Release RelayX v0.1.15 operator UX

Author: RedteamNotes

README.md

@@ -248,6 +248,8 @@ relayx opsec             List or inspect OPSEC policies
 relayx modules           List execution module manifests
 relayx module-plan       Evaluate execution modules for one path
 relayx run               Run the guarded execution state machine
+relayx console           Start a local operator console with context prompts
+relayx completion        Print bash, zsh, or fish completion scripts
 relayx rank              Rank paths by impact, confidence, and OPSEC cost
 relayx explain           Explain one host or one path
 relayx fixes             Show remediation priorities
@@ -259,11 +261,17 @@ RelayX also includes curated help topics:
 
 ```bash
 relayx help
+relayx help getting-started
 relayx help commands
 relayx help workflows
 relayx help exports
 relayx help short-options
 relayx help safety
+relayx help calibration
+relayx help execution
+relayx help enterprise
+relayx help troubleshooting
+relayx help completion
 relayx help scan
 relayx help run --format json
 relayx help schema
@@ -292,6 +300,23 @@ such as `-A/--auth-validation`, `-y/--confirm`, and `-P/--opsec-policy` are
 only aliases; RelayX still enforces operator, reason, scope, audit, and adapter
 guardrails.
 
+## Operator Console And Completion
+
+RelayX includes a local operator console for repeated analysis on the same
+result and path. It is not a C2 client and does not start listeners, pivot
+sessions, source triggers, or live relay adapters; it calls the same guarded
+CLI handlers with remembered context.
+
+```bash
+relayx console --result result.json --path-id PX-0001 --opsec-policy strict
+relayx completion zsh > relayx.zsh
+relayx help getting-started
+```
+
+Inside the console, use commands such as `use result <file>`, `use path
+PX-0001`, `set opsec-policy strict`, `show summary`, `show paths`, `explain`,
+`validate`, `run`, `export`, `bundle`, `help`, `back`, and `exit`.
+
 ## Output Formats
 
 - `json`: full RelayX result or command output for automation.

docs/CLI.md

@@ -1,7 +1,10 @@
 # RelayX CLI Help
 
-RelayX keeps standard `-h` output for every command and adds curated help topics
-for workflows, examples, exports, and safety boundaries.
+RelayX keeps standard `-h` output for every command and adds registry-backed
+curated help topics for workflows, examples, exports, OPSEC boundaries,
+completion, and troubleshooting. The CommandSpec registry is the single source
+for grouped command help, short-option documentation, shell completion, and
+quality-gate drift checks.
 
 For a complete end-to-end offline walkthrough, use
 [`docs/TUTORIAL.md`](TUTORIAL.md) with the fixtures in
@@ -13,11 +16,17 @@ Authorized AD/IIS/AD CS/MSSQL integration-test expectations are documented in
 
 ```bash
 relayx help
+relayx help getting-started
 relayx help commands
 relayx help workflows
 relayx help exports
 relayx help short-options
 relayx help safety
+relayx help calibration
+relayx help execution
+relayx help enterprise
+relayx help troubleshooting
+relayx help completion
 relayx help scan
 relayx help run
 relayx help schema
@@ -34,19 +43,100 @@ relayx help export -f json
 
 `-q` is an alias for `--no-banner`, and `-V` is an alias for `--version`.
 
+Command-specific curated help uses a consistent operator format:
+
+```text
+What it does
+When to use
+Required inputs
+Safety notes
+Examples
+Short options
+Output formats and contracts
+Common mistakes
+Next steps
+```
+
 ## Command Groups
 
