CLI command
skarbiec capability-serve
Serve signed finite-capability redemption and cancellation over an owner-only Unix socket.
Invocation#
skarbiec capability-serve --socket <unix-socket-path>Purpose#
Serve signed finite-capability redemption and cancellation over an owner-only Unix socket.
Required inputs and options#
- Requires --socket or SKARBIEC_CAP_SOCKET. Redeemers supply the v1 wire request and an Ed25519 proof from a live workload-bound grant.
Output and state effects#
- Replaces a stale socket, binds it mode 0600, serves until stopped, spends uses before returning secret bytes, and prints status stopped when the listener exits.
Refusals#
- Denies malformed/replayed proofs, expired/spent/mismatched capabilities, absent workload keys, missing routes or values, and authorization-id mismatch; challenge resources may return pending.