saphan verify
Checks a signed instruction — a law document by path, or a registered order by reference — against the installation's trust chain (root key, actor registry, laws manifest and delegations) and prints o
Checks a signed instruction — a law document by path, or a registered order by reference — against the installation's trust chain (root key, actor registry, laws manifest and delegations) and prints only the fields it has authenticated. For an order, a pass means the signature is sound, the order is registered, its bytes match the registration and it is active. ⚠ It only reports: in this release nothing gates a run or a dispatch on its answer.
| flag | type | default | what it does |
|---|---|---|---|
--class | string | law or order; by default a <path>.sig file next to the path means order, and its absence means law. | |
--manifest | string | The laws manifest; defaults to <workspace>/bridge/registry/LAWS_MANIFEST.md, and a missing file is read as empty rather than refused. | |
--ref | bool | false | Treat the argument as a registered order reference; needed for a bare full digest. |
--registry | string | The actor registry file; defaults to <workspace>/bridge/registry/ACTORS.md, and a missing file is read as empty rather than refused. | |
--root-pub | string | The root public key to verify against; defaults to ~/.saphan/trust/root.key.pub. | |
--stream | string | The order's target stream, used to match a delegation's stream scope (orders only). |
Global options apply to every command — see Every command.
saphan trust
Creates and manages the keys and signed records that establish who may instruct and approve work in an installation: the root key, delegations, the deployment record and edition, the owner's presence
saphan verify-affected
Runs a fast, advisory check of what changed between --base and --head: the changed paths are handed to the test adapter configured under [verify.affected], which selects and runs the affected packages