Tasks, repositories and applications from RAC

Use RAC from a laptop, CI job or agent with your platform identity. The commands call authenticated public APIs; the service prepares the checkout, environment and chosen harness. No local Kubernetes access or operator forge token is needed.

Select the application API origin with --api-url and a workspace with --tenant-id. Supply your existing credential through REDGOLD_API_KEY or the normal RAC identity configuration. Set EXECUTOR_API_BASE and TENANT_ID (or configure the current RAC profile) to reuse the origin and workspace in later commands. A workspace API key must be bound to that workspace and its owner must retain membership. Product-scoped service keys are not general account credentials. Personal tasks can omit the workspace option.

rac account --api-url https://api.redgold.ai --tenant-id WORKSPACE github connect
rac account --api-url https://api.redgold.ai --tenant-id WORKSPACE github status
rac account --api-url https://api.redgold.ai --tenant-id WORKSPACE github install
rac repo --api-url https://api.redgold.ai --tenant-id WORKSPACE discover
rac repo --api-url https://api.redgold.ai --tenant-id WORKSPACE select REPO_ID --installation-id INSTALLATION_ID

connect and install return GitHub consent URLs. The account owner opens them and approves the account and repository permissions. Status, sync, disconnect, installation sync, repository selection, review settings and connection policy share the same state as Settings → account connections. Tokens stay in the existing server credential store. github policy --file settings.json patches only the supplied connection options.

Create a private repository on the workspace's git.redgold.ai forge, or import a public GitHub repository. Private GitHub repositories use the connected App. Repository creation is resumable by workspace and normalized name; retain the receipt if application association fails after creation.

rac repo --tenant-id WORKSPACE create example
rac repo --tenant-id WORKSPACE list
rac repo --tenant-id WORKSPACE import https://github.com/OWNER/REPO
rac project --tenant-id WORKSPACE create "Example" --id example
rac project list
rac project show example
rac project source example --repo https://git.redgold.ai/WORKSPACE_ORG/example.git --branch main
rac project update example --file settings.json
rac repo add https://github.com/OWNER/REPO --app example --branch main --subdirectory apps/web

project create creates a managed repository by default. With --repo, it associates an existing source instead. Keep an explicit --id for automation. rac application is an alias for rac project. Updates accept the application's normal partial JSON settings, including its budget, publishing preferences and marketing configuration. project overview also exposes namespaces, domains and connection metadata. project archive retains the source and history while hiding the application. project source --clear removes its source association. Installed-app releases, publication and installation remain under rac app. A source association is a reference; task admission independently verifies that the repository is active and connected to the selected workspace.

rac task profiles
rac task run "Fix pagination" --app example --cost normal --harness redgold \
  --budget-usd 5 --reasoning high --request-id pagination-v1 --dry-run
rac task run "Fix pagination" --app example --cost normal --harness redgold \
  --budget-usd 5 --reasoning high --request-id pagination-v1 --wait
rac task run --issue TICKET_ID --harness codex --cost cheap --budget-usd 1
rac task list
rac task status TASK_ID
rac task retry TASK_ID
rac task result TASK_ID
rac task pause TASK_ID
rac task resume TASK_ID
rac task cancel TASK_ID

Each launch has its own durable ticket, conversation, checkout and budget, so independent tasks may run in parallel within the workspace's normal quotas. Standalone tasks appear in personal Tasks with their executor ticket's current state. Use the task's CLI controls to manage execution. --workstream ROOT_TICKET_ID associates a task with an existing workstream, preserving its holds; it does not start a recurring schedule or consume that root's single conversation. A source issue is linked and retained. The task ticket is excluded from automatic workstream selection to prevent a second executor from taking it.

run waits for a cold environment to wake and for ordinary Send acceptance, reusing the same frozen task throughout preparation. --wait additionally waits for the task's result. Each wait has a finite --timeout-secs. If the CLI exits during preparation, rac task retry TASK_ID continues that exact launch; no task is claimed as running merely because its environment was requested.

The executor records its result with rac issue comment and closes the task ticket with rac issue close. Workspace credentials can close only task tickets admitted under their exact owner and workspace. Runtime retirement and ticket completion are checked separately by rac task wait.

run also accepts --prompt-file, --repo, --branch, --subdirectory, --provider-policy, --provider with --model, and --auth-mode. The Redgold harness additionally accepts --model-preset, repeatable --stage-model STAGE=MODEL@EFFORT, --orchestrator-model and --expert-runtime. These use the shared TUI/workstream model validators and cost defaults. Account entitlements, connected model credentials, spending gates and runtime quotas remain enforced by ordinary conversation admission. Each task installs the existing gateway's lifetime conversation limit before sending; Redgold TUI runs also receive their ordinary run-budget envelope. Native harnesses require gateway authentication for budgeted tasks. Use the Redgold harness for byok or subscription direct credentials so its local budget gate can apply.

Keep the printed request ID after a lost reply and repeat the same request with --request-id. The server freezes the submitted prompt and policy, rejects reuse with different input, and reuses the same Send and ticket. A new request ID means a new task and a new allowance. --dry-run prints the request without launching. If a task ID is already available, rac task retry TASK_ID reconciles the saved launch directly, including when the source issue or application settings have since changed. It retains the original prompt, repository, policy and budget. Use --json for machine-readable receipts.

status reports native dispatch and runtime evidence separately from the task issue's state. wait has a finite --timeout-secs; a timeout leaves the task tracked and running. It waits for native retirement and returns success only when the task issue is complete. A final response, idle pane or missing pod is not completion evidence. Controls return the normal command receipt; the controller acknowledgement and subsequent status establish their outcome. Ordinary idle-runtime reclamation releases the ephemeral environment while retaining task history and results; cancellation does not delete repositories or application data.