skarbiec doctor

Invocation#

skarbiec doctor

Purpose#

Diagnose the vault file, audit chain, canonical credential endpoint, optional WORM evidence, and consumer grants without depending on the API being healthy.

Required inputs and options#

• No positional input or command-specific option. The configured vault, audit, forward, and WORM paths are read directly.

Output and state effects#

• Prints five checks — vault, audit, endpoint, worm, and grants — each pass, fail, or not_configured, plus pass, failed, and not_configured tallies. The grants check walks every live consumer grant against the vault it names and decrypts nothing, reading state and kind from the cleartext envelope so it still answers on a host whose gpg is the fault. Diagnosis is read-only and does not repair state.

Refusals#

• A missing optional WORM configuration is reported as not_configured, not failure, and so is a vault whose live grants name no vault item at all — the detail reads no live consumer grant names a vault item. A broken vault, audit chain, endpoint, or grant is reported as fail rather than hidden.