# behold

> A live control plane on chant (https://intentius.io/chant/). behold draws an estate as one graph coloured by what the live estate holds. It reads the estates of the other INTENTIUS tools as well as chant's. Every view is a read. Each write starts an Op the project committed or a forge workflow, on the credentials behold was started with.

An agent driving behold starts with https://intentius.io/behold/using/agents/. Every pane is plain JSON over HTTP, and `GET /api` lists the routes. A person new to it starts with https://intentius.io/behold/start/run-it/.

A read-only live demo of behold on real terragucci pipelines runs at https://demo.intentius.io/kiosk. Each tool has its own page there, such as https://demo.intentius.io/terraform.

Each page under /for/ is a starting point for one kind of estate or one role. A page with a prompt carries it under "Optional: hand this page to your coding agent", and llms.txt lists it under the page. Every prompt ends with the same line, which keeps each write with the person.

## Pages

- [Driving it from an agent](https://intentius.io/behold/using/agents/): Every pane of the UI is plain JSON over HTTP. The read loop, the act loop, and where the contract lives.
  - Optional agent prompt: Clone https://github.com/INTENTIUS/behold and get me looking at a live infrastructure graph in my browser. I want the bundled demo. It needs Docker and no cloud account. Install what it needs and start it, then tell me the URL. Walk me through what I am looking at: what the colours mean, and how I make a resource change colour while I watch. When Docker is not running, say so. Show me the source graph on its own instead. For anything past the demo, read https://intentius.io/behold/llms.txt and https://intentius.io/behold/using/agents/. Never deploy with the Deploy button, `POST /api/apply` or `POST /api/ci/dispatch`. Gate approvals stay mine as well (`/api/ops/:name/signal/:gate`, `/api/workspace/gates/approve`, `/api/operator/approve/:op/:gate`). Op runs (`/api/ops/:name/run`) and rollbacks (`/api/rollback`) are mine too. Leave `--auto-sync` off, and keep a `behold preview` or `--public` serve read-only.
- [behold](https://intentius.io/behold/): A live control plane on chant. Your whole estate in one graph, coloured by drift, with every write delegated to the Ops you committed.
- [What behold is](https://intentius.io/behold/start/what-it-is/): A read-only viewer over a compiler, and what that buys.
- [Run it in five minutes](https://intentius.io/behold/start/run-it/): Two demos that need no cloud account, one AWS and one Kubernetes.
- [Open your own project](https://intentius.io/behold/start/your-project/): Point behold at a chant project you already have. Source graph first, live overlay when you want it.
- [Reading the graph](https://intentius.io/behold/using/reading-the-graph/): What the colours mean, what each zoom tier shows, and what behold does when it cannot see.
- [Acting on it](https://intentius.io/behold/using/acting/): Sync, Adopt, gates, rollback and auto-sync, all delegated to Ops you committed.
- [Export a snapshot](https://intentius.io/behold/using/export/): Freeze the estate into a self-contained static site anyone can open.
- [Serve a chant workspace](https://intentius.io/behold/using/workspace/): Serve a directory that holds a chant.workspace.json, and convert an estate that lists its members in .behold.json.
  - Optional agent prompt: Read https://intentius.io/behold/using/workspace/. Serve this directory with `npx @intentius/behold serve .` and tell me the URL. Name each member that draws as one card, and the reason code on it. If it does not serve, show me what `npx @intentius/behold doctor .` reports. Never deploy with the Deploy button, `POST /api/apply` or `POST /api/ci/dispatch`. Gate approvals stay mine as well (`/api/ops/:name/signal/:gate`, `/api/workspace/gates/approve`, `/api/operator/approve/:op/:gate`). Op runs (`/api/ops/:name/run`) and rollbacks (`/api/rollback`) are mine too. Leave `--auto-sync` off, and keep a `behold preview` or `--public` serve read-only.
- [Look at a Terraform estate](https://intentius.io/behold/using/terraform/): Draw a multi-root Terraform estate. What behold reads, what it refuses to infer, and where the live half is not.
  - Optional agent prompt: Read https://intentius.io/behold/using/terraform/. Install the two packages the page names beside behold. Serve this repository's Terraform with `npx @intentius/behold serve <dir>` and tell me the URL. List the roots it found and each directory it skipped, and why. Never deploy with the Deploy button, `POST /api/apply` or `POST /api/ci/dispatch`. Gate approvals stay mine as well (`/api/ops/:name/signal/:gate`, `/api/workspace/gates/approve`, `/api/operator/approve/:op/:gate`). Op runs (`/api/ops/:name/run`) and rollbacks (`/api/rollback`) are mine too. Leave `--auto-sync` off, and keep a `behold preview` or `--public` serve read-only.
