Admin

my admin groups commands that mutate shared or workspace configuration. Operational reads stay top-level. The manifest is the control plane in its own private repository — admin commands are the intended way to change it, since it never appears inside the day-to-day workspace.

Manifest skill authoring

Admin skill commands write a maintainer checkout through --manifest-dir (your own clone of the manifest repo, or the registered checkout printed by my manifests list):

my admin skills add ./my-skill \
  --id acme:my-skill \
  --require service:docs \
  --manifest-dir ~/src/acme-manifest

my admin skills remove acme:my-skill \
  --manifest-dir ~/src/acme-manifest

On add, repeatable --require TYPE:ID records a workspace:, tool:, or service: dependency and routes it through normal manifest validation; --install-slug SLUG renames the install directory inside the manifest, and --keep-original/--remove-original decides whether the imported source directory stays or is deleted. On remove, --delete-source also deletes the skill's source directory; --prune-related drops catalog related_skills references to the removed skill; --prune-orphans removes tools and allowed namespaces left orphaned by the removal.

They refuse dirty checkouts unless --force is supplied, never commit or push, and print follow-up git status and git diff commands. Removal reports now-orphaned tools and allowed namespaces by default; add --prune-orphans to remove them in the same write.

After an admin edit, only the maintainer checkout has changed: review with git status and git diff, then commit and push yourself. Teammates pick the change up via my manifests sync, which reconciles generated guidance and launch-scoped skill reconciliation notices automatically.

Data bindings

Declare the service first, then bind the domain through validated commands:

my admin services add registry --manifest-dir ~/src/acme-manifest \
  --kind http --purpose "Instance registry" \
  --connection-url https://registry.example.test/api/v1 \
  --auth-ref env://REGISTRY_TOKEN
my admin bindings set fleet --manifest-dir ~/src/acme-manifest \
  --surface service:registry --surface mount:workspace

set replaces one binding in full. Optional repeatable --guidance PATH and --field-alias KEY=FIELD flags declare its guidance and write aliases; omitted optional fields are cleared. my admin bindings remove fleet --manifest-dir DIR removes the binding. Invalid references leave the file unchanged. These commands use the same administrator authorization and dirty-checkout guard as service authoring; --force permits a dirty checkout but never skips validation or authorization. Review and publish the resulting manifest before teammates use it.

Tool hints

Manifest tool declarations are admin-owned hints, not installers that My AI runs silently:

my admin tools add gnit \
  --manifest-dir ~/src/acme-manifest \
  --mode required \
  --purpose "Multi-repo workspace publishing" \
  --install-command "curl -fsSL https://raw.githubusercontent.com/mostlydev/gnit/master/install.sh | sh" \
  --docs-url https://github.com/mostlydev/gnit

my admin tools edit gnit \
  --manifest-dir ~/src/acme-manifest \
  --purpose "Gnit workspace publishing"

my admin tools remove gnit \
  --manifest-dir ~/src/acme-manifest

Tool removal refuses declarations still referenced by manifest skills.

add and edit also accept skill-install hints — --skill-install-command and repeatable --skill-install-arg — for tools that materialize their own skills; edit clears them with --clear-skill-install (and install commands or docs URLs with the matching --clear-* flags).

Repository catalog

Declare a Git-backed code or document repository before operators select it with my repos add:

my admin repos add sample-service \
  --manifest-dir ~/src/acme-manifest \
  --git-url https://github.com/acme/sample-service.git \
  --description "Sample service source"

Pass --default when my setup should clone the repository automatically. Adding an existing id is refused unless --force explicitly replaces it. Repository catalog authoring uses the same dirty-checkout and governance gates as the other manifest admin commands.

Services and roles

Manifest services and roles are shared control-plane configuration. There are inspection verbs (my services list|get, my roles list|get) and admin writers for maintainer checkouts:

my admin services add docs-search \
  --manifest-dir ~/src/acme-manifest \
  --kind mcp \
  --purpose "Search workspace docs" \
  --auth-ref env://ACME_DOCS_TOKEN \
  --connection-type stdio \
  --connection-command acme-docs-mcp \
  --connection-env ACME_DOCS_TOKEN='${ACME_DOCS_TOKEN}'

my admin roles add operator \
  --manifest-dir ~/src/acme-manifest \
  --purpose "Default operator role" \
  --guidance agent-guidance/operator.md \
  --service docs-search

After reviewing the local manifest checkout, publish those control-plane edits with my publish --manifest NAME.

my admin manifest-mounts add <id> --kind KIND --git-url URL --mode MODE declares a manifest mount (my admin mounts stays the umbrella-local my mounts alias). Mode role makes a role-only mount: it is cloned and in launch scope only when the selected role lists it, so declare it together with a selecting role via --role ID. remove refuses while any role selects the mount unless --prune-roles is supplied, which removes the mount and every role reference to it in one validated write (the way to retire a role mount).

