saphan gates

saphan gates

Read the fleet_gate log with a per-row signature verdict (read-only, no database client)

saphan gates [flags]

Print the human gate decisions recorded in fleet_gate — ts, stream, gate, actor, decision, recommendation ref, detail — and, per row, what the row's signature PROVES:

ok all four verification steps pass: the signature parses, its payload is this row's canonical bytes, its key-id is this workspace's key, and the constant-time MAC verifies. absent a PRE-EPOCH row (id at or below the recorded gate_identity_epoch boundary). It predates signing and never could carry a signature: historical, NOT a failure. mismatch a POST-EPOCH row that fails one of the four steps — including carrying no signature at all, which above the boundary means tampered, not historical. The failing step is named.

Read-only in the strong sense: the store is opened through the engine's read door (mode=ro, no migration, no state created), so this verb cannot write even by mistake. That is the point — reading the gate log used to mean copying the .db and shelling sqlite3, and a WAL-mode store copied without its -wal reads STALE while a live one refuses intermittently on its -shm. Both lie quietly.

A verified signature proves the WORKSPACE KEY produced the row's bytes. It does NOT prove which human acted — the actor column is signed content, never the authorisation. Every render says so; do not read more into ok than that.

Exit 2 if any row is a mismatch: a post-epoch row that does not verify is a question for a human, and this verb is loud about it. Pre-epoch rows exit 0 — they are the record's own history.

Options