skarbiec policy-set

Invocation#

skarbiec policy-set <key> <value>

Purpose#

Set one administrative policy rule the binary actually enforces.

Required inputs and options#

• Requires a key and a value. The supported keys are a compiled registry rather than an open bag of operator metadata, and exactly one rule is registered today: min_generated_length, taking a whole number. The value is read as boolean, unsigned number, or string in that order and then checked against the shape the registered rule can consume.

Output and state effects#

• Writes the rule into the vault's policy section, saves the vault, appends audit naming the key, and prints ok plus key. A refused key or value writes nothing and appends nothing.

Refusals#

• Refuses a missing key or value. Refuses a key the registry does not carry — policy key <key> is not a rule this binary enforces, so setting it would report success and change nothing. Supported keys: min_generated_length (a whole number). Register a key here in the commit that starts reading it. Refuses a value the rule's reader could not consume — policy key <key> requires a whole number; <value> is not one, and the rule would be stored but never applied. Supported keys: min_generated_length (a whole number). Both refusals name every supported key and its shape, because a refusal that withholds the allowed set only moves the guessing one step along. Vault concurrency or save failures propagate rather than reporting a policy that did not persist.