`maqpna dev fork`

Live-fork a session's kosa8 sandbox into a governed child session with its own token

Synopsis#

maqpna dev fork [--session S] [--name STEM] [--attach=false] [--ttl 1h] [--sandbox kosa8] [-o json]

Description#

From the help of maqpna dev:

up starts maqpna-identity, maqpna-gateway and (unless --no-echo) mcp-echo from the installed binaries (next to maqpna or on PATH); in a source checkout with --from-source, or when they are missing, they are built with go build. run mints a session token from the local broker and runs CMD with the same environment the operator gives a sandbox (MAQPNA_GATEWAY_URL, MAQPNA_TOKEN, MAQPNA_SESSION, MAQPNA_AGENT, MAQPNA_TOOL_<NAME>_URL), then prints what the session did. Exit code: CMD's. up --llamay MODEL also serves MODEL with llamay as model route "llamay": each session gets its own llamay inference context, forked with the session, and llamay's request audit is anchored in the ledger (fail closed). up --kosa8 serves the gateway on this host's LAN address and cross-anchors the ledger with kosa8d's audit; run --kosa8-image then runs CMD in a kosa8 microVM that can reach only the gateway, and fork live-forks a kept sandbox into a governed child session with its own token. snapshot checkpoints a kept sandbox together with its llamay inference contexts; restore boots the checkpoint as a new session (its own token, the checkpointed session as parent) and resumes those contexts. attest prints the sandbox's measurements (kernel, rootfs, image digests) and proves its egress is the gateway only (exit code 3 when it is not).

Flags#

Flag	Type	Description	Default
`--attach`	switch	stream the forked agent's output until it exits	`true`
`--dir`	string	state directory (keys, config, ledger, logs)	`.maqpna`
`--name`	string	stem of the child session id (default: <session>-fork); the child is <stem>-1	none
`--sandbox`	string	sandbox driver (agent-sandbox, e2b, kosa8)	`kosa8`
`--session`	string	session to fork (default: the last one dev run started)	none
`--ttl`	duration	child token lifetime	`1h0m0s`

The global flags (--context, -o, --no-color, ...) work with every command.

Examples#

$ maqpna dev fork --session dev-1a2b3c4d

What happens when you run it#

Prints a table by default; -o json or -o yaml print the data, and --jq EXPR filters the JSON.

Exit codes#

Code	Meaning
`0`	success
`1`	error (the message says what failed, with a hint when there is one)
`2`	usage error: unknown flag, missing argument or bad value; the synopsis is printed
`3`	a check failed, a change is blocked, or a result did not match (tamper, policy mismatch) (not used by this command)

maqpna dev fork