# All commands are read-only with respect to live profile/service/archive state.
python cleanup_controller.py dry-run [exact pinned v5 arguments recorded in process cmdline evidence]
python cleanup_controller.py verify [exact pinned v5 arguments recorded in process cmdline evidence]
python independent_verify.py
python -m pytest -q -p no:cacheprovider test_cleanup_controller.py
/home/cube/projects/richard/hermes-agent/.venv/bin/ruff check cleanup_controller.py test_cleanup_controller.py independent_verify.py
python -m compileall -q .
python verify_successor_seal.py

# Prohibited and not run: execute mode, cleanup replay, service start/stop/restart, live mutation.