Management commands¶

Run commands from core/backend through uv in an initialized backend environment.

Command	Purpose and prerequisite	Side effect
`ATLAS_BOOTSTRAP_PASSWORD=... uv run python manage.py seed_admin`	Idempotently create or update the first local administrator, linked Actor, and owner Group. Use the environment or `--password-stdin`; never pass the secret as an argument.	Validates and updates the exact bootstrap account and catalog linkage.
`ATLAS_DEMO_GUEST_PASSWORD=... uv run python manage.py seed_guest`	Idempotently create or update an unprivileged demo user (`guest`), its Actor and its own `guest-team` Group.	Validates and updates the account; never grants staff or superuser rights.
`uv run python manage.py seed_booking_demo`	Create the reproducible demo catalog. Add `--yes` only for an intentional non-interactive run.	Destructive: flushes the database before seeding.
`uv run python manage.py reindex`	Rebuild the whole search index from every registered source. Requires the `atlas.search` plugin to be selected and enabled; works without a scheduler (see Enable and operate search).	Replaces the engine's index atomically and prints `Indexed N documents`; fails if another indexing run holds the lock.
`uv run python manage.py check_migration_boundaries`	Check selected plugin migration ownership.	Read-only; fails on a sibling-plugin dependency.
`uv run python manage.py purge_plugin <id>`	Preview model tables and row counts for a selected plugin.	Read-only dry run.
`uv run python manage.py purge_plugin <id> --confirm`	Delete the displayed scoped rows while the plugin remains selected.	Irreversible: transactional data deletion.
`uv run python manage.py clear_read_only <exact-username> --reason <reason>`	Preview infrastructure recovery for an account restriction. Requires an exact target and non-blank audit reason.	Read-only dry run.
`uv run python manage.py clear_read_only <exact-username> --reason <reason> --confirm`	Apply the reviewed recovery when no writable authorized administrator remains.	Transactionally changes `AccountAccess` and writes an infrastructure-recovery audit record.
`uv run python manage.py classify_membership_grant <grant-id> --as-manual --reason <reason>`	Preview acknowledgement of one reviewed legacy grant as intentionally retained manual access.	Read-only dry run.
`uv run python manage.py classify_membership_grant <grant-id> --as-manual --reason <reason> --apply`	Apply that acknowledgement before enabling exact synchronization.	Clears the legacy-unclassified marker and writes an immutable audit record.
`uv run python manage.py classify_membership_grant <grant-id> --identity-link-id <link-id> --external-key <key> --reason <reason> [--apply]`	Preview, or with `--apply` transfer, one reviewed legacy grant to an exact external identity link.	Apply removes the manual provenance in place (or deduplicates it), records provider provenance and freshness, and writes an immutable audit record.
`uv run python manage.py check_membership_grants`	List exact identifiers for legacy-unclassified grants before enabling exact synchronization.	Read-only; exits unsuccessfully until every legacy grant has been classified or explicitly retained.
`uv run python manage.py manage_auth_identity inspect --provider <id> --source <source> [--subject <subject>] [--principal-id <id>]`	Inspect links with exact provider/source filters.	Read-only.
`uv run python manage.py manage_auth_identity link --provider <id> --source <source> --subject <subject> --principal-id <id> --reason <reason> [--operator-id <id>] [--privileged-target] [--apply]`	Preview or create one exact preprovisioned link. Administrative targets require `--privileged-target`.	Dry run unless `--apply`; apply is audited.
`uv run python manage.py manage_auth_identity revoke \| restore --provider <id> --source <source> --subject <subject> --reason <reason> [--operator-id <id>] [--apply]`	Preview or change one exact link.	Revoke invalidates link grants and sessions; restore does not resurrect grants.
`uv run python manage.py manage_auth_identity source-migrate --provider <id> --source <old> --to-source <new> --subject <subject> --reason <reason> [--operator-id <id>] [--apply]`	Preview or migrate verified links to a new immutable source after collision checks.	Apply revokes the old binding generation and records audited source changes.
`uv run python manage.py issue_pat <username> [--name <label>] [--scope <scope>]... [--expires-in-days <n>]`	Issue an Atlas Personal Access Token for an existing user (see MCP; the admin UI offers the same). `--scope` is repeatable; omit for a token with no scopes.	Creates the token row and prints its plaintext exactly once — it is never shown again.

The seed_flow_layout_tests command is a development fixture and is not an operator recovery procedure. For backup and restore, see data safety. For lifecycle procedures, see plugin lifecycle. For command output, authorization, and verification, follow Manage read-only accounts.

Legacy membership classification never infers ownership from group names or claims. Review exact grant and identity-link identifiers first. Before enabling exact synchronization, classify every legacy-unclassified grant or explicitly retain it with --as-manual; otherwise diagnostics must be treated as a failed activation check. Reversing the membership migration preserves one currently effective Actor/Group pair but loses source provenance, confirmation time, and expiry metadata.

Identity mutations require --subject and a non-empty reason. Run the default dry run first, record the exact identifiers and counts, and add --apply only after review. See the migration and revocation runbook.