> For the complete documentation index, see [llms.txt](https://asus-isg-aidc.gitbook.io/guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://asus-isg-aidc.gitbook.io/guide/latest/cli/commandreference/sat.md).

# SAT Baselines and Validation

| Developer | Last modified |
| --------- | ------------- |
| AIDC Team | 2026/07/06    |

## Table of Contents

* [1. Overview](#overview)
* [2. Shared Flags](#shared-flags)
* [3. Available Domains](#available-domains)
* [4. Subcommands](#subcommands)
* [5. Usage Examples](#usage-examples)

***

## 1. Overview <a href="#overview" id="overview"></a>

{% hint style="warning" %}
**⚠️ Prerequisite: `aidc-cli init` required first**

This command depends on settings saved by [`aidc-cli init`](/guide/latest/cli/commandreference/init.md). Before running it, make sure you have completed:

* [`aidc-cli init inventory`](/guide/latest/cli/commandreference/init.md#inventory) — render the node inventory from `aidc.csv`
* SSH access to the nodes — [`aidc-cli deploy install`](/guide/latest/cli/commandreference/deploy.md) sets this up during OS deployment; for nodes that already have an OS, run [`aidc-cli deploy access-key`](/guide/latest/cli/commandreference/deploy.md) or fill the `password` column in `aidc.csv`
* [`aidc-cli init bmc-set`](/guide/latest/cli/commandreference/init.md#bmc-configuration) — save the BMC credentials

For the full setup sequence, see the [Getting Started](/guide/latest/cli/gettingstarted.md) guide.
{% endhint %}

The `sat` command creates golden baselines and validates current host state against those baselines across selected hardware, firmware, and OS inventory domains.

```bash
aidc-cli sat <subcommand> [flags]
```

The current SAT workflow provides:

* `sat baseline create` to create a named golden baseline
* `sat validate` to compare current hosts against an existing baseline

***

## 2. Shared Flags <a href="#shared-flags" id="shared-flags"></a>

Both `sat baseline create` and `sat validate` support the following flags:

| Flag        | Short | Required |               Default              | Description                                                                            |
| ----------- | :---: | :------: | :--------------------------------: | -------------------------------------------------------------------------------------- |
| `--domains` |   —   |     ❌    | `hwspec,chkhw,chkfw,osinfo,driver` | Comma-separated SAT domains to include                                                 |
| `--view`    |   —   |     ❌    |               `brief`              | SAT report view. Allowed values: `brief`, `summary`                                    |
| `--stdout`  |   —   |     ❌    |               `false`              | Output the raw SAT report JSON to stdout instead of only saving the generated artifact |

{% hint style="info" %}
If `--domains` is omitted, SAT uses all five supported domains. Duplicate domain entries are ignored.
{% endhint %}

***

## 3. Available Domains <a href="#available-domains" id="available-domains"></a>

| Domain   | Purpose                                        |
| -------- | ---------------------------------------------- |
| `hwspec` | Hardware specification collection              |
| `chkhw`  | In-band hardware health checks                 |
| `chkfw`  | Firmware version validation                    |
| `osinfo` | OS configuration inventory                     |
| `driver` | Installed driver package and version inventory |

***

## 4. Subcommands <a href="#subcommands" id="subcommands"></a>

### 4.1 `baseline create` — Create a Golden Baseline

Creates a named SAT baseline from the current state of the selected hosts.

```bash
aidc-cli sat baseline create --name <baseline-name> [--domains <list>] [--view <brief|summary>] [--stdout]
```

| Flag     | Short | Required | Description                        |
| -------- | :---: | :------: | ---------------------------------- |
| `--name` |   —   |     ✅    | Name of the SAT baseline to create |

### 4.2 `validate` — Validate Against a Golden Baseline

Validates the current state of the selected hosts against an existing SAT baseline.

```bash
aidc-cli sat validate --baseline <baseline-name> [--domains <list>] [--view <brief|summary>] [--stdout]
```

| Flag         | Short | Required | Description                                  |
| ------------ | :---: | :------: | -------------------------------------------- |
| `--baseline` |   —   |     ✅    | Name of the SAT baseline to validate against |

***

## 5. Usage Examples <a href="#usage-examples" id="usage-examples"></a>

```bash
# Create a baseline with the default SAT domains
aidc-cli sat baseline create --name golden-v1

# Create a summary baseline for hardware and firmware domains only
aidc-cli sat baseline create \
  --name golden-hw-fw \
  --domains hwspec,chkhw,chkfw \
  --view summary

# Validate current hosts against an existing baseline
aidc-cli sat validate --baseline golden-v1

# Validate only hardware and OS domains and print the raw JSON report
aidc-cli sat validate \
  --baseline golden-v1 \
  --domains hwspec,osinfo \
  --stdout

# Create a baseline for specific nodes only
aidc-cli sat baseline create --name rack-a --domains hwspec,chkhw -l node01,node02
```