- [Look at a terragucci estate](https://intentius.io/behold/using/terragucci/): Every root of a terragucci repo as one graph, marked with what the pipeline last found. Local, read-only, dated.
  - Optional agent prompt: Read https://intentius.io/behold/using/terragucci/. Ask me where the reports bucket is. Serve this repository with `npx @intentius/behold serve . --terragucci <source>` and tell me the URL. List the roots that carry a mark and the date on each. Never deploy with the Deploy button, `POST /api/apply` or `POST /api/ci/dispatch`. Gate approvals stay mine as well (`/api/ops/:name/signal/:gate`, `/api/workspace/gates/approve`, `/api/operator/approve/:op/:gate`). Op runs (`/api/ops/:name/run`) and rollbacks (`/api/rollback`) are mine too. Leave `--auto-sync` off, and keep a `behold preview` or `--public` serve read-only.
- [Look at a SQL Yodeler project](https://intentius.io/behold/using/sql-yodeler/): Which schema each environment holds, and what SQL Yodeler's report and drift files say, drawn on the project's schema. Local, read-only, dated.
  - Optional agent prompt: Read https://intentius.io/behold/using/sql-yodeler/. Serve this SQL Yodeler project with `npx @intentius/behold serve .` and tell me the URL. List the environments the Releases tab shows. For each gate that waits, show me the `yodel approve` line to run myself. Never deploy with the Deploy button, `POST /api/apply` or `POST /api/ci/dispatch`. Gate approvals stay mine as well (`/api/ops/:name/signal/:gate`, `/api/workspace/gates/approve`, `/api/operator/approve/:op/:gate`). Op runs (`/api/ops/:name/run`) and rollbacks (`/api/rollback`) are mine too. Leave `--auto-sync` off, and keep a `behold preview` or `--public` serve read-only.
- [Look at a choudoufu estate](https://intentius.io/behold/using/choudoufu/): Ownership as two tags. What a green card means here, and what it does not.
  - Optional agent prompt: Read https://intentius.io/behold/using/choudoufu/. Start `npx @intentius/behold demo choudoufu-estate`, or serve this estate with `npx @intentius/behold serve . --env <env>`. Tell me the URL and list the cards that read unowned. Copy out each move preview for me to run. Never deploy with the Deploy button, `POST /api/apply` or `POST /api/ci/dispatch`. Gate approvals stay mine as well (`/api/ops/:name/signal/:gate`, `/api/workspace/gates/approve`, `/api/operator/approve/:op/:gate`). Op runs (`/api/ops/:name/run`) and rollbacks (`/api/rollback`) are mine too. Leave `--auto-sync` off, and keep a `behold preview` or `--public` serve read-only.
- [Look at a Terraform carve-out](https://intentius.io/behold/using/carve/): Render a chant peelability report as a graph. What is cheap to move off Terraform, and what it would cost.
  - Optional agent prompt: Read https://intentius.io/behold/using/carve/. Run `chant carve advise --from <terraform dir> --report carve.json`. Then serve the report with `npx behold carve carve.json` and tell me the URL. List the resources in the carve now band, and hand me the runbook commands to run myself. Never deploy with the Deploy button, `POST /api/apply` or `POST /api/ci/dispatch`. Gate approvals stay mine as well (`/api/ops/:name/signal/:gate`, `/api/workspace/gates/approve`, `/api/operator/approve/:op/:gate`). Op runs (`/api/ops/:name/run`) and rollbacks (`/api/rollback`) are mine too. Leave `--auto-sync` off, and keep a `behold preview` or `--public` serve read-only.
- [Approving a gate](https://intentius.io/behold/using/approving/): Who chant records when you approve a gate from behold, and how behold signs a gate that needs a signed approval.
- [A change set on the graph](https://intentius.io/behold/using/change-set/): Draw a waiting gate's change set on the graph, so a reviewer approves a picture of what will change.
- [Collision marks](https://intentius.io/behold/using/collisions/): See which graph nodes two or more in-flight work items touch, and filter the graph down to the colliding work.
- [Feature flags on the graph](https://intentius.io/behold/using/flags/): See each feature flag on or off per environment, with its owner and work item, and open a flip waiting at a gate as its change set.
- [Running a CI job locally](https://intentius.io/behold/using/local-run/): Run a pull request's plan job on this machine with chant ci run --local, and read it beside CI's run of the same job at the same commit.
- [The three-cloud demo](https://intentius.io/behold/using/three-cloud/): A website in AWS, Azure and GCP behind Route 53, on local emulators. Turn Azure off and see where the traffic goes.
