skarbiec acquisition request

Invocation#

skarbiec acquisition request <consumer> <item> <field> --workload-id <id> --workload-timestamp <epoch> --workload-nonce <nonce> --workload-signature <hex>

Purpose#

Verify a workload's signed proof and issue a short-lived, one-use capability for one exact field.

Required inputs and options#

• Requires consumer, item, field, workload id, integer epoch timestamp, nonce, and Ed25519 signature matching the registered workload public key.

Output and state effects#

• On success prints the opaque token and expiry and appends acquisition-issued without logging the token or value.

Refusals#

• Fails with exit status 1 and 'acquisition request: unauthorized: <consumer> has no acquire grant for <item>#<field> that this workload proof satisfies' for absent/expired grants, scope mismatch, stale proof, replayed nonce, or invalid signature, without naming which check failed; malformed required inputs are rejected.