---
title: "Check on a previous run"
description: "Summarize a run directory with status, compare two runs or plans with diff, and inventory existing MDS role bindings."
url: https://monedula.dev/flock/docs/acl-rbac-converter/how-to/check-a-previous-run/
---
A migration spreads over days and run directories. Three read-only commands tell you where things stand: `status` summarizes one run directory, `diff` compares the ACLs or plans of two runs, and `mds list-bindings` shows what MDS already holds.

## Summarize a run directory

```bash
monedula-acl-rbac status runs/2026-05-21T10-00-00Z
```

`status` reads only the files in the run directory and makes no external calls. It prints one line per step, `NOT RUN` for a step that left no artifact, and the state of the lock. The README's sample output:

```text
Run directory: runs/2026-05-21T10-00-00Z

extract:           acl_count=500, source=json
plan:              bindings=487, checksum_ok=true, rejected=0, unmapped=13
apply:             
verify:            487 EFFECTIVE_OK, 0 missing, 0 unknown (487 total)
delete-acls:       NOT RUN
delete-deny-acls:  NOT RUN
lock:              none
```

- `checksum_ok=false` on the `plan` line means `plan.json` changed since it was planned or revalidated, and `apply`, `verify` and the delete commands will refuse it.
- `verify` counts the results in `verify.json`. `status` looks for that file name; results written elsewhere with `verify --out` do not show here.
- `delete-acls` and `delete-deny-acls` show as run once their scripts have written `delete.log` or `delete-deny.log` in the run directory.
- An empty `apply` line means that `apply.log` exists; `NOT RUN` means it does not.
- `lock` shows the contents of an `apply` lock file, when one exists.

Add `--format json` for CI; [status.v1.json](/flock/docs/acl-rbac-converter/reference/formats/status-v1/) describes the output. [Recover from a failed run](/flock/docs/acl-rbac-converter/how-to/recover-from-a-failed-run/) starts from what `status` shows.

## Compare two runs

For an incremental migration, compare the ACLs or the plans of two run directories:

```bash
# What ACLs are new this batch?
monedula-acl-rbac diff --acls runs/A/acls.json,runs/B/acls.json

# What does the new plan add or change vs. the previously-approved one?
monedula-acl-rbac diff --plan runs/A/plan.json,runs/B/plan.json
```

`--acls` and `--plan` each take exactly two paths, separated by a comma, or given by repeating the flag: `--acls runs/A/acls.json --acls runs/B/acls.json`. The two flags cannot be combined.

Each line of the output starts with `ADDED` or `REMOVED`, and for plans also `CHANGED` for a binding whose content differs. `diff` reads only the two files and exits 0 whether or not it finds differences; `--format json` gives a machine-readable result.

## See what MDS already holds

Before you plan a new batch, check which role bindings a principal already has:

```bash
monedula-acl-rbac mds list-bindings \
  --mds-url https://mds.example.com \
  --mds-token-file ~/.confluent/token \
  --principal-filter User:alice
```

It takes the same MDS flags as [`apply`](/flock/docs/acl-rbac-converter/how-to/apply-to-mds/). `--principal-filter` is required and repeatable, because MDS has no lookup across all principals. Narrow the result with `--scope-filter`, for example `--scope-filter kafka-cluster`, or set the lookup scope with `--kafka-cluster`, `--schema-registry-cluster`, `--ksql-cluster` or `--connect-cluster`. `--format` takes `text`, `json` or `yaml`.

## Related

- The [status](/flock/docs/acl-rbac-converter/reference/cli/status/), [diff](/flock/docs/acl-rbac-converter/reference/cli/diff/) and [mds list-bindings](/flock/docs/acl-rbac-converter/reference/cli/mds-list-bindings/) command references list every flag.