- [The trunk lane](https://intentius.io/behold/using/trunk/): What is in flight and where it is. The trunk's recent commits, and per environment what runs there and what waits at a gate, with approve.
- [behold on a chant workspace](https://intentius.io/behold/for/workspace/): Serve a directory whose chant.workspace.json lists its members and see every member in one graph. One chant project on its own works the same way.
  - Optional agent prompt: Read https://intentius.io/behold/for/workspace/. Serve this directory with `npx @intentius/behold serve .` and tell me the URL. Name each member that draws as one card, and the reason code on it. If it does not serve, show me what `npx @intentius/behold doctor .` reports. Never deploy with the Deploy button, `POST /api/apply` or `POST /api/ci/dispatch`. Gate approvals stay mine as well (`/api/ops/:name/signal/:gate`, `/api/workspace/gates/approve`, `/api/operator/approve/:op/:gate`). Op runs (`/api/ops/:name/run`) and rollbacks (`/api/rollback`) are mine too. Leave `--auto-sync` off, and keep a `behold preview` or `--public` serve read-only.
- [behold on a Terraform estate](https://intentius.io/behold/for/terraform/): Draw a directory of Terraform roots straight from the checkout. Each root is a box of resource cards, and the references the configuration states are its edges.
  - Optional agent prompt: Read https://intentius.io/behold/for/terraform/. Install the two packages the page names beside behold. Serve this repository's Terraform with `npx @intentius/behold serve <dir>` and tell me the URL. List the roots it found and each directory it skipped, and why. Never deploy with the Deploy button, `POST /api/apply` or `POST /api/ci/dispatch`. Gate approvals stay mine as well (`/api/ops/:name/signal/:gate`, `/api/workspace/gates/approve`, `/api/operator/approve/:op/:gate`). Op runs (`/api/ops/:name/run`) and rollbacks (`/api/rollback`) are mine too. Leave `--auto-sync` off, and keep a `behold preview` or `--public` serve read-only.
- [behold on a terragucci estate](https://intentius.io/behold/for/terragucci/): Serve a repo that terragucci runs and see every root in one graph. Each card carries what the newest run found about it.
  - Optional agent prompt: Read https://intentius.io/behold/for/terragucci/. Ask me where the reports bucket is. Serve this repository with `npx @intentius/behold serve . --terragucci <source>` and tell me the URL. List the roots that carry a mark and the date on each. Never deploy with the Deploy button, `POST /api/apply` or `POST /api/ci/dispatch`. Gate approvals stay mine as well (`/api/ops/:name/signal/:gate`, `/api/workspace/gates/approve`, `/api/operator/approve/:op/:gate`). Op runs (`/api/ops/:name/run`) and rollbacks (`/api/rollback`) are mine too. Leave `--auto-sync` off, and keep a `behold preview` or `--public` serve read-only.
- [behold on a SQL Yodeler project](https://intentius.io/behold/for/sql-yodeler/): Draw the schema a SQL Yodeler project declares. What each environment holds comes from the files yodel wrote and the chant/lifecycle branch.
  - Optional agent prompt: Read https://intentius.io/behold/for/sql-yodeler/. Serve this SQL Yodeler project with `npx @intentius/behold serve .` and tell me the URL. List the environments the Releases tab shows. For each gate that waits, show me the `yodel approve` line to run myself. Never deploy with the Deploy button, `POST /api/apply` or `POST /api/ci/dispatch`. Gate approvals stay mine as well (`/api/ops/:name/signal/:gate`, `/api/workspace/gates/approve`, `/api/operator/approve/:op/:gate`). Op runs (`/api/ops/:name/run`) and rollbacks (`/api/rollback`) are mine too. Leave `--auto-sync` off, and keep a `behold preview` or `--public` serve read-only.
- [behold on a choudoufu estate](https://intentius.io/behold/for/choudoufu/): choudoufu manages estates on AWS and Kubernetes and keeps ownership in marker tags on the live resources. behold reads those tags, so a green card means the resource is ours.
  - Optional agent prompt: Read https://intentius.io/behold/for/choudoufu/. Start `npx @intentius/behold demo choudoufu-estate`, or serve this estate with `npx @intentius/behold serve . --env <env>`. Tell me the URL and list the cards that read unowned. Copy out each move preview for me to run. Never deploy with the Deploy button, `POST /api/apply` or `POST /api/ci/dispatch`. Gate approvals stay mine as well (`/api/ops/:name/signal/:gate`, `/api/workspace/gates/approve`, `/api/operator/approve/:op/:gate`). Op runs (`/api/ops/:name/run`) and rollbacks (`/api/rollback`) are mine too. Leave `--auto-sync` off, and keep a `behold preview` or `--public` serve read-only.
- [behold on a Terraform carve-out](https://intentius.io/behold/for/carve/): Move resources from Terraform to chant one at a time. behold draws chant's peelability report and ranks each resource by what carving it costs.
