saphan seat

saphan seat

A seat's own acts: what the record says about its credential, and the repair that follows

saphan seat

The SEAT, not the machine, is the subject here. machine verbs admit, seat and retire HOSTS; these verbs answer for one SEAT's credential — the thing that dies on its own schedule, that no other verb repairs, and whose remedy the record has been printing with nothing to perform it.

Subcommands

saphan seat auth

What the record says about a seat's credential — and, only when it is dead, the exact host-side line to repair it

saphan seat auth [flags]

Read what the record says about a seat's credential and, WHEN AND ONLY WHEN it says the credential is dead, compose the exact command an operator pastes ON THAT SEAT'S OWN HOST to repair it: the machine, the identity, the config dir, the vendor binary — absolute, complete, nothing to fill in.

FIVE ANSWERS, and they are not interchangeable:

credential-dead the last credential-deciding run died auth-failed ⇒ THE ACT IS COMPOSED reauth-recorded a human's re-auth was RECORDED after that failure ⇒ believed alive ON A REPORT; the next run confirms it lane-limited the record's LAST RUN word is a SPENT LANE, not a credential ⇒ waiting heals it; re-authenticating does NOTHING credential-ok the last credential-deciding run completed ⇒ NOTHING TO REPAIR, and no act is offered never-measured no terminal run has ever landed on this seat ⇒ an absence reported as itself, never as health

THIS VERB NEVER LOGS A SEAT IN. The vendor's re-authentication is interactive and lives on the far host; measured against the captured vendor help, the only non-interactive credential path it documents is an API key, which is a DIFFERENT credential and a different billing class. So the engine hands the act over and records it — it does not perform it.

PURE READ: no probe, no spawn, no vendor call, no store write. It costs nothing and is safe in a loop.

Options

saphan seat auth-performed

Record that a human re-authenticated a seat, so the record agrees without waiting for the next run to discover it

saphan seat auth-performed [flags]

Record the act seat auth handed over, AFTER a human performed it.

WHY THIS IS A VERB AND NOT A WAIT. Without it, a seat whose credential a human repaired at 08:00 keeps reading credential-dead until some master aims a real run at it and that run happens to succeed — so the record disagrees with the world for as long as nobody gambles a spawn. This verb closes that window with an OBSERVATION.

⚠ WHAT IT RECORDS IS A REPORT, AND IT SAYS SO. This engine did not dial the vendor and did not read a keychain: it records THAT A NAMED HUMAN SAYS THEY performed the login, with the host and the config dir the act named. seat auth then answers reauth-recorded — never credential-ok — and says in those words that the next real run is what confirms it.

It REFUSES on a seat whose CREDENTIAL axis the record does not read as dead: recording a repair of something that was not broken puts a fact in the ledger with nothing behind it.

Options