skarbiec review

Invocation#

skarbiec review --before <iso8601> [--breached] [--alert]

Purpose#

Answer the questions an owner asks on a schedule in one report, from the commands that already answer each one, and with --alert tell the chat channel the owner watches what the review found.

Required inputs and options#

• --before is required: a UTC time of the vault's stamp form, the moment the review is held to. A certificate must outlive it, and an item last written before it is reported as not rotated since. How old is too old is yours to decide, so nothing is assumed. --breached adds the Have I Been Pwned check to secret health, as `health --breached` does; without it the review never leaves this machine. --alert posts the findings to the webhook `alert set` named on this host. POST /v1/operator/review takes before, breached and alert.

Output and state effects#

• Runs, in order, health (password reuse, short values, values below the policy, sign-ins without TLS, accounts kept twice, unreadable items), with --breached breach sites, certificates --expiring-before, expiry tokens --before, keys --expiring-before, expiry list --before, list --updated-before, grant list --expired, grant list --dangling, grant list --idle-since, list --untouched-since, password age --set-before, the logins offered on no site, rotation list --due, emergency list, totp seed and shares, and prints ok, before, reviewed_at, failed_sections and sections (each command's own answer under its name; with --breached the logins whose site was breached after their password was set under breached_sites; the stored JSON Web Tokens ending before the moment under tokens_ending_before; the keys are under keys_ending_before, the recorded expiries under items_expiring_before, the dangling grants under grants_naming_missing_items, the grants and items nothing has used since the moment under grants_unused_since and items_unused_since, the logins whose password was last set before it under passwords_set_before, the logins whose context names no site — so autofill offers them nowhere until sites --add gives them one — under logins_offered_nowhere with any login that would not open to tell, the seed states under second_factors and the shares that end on their own under timed_shares, where an ended one still listed is one maintain has not revoked). Every section runs even when another fails; a failed section holds its error and ok is false. It opens every live item, as health does, prints item ids only, and appends a review journal record with the moment and the failed sections. With --alert it then posts one message to the alert webhook naming each section that holds rows, with its counts, and each failed section, and adds alert to the report. Desktop's Settings → Policy shows it as Security review.

Refusals#

• A missing --before exits 2 with `usage: review --before <iso8601> [--breached] [--alert]: the moment certificates must outlive and values must have been written after`; another shape exits 2 with `--before <value> is not a UTC time of the form <now>`. A section's own refusal is reported inside that section, not as the whole command's failure, so Have I Been Pwned being unreachable fails only secret_health. With --alert the report adds alert: posted true with how many sections were posted — each section holding rows, with its counts, and each failed section with its error, never a value — or posted false with the reason: the review found nothing, no alert is set on this host, or the error the webhook answered.