opschain admin settings prune

Included from Basic tier

Strips the stored global settings document down to the keys the Go server actually reads, removing the legacy Rails-era keys (and the Rails-only sub-keys inside kept blocks such as git_remote) that only pollute the configuration. The prune is safe by construction in two ways: without --confirm it only previews what would be removed, and every applied prune writes a new document version while the old one stays in the history — any pruned value is recoverable with opschain admin settings show and its version flag, which the prune output reminds you of by number.

The stored licence key is deliberately not pruneable: it holds the uploaded legacy licence file the server's licence info is computed from. maintenance_mode is not pruneable either — the server still reads it for the /api/info maintenance_mode? display, so pruning it would silently clear the flag. The whole stored ldap block IS pruneable: the ldap.* settings were removed completely — directory sign-in is a kind: ldap identity provider connection, and the upgrade's boot seed consumes and strips the stored block itself — so anything prune finds there is an inert leftover. The retired auth_strategy/auth.providers chain selectors are pruneable for the same reason (login-surface amendment): sign-in ordering is per-connection display_order on the identity provider connections, and only that same boot seed reads the stored selectors. (The former per-flag migration lane and its config-catalog precondition are retired with the settings they guarded.) The retired requires_approval_from approver entries are pruneable too — the server ignores them everywhere, and approval policies are their enforced successor. Convert them first with opschain approval-policies convert-settings-approvers, which reads the stored entries until they are pruned. The retired product_name setting is pruneable as well: the product name is fixed, new session tokens stamp the fixed iss claim, and token verification never reads iss — tokens minted under a previously customised value keep validating, so a stored leftover is inert.

Flags

Flag	Meaning
--confirm	Apply the prune. Without it the command previews the keys that would be removed and changes nothing.

A server target is required (--server <url>, OPSCHAIN_SERVER, or the active context). -o json|yaml prints the pruned keys and new version as a machine document on an applied prune.

Exit codes

Code	Meaning
0	Preview printed, prune applied, or nothing to prune.
1	The read or the PATCH failed.
2	Usage error — no server target.

Named errors

• the system configuration carries no settings document reference — exit 1.

Examples

Preview, then apply:

opschain admin settings prune
would prune 3 legacy key(s) the Go server does not read:
  - pod_per_change_step
  - pod_templates
  - runner
current version 7 is preserved in the document's history. Re-run with --confirm to apply.

opschain admin settings prune --confirm
pruned 3 legacy key(s): pod_per_change_step, pod_templates, runner

See also

• opschain docs cli/admin-settings-show — the pruneable-keys advisory and the history any pruned value is recovered from.