saphan canon
Carry the canon a seat must obey — signed, deterministic, no git
saphan canon
Carry the canon a seat must obey — signed, deterministic, no git
Subcommands
| Subcommand | What it does |
|---|---|
saphan canon apply | Verify a canon pack and land its members (the far-side half of canon send) |
saphan canon send | Compose, sign and carry a seat's canon; land it in <workdir>/.provision |
saphan canon verify | Judge a canon pack's signature and digests; write nothing |
saphan canon apply
Verify a canon pack and land its members (the far-side half of canon send)
Verifies BEFORE anything is written: the manifest's signature against this host's trust root pin, then every member against the digest that signed manifest declares. A pack that is unsigned (under trust.enforce=enforce), signed by an unknown key, signed by a revoked delegate, or whose members do not match their digests is refused by NAME and nothing is written.
The members land in --canon-dir; the FRESHNESS FLOOR does not. It is kept in the engine's own canon state (--canon-state-dir, default ~/.saphan/canon), outside the directory the canon lands in, because that directory is one every leg can write — and a replay floor a leg can lower is not a floor. Only what a previous apply RECORDED as delivered is ever removed from --canon-dir: the leg's brief and every provisioned destination live there too and are not this verb's to touch.
Consults no repository. Invokes no git.
Options
| Option | Type | Default | Description |
|---|---|---|---|
--canon-dir | string | unset | directory the members land in (required; normally <workdir>/.provision) |
--canon-state-dir | string | unset | engine-owned canon state holding this seat's freshness floor and delivered-member record (default: ~/.saphan/canon) |
--enforce | string | unset | override trust.enforce for this act: off|warn|enforce (default: the config value) |
--max-bytes | int64 | 0 | canon byte budget (default 524288) |
--pack | string | unset | canon pack to apply (required) |
--re-baseline | bool | false | DELIBERATELY accept canon members already on disk in --canon-dir that this host holds no record of delivering; recorded as an admission. Waives only that case — never the staleness floor, never a cross-seat record |
--registry | string | unset | actor registry carrying DELEGATIONS (default: <workspace>/bridge/registry/ACTORS.md) |
--root-pub | string | unset | root pin path (default: ~/.saphan/trust/root.key.pub) |
--stream | string | unset | the seat's stream; a pack carrying another seat's canon is refused |
saphan canon send
Compose, sign and carry a seat's canon; land it in <workdir>/.provision
Composes the canon from PLAIN LOCAL FILES on this host (no repository of any kind is consulted or required), signs it with the trust root, carries it over the ssh transport that already moves packs, and prints the exact far-side command that applies it — complete, literal, runnable from any directory.
The fleet-state member, when named, travels as a bounded EXCERPT: the seat's own rows plus any --context-stream, never the whole projection.
Nothing is applied that does not verify: a canon that is unsigned, signed by an unknown key, signed by a revoked delegate, or whose members do not match their declared digests is refused on arrival BY NAME, and nothing is written.
Options
| Option | Type | Default | Description |
|---|---|---|---|
--canon-state-dir | string | unset | engine-owned canon state on THIS host, holding the monotonic per-stream sequence (default: ~/.saphan/canon) |
--context-stream | stringSlice | [] | extra stream to keep in the fleet-state excerpt, e.g. the master's (repeatable) |
--enforce | string | unset | trust enforcement the FAR side applies to this canon: off|warn|enforce (default: enforce — this act delivers a seat's LAWS and never inherits a permissive default) |
--far-canon-state-dir | string | unset | engine-owned canon state on the FAR host, holding that seat's freshness floor (default: the far host's own ~/.saphan/canon) |
--fleet-state | string | unset | path to a fleet-state projection on THIS host; carried as a bounded EXCERPT, never whole (optional) |
--governance | string | unset | directory of governance documents on THIS host (optional, walked recursively; dot-entries skipped) |
--landing | string | unset | far directory the pack is staged in (default: the workdir's parent) |
--laws | string | unset | path to the standing-law index on THIS host (required) |
--machine | string | unset | registered machine holding the seat (required) |
--max-bytes | int64 | 0 | canon byte budget (default 524288) |
--out | string | unset | also write the composed pack to this local path (optional) |
--root-key | string | unset | signing key path (default: ~/.saphan/trust/root.key) |
--signer-actor | string | unset | signer actor name (default: identity.actor, else owner-root) |
--stream | string | unset | the seat's stream slug (required) |
--workdir | string | unset | the seat's workdir on that machine, absolute; the canon lands in <workdir>/.provision (required) |
saphan canon verify
Judge a canon pack's signature and digests; write nothing
Options
| Option | Type | Default | Description |
|---|---|---|---|
--enforce | string | unset | override trust.enforce for this act: off|warn|enforce (default: the config value) |
--pack | string | unset | canon pack to judge (required) |
--registry | string | unset | actor registry carrying DELEGATIONS (default: <workspace>/bridge/registry/ACTORS.md) |
--root-pub | string | unset | root pin path (default: ~/.saphan/trust/root.key.pub) |
--stream | string | unset | the seat's stream; a pack carrying another seat's canon is refused |