Inspect an application

In this tutorial you inspect the documentation task app: an Acore UI frontend, an Acore backend and a SQLite database contract. You list its facts, find what writes a piece of state, add the backend contract to the evidence and follow a field to the operations that return it. No application runs: Inspector reads source and artifacts only.

Prerequisites

• Axiom CLI 0.149.1 (this tutorial was verified on macOS arm64). See Install the Axiom CLI.
• git.
• No UI host, database or running server is needed.

1. Get the task app

git clone --depth 1 https://github.com/AxiomCore/AxiomCore.git
cd AxiomCore/examples/documentation/task-app

The directory has backend/, frontend/ and database/ folders. Run every later command from task-app unless a step says otherwise.

2. Prepare the evidence

Inspector reads compiled evidence. Build the backend contract, then resolve the frontend's contract lock so the UI compiler can check the frontend:

axiom build backend/sqlite.acore
cd frontend
axiom contract resolve
cd ..

Built backend contract: <task-app>/backend/.axiom/contracts/backend.axiom
Warning: contract `tasks` uses unsigned local artifact contracts/tasks.axiom. Allowed for development; release it through Axiom Cloud before production use.
Resolved 1 UI contract alias(es) into .axiom/axiom.ui.lock.json

The warning is expected: local development contracts are unsigned. See Artifact trust.

3. Summarize the application

axiom inspect overview .

Axiom Inspector
Graph revision 18be964eb0eb528277b270e4b48bf6aa7a444ebd76195f273454b1f961cae3fa
Facts 100  Relationships 155  Truncated false

FACTS
- Accessibility  accessibility_label [android,ios,web]
...

The graph revision is a hash of the complete evidence; it changes whenever the source changes. Each fact shows its kind, label and targets, then its semantic ID, truth layer (Declared or Resolved here) and verification state, then any attributes and evidence references.

Inspector discovers .acore sources, .axiom artifacts, *.server.json plans and the AxiomDeps.toml, AxiomDeps.lock, AxiomContracts.toml, AxiomPackages.lock, AxiomExtensions.toml and axiom.ui.lock.json files. It skips symbolic links and the .git, .axiom, target, node_modules, .dart_tool, build and dist directories; the UI compiler still reads each frontend's lock from .axiom/. Inspector reports what it found and how complete it is, instead of assuming every workspace is full-stack.

4. Explore the frontend

axiom inspect state .

Axiom Inspector
Graph revision 18be964eb0eb528277b270e4b48bf6aa7a444ebd76195f273454b1f961cae3fa
Facts 5  Relationships 0  Truncated false

FACTS
- State  Home.message [android,ios,web]
  state:42ed3fd139f610b5494f09ce  Resolved / Verified
  {"initializer":"\"\"","name":"message","path":"message","renderedSemanticId":"state:a1995aa970770323","scope":null,"span":{"end":704,"start":678},"type":"String"}
  evidence: frontend/main.acore (source-span)
...

The other frontend views work the same way:

Frontend evidence comes from the Acore UI compiler for the web, iOS and Android targets. Inspector never infers behavior from visual similarity or DOM conventions.

5. Find what writes a state value

axiom inspect ask "what can write Home.apiKey" .

AXIOM INSPECTOR ANSWER
Status: Incomplete
1 canonical write relationship can modify `home.apikey`.
...
FACTS
- actionstep · write apiKey · action-step:515fae9aae8646e5d0ff8ad7
- state · Home.apiKey · state:beb6895899277ccd1fbb36b3

Incomplete means runtime evidence was not collected, not that the static answer is wrong. To see the whole upstream path, including the Home.connect action and the button that triggers it, run axiom inspect trace Home.apiKey . --direction upstream.

6. Add the backend contract

Inspector skips .axiom/ directories, so the backend artifact from step 2 is not part of the evidence yet. Export a copy into the workspace:

axiom build backend/sqlite.acore --out backend/tasks.axiom
axiom inspect backend .

Built backend contract: backend/tasks.axiom
Axiom Inspector
Graph revision e4a226e9740c93558fbd8feffc0efe32c4e9cba082d4829eec1d47648ea9875e
Facts 75  Relationships 98  Truncated false

FACTS
- Operation  list_tasks [server]
...

The build also wrote the private server plan backend/tasks.server.json, which adds actions, implementation bindings and auth policies. The overview now reports 176 facts and 279 relationships.

Backend implementation bodies stay opaque when the artifact does not contain them. In this app exposure and cache return no facts: there is no explicit exposure declaration or cache-policy association. That does not prove an endpoint is private or uncached.

Without --deployment and --bindings, inspect server reports compatible=false because provider review is pending, and it labels request evidence and provider internals as not captured or unknown. Add --session with a redacted startup observation to include observed execution facts.

7. Follow a field

axiom inspect lineage Task.title .

The result connects the Task.title field to the taskPublic projection and the list_tasks, create_task, update_task and delete_task operations. axiom inspect data . --lineage Task.title returns the same result. Each step is a typed relationship with its own evidence.

Selectors and output formats

Focused commands accept a unique label such as Home.apiKey, or an exact semantic ID copied from any output. Labels can be ambiguous (Home.add matches two facts in this app), so prefer IDs in CI and agent workflows.

Machine results keep the format version, graph revision, semantic IDs, completeness and evidence references.

Common failures

Clean up

Inspector and the build wrote only inside the clone: .axiom/ folders (ignored by the example's .gitignore), backend/tasks.axiom and backend/tasks.server.json. Delete the cloned AxiomCore directory when you are done.

Next steps

• Local dashboard
• Trace relationships
• Changes and impact