> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aureuma.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# FORT

# `si fort`

`si fort` wraps the native `fort` binary (github.com/Aureuma/fort) and keeps
runtime auth file-based. The dotenv encryption tool it brokers now lives in its
own repo: github.com/Aureuma/vault.

## Wrapper Contract

* `si fort` wraps the native `fort` binary and keeps runtime auth file-based.
* `si codex spawn ...` and `si codex shell ...` provision or reuse a slot-scoped Fort session under `CODEX_HOME/fort/` (`~/.si/codex/profiles/<profile>/fort/` for `primary`, `~/.si/codex/profiles/<profile>/workers/<slot>/fort/` for non-primary slots).
* Host bootstrap/admin auth for provisioning uses the bootstrap token files at `~/.si/fort/bootstrap/admin.token` and `~/.si/fort/bootstrap/admin.refresh.token`.
* Runtime worker sessions use profile-local file-backed token paths for the short-lived access token and rotating refresh token.
* Wrapper behavior:
  * prefers the Fort session under `CODEX_HOME/fort/` when `CODEX_HOME` is set by a managed Codex profile runtime
  * does not accept caller-supplied `FORT_TOKEN_PATH` / `FORT_REFRESH_TOKEN_PATH` as a normal `si fort` runtime fallback
  * does not fall back to the active Codex profile outside a managed `si codex spawn` / `si codex shell` runtime
  * fails loudly for runtime secret commands (`get`, `set`, `list`, `batch-get`, `run`) when no usable runtime session exists or runtime refresh fails
  * uses bootstrap/admin auth only for explicit provisioning and admin commands (`agent ...`, `auth issue|login|list|revoke`, `auth session open`)
  * runtime refresh is owned by the profile-scoped Fort refresher
  * refuses to rotate a Codex profile `refresh.token` into a different output path; profile refresh tokens must be refreshed in place
  * passes explicit token-file auth to native `fort` when default files are available (no bearer token argv injection)
  * rejects deprecated token-value env vars (`FORT_TOKEN`, `FORT_REFRESH_TOKEN`)
  * strips legacy token env entries from child process env if present
* Operational guidance:
  * keep `~/.si/fort/bootstrap/*` for break-glass recovery only
  * keep routine Fort access in `~/.si/codex/profiles/<profile>/fort/access.token` and `refresh.token`
  * invoke routine Fort commands through `si codex shell --profile <profile> --slot <slot> -- si fort ...` when outside that profile runtime
  * Codex profile provisioning explicitly requests a `30d` refresh-session TTL; Fort's general default may be shorter for non-Codex sessions
  * Fort runtime agent IDs are slot-aware: `si-codex-<profile>` for `primary` and `si-codex-<profile>--<slot>` for non-primary slots
* For flags that belong to native `fort` global options, pass through after `--`:
  * `si fort -- --host https://fort.aureuma.ai doctor`

## Core Model