skarbiec grant ensure

Invocation#

skarbiec grant ensure <consumer> <item> --field <field> --token-file <owner-only-path>

Purpose#

Widen an existing direct declaration by one exact read of one field, without rotating its bearer.

Required inputs and options#

• Requires exact consumer, item, field, and a mode-0600 regular token file containing the current bearer.

Output and state effects#

• Adds the capability or reports unchanged, saves the vault, appends the journal record when added, exercises the same two predicates the read route applies, names the vault it decided against, and never prints the bearer.

Refusals#

• Refuses a missing, expired, workload-bound, legacy, or mismatched grant and rejects token files that are not owner-only regular files.