Runtime

How adversaries execute under the CLI: scope selection, capabilities, host trust, and review output.

Run anywhere you can run the CLI

The same kind of versioned adversary package runs on a developer machine or in CI with the open-source CLI. Hosted pull-request reviews use the official review/code package and hosted inference instead of a workflow you maintain.

Prefer domain/name catalog ids and --path for the repository under review. Full flag list: CLI reference. For pull requests without a workflow, see Hosted reviews. For pipelines you run yourself, see Run reviews in CI.

bash

doomer run go/security --path .

doomer run ci/github-actions --path . --base main --head HEAD

doomer run ./my-adversary --path ../service --build

# Auto-select from catalog + local store for this repo's change scope
doomer run --path .
doomer run --dry-run --explain --path .

Execution

The CLI launches the adversary process (HostExecutor today), pins remote artifacts to a digest, and reports identity before run.

Review scope

Infers git change set from CI PR refs, worktree, or feature vs default branch unless you pass --base/--head/--all-files.

Permissions

Manifest permissions describe isolation. Advisory by default; enforcement: required and --no-network fail closed when HostExecutor cannot enforce them.

Trust gate

Official-signed catalog packages may use host execution. Unsigned packages require TTY confirm or --allow-unsafe-host-execution.

Output contract

Structured review on stdout (text or versioned JSON envelope). Progress, trust warnings, and diagnostics on stderr.

Permissions

Packages declare portable access intent in permissions (filesystem, network, model broker, environment). There is no separate requires: capability list. Full field reference: Permissions.

adversary.yaml

permissions:
  enforcement: advisory
  filesystem:
    read:
      - .
    write: []
  network: false
  model: true
  environment:
    allow: []

Deep dive: Execution trust model.