A manifest that uses a feature newer than some members' my should declare min_my_version, so an older my asks for my update instead of rejecting the manifest as invalid. my admin min-version --manifest-dir DIR raises it to the newest feature in use (mount mode role needs v0.45.0) and never lowers a higher value; --set X.Y.Z declares an explicit version, which must not be below that floor. Other my admin manifest writes raise it automatically, and my manifests validate warns when it is missing or too low. The check runs in the release that introduced min_my_version and later; earlier releases ignore the field.

my admin services edit|remove and my admin roles edit|remove update the same declarations. Service removal refuses role-selected services unless --prune-roles is supplied. Inline connection env values must be exact ${VAR} placeholders, and connection header values must include a ${VAR}; literal credentials are rejected before the manifest is saved.

my setup --role operator stores the selected role locally, appends role guidance to generated AGENTS.md, and materializes umbrella-root .mcp.json for locally described MCP services selected by that role. my doctor reports URL-only descriptors, missing checked-in descriptors, unset environment variables, and missing optional resolver tools such as op.

Contract rules

The organization contract — short, binding rules rendered into generated AGENTS.md — is edited through the same manifest-admin review flow as tools:

my admin contract add "Record decisions in the handbook before acting on them." --manifest-dir ~/src/acme-manifest
my admin contract remove 2 --manifest-dir ~/src/acme-manifest
my admin contract replace 1 "Record decisions in the handbook first." --manifest-dir ~/src/acme-manifest
my admin contract migrate --manifest-dir ~/src/acme-manifest   # inline list -> guidance/contract.md, keeping the list for older my

Without --manifest-dir, the same commands open one pull request against the registered manifest. remove and replace accept the 1-based index shown by my contract list or the exact rule text. Validation rejects empty, multiline, and duplicate rules. A growing contract is easier to review as guidance/contract.md, one - rule per line with optional ## groups. migrate keeps the inline list as a copy older my releases read, so members do not need to upgrade first. Run it with a current my. See Guidance and Contract.

Governance policies

Registered policy authoring hashes the committed policy blob from its declared mount and opens an isolated manifest PR without dirtying the sync-managed manifest cache:

my admin policy add security-baseline \
  --title "Security Baseline" \
  --mount handbook \
  --path policy/security-baseline.md \
  --version 2026-08 \
  --acceptance required \
  --summary "How we handle credentials, access, and customer data." \
  --topic credentials \
  --topic "customer data" \
  --role operator

--summary is a one-line agent-facing description. Repeatable --topic values are consultation triggers, and repeatable --role values scope the policy; with no role it applies universally. required adds the human acceptance gate, while optional remains available and binding for consultation without that gate. Both forms are verified locally before every real AI launch.

The compatibility --manifest-dir DIR --sha256 sha256:... form is for an explicit maintainer checkout. Prefer registered authoring because it derives the digest from committed upstream bytes. Removing a policy proposes another isolated PR and never rewrites historical acceptance evidence. See Governance for the employee and agent experience.

Admin aliases

Use my init to create a new local manifest repo. Mutating or configuration commands for an existing source are reachable under admin:

my admin setup
my init acme --name "Acme"
my admin manifests add acme <git-url>
my admin manifests sync acme
my admin manifests validate acme
my admin meetings add sampleco-followup --workspace handbook
my admin support add routing-timeout --workspace handbook
my admin tools add qmd --manifest-dir ~/src/acme-manifest --mode optional --purpose "Markdown search"

The top-level forms remain quiet compatibility aliases in this release.

Operational reads stay top-level

These commands inspect local or manifest-derived state:

my skills list
my skills status
my manifests list
my mounts list
my tools list
my tools info qmd
my services list
my services get docs-search
my roles list
my roles get operator
my contract list
my meetings list
my meetings search cleanup
my meetings get 2026-05-13-sampleco-followup
my support list
my support search timeout
my support get 2026-06-10-routing-timeout

If a read command is invoked through my admin, the CLI points back to the top-level form.