skarbiec credential directory seal

Invocation#

skarbiec credential directory seal <item-id> --provider <provider> --tenant <uuid> --object-id <uuid> --account-upn <email> --local

Purpose#

Seal the immutable provider directory identity used by later credential lifecycle operations.

Required inputs and options#

• Requires item id, provider, lowercase tenant/object UUIDs, account UPN, and --local.

Output and state effects#

• Writes the sealed directory contract as a lifecycle-owned record carrying its own canonical kind, credential-directory-seal, and prints its metadata; future operations read this identity instead of accepting replacements.

Refusals#

• Refuses remote mode with `credential directory seal runs against the vault file it owns; rerun it with --local on the canonical Skarbiec host`, invalid identifiers, and an item that already carries a directory contract; changing one requires credential directory reseal.