The command line

kewos is the operator’s knife. The installation tour shows six of its commands; there are twenty-eight. Here are the others, sorted by the question you are asking, not alphabetically.

They all take the URL of the database concerned (--database-url, or --master-url for the ones talking to the customer registry). They all just print what they did.

Deploying and upgrading

Command	What it does
`kewos init`	Local bootstrap: master database, dev tenant, migrations, config. Idempotent.
`kewos reconcile`	Brings every customer up to the code. The last step of every deploy.
`kewos migrate`	The migration detail: plan, generate, apply.
`kewos upgrade plan / apply / rollback`	Installing, upgrading and rolling back a module.
`kewos module` / `kewos template`	Sign, verify and install a `.kws` (module) or `.kwstpl` (template) package.

upgrade rollback is the one you look for at three in the morning: it takes a module back to its previous version.

Running the instance

Command	What it does
`kewos worker`	Drains the job queue. Mandatory: without it, sends pile up silently.
`kewos cron list / enable / disable / run`	The scheduled-task registry.
`kewos backup`	Backing up and restoring a customer.
`kewos cache flush`	Invalidates the Redis cache, by scope.
`kewos search status / reindex / reindex-all`	The search index.

$ kewos cron list --database-url ...
NAME                          EXPRESSION     STATE     NEXT FIRE                  LAST FIRE
appointment.expire_pending    */15 * * * *   enabled   2026-09-06 21:15:00+00:00  2026-09-06 21:00:00+00:00
backup.nightly                0 1 * * *      enabled   2026-09-07 01:00:00+00:00  -

The LAST FIRE column reading - on backup.nightly says it at a glance: that task has never run. That is the kind of silence you do not otherwise see.

$ kewos search status --database-url ...
  library_title      8
  library_member     4
  pipeline_lead      4

A model missing from that list is not searchable, whatever the search screen suggests.

The customers

Command	What it does
`kewos tenant create / list / drop / restore`	The customer registry. See Hosting several customers.
`kewos domain add / list / remove / verify`	Which hostname leads to which customer, and for what purpose.
`kewos license`	Inspect and install a signed licence.
`kewos metering`	Calibrate the cost model. See Counting what a customer consumes.

kewos domain verify answers “why does this customer land on the wrong instance” without reading a proxy configuration.

Looking at what happened

Command	What it does
`kewos audit list / verify / purge`	The audit log, its chain verification, and its purge past retention.
`kewos sequence list / audit`	The state of legal numbering.
`kewos config flags stale`	Feature flags forgotten past the staleness horizon.

$ kewos audit list --database-url ... --limit 3
ID    TIMESTAMP                    ACTION   USER   MODEL                RECORD
246   2026-09-06 20:55:20+00:00    update   1      kws_builder_module   reliure
245   2026-09-06 20:55:01+00:00    create   1      reliure_chantier     1

$ kewos audit verify --database-url ...
rows: 244
head_hash: 1c4789d6cedb867b...
tail_hash: f0dbf16c39feca2f...

verify is the one that matters: the log is chained, so a row altered or removed after the fact breaks the chain and shows. An audit log you cannot verify is just a text file.

kewos sequence list answers the accountant’s “where is the invoice numbering”, and sequence audit dumps one sequence’s full state when a gap is suspected.

Writing and trying

Command	What it does
`kewos km check / fmt / convert / show / complete`	The `.km` format: check, format, convert, explain.
`kewos demo load`	Loads every module’s demo data (development only).
`kewos shell`	A Python REPL with `kewos` already imported.
`kewos test`	The test suite.
`kewos access grant / revoke / groups`	Give or take a group from a user, in an emergency.
`kewos currency fetch-rates`	Fetches the day’s exchange rates.
`kewos push generate-keys`	A VAPID key pair ready to paste into the environment.

km check is a checker, not a polite parser: it gives the line and points at it.

$ kewos km check library.km
line 72: unknown view kind 'gallery'
  view library_title gallery {
  ^

Here, a gallery is not a view kind you declare: it appears because a model names its image_field. The refusal lands before the install, at the exact spot, rather than three layers down at first load.