skarbiec agent-enrol

Invocation#

skarbiec agent-enrol <agent>

Purpose#

Give one fleet agent the request-signing identity Brama verifies its calls with, so agent:<agent> resolves without a hand-written payload.

Required inputs and options#

• One agent name of letters, digits, '.', '_' and '-'. No value is typed or passed: the secret is generated by the vault. Runs on the vault owner; a replica vault is refused.

Output and state effects#

• Creates the internal-authority item <agent>-agent-signing whose id field names the agent and whose agent_auth_secret is freshly generated, then prints ok, agent, item, resource agent:<agent> and created. The secret is never printed; skarbiec route resolve agent:<agent> shows the item that now answers.

Refusals#

• Refuses a missing name, a name that is not one path component, an agent that already has a signing identity (naming the item and the route resolve command that shows it), an existing item at <agent>-agent-signing that is not that agent's identity, and a replica vault. A refusal writes nothing. tests/access/agent_enrol.sh runs these cases against a vault of its own.