Run all four phases

Execute BUILD, TEST, VALIDATE, and RUNTIME in lifecycle order from one versioned manifest.

Terminal

secureai run --config secureai.run.yaml

Create the manifest

secureai.run.yaml

version: 1

build:
  target: ./prompts
  config: secureai.config.yaml
  fail_on: high

test:
  target: http://127.0.0.1:8090/v1/chat/completions
  model: proxied-model
  intensity: standard
  concurrency: 4
  rps: 5
  fail_asr: 5

validate:
  - type: rag
    input: ./security/rag.yaml
    fail_below: 70
  - type: guardrail
    input: ./prompts/system.md
    fail_below: 70

runtime:
  - type: lcac
    policy: ./security/lcac-policy.yaml
    context: ./security/context-sample.json
  - type: cbe
    profile: ./security/capability-profile.yaml
    session: ./security/session-sample.json

Start the model proxy first

When TEST uses a non-OpenAI provider, start secureai proxy and set test.target to its local Chat Completions URL. See Model proxy.

Execution order

Order	Phase	Manifest input
1	BUILD	`build.target` and optional scan settings
2	TEST	`test.target`, model traffic settings, and ASR gate
3	VALIDATE	Every RAG or guardrail check in the validate list
4	RUNTIME	Every LCAC, LBF, or CBE check in the runtime list

The order is fixed so BUILD findings reach TEST through the local Intelligence Bus, and runtime checks can consume earlier runtime signals. A manifest must configure every phase. Add more than one VALIDATE or RUNTIME check when the application has several artefacts.

Gate and error behaviour

A policy gate failure is recorded and later checks continue. The final process exit code is 1 if any gate failed.
Invalid YAML, a missing file, an unavailable endpoint, or another execution error stops the run. The process exits 2.
A clean run exits 0.

Credentials

TEST still fetches the CoreLayer attack corpus, so run secureai login first. If the TEST target itself needs a key, use api_key_env or an env:VARIABLE_NAME header value in the manifest. Do not place a secret directly in committed YAML.

Terminal

test:
  target: https://gateway.example.com/v1/chat/completions
  api_key_env: MODEL_GATEWAY_KEY
  headers:
    X-Tenant-ID: env:MODEL_TENANT_ID

Command options

Flag	Default	Description
`--config`	`secureai.run.yaml`	Lifecycle manifest path.
`--format`	`terminal`	`terminal` or `json` phase output.
`--server`	`$SECUREAI_SERVER`	Control-plane URL inherited by every phase.
`--no-upload`	off	Keep all phase results local.