skarbiec key-doctor

Invocation#

skarbiec key-doctor

Purpose#

Determine directly from the vault and keyring whether this host has a key that can open a deterministic live canary.

Required inputs and options#

• No positional input. The configured vault and current GPG keyring are inspected directly.

Output and state effects#

• Prints vault, owner, readable/empty/unreadable status, canary id, canary_error with the actual decryption cause, possible openers, recipient fingerprints/keygrips, backup file names, and a remedy. A recipient whose entry records no fingerprint is listed with fingerprint null, secret_half_present false and a damaged sentence, and the keyring is not asked about it. A recipient without a role shows role null. Plaintext is discarded.

Refusals#

• A failed canary open is unreadable, not a missing item or proof of an absent private key. Inspect canary_error and the recipient key inventory before choosing key restoration or owner rotation. The recovery drill retains its actual canary error in both the result and the audit entry.