saphan evidence
Parks a stream's evidence outside its worktree, places archives in the evidence store, and reads them back.
Parks a stream's evidence outside its worktree, places archives in the evidence store, and reads them back. The evidence store is where saphan teardown keeps a stream's signed evidence record, so it still answers after the stream's worktree has been removed. detach writes to a directory on this machine, not to the evidence store; place and show use the store. Run it with a subcommand.
saphan evidence detach
Moves a stream's committed evidence pack out of its worktree into one signed archive. It collects the files, writes the archive, its signed metadata and its signature as three files in the --out directory on this machine, reads the archive back from that disk and compares every file's size and sha256, and only then removes the files from the worktree. ⛔ On any disagreement it removes nothing. ⚠ Detach does not write to the evidence store: once you commit the removal, those three files are the only copy, so back them up (or store them with saphan evidence place). They are created readable by every user of this machine.
Nothing is parked unless the setting evidence.archive is true; otherwise the files are collected and measured, and nothing is written or removed. Detach refuses when this machine has no signing key, and never overwrites an existing archive that holds different bytes. It does not commit the removal; it prints the command for you to do so, and running it again writes nothing and says what is left to commit.
| flag | type | default | what it does |
|---|---|---|---|
--commit | string | The commit to record in the archive's metadata. | |
--gate | string | stop2 | The gate the archive is named for; defaults to stop2. |
--json | bool | false | Print the result as JSON. |
--out | string | The absolute directory to keep the archive in, which may not be inside the worktree; defaults to evidence-archive under the installation prefix. | |
--repo | string | The repository name to record in the archive's metadata. | |
--worktree | string | The absolute path of the stream's worktree; required, because files there are removed and the command never guesses the path. |
saphan evidence place
Stores an archive that already exists, together with the manifest that describes it, as one signed document in the evidence store. It checks the archive against the manifest before writing, writes both in one request, reads both back to verify them, and prints the document ID. It never builds, changes or removes a file; running it again finds the document already stored and writes nothing. The store is set by evidence.base_url and evidence.db_name.
| flag | type | default | what it does |
|---|---|---|---|
--batch | string | Which batch this archive is; part of the document's ID and required. | |
--manifest | string | The tab-separated manifest (sha256, bytes, path) that describes the archive; required. | |
--placed-at | string | The RFC 3339 timestamp to record in the document; defaults to now, and is given explicitly when a placement must be reproducible. | |
--stream | string | The stream this batch belongs to; part of the document's ID and required. |
saphan evidence show
Fetches one evidence document and its archive from the store, re-hashes both, and prints the document ID, both digests and the member count. It refuses if the content does not match the address it is stored under, or if the signature is absent, malformed, signed by a key this machine cannot resolve, or does not verify. ⚠ The signature is checked against this machine's device key, so a document another machine signed is refused here by name.
| flag | type | default | what it does |
|---|---|---|---|
--gate | string | teardown | The gate part of a derived document ID; defaults to teardown, the gate that writes these documents. |
--sha256 | string | The sha256 of the signed metadata document, for a derived ID. | |
--stream | string | Derive the document ID from this stream (with --gate and --sha256) instead of naming it. |
Global options apply to every command — see Every command.
saphan egress-door
Runs one agent's egress door on a remote machine: it opens a SOCKS5 proxy on a unix socket that judges every outbound connection against the run's egress policy, runs the given command as its child, a
saphan fleet
Shows the state of the fleet — streams, seats, running legs, capacity and refusals — from the record.