saphan bridge

Creates and maintains the bridge: the project's git repository of governing documents, orders, decisions and board that the whole team works from. These commands generate it, bind it to a gateway, check the connection, and commit, merge, pull and push it. Most of them refuse unless the workspace is named explicitly, with --workspace or SAPHAN_WORKSPACE, rather than found from the current directory.

saphan bridge

saphan bridge acceptances

Checks every recorded acceptance of a relayed document against the files on disk, by recomputing each file's digest. Each row gets one verdict: verified, refused (it disagrees or cannot be checked), claimed (a relay exists with no recorded acceptance) or unanswerable (the file could not be read). It prints how many rows and files it read first, is read-only, opens no network connection, and exits 0 even for refused rows: acting on them is your decision. The workspace must be named explicitly.

saphan bridge acceptances

saphan bridge bind

Registers this workspace on a gateway and points an existing bridge at the repository created there, without changing the bridge's contents. Use it when bridge init refuses because you already have a bridge. It refuses a workspace bound to a different gateway, a missing bridge, or a bridge whose origin already points elsewhere; it never commits or pushes, but it does set the bridge's origin and store the client-certificate settings for that one address in the bridge's git configuration. The workspace must be named explicitly and --gateway is required. Running the identical command again is safe and repairs a bind that failed partway.

saphan bridge bind

saphan bridge check

Proves from this machine that the bound gateway answers, by listing the trunk branch on the gateway with the bridge's recorded client certificate, key and CA, within 10 seconds. It prints the address, the certificate fingerprint and one verdict: ok, bridge-gateway-unreachable, bridge-tls-refused, bridge-admission-refused, bridge-ref-missing, bridge-check-unclassified, bridge-tx-environment-not-admitted or bridge-tx-url-rewritten. It writes nothing, retries nothing, and exits 0 only for ok. The workspace must be named explicitly.

saphan bridge check

saphan bridge commit

Stages and commits changes to a repository, limited to the paths a role's write-set document allows. Naming a path the set does not allow refuses the whole commit; with no paths it stages every allowed change and lists what it left out and why. Before committing it checks for paths outside the set, symlinks leaving the repository, secrets, AI attribution lines in the message, and that the author is the committing seat's recorded identity; it must be run from a registered seat's own configuration home and refuses otherwise (bridge-commit-no-seat). ⚠ This is an early warning, not the enforcement point: the gateway enforces on push, and this build does not verify the write-set document's signature. Rehearse with saphan dry-run bridge commit.

saphan bridge commit [path...]

saphan bridge identity-cutover

The owner's recorded decision, signed with the owner's root key itself, that from the current bridge tip onwards the gateway accepts a commit only when its author is the seat pushing it. It first prints a seven-day count of commit authors by kind so you can see whether any old-style identities are still in use; the count is information, not a gate. It is an owner act: before signing it prints a one-time six-character code on your terminal and waits for you to type it back, and it is refused with no terminal (scripts, CI), inside the console's browser terminal, and after 5 wrong codes. Once signed, a local saphan checks bridge-author --staged refuses where it used to warn. Earlier commits are never re-judged, and saphan identity revoke --kind bridge_identity_cutover --subject bridge reverses it.

saphan bridge identity-cutover --workspace /path/to/workspace

saphan bridge identity-cutover

saphan bridge init

Generates a new, working bridge at <workspace>/bridge from the documents built into this binary, commits it once as a git repository, and registers the workspace (writing its .saphan marker and a worktrees/ directory). The bridge starts with its governing documents, templates, board and a write-set document already in place; without --gateway no network is used. ⚠ If your configuration declares no git author name and e-mail, the first commit is made under the engine's fallback author, which the gateway refuses when that commit is pushed. It never overwrites: any existing file is refused with a per-path report. The workspace must be named explicitly. With --gateway, the workspace is also registered on a gateway and the bridge's origin pointed at a new, empty repository there. Rehearse with saphan dry-run bridge init.

saphan bridge init

saphan bridge merge

Merges a local branch into the bridge's checked-out branch, always as a merge commit. Nothing is resolved automatically: custom merge drivers and merge=union attributes are refused, conflicts the role's write-set covers are left in the repository for that person to resolve, and a conflict in a path another role owns aborts the merge and names the owner. The repository must be inside the workspace and clean, and the write-set must carry a valid signature. It is an owner act: it needs this workspace's signing key (saphan actor init), prints a one-time six-character code on your terminal and waits for you to type it back, and is refused with no terminal (scripts, CI), inside the console's browser terminal, and after 5 wrong codes.

saphan bridge merge <branch>

saphan bridge pull

Fast-forwards the bridge from its origin. A bridge that is up to date or ahead is left alone; one that has diverged is refused, both commits are shown, and nothing moves. The workspace must be named explicitly.

saphan bridge pull

saphan bridge push

Pushes exactly one bridge branch to one gateway address you name, declaring which seat is pushing so the gateway applies that seat's permissions. It cannot force, delete, mirror or push tags, ignores your git configuration, and refuses a destination that git would rewrite to another address. The workspace must be named explicitly. Rehearse with saphan dry-run bridge push.

saphan bridge push

Global options apply to every command — see Every command.