skarbiec policy check

Invocation#

printf '%s' "$CANDIDATE" | skarbiec policy check

Purpose#

Decide a candidate against every rule the policy declares without storing it.

Required inputs and options#

• Reads the candidate from standard input, never from an argument, because an argument stays in the process table and shell history. One trailing newline is removed and nothing else, so whitespace inside a password counts. Each rule decides on whatever policy set stored for it; min_generated_length is the one registered rule today.

Output and state effects#

• Prints ok and rules: one entry per registered rule with key and configured, and for a configured rule required, actual and ok. ok is true only when every configured rule passes; a rule that is not set passes and says configured false. The candidate is never printed; no audit or vault write occurs.

Refusals#

• A candidate given as an argument is refused: policy check reads the candidate from standard input, never from an argument: an argument stays in the process table and shell history. An empty candidate is refused: policy check needs a candidate, and the one it read was empty: standard input on the command line, the candidate field over the operator API. An undersized candidate is reported with ok false rather than refused, modified or stored. Skarbiec Desktop runs the same check through POST /v1/operator/policy/check with the candidate in the JSON body.