Genesis Mesh CLI

Command and option reference generated from the Click command tree. Workflow examples remain curated in the documentation.

Command Reference

Generated command and option metadata. Managed operations are listed here from the same Click command tree.

Command Description Options
genesis-mesh admin Run operator admin actions against the Network Authority. None
genesis-mesh admin invite Create a single-use invite token and print it.
  • --config - Config path.
  • --na - Network Authority URL.
  • --operator-key - Operator private key.
  • --operator-key-id - Operator key ID. default: operator-local
  • --role - Role to assign. default: ['client']
  • --validity-hours - Maximum certificate validity. default: 168
  • --token-expiry-hours - Invite validity. default: 24
  • --recipient-key - Bind the invite to this node public key; only that key may redeem it.
genesis-mesh admin revoke Revoke a certificate by ID.
  • --config - Config path.
  • --na - Network Authority URL.
  • --operator-key - Operator private key.
  • --operator-key-id - Operator key ID. default: operator-local
  • --reason - Revocation reason. default: unspecified
genesis-mesh admin revoke-operator-key Switch an operator key off immediately, without restarting the service.
  • --config - Config path.
  • --na - Network Authority URL.
  • --operator-key - Operator private key.
  • --operator-key-id - Operator key ID. default: operator-local
  • --reason - Revocation reason. default: unspecified
genesis-mesh atlas Trust graph exploration and evidence overlay. None
genesis-mesh atlas build Build a self-contained static Atlas from a recognition graph export.
  • --graph - Recognition graph JSON export path. default: Sentinel.UNSET
  • --output - Directory to write atlas.json and atlas.html. default: Sentinel.UNSET
  • --evidence - Directory of TrustEvidence JSON files to overlay.
  • --public-key - Issuer public key (base64) for evidence signature verification. Repeatable. default: Sentinel.UNSET
genesis-mesh atlas cache Pre-compute trust paths for all pairs and write a signed TrustPathCache.
  • --graph default: Sentinel.UNSET
  • --pairs - JSON file: [["from_id", "to_id"], ...] default: Sentinel.UNSET
  • --operator-sovereign default: Sentinel.UNSET
  • --path-ttl-seconds default: 300
  • --signing-key default: Sentinel.UNSET
  • --output default: Sentinel.UNSET
genesis-mesh atlas lookup Query a TrustPathCache for a (source -> target) trust path.
  • --cache default: Sentinel.UNSET
  • --from default: Sentinel.UNSET
  • --to default: Sentinel.UNSET
  • --format default: human
genesis-mesh atlas prune Apply a pruning policy to a graph and produce a signed audit export.
  • --graph default: Sentinel.UNSET
  • --policy - GraphPruningPolicy JSON (defaults to policy with 86400s expiry).
  • --operator-sovereign default: Sentinel.UNSET
  • --signing-key default: Sentinel.UNSET
  • --output-graph default: Sentinel.UNSET
  • --output-audit default: Sentinel.UNSET
genesis-mesh dev Run local developer workflows. None
genesis-mesh dev down Remove local development artifacts created by `genesis-mesh init`. None
genesis-mesh dev up Run the in-process local smoke workflow. None
genesis-mesh discover Discover registered agents on the Network Authority by capability.
  • --config - Config path.
  • --na - Network Authority URL (overrides config).
  • --capability - Filter to agents advertising this capability.
  • --format - Output format. default: table
genesis-mesh federation Review and bootstrap recognition between sovereigns. None
genesis-mesh federation bootstrap Review another sovereign and optionally issue a direct treaty.
  • --acceptor - Recognizing sovereign NA endpoint. default: Sentinel.UNSET
  • --issuer - Sovereign being recognized.
  • --issuer-bundle - Trust bundle for the sovereign being recognized.
  • --acceptor-config, --config - Config for acceptor admin signing.
  • --operator-key - Acceptor operator private key.
  • --operator-key-id - Acceptor operator key ID. default: operator-local
  • --role - Role accepted from issuer. default: ['role:service:maintainer']
  • --accepted-status - Accepted attestation status. default: ['active']
  • --claim - Treaty claim as key=value. Repeatable. default: Sentinel.UNSET
  • --validity-hours - Treaty validity window. default: 24
  • --evidence - Optional JSON evidence output path.
  • --dry-run - Review and preview without issuing a treaty. default: False
  • --yes - Issue treaty without interactive confirmation. default: False
  • --format - Output format. default: table
genesis-mesh fleet Generate and federate a fleet of Network Authorities. None
genesis-mesh fleet generate Scaffold a fleet of independent sovereigns plus a manifest.
  • --output - Directory for the generated fleet. default: fleet