  - Optional agent prompt: Read https://intentius.io/behold/for/carve/. Run `chant carve advise --from <terraform dir> --report carve.json`. Then serve the report with `npx behold carve carve.json` and tell me the URL. List the resources in the carve now band, and hand me the runbook commands to run myself. Never deploy with the Deploy button, `POST /api/apply` or `POST /api/ci/dispatch`. Gate approvals stay mine as well (`/api/ops/:name/signal/:gate`, `/api/workspace/gates/approve`, `/api/operator/approve/:op/:gate`). Op runs (`/api/ops/:name/run`) and rollbacks (`/api/rollback`) are mine too. Leave `--auto-sync` off, and keep a `behold preview` or `--public` serve read-only.
- [behold with no project yet](https://intentius.io/behold/for/demo/): The bundled demo deploys an S3 bucket to a local emulator. Its cards turn green once behold observes it. To watch behold first, open the live demo, which needs no install.
  - Optional agent prompt: Read https://intentius.io/behold/for/demo/. Start `npx @intentius/behold demo` and tell me the URL. Walk me through Deploy on the control panel so I watch the bucket turn green. When Docker is not running, say so. Never deploy with the Deploy button, `POST /api/apply` or `POST /api/ci/dispatch`. Gate approvals stay mine as well (`/api/ops/:name/signal/:gate`, `/api/workspace/gates/approve`, `/api/operator/approve/:op/:gate`). Op runs (`/api/ops/:name/run`) and rollbacks (`/api/rollback`) are mine too. Leave `--auto-sync` off, and keep a `behold preview` or `--public` serve read-only.
- [Working with a coding agent](https://intentius.io/behold/for/agents/): Hand behold to a coding agent. Every pane is plain JSON over HTTP, and each write stays with you.
  - Optional agent prompt: Read https://intentius.io/behold/for/agents/. Serve this project with `npx @intentius/behold preview .`. Fetch `GET /api` and `GET /api/graph`, then tell me what the graph holds. Never deploy with the Deploy button, `POST /api/apply` or `POST /api/ci/dispatch`. Gate approvals stay mine as well (`/api/ops/:name/signal/:gate`, `/api/workspace/gates/approve`, `/api/operator/approve/:op/:gate`). Op runs (`/api/ops/:name/run`) and rollbacks (`/api/rollback`) are mine too. Leave `--auto-sync` off, and keep a `behold preview` or `--public` serve read-only.
- [Running behold for a platform team](https://intentius.io/behold/for/platform/): Give a platform team one graph per estate across substrates. Deploys go through the Ops and forges the team already runs.
  - Optional agent prompt: Read https://intentius.io/behold/for/platform/. Serve this estate with `npx @intentius/behold serve . --env <env> --poll 30` and tell me the URL. List the nodes it reports as unobserved. Name the Ops it offers so I can decide on them. Never deploy with the Deploy button, `POST /api/apply` or `POST /api/ci/dispatch`. Gate approvals stay mine as well (`/api/ops/:name/signal/:gate`, `/api/workspace/gates/approve`, `/api/operator/approve/:op/:gate`). Op runs (`/api/ops/:name/run`) and rollbacks (`/api/rollback`) are mine too. Leave `--auto-sync` off, and keep a `behold preview` or `--public` serve read-only.
- [Security review](https://intentius.io/behold/for/security/): Review what behold reads and where each of its writes runs.
  - Optional agent prompt: Read https://intentius.io/behold/for/security/. Run `npx @intentius/behold doctor . --json` in this project and summarise it. List the Ops this project commits so I can review which ones behold would offer. Never deploy with the Deploy button, `POST /api/apply` or `POST /api/ci/dispatch`. Gate approvals stay mine as well (`/api/ops/:name/signal/:gate`, `/api/workspace/gates/approve`, `/api/operator/approve/:op/:gate`). Op runs (`/api/ops/:name/run`) and rollbacks (`/api/rollback`) are mine too. Leave `--auto-sync` off, and keep a `behold preview` or `--public` serve read-only.
- [Evaluating behold](https://intentius.io/behold/for/evaluate/): Try the demo on a local emulator first. Then draw your own project's source graph with nothing set up.
  - Optional agent prompt: Read https://intentius.io/behold/for/evaluate/. Start `npx @intentius/behold demo` and tell me the URL. Then run `npx @intentius/behold demo --list` and tell me which demos run on this machine. Never deploy with the Deploy button, `POST /api/apply` or `POST /api/ci/dispatch`. Gate approvals stay mine as well (`/api/ops/:name/signal/:gate`, `/api/workspace/gates/approve`, `/api/operator/approve/:op/:gate`). Op runs (`/api/ops/:name/run`) and rollbacks (`/api/rollback`) are mine too. Leave `--auto-sync` off, and keep a `behold preview` or `--public` serve read-only.

## Full text

- [llms-full.txt](https://intentius.io/behold/llms-full.txt): every page above in one file