Recon Data Acquisition CLI

recon is a standalone offline command-line tool for registering external data sources, acquiring immutable raw records, verifying local integrity, producing daily evidence reports, and exporting deterministic axiom.ingestion-manifest/v1 bundles.

Recon is intentionally not a crawler, agent framework, credential manager, or Axiom service. An external collector supplies source facts and bytes. Recon performs deterministic validation, identity calculation, checksumming, append-only storage, duplicate detection, conflict rejection, and export.

Requirements

• Node.js 22.13 or newer
• No service, network connection, Platform credential, Meridian dependency, or Axiom process is required after installation

Quick start

recon init --workspace ./research

recon source add \
  --workspace ./research \
  --name "Sentinel-2 Level-2A" \
  --id provider.copernicus.collection=S2_L2A \
  --locator "https://dataspace.copernicus.eu/collections/S2_L2A" \
  --access api \
  --content image

recon data add-file \
  --workspace ./research \
  --source sentinel-2-level-2a \
  --record-id scene-123 \
  --revision 1 \
  --content image \
  --mime image/tiff \
  --file ./scene-123.tif

recon verify --workspace ./research
recon report daily --workspace ./research --date 2026-08-25
recon export --workspace ./research --source sentinel-2-level-2a --out ./sentinel-export

All commands support --non-interactive --output json. Mutating commands require an explicit --workspace; Recon never infers a home-directory target. Run recon docs list for bundled offline workflow documentation.

Integrity and privacy

• Workspace directories are created private (0700) and files private (0600) where the host supports POSIX permissions.
• Payloads, provider metadata, source descriptors, sealed segments, and exports are content-addressed and immutable.
• SQLite is an append-only index. Filesystem artifacts remain the payload source of truth and the catalog is reconciled after interrupted writes.
• Secret-shaped metadata fields, authentication headers, cookies, and signed locators are rejected before storage.
• Version 0 exports only RECORDS_ONLY coverage. It cannot assert COMPLETE_WINDOW.

Contract pin

This release pins axiom-data-workflow==2.1.0, including axiom.ingestion-manifest/v1, and verifies exported fixtures with that exact published Python package in acceptance tests. The dependency is a conformance authority used by CI; it is not a runtime dependency of the CLI.