---
path: /studio/isis/cli
surface: studio
domain: isis
auth:
  signed-in + studio entitlement; Studio Isis production boundary hard-blocks
  this AAA-only route. Automated lane verification uses the explicit
  localhost-only E2E bypass.
source: apps/oshun/web/src/app/studio/isis/cli/page.tsx
status: walked
last_walked:
  '2026-07-23 automated desktop Chromium + Pixel 7 mobile walk — production
  hard-block, localhost-only lane entry, explicit composition boundary, five
  child lanes, absence of an aggregator request and command authority, route
  status, touch targets, responsive containment, and applicable axe verified'
---

# Isis CLI

## Purpose

UI-only, non-authoritative composition of five independent Isis workspaces: CLI
Surface, Client SDK, Integration Events, Account Protection, and Chargeback
Prevention. Each child retains its own exact contract and state. The composition
has no CLI aggregator endpoint, shared command/session state, command execution,
diagnostic trace, parity run, governance record, or release authority.

## Entry points

- Breadcrumb / quick-action card from sibling Isis workspaces
- Embedded as a "CLI Lane" in several Isis aggregators
- Studio index (`/studio`)
- Direct URL / bookmark (AAA-gated)

## Layout regions

`page.tsx` mounts `ShellLayout active="studio"` with a breadcrumb panel.

- **Breadcrumb panel** (`data-isis-cli-breadcrumbs`): Studio → Isis CLI →
  (current)
- **Workspace panel** (`data-isis-cli-workspace`):
  - `<h1>` "Isis CLI Workspace" (`WorkspaceHeading`) + summary
    (`data-isis-cli-summary`) and exact
    `ui_only_non_authoritative_embedded_lane_composition` disposition
    (`data-isis-cli-disposition`)
  - Composition Boundary panel (`data-isis-cli-capability-summary`, `<h2>`) with
    four honest cards: independent lane authority, no aggregator endpoint, no
    command operations, and no governance/release authority
  - Five embedded lanes, each an `<h2>` panel wrapping a sibling workspace via
    `WorkspaceSection`:
    - CLI Surface Lane (`data-isis-cli-cli-surface-lane`)
    - Client SDK Lane (`data-isis-cli-client-sdk-lane`)
    - Integration Events Lane (`data-isis-cli-integration-events-lane`)
    - Account Protection Lane (`data-isis-cli-account-protection-lane`)
    - Chargeback Prevention Lane (`data-isis-cli-chargeback-prevention-lane`)
- **Route map panel** (`data-isis-cli-route-map`): `<h2>` "Route Map" over one
  `mounted-composition` entry and five `documented-contract` entries
- **Quick-actions panel**: links to `/studio/isis/account-protection`,
  `/studio/isis/cli-surface`, `/studio/isis/client-sdk`,
  `/studio/isis/integration-events`, and "Back to Studio workspace index" →
  `/studio`

## States

No fetch at the aggregator; each embedded lane drives its own Loading /
Unauthorized (admin-scope 401/403) / Error / Ready / Result states.

- [ ] **CLI Surface Lane** — walk via
      [`studio-isis-cli-surface.md`](./studio-isis-cli-surface.md)
- [ ] **Client SDK Lane** — walk via
      [`studio-isis-client-sdk.md`](./studio-isis-client-sdk.md)
- [ ] **Integration Events Lane** — walk via
      [`studio-isis-integration-events.md`](./studio-isis-integration-events.md)
- [ ] **Account Protection Lane** — walk via
      [`studio-isis-account-protection.md`](./studio-isis-account-protection.md)
- [ ] **Chargeback Prevention Lane** — walk via
      [`studio-isis-chargeback-prevention.md`](./studio-isis-chargeback-prevention.md)

## Interactions

### Embedded lanes

- [ ] **CLI Surface Lane**
- [ ] **Client SDK Lane**
- [ ] **Integration Events Lane**
- [ ] **Account Protection Lane**
- [ ] **Chargeback Prevention Lane**

### Composition boundary

- [ ] **Boundary cards** ×4 — non-interactive and authority-limiting

### Route map

- [ ] **Mounted composition** ×1
- [ ] **Documented route shapes without pages or authority** ×5

### Quick-actions

- [ ] **Open Isis Account Protection workspace** →
      `/studio/isis/account-protection`
- [ ] **Open Isis CLI Surface workspace** → `/studio/isis/cli-surface`
- [ ] **Open Isis Client SDK workspace** → `/studio/isis/client-sdk`
- [ ] **Open Isis Integration Events workspace** →
      `/studio/isis/integration-events`
- [ ] **Back to Studio workspace index** → `/studio`

## Data & contracts

- **Reads / writes**: none from this composition directly — delegated to the
  embedded sibling lanes, each calling its own exact `/v1` endpoint
- **CLI controls**: none; no shared command/session state, execution,
  retry/cancellation, diagnostics, traces, permission/audit control, parity
  certification, remediation, governance, or release action is bound here
- **Realtime**: None
- **Caching**: delegated to embedded lanes (client fetch on mount, no-store)
- **Auth**: admin-scoped fail-closed per embedded lane; AAA-gated studio route
  behind the signed-in + studio proxy gate
- **Component sources**:
  - `apps/oshun/web/src/components/studio/StudioIsisCliWorkspace.tsx`
  - `apps/oshun/web/src/components/studio/StudioIsisCliRouteMap.ts`

## Cross-references

- Studio overview: [`../../studio-overview.md`](../../studio-overview.md)
- Embedded lanes:
  - [`studio-isis-cli-surface.md`](./studio-isis-cli-surface.md)
  - [`studio-isis-client-sdk.md`](./studio-isis-client-sdk.md)
  - [`studio-isis-integration-events.md`](./studio-isis-integration-events.md)
  - [`studio-isis-account-protection.md`](./studio-isis-account-protection.md)
  - [`studio-isis-chargeback-prevention.md`](./studio-isis-chargeback-prevention.md)

## Open questions / known gaps

- [ ] Command, session, diagnostics, permissions, and audit paths are documented
      shapes only, with no pages or corresponding aggregator authority
- [ ] There is no CLI command/session service, execution console, diagnostic
      evidence record, parity certification, governance, or release authority
      here