saphan trust
The signed-instruction-provenance root: mint, delegate, and health-check
saphan trust
The signed-instruction-provenance root: mint, delegate, and health-check
Subcommands
| Subcommand | What it does |
|---|---|
saphan trust delegate | Root-sign a delegation grant into the actor registry's DELEGATIONS section |
saphan trust doctor | MINIMAL trust-material health check (root pin present+loadable, keypair custody-guard clean, trust.enforce valid) |
saphan trust init | Mint the root keypair at ~/.saphan/trust/root.key (O_EXCL, never re-mints) |
saphan trust delegate
Root-sign a delegation grant into the actor registry's DELEGATIONS section
Root-signs {delegate-actor, delegate-key-id, scope=order-signing, streams,
nbf, exp, ts} (instr.SignDelegation — LINE-kind, over canonicalDelegationTuple)
and appends the row to <registry>'s DELEGATIONS section (append-only, human-
gated shape — registry/delegations.go). The row format matches what
verify/order sign's S0 loader reads back (canonical-symmetry).
Options
| Option | Type | Default | Description |
|---|---|---|---|
--delegate-actor | string | unset | delegate actor name (required) |
--delegate-key-id | string | unset | delegate's apk- key-id (required) |
--delegate-pub | string | unset | delegate's public key, base64-encoded (required) |
--exp | string | unset | RFC3339 expiry (required) |
--nbf | string | unset | RFC3339 not-before (required) |
--registry | string | unset | actor registry path (default: <workspace>/bridge/registry/ACTORS.md) |
--root-key | string | unset | root private key path (default: ~/.saphan/trust/root.key) |
--stream | stringSlice | [] | stream this grant covers (repeatable; "*" for any stream) |
--ts | string | unset | RFC3339 grant timestamp (default: now) |
saphan trust doctor
MINIMAL trust-material health check (root pin present+loadable, keypair custody-guard clean, trust.enforce valid)
Checks exactly three things: the root pin (--root-pub, default ~/.saphan/trust/root.key.pub) is present and passes the full custody guard ladder; the sibling root.key, if present, also passes the guard ladder; and ~/.saphan/config's trust.enforce (if set) is a valid value. This is NOT the full registry↔sig divergence sweep (wsk-067a3325's regression class) — that full check is P2 T16, deliberately out of scope here.
Options
| Option | Type | Default | Description |
|---|---|---|---|
--root-pub | string | unset | root pin path (default: ~/.saphan/trust/root.key.pub) |
saphan trust init
Mint the root keypair at ~/.saphan/trust/root.key (O_EXCL, never re-mints)
Generates a fresh ed25519 root keypair via trust.MintKeypair (O_EXCL — refuses to clobber an existing key: a re-mint would silently invalidate every signature the old root ever produced) and prints the resulting apk- pin id. The PRIVATE key bytes never appear on any surface (§1.6); only the derived key-id is ever shown.
Owner ceremony (who runs this, when, on what machine) is P1.e — this verb only builds the mint mechanism.
Options
| Option | Type | Default | Description |
|---|---|---|---|
--root-key | string | unset | root private key write path (default: ~/.saphan/trust/root.key) |