skarbiec grant keep

Invocation#

skarbiec grant keep <consumer>

Purpose#

Make a direct grant live until revoked without rotating its bearer.

Required inputs and options#

• Requires exactly one consumer name. Nothing else is read: the grant keeps its capabilities, audience and the hash of the bearer the consumer holds, so a consumer whose bearer lives on another machine needs nothing delivered.

Output and state effects#

• Stores the until-revoked expiry (the value grant issue --until-revoked stores), saves the vault, appends a grant-kept journal record naming the expiry it replaced, and prints status kept with previous_expires_at and the vault it decided against. A grant that already lives until revoked is answered status unchanged and the vault is not written. A lapsed grant is kept as well: a clock ended it, not a revocation. Only a typed concurrent-generation conflict causes a fresh read and reapplication.

Refusals#

• Refuses without a consumer (`usage: grant keep <consumer>`), a consumer with no grant (`consumer <name> has no grant in <vault>`), an acquire grant, whose lifetime every acquisition bearer inherits, a grant that records no bearer, and a legacy grant that is not v2.