Guide
This page follows the loop you run on a machine: kempt plan to read the diff, kempt apply to make it, kempt verify to confirm it still holds, and the two commands that keep a machine current afterward.
plan & apply
The core loop is two commands. kempt plan inspects the machine and
prints the deltas apply would make — read-only, it changes nothing.
kempt apply converges the machine to the manifest, applying only the changes you
approved (it prompts unless you pass -yes). Installs stage to a temp file and land
with an atomic mv; services are cmp-compared before reload so
unchanged ones never restart.
kempt plan
The read-only diff. Prints every delta with its primitive and safety class, and honors
only = { os, arch } visibly. Pass -os/-arch to
dry-plan for another platform without inspecting the local machine.
kempt apply -yes
Converges to the manifest, applying only approved changes. Atomic installs, and cmp-before-reload services so nothing restarts without cause.
kempt verify
Runs the manifest's declared read-only checks — the same verify steps that
appear in a plan — to confirm the machine still matches, touching nothing.
the update split
kempt update refreshes the source (git pull, or re-fetch and re-extract a tarball), self-updates the binary, and converges. kempt refresh recomputes pending changes and, with auto-apply enabled, applies files-class changes only, never software.
$ kempt update $ kempt refresh