saphan ask
Asks the engine a typed question about a machine and its capabilities, from a request file that can be reviewed and replayed, and reads the receipt an answer was released under.
Asks the engine a typed question about a machine and its capabilities, from a request file that can be reviewed and replayed, and reads the receipt an answer was released under. ⚠ This build cannot yet produce an answer in a real workspace: the data sources an answer needs are not connected, so resolve refuses and lists what is missing, and no receipts are stored for receipt show to find. The conversational form (saphan ask "…") is not built.
saphan ask audit
Sets up and reads the audit epochs that answers are audited under for one tenant.
saphan ask audit epoch
Shows or appoints an audit epoch: the named period every audit event is written under. Until the tenant's operator appoints the first epoch, the audit trail refuses every entry and no answer that must be audited can be released; this is by design.
saphan ask audit epoch rotate
Opens a new audit epoch for a partition under a recorded rotation act, naming the open epoch it replaces. Both epochs stay readable, because the record of what was signed under the old one must remain legible. The appointment is written to the workspace store; nothing verifies the appointment document or the --actor name, so anyone who runs the command can rotate, and the reference, digest and actor are recorded.
| flag | type | default | what it does |
|---|---|---|---|
--act-digest | string | The digest of the signed appointment document, as 64 lower-case hex characters; it becomes the starting link of the new epoch's audit chain. Required. | |
--act-ref | string | The reference of the signed appointment document authorising this rotation. Required. | |
--actor | string | The name recorded as performing the appointment, as 1–64 characters of a-z, 0-9, _ and -; defaults to SAPHAN_ACTOR, then your configured identity. It is recorded, not authenticated. | |
--epoch | string | The identifier of the new epoch, 1–64 characters of a-z, 0-9, _ and - (for example epoch-0002). Required; never derived from the date. | |
--from | string | The epoch this rotation replaces; it must already exist in the partition, though it need not be the most recent one. Required. | |
--partition | string | The tenant partition the epoch belongs to, 1–64 characters of a-z, 0-9, _ and -. Required. | |
--scope | string | The tenant scope, as 64 lower-case hex characters. Required. |
saphan ask audit epoch show
Shows the epochs appointed for a partition, together with the fixed list of audit event kinds this build records. An empty list means no epoch has been appointed yet, so audit entries would be refused.
| flag | type | default | what it does |
|---|---|---|---|
--partition | string | The tenant partition to read. Required. | |
--scope | string | The tenant scope, as 64 lower-case hex characters. Required. |
saphan ask audit epoch start
Appoints a partition's first audit epoch under a recorded start act, meant to be done once, on the tenant's first day. You choose the identifier; an identifier the partition already holds is refused, but a further start with a new identifier is not. The appointment is written to the workspace store; nothing verifies the appointment document or the --actor name, so anyone who runs the command can appoint, and the reference, digest and actor are recorded.
| flag | type | default | what it does |
|---|---|---|---|
--act-digest | string | The digest of the signed appointment document, as 64 lower-case hex characters; it becomes the starting link of the epoch's audit chain. Required. | |
--act-ref | string | The reference of the signed appointment document authorising this start. Required. | |
--actor | string | The name recorded as performing the appointment, as 1–64 characters of a-z, 0-9, _ and -; defaults to SAPHAN_ACTOR, then your configured identity. It is recorded, not authenticated. | |
--epoch | string | The identifier of the first epoch, 1–64 characters of a-z, 0-9, _ and - (for example epoch-0001; 2026-Q3 is refused). Required. | |
--partition | string | The tenant partition the epoch belongs to, 1–64 characters of a-z, 0-9, _ and -. Required. | |
--scope | string | The tenant scope, as 64 lower-case hex characters. Required. |
saphan ask receipt
Reads the receipts that answers were released under.
saphan ask receipt show
Shows the identity and completeness of one receipt by its reference. ⚠ This build stores no receipts, so it currently reports that none exists and names what is missing.
saphan ask resolve
Opens a typed request file and resolves it, printing where each step stopped. The file states the contract version, the kind of question, the mode and the subject machine and capability; a machine named only by the file's location is refused. ⚠ In a real workspace this build refuses at the end and lists the missing pieces it would need to answer.
| flag | type | default | what it does |
|---|---|---|---|
--at-least | string | A threshold the question asks about, such as a minimum version (1.24) or, for disk headroom, an amount (20GiB); without it the question is only whether the capability is present. | |
--backend | string | For questions about seats only: list only the seats registered on this backend. | |
--disclosure | string | The disclosure decision that applies: indeterminate, releasable, redact or withhold. Deliberately has no default; leaving it out is refused rather than treated as consent. | |
--grants | string | Directory of a published, signed grant store; every grant in it is verified against the trust file inside that same directory, so naming a store means trusting it. Not searched for: if you omit it, no grants are considered. | |
--request | string | Path to the typed request file. Required. | |
--role | string | For questions about seats only: list only the seats with this role. | |
--scope | string | The scope the question is asked in. Required, with no default, because an unknown scope authorises nothing. |
saphan ask source
Records signed checkpoints of where a data source that answers draw on currently stands. Run it with a subcommand.
saphan ask source checkpoint
Reads the current position of a data source (in this build, only the capability registry), signs it with the installation's identity key, verifies the signature and stores it as that source's checkpoint. A source whose contract has not been ratified yet is refused, and saphan dry-run ask source checkpoint goes through every step without writing anything.
| flag | type | default | what it does |
|---|---|---|---|
--root-key | string | The root private key to sign with; by default the installation's granted identity-signing key is used, then the root key. | |
--scope | string | The question scope this checkpoint belongs to (required). | |
--source | string | The source to checkpoint (required); this build knows only capability-registry. |
Global options apply to every command — see Every command.
saphan actor
Manages the people who sign decisions: this workspace's signing key and the list of enrolled actors.
saphan backup
Writes one complete backup of an installation while the gateway keeps serving: a consistent snapshot of the store, every configured CouchDB database, the bridge repositories and documents and the forg