Search all skarbiec documentation

Direct diagnosis#

Run status for configured paths and non-sensitive counts.
Run key-doctor to compare vault recipients with locally available private keys.
Run audit verify against the audit journal.
Run doctor for the combined vault, audit, GnuPG daemon, endpoint, WORM receipt, and consumer-grant report. The grants check names a grant whose item was trashed, purged, or renamed away, and one naming a field the item's kind refuses outright, in the same words routes verify uses for a broken route. The gpg_daemons check names a keyboxd or gpg-agent over its memory ceiling; the running service replaces it on its next readiness pass, and recover-daemons replaces it now.

Authorization refusal#

consumer not authorized to read item field means the presented grant does not cover the exact item#field. It deliberately does not reveal whether an ungranted item exists. grant verify answers whether a named consumer, action, item, field, and bearer match.

Recovery order#

Do not initialize over a missing-looking production path.
Identify the canonical vault and keyring before importing or migrating anything.
Prove a recovery key against the deterministic canary before an incident.
Use rotate-owner to rewrap current and historical ciphertext; copying a new public key into configuration is not rotation.