Search all skarbiec documentation

Direct diagnosis#

Run status for configured paths and non-sensitive counts.
Run key-doctor to compare vault recipients with locally available private keys.
Run verify-chain against the audit journal.
Run doctor for the combined vault, audit, endpoint, WORM receipt, and consumer-grant report. The grants check names a grant whose item was trashed, purged, or renamed away, and one naming a field the item's kind refuses outright, in the same words routes verify uses for a broken route.

Authorization refusal#

consumer not authorized to read item field means the presented grant does not cover the exact item#field. It deliberately does not reveal whether an ungranted item exists. grant verify answers whether a named consumer, action, item, field, and bearer match.

Recovery order#

Do not initialize over a missing-looking production path.
Identify the canonical vault and keyring before importing or migrating anything.
Prove a recovery key against the deterministic canary before an incident.
Use rotate-owner to rewrap current and historical ciphertext; copying a new public key into configuration is not rotation.