-- Assessment: `scan`, `assess`, `summary`, `matrix`, `sources`, `routes`,
-  `paths`, `rank`, `explain`
-- Analysis: `calculus`, `controls`, `fixes`, `plan`, `evidence-report`,
-  `calibrate`, `compare-baseline`, `lab-matrix`, `lab-corpus`, `lab-verify`,
-  `lab-provenance`, `lab-stability`, `lab-diff`, `lab-profile`
-- Validation: `validate`, `source-check`, `source-plan`, `run`
+- Assessment: `scan`, `assess`, `summary`, `matrix`, `sources`, `paths`,
+  `rank`, `explain`
+- Evidence: `calculus`, `controls`, `fixes`, `plan`, `evidence-report`
+- Calibration: `calibrate`, `compare-baseline`, `lab-matrix`, `lab-corpus`,
+  `lab-verify`, `lab-provenance`, `lab-stability`, `lab-diff`, `lab-index`,
+  `lab-profile`
+- Route/Pivot: `routes`, `source-check`, `source-plan`
+- Validation: `validate`
+- Controlled Execution: `modules`, `module-plan`, `run`
 - Enterprise: `profiles`, `report`, `export`, `bundle`, `diff`,
-  `simulate-fixes`, `quality-gate`
-- Modules: `modules`, `module-plan`
-- Contracts: `schema`
-- Policy: `opsec`
+  `simulate-fixes`
+- Admin: `help`, `completion`, `console`, `opsec`, `schema`, `quality-gate`
+
+## Operator Console
+
+`relayx console` provides a local, single-process operator shell for repeated
+work on the same result, path, OPSEC policy, and scope. It is inspired by
+mature operator consoles, but it is not a C2 runtime: there is no server-client
+split, no listener start, no pivot-session operation, no source-side trigger
+execution, and no live relay adapter registration.
+
+```bash
+relayx console
+relayx console --result examples/tutorial/sample-result.json --path-id PX-0001 --opsec-policy strict
+relayx console --script console.txt
+```
+
+The prompt reflects context:
+
+```text
+relayx>
+relayx[result:sample-result.json policy:standard]>
+relayx[result:sample-result.json path:PX-0001 policy:strict scope:set]>
+```
+
+Supported console commands:
+
+```text
+use result <file>          Select a RelayX result and clear the current path
+use path <id>              Select a path such as PX-0001
+set opsec-policy <policy>  Set the policy used by validate/run shortcuts
+set scope <scope>          Set scope text or a scope file for validate/run
+context                    Show current result, path, policy, and scope
+show summary               Run summary with the selected result
+show paths                 Run paths with the selected result
+show matrix                Run matrix with the selected result
+show sources               Run sources with the selected result
+explain [query]            Explain a query or the selected path
+validate [args...]         Run validate with context-filled result/path/policy
+run [args...]              Run controlled execution with context-filled inputs
+export [args...]           Run export with context-filled result
+bundle [args...]           Run bundle with context-filled result
+help [topic]               Render curated RelayX help
+back                       Clear path first, then result
+exit                       Leave the console
+```
+
+Console shortcuts call the same CLI handlers and preserve the same guardrails.
+Confirmed validation and execution still require explicit confirmation,
+operator, reason, audit log, and any required scope. Script mode returns exit
+code `2` on the first failed console command, which makes it suitable for
+runbook smoke tests.
+
+## Shell Completion
+
+`relayx completion bash|zsh|fish` prints shell completion generated from the
+CommandSpec registry. Completion covers commands, curated help topics, common
+flags, output formats, schema kinds, export formats, and built-in OPSEC policy
+names.
+
+```bash
+relayx completion bash > relayx.bash
+relayx completion zsh > relayx.zsh
+relayx completion fish > relayx.fish
+```
+
+Completion only suggests syntax. It does not weaken authorization, OPSEC,
+scope, audit, or adapter checks.
 
 ## Short Options
 

docs/README.fr.md

@@ -246,6 +246,8 @@ relayx opsec             Liste ou inspecte les politiques OPSEC
 relayx modules           Liste les manifests de modules d'execution
 relayx module-plan       Evalue les modules d'execution pour un chemin
 relayx run               Lance la machine d'etats d'execution controlee
+relayx console           Lance une console operateur locale avec contexte
+relayx completion        Genere les completions bash, zsh ou fish
 relayx rank              Classe les chemins par impact, confiance et cout OPSEC
 relayx explain           Explique un host ou un chemin
 relayx fixes             Affiche les priorites de remediation
@@ -257,11 +259,17 @@ RelayX inclut aussi des rubriques d'aide guidees :
 
 ```bash
 relayx help
+relayx help getting-started
 relayx help commands
 relayx help workflows
 relayx help exports
 relayx help short-options
 relayx help safety
+relayx help calibration
+relayx help execution
+relayx help enterprise
+relayx help troubleshooting
+relayx help completion
 relayx help scan
 relayx help run --format json
 relayx help schema
@@ -292,6 +300,24 @@ sensibles comme `-A/--auth-validation`, `-y/--confirm` et
 `-P/--opsec-policy` ne changent pas les guardrails: RelayX continue d'exiger
 operator, reason, scope, audit et adapter policy.
 
+## Console Operateur Et Completion
+
+`relayx console` est une console operateur locale, mono-processus, pour
+travailler plusieurs fois sur le meme result, path, OPSEC policy et scope.
+Ce n'est pas un client C2: elle ne lance pas de listener, pivot session,
+source trigger ou live relay adapter. Les commandes de la console appellent
+les memes handlers CLI et conservent les memes guardrails.
+
+```bash
+relayx console --result result.json --path-id PX-0001 --opsec-policy strict
+relayx completion zsh > relayx.zsh
+relayx help getting-started
+```
+
+Dans la console, utilisez `use result <file>`, `use path PX-0001`, `set
+opsec-policy strict`, `show summary`, `show paths`, `explain`, `validate`,
+`run`, `export`, `bundle`, `help`, `back` et `exit`.
+
 ## Formats de sortie
 
 - `json` : resultat RelayX complet ou sortie de commande pour l'automatisation.

docs/README.zh-CN.md

@@ -232,6 +232,8 @@ relayx opsec             列出或查看 OPSEC policy
 relayx modules           列出 execution module manifest
 relayx module-plan       评估 execution module 是否适用于某条 path
 relayx run               运行受控 execution state machine
+relayx console           启动带上下文 prompt 的本地 operator console
+relayx completion        输出 bash、zsh 或 fish completion 脚本
 relayx rank              按 impact、confidence 和 OPSEC cost 排序 path
 relayx explain           解释某个 host 或 path
 relayx fixes             展示修复优先级
@@ -243,11 +245,17 @@ RelayX 也提供 curated help topic：
 
