saphan laws
The LAWS MANIFEST: ratified Class-L standing-law documents
saphan laws
The LAWS MANIFEST: ratified Class-L standing-law documents
Subcommands
| Subcommand | What it does |
|---|---|
saphan laws cat | Print the ratified LAWS MANIFEST, or verify one Class-L document against it |
saphan laws ratify | Root-sign a fresh LAWS MANIFEST over the given Class-L documents |
saphan laws cat
Print the ratified LAWS MANIFEST, or verify one Class-L document against it
With no argument: root-verifies the manifest's OWN envelope (alg-pinned, untampered, root-signed) and lists its ratified entries — path, sha256, note — authenticated ONLY as far as the manifest's own signature proves (this does NOT re-hash any live file on disk).
With a path argument: identical to verify --class law <path> — walks the
full Class-L chain (instr.Verify) and prints only the authenticated result.
Read-only either way; nothing is written.
Options
| Option | Type | Default | Description |
|---|---|---|---|
--manifest | string | unset | LAWS MANIFEST path (default: <workspace>/bridge/registry/LAWS_MANIFEST.md) |
--registry | string | unset | actor registry path (default: <workspace>/bridge/registry/ACTORS.md) |
--root-pub | string | unset | root pin path (default: ~/.saphan/trust/root.key.pub) |
saphan laws ratify
Root-sign a fresh LAWS MANIFEST over the given Class-L documents
Hashes each given path's EXACT bytes, builds a monotonic-serial manifest
table (instr.BuildManifestCanonical), and root-signs it — byte-identical to
what verify/laws cat re-derive and check (canonical-symmetry). Owner-hand
ceremony (which docs get ratified, when) is P1.e — this verb only builds
the mechanism; tests drive it with synthetic keys/paths.
Options
| Option | Type | Default | Description |
|---|---|---|---|
--actor | string | unset | signing actor label (flag > SAPHAN_ACTOR > ~/.saphan/config) |
--manifest | string | unset | manifest write path (default: <workspace>/bridge/registry/LAWS_MANIFEST.md) |
--note | string | unset | free-text note applied to every entry this ratification writes |
--root-key | string | unset | root private key path (default: ~/.saphan/trust/root.key) |
--serial | int64 | 0 | manifest serial (default: previous manifest's serial + 1, or 1 if none) |
--ts | string | unset | RFC3339 timestamp (default: now — tests pin this for determinism) |