Commands
vrtmv is a single binary with these subcommands.
Bills? shows whether the command claims a paid instance seat. The billable seat kinds are migration, verify, and license — the last is vrtmv license/enroll, the lightweight way to claim a seat without a full run (a seat is 402-gated quota, not a metered charge). drift and cve-scan are license-gated and never metered: drift is refused on a VM not already licensed by a migration, verify, or license, while cve-scan auto-claims a seat when the account has capacity (VRTMV-620) and is refused only when capacity is exhausted. See Accounts, quota & billing.
| Command | Account? | Bills? | What it does |
|---|---|---|---|
assess | no | no | Detect a disk image's source format from magic bytes. |
inventory | optional | no | Extract distro + installed packages from a source. |
drift | yes | no (license) | Classify /etc into carry / caveat / default / skipped; derive service accounts. |
resolve | yes | no | Map native package names to canonical slugs. |
translate | yes | no | Fetch target-distro packages for canonicals. |
config-paths | yes | no | Fetch config-path relocations for canonicals. |
migrate | yes | yes (full run) | Full pipeline → runbook (--format) + signed attestation. Plan-only — never executes. |
verify | for --sign | yes (seat) | Prove a rebuilt target matches the attestation migrate wrote. |
license | yes | yes (seat) | License (seat) one or more hosts by fingerprint alone — no translation or attestation. Alias enroll. |
identity | no | no | Write the operator instance stamp /etc/vrtmv/instance-id, so a cloned host has its own billing identity. |
cve-scan | yes | no (license) | Match installed packages against vendor advisories; report still-vulnerable CVEs, signed. |
patch | yes | no | Render (or --apply over SSH) a role bumping vulnerable packages to their vendor-fixed version. |
run | yes | yes | Unattended migration: plan → apply the role over real SSH → carry config → verify. |
deploy | no | no | Deploy the workload to OpenShift/Kubernetes (VM or container). |
readiness | yes | no | Fleet migration-readiness report across many sources. |
remediate | no | no | Record accept decisions for readiness refusal clusters into a resolutions store. |
cluster-migrate | for --emit-roles | yes (--emit-roles) | Cluster sources by similarity; per-host variance report, optionally a role per cluster. |
cluster-verify | for --sign | yes (seat) | Verify a rebuilt fleet once per class, then borrow the verdict (alias verify-fleet). |
coupled-migrate | yes | yes | Migrate N coupled nodes (replicated / quorum DB) as one subject. |
container-fleet | yes | yes (once per host) | One Containerfile per workload across a fleet, from one manifest. |
ui | — | no | Local migrate client (loopback only). |
panel | — | no | Local operator panel: assess → plan → verify (loopback only; never applies). |
mcp | yes | via migrate | Local MCP server on stdio. vrtmv mcp --print-config prints the agent fragment. |
auth | — | no | Store / show / clear API credentials. |
docs / help | — | no | Bundled documentation. |
resolve, translate, and config-paths are direct windows onto the API — mainly for scripting and debugging. Most users run assess, drift, migrate, verify, and readiness.
migrate output formats
migrate --format <list> selects one or more runbook formats (comma-separated; default ansible). Every non-preflight run also writes the signed attestation regardless of format. See migrate for the full behavior.
--format | Emits | Requires | Notes |
|---|---|---|---|
ansible (default) | roles/vrtmv_migration/tasks/main.yml | — | Installs the translated packages and reconciles config. |
terraform | terraform/main.tf + terraform/cloud-init.yaml | — | Workload as cloud-init attached to a compute resource. |
container | container/Containerfile | --entrypoint, an Index base image | Buildable OCI image; operator runs podman build. Refuses rather than guess. |
image | image/ (kickstart or preseed + build-image.sh) | --target-base, --firmware | qcow2 build recipe for a fresh bootable target (rpm/dpkg families). Refuses rather than guess. |
Conventions
- Extraction commands take a source as
--image,--root, or--ssh(see Sources). -o/--outsets an output directory where relevant.- Local-only commands (
assess) never call the API and need no account.driftandcve-scanare license-gated and never metered —driftis refused on a VM not already licensed by amigrationorverify, whilecve-scanauto-claims a seat when the account has capacity.ui/panelthemselves do not bill; amigratethey launch records the same usage event as the CLI.