 ```bash
 relayx help
+relayx help getting-started
 relayx help commands
 relayx help workflows
 relayx help exports
 relayx help short-options
 relayx help safety
+relayx help calibration
+relayx help execution
+relayx help enterprise
+relayx help troubleshooting
+relayx help completion
 relayx help scan
 relayx help run --format json
 relayx help schema
@@ -275,6 +283,23 @@ relayx quality-gate -C . -f json -o relayx-quality-gate.json
 `-y/--confirm`、`-P/--opsec-policy` 这类安全敏感选项只是别名；RelayX 仍然
 强制执行 operator、reason、scope、audit 和 adapter guardrail。
 
+## Operator Console 与 Completion
+
+`relayx console` 是本地单进程 operator console，用来在同一个 result、path、
+OPSEC policy 和 scope 上重复分析。它不是 C2 client，不启动 listener、pivot
+session、source trigger 或 live relay adapter；console 命令仍调用同一套 CLI
+handler 和 guardrail。
+
+```bash
+relayx console --result result.json --path-id PX-0001 --opsec-policy strict
+relayx completion zsh > relayx.zsh
+relayx help getting-started
+```
+
+console 内可使用 `use result <file>`、`use path PX-0001`、`set opsec-policy
+strict`、`show summary`、`show paths`、`explain`、`validate`、`run`、`export`、
+`bundle`、`help`、`back` 和 `exit`。
+
 ## 输出格式
 
 - `json`：完整 RelayX result 或命令输出，适合自动化处理。

docs/TUTORIAL.md

@@ -50,9 +50,19 @@ From the repository root:
 ```bash
 relayx -V
 relayx -q help workflows
+relayx -q help getting-started
 relayx -q quality-gate -C .
 ```
 
+Optional shell completion can make longer RelayX commands easier to use during
+runbook development:
+
+```bash
+relayx completion zsh > /tmp/relayx.zsh
+relayx completion bash > /tmp/relayx.bash
+relayx completion fish > /tmp/relayx.fish
+```
+
 Validate the tutorial fixtures:
 
 ```bash
@@ -62,6 +72,27 @@ relayx -q schema validate -k result examples/tutorial/baseline-result.json
 
 The expected validation result is `valid: true` with zero errors.
 
+You can also use `relayx console`, the local operator console, for repeated work on the same
+result. The console remembers selected result, path, OPSEC policy, and scope;
+it still calls the same CLI handlers and does not start listeners, pivots,
+source triggers, or live relay adapters.
+
+```bash
+relayx -q console --result examples/tutorial/sample-result.json --path-id PX-0001 --opsec-policy strict
+```
+
+Example console commands:
+
+```text
+context
+show summary
+show paths
+explain
+validate --mode dry-run
+run --mode dry-run
+exit
+```
+
 ## 1. Inspect The Result
 
 Start with a compact summary:

fixtures/enterprise_output_matrix.json

@@ -12,7 +12,9 @@
     "module-plan",
     "report",
     "schema",
-    "lab-provenance"
+    "lab-provenance",
+    "console",
+    "completion"
   ],
   "export_formats": [
     "opengraph",
@@ -129,8 +131,12 @@
       "package.metadata",
       "version.consistency",
       "quality_gate.contract",
+      "cli.help_registry",
       "cli.short_options",
       "cli.short_options.docs",
+      "cli.console_contract",
+      "cli.completion_contract",
+      "docs.cli_sync",
       "schema.catalog",
       "fixtures.json",
       "fixtures.evidence_report",
@@ -204,7 +210,7 @@
     "docs/INSTALL.md"
   ],
   "release": {
-    "version": "0.1.14",
+    "version": "0.1.15",
     "console_script": "relayx",
     "pipx_installable": true
   },

fixtures/execution_modules/lab_only_target_relay_fixture.json

@@ -1,7 +1,7 @@
 {
   "key": "lab_only_target_relay_fixture",
   "label": "Lab-only target relay adapter fixture",
-  "version": "0.1.14-fixture",
+  "version": "0.1.15-fixture",
   "supported": false,
   "lab_only": true,
   "description": "Fixture manifest for a future live target relay adapter contract. It is intentionally not registered or supported.",

fixtures/execution_modules/ntlmrelayx_compat.json

@@ -1,7 +1,7 @@
 {
   "key": "ntlmrelayx_compat",
   "label": "ntlmrelayx-inspired compatibility boundary",
-  "version": "0.1.14-fixture",
+  "version": "0.1.15-fixture",
   "supported": false,
   "lab_only": true,
   "description": "Fixture manifest for a future Impacket-style adapter boundary.",