saphan canon
Delivers the canon a seat must obey (its standing rules, governing documents and a slice of the fleet's state) to the machine the seat runs on, as a signed pack.
Delivers the canon a seat must obey (its standing rules, governing documents and a slice of the fleet's state) to the machine the seat runs on, as a signed pack. The pack is verified on arrival and nothing is written unless every part checks out; how strictly the signature is judged depends on the enforcement setting. No git repository is involved.
saphan canon apply
Verifies a canon pack and installs its contents on the receiving machine; canon send prints this exact command for you. Every file is checked against its recorded digest and the signature against this machine's trusted root or a delegate under it; a pack signed by an unknown or revoked key, a tampered pack, or one older than the last applied is refused with nothing written. ⚠ An unsigned pack is refused only under enforce: under warn or off (the default when trust.enforce is not configured) it is applied, and a signed pack is applied without its signature being judged when this machine has no root public key. It only ever removes files it delivered itself.
| flag | type | default | what it does |
|---|---|---|---|
--canon-dir | string | The directory the canon files are installed into, normally <workdir>/.provision. Required. | |
--canon-state-dir | string | Where this machine keeps its record of delivered canon and the newest version applied, outside the seat's writable directory so a seat cannot roll it back. Defaults to ~/.saphan/canon. | |
--enforce | string | Overrides the configured signature enforcement (trust.enforce, default off) for this run: off, warn or enforce. Anyone who runs the command can lower it. | |
--max-bytes | int64 | 0 | The largest canon pack accepted, in bytes. Defaults to 524288. |
--pack | string | The canon pack to apply. Required. | |
--re-baseline | bool | false | Deliberately accept canon files already present in --canon-dir that this machine has no record of delivering; the acceptance is recorded. It never waives the freshness or seat checks. |
--registry | string | The actor registry listing delegated signers whose grants are honoured. Defaults to <workspace>/bridge/registry/ACTORS.md. | |
--root-pub | string | The trusted root public key. Defaults to ~/.saphan/trust/root.key.pub. | |
--stream | string | The seat's stream; a pack built for a different seat is refused. |
saphan canon send
Builds a seat's canon from plain files on this machine, signs it with the trust root key or a delegate key, copies it over ssh to the machine the seat runs on, runs saphan canon apply there (printing that command), and removes the staged pack afterwards. The far side applies it under enforce unless --enforce says otherwise. The fleet state travels only as an excerpt with the seat's own rows.
| flag | type | default | what it does |
|---|---|---|---|
--canon-state-dir | string | Where this machine keeps the per-stream version counter. Defaults to ~/.saphan/canon. | |
--context-stream | stringSlice | Another stream whose rows to include in the fleet-state excerpt, such as the coordinating stream's. Repeatable. | |
--enforce | string | The signature enforcement the receiving machine applies: off, warn or enforce. Defaults to enforce; a lower value lets the far side accept an unsigned pack. | |
--far-canon-state-dir | string | Where the receiving machine keeps its canon record. Defaults to that machine's ~/.saphan/canon. | |
--fleet-state | string | A fleet-state file on this machine to include as an excerpt. Optional. | |
--governance | string | A directory of governing documents on this machine to include, read recursively. Optional. | |
--landing | string | The directory on the receiving machine where the pack is staged. Defaults to the parent of --workdir. | |
--laws | string | The index of standing rules on this machine to include. Required. | |
--machine | string | The registered machine that hosts the seat. Required. | |
--max-bytes | int64 | 0 | The largest canon pack allowed, in bytes. Defaults to 524288. |
--out | string | Also save the built pack to this local path (readable only by you). | |
--root-key | string | The signing key: the trust root key or a delegate key granted under it. Defaults to ~/.saphan/trust/root.key. | |
--signer-actor | string | The signer's name recorded in the pack; it is a label, not checked against the key. Defaults to your configured identity, else owner-root. | |
--stream | string | The seat's stream. Required. | |
--workdir | string | The seat's absolute working directory on the receiving machine; the canon is installed in <workdir>/.provision. Required. |
saphan canon verify
Checks a canon pack's signature and file digests and reports the result, without writing anything. The same enforcement rules as canon apply decide whether an unsigned pack passes.
| flag | type | default | what it does |
|---|---|---|---|
--enforce | string | Overrides the configured signature enforcement (trust.enforce, default off) for this check: off, warn or enforce. | |
--pack | string | The canon pack to check. Required. | |
--registry | string | The actor registry listing delegated signers whose grants are honoured. Defaults to <workspace>/bridge/registry/ACTORS.md. | |
--root-pub | string | The trusted root public key. Defaults to ~/.saphan/trust/root.key.pub. | |
--stream | string | The seat's stream; a pack built for a different seat is refused. |
Global options apply to every command — see Every command.