derived-from-registry <url> --derived-from-name <name> --derived-from-version <version>] \
    [--json]

Flags

The three --derived-from-* flags must be supplied together or not at all — publishing a fork without full lineage information is rejected.

Examples

$ hoziron-cli package publish ./claims-intake/ --notes "Add CLUE report caching"
→ Linting package...
→ Building .hpkg archive...
✓ Published claims-intake@1.0.0 to default registry

# Publish to a specific registry
$ hoziron-cli package publish ./claims-intake/ --registry internal --notes "Internal hotfix"
✓ Published claims-intake@1.0.1 to internal

# Publish a fork, with full lineage
$ hoziron-cli package publish ./claims-intake-fork/ \
    --notes "Add EU coverage rules on top of upstream 1.2.0" \
    --derived-from-registry https://catalog.hoziron.com \
    --derived-from-name claims-intake \
    --derived-from-version 1.2.0
✓ Published claims-intake-fork@0.1.0 to default registry

hoziron-cli package provenance

Show the version/lineage history for an installed or published package — publisher, signed-at timestamp, release notes — and, if any version carries a derived_from fork snapshot, walk the chain back to the origin registry (fetched live when reachable, falling back to the recorded snapshot when it isn't).

hoziron-cli package provenance <name> [--registry <url>] [--json]

Flags

Example

$ hoziron-cli package provenance claims-intake
claims-intake — provenance chain

https://catalog.hoziron.com (reachable)
  1.2.0  2026-05-20  discovery-insure  "Add CLUE report caching"
  1.1.0  2026-04-15  discovery-insure  "Fix coverage rounding"
  1.0.0  2026-03-01  discovery-insure  "Initial release"

MANIFEST.toml Reference

[package]
type = "competency"
name = "claims-intake"
title = "Claims Intake"
version = "1.0.0"
description = "First Notice of Loss processing"
license = "MIT"
min_platform_version = "0.5.0"

# There is no [package.author] section — package provenance comes from the
# registry's signed publish record, not a self-declared field. See
# ../config/manifest-schemas.md for the full schema.

[package.metadata]
repository = "https://github.com/company/claims-intake"
homepage = "https://company.com/docs/claims-intake"
keywords = ["insurance", "claims", "fnol"]
categories = ["insurance/claims"]
regions = ["us", "uk"]

[dependencies]
document-ocr = "^1.0"
claims-core-adapter = "^2.0"

[standards]
mcp_compatible = true
openapi_spec = "payload/openapi.yaml"

[signing]
# Populated by `hoziron-cli package build` (content hash only — the registry
# signature is assigned at publish time, not stored locally in the manifest).
content_hash = "sha256:a1b2c3d4..."

See Also

• catalog.md — Installing and searching published packages
• competency.md — Using installed competencies
• ../../guides/competencies/authoring.md — Writing COMPETENCY.md