ASLICE-APPLY(1) aslice v0.1

aslice contributors · September 2026

NAME

aslice-apply — execute a saved plan; replay a lock file

SYNOPSIS

aslice apply [plan.json | aslice.lock | https://…] [--dry-run] [--accept-system-changes] [--accept-grafts] [--allow-source-builds] [--json]

aslice plan install package… [install-options]

aslice lock export

DESCRIPTION

apply detects the document kind from its content and executes the exact state it records. A saved plan (JSON, from aslice plan) is executed step for step. A lock file (lock_version = 2, PACKAGE-FORMAT §7) is replayed exactly — the recorded package set becomes a new generation. An https:// argument is fetched, hash-printed, and shown before any consent is asked. With no argument there is no default document — apply prints its usage.

A whole-machine setup file (schema = 1, SETUP.md) is refused here with a pointer to aslice machine apply (aslice-machine(1)). That command resolves a machine wishlist and uses ./aslice-machine.toml as its default document. Exact-state replay belongs to the top-level command; wishlist convergence belongs under aslice machine.

PRODUCING PLANS AND LOCKS

plan install resolves the named package request without executing it and emits a saved JSON plan. Package identifiers, targeted batch options, and solver choices follow aslice-install(1). The specifications demonstrate the install form; a complete grammar for other plan actions is not yet defined. Planning does not transfer consent to later execution.

lock export writes the current profile's exact resolution to stdout as a version-2 lock file. It records exact artifacts and bindings, not a wishlist; replay cannot silently substitute another artifact. Additional profile-selector syntax for export is unspecified. Both documents require authentic records and available exact artifacts; a lock alone is not an offline backup of their bytes.

EXAMPLES

aslice plan install extended:ffmpeg > plan.json
aslice apply plan.json --dry-run
aslice apply plan.json
aslice lock export > aslice.lock
aslice apply aslice.lock

APPLY SEMANTICS

Before execution, the document is shown and confirmed, and its exact artifact records, repository identities, machine requirements, and expected base generation are revalidated. A stale plan is refused. Packages are staged before activation; external writes and profile changes follow the durable journal. Failure after live changes invokes recovery and may require conflict resolution or reboot. Package rollback does not restore application data (STATE-AND-RECOVERY §5 and STATE-AND-RECOVERY §8).

--dry-run prints the complete plan and changes nothing.

A plan or lock containing system packages or system patches is refused non-interactively — exit status 2 — unless --accept-system-changes is passed for that operation; interactively each gated step prompts, naming what will be written. There is deliberately no persistent always-accept setting — consent is per-decision, like the risk (DESIGN §12.7).

Graft-bearing packages gate the same way: non-interactively the apply is refused — exit status 2 — for any graft without a recorded approval, unless --accept-grafts is passed for that run; interactively the behavior manifest is shown and approval asked per package (aslice-graft(1)).

EXIT STATUS

0 applied, or nothing to do. 1 error (schema, resolution, execution). 2 refused at a consent or trust gate.

FILES

/opt/aslice/profiles//aslice.lock: The per-profile lock, rewritten with every generation; exportable with aslice lock export.

NOTES

Plans and the plan/apply split: DESIGN §12.1. The lock format: PACKAGE-FORMAT §7. Whole-machine setup: SETUP.md and aslice-machine(1).

The plan discloses source compilation and its dependency reasons. Interactive execution asks before compiling; unattended execution requires --allow-source-builds for newly required builds. Saved plans and locks convey no consent. Refusal returns 2 and never silently selects an older cached binary. Version-1 plans/locks are rejected; regenerate version 2 from authenticated records and explicit provider/replacement selections. Exact replay retains exact artifacts.