  • --count - Number of NAs to generate (with --prefix). default: 0
  • --prefix - Name prefix when using --count (e.g. na -> na-1). default: na
  • --name - Explicit NA name. Repeatable; overrides --count. default: Sentinel.UNSET
  • --network-version - Network version for each sovereign. default: v0.1
  • --host - Bind host recorded in each config. default: 127.0.0.1
  • --base-port - Port of the first NA; incremented per NA. default: 8443
  • --na-valid-days - NA key validity in days. default: 90
  • --force - Overwrite an existing output directory. default: False
genesis-mesh fleet mesh Issue recognition treaties across every ordered pair (idempotent).
  • --config - Fleet manifest path. default: Sentinel.UNSET
  • --role - Role accepted across the mesh. Repeatable. default: Sentinel.UNSET
  • --validity-hours - Treaty validity window. default: 8760
  • --format default: table
genesis-mesh fleet status Show healthz/readyz for each NA in the fleet.
  • --config - Fleet manifest path. default: Sentinel.UNSET
  • --format default: table
genesis-mesh fleet verify Confirm a trust-path resolves across every ordered pair.
  • --config - Fleet manifest path. default: Sentinel.UNSET
  • --format default: table
genesis-mesh genesis Manage genesis blocks. None
genesis-mesh genesis create Create a new genesis block (unsigned).
  • --network-name - Network name (e.g., USG) default: Sentinel.UNSET
  • --network-version - Network version default: v0.1
  • --root-key - Path to root public key default: Sentinel.UNSET
  • --na-key - Path to NA public key default: Sentinel.UNSET
  • --na-valid-days - NA key validity in days default: 90
  • --anchor - Bootstrap anchor (id:endpoint) default: Sentinel.UNSET
  • --output - Output genesis block path default: Sentinel.UNSET
genesis-mesh genesis sign Sign a genesis block with Root Sovereign key.
  • --genesis - Path to unsigned genesis block default: Sentinel.UNSET
  • --root-private-key - Path to root private key default: Sentinel.UNSET
  • --key-id - Root key identifier default: rs-2025-q1
  • --output - Output signed genesis block path default: Sentinel.UNSET
genesis-mesh genesis verify Verify genesis block signatures.
  • --genesis - Path to signed genesis block default: Sentinel.UNSET
genesis-mesh info Display genesis block information.
  • --genesis - Path to signed genesis block default: Sentinel.UNSET
genesis-mesh init Create local keys, a signed genesis block, and CLI config.
  • --config - Config path to write.
  • --home - Directory for generated artifacts. default: .genesis-mesh
  • --network-name - Network name. default: USG
  • --network-version - Network version. default: v0.1
  • --na-endpoint - Network Authority URL. default: http://127.0.0.1:8443
  • --genesis-file - Signed genesis output path.
  • --na-private-key-file - Network Authority private key output path.
  • --operator-private-key-file - Operator private key output path.
  • --operator-public-key-file - Operator public key output path.
  • --db-path - Network Authority SQLite DB path to store in config.
  • --na-host - Network Authority bind host to store in config. default: 127.0.0.1
  • --na-port - Network Authority bind port to store in config. default: 8443
  • --anchor - Optional peer bootstrap anchor id:endpoint. Do not use the NA HTTP endpoint.
  • --force - Overwrite existing config and artifacts. default: False
genesis-mesh join Enroll this machine as a node and persist node config.
  • --config - Config path.
  • --na - Network Authority URL. default: Sentinel.UNSET
  • --token - Invite token. Required only for first enrollment.
  • --role - Requested local role. default: ['client']
  • --validity-hours - Requested certificate validity. default: 168
  • --persistent - Start the peer runtime after enrollment. default: False
  • --listen-host - Peer runtime bind host. default: 0.0.0.0
  • --listen-port - Peer runtime bind port. default: 0
  • --peer - Bootstrap peer endpoint (host:port or ws://host:port). Repeatable. default: Sentinel.UNSET
genesis-mesh keygen Generate cryptographic keys. None
genesis-mesh keygen network-authority Generate Network Authority keypair.
  • --output - Output path (without extension) default: Sentinel.UNSET
  • --key-id - Key identifier default: na-2025-q1
genesis-mesh keygen node Generate node identity keypair.
  • --output - Output path (without extension) default: Sentinel.UNSET
  • --key-id - Optional key identifier default: Sentinel.UNSET
genesis-mesh keygen root Generate Root Sovereign keypair (offline authority).
  • --output - Output path (without extension) default: Sentinel.UNSET
  • --key-id - Key identifier default: rs-2025-q1
genesis-mesh managed Managed sovereign backup, restore, and audit operations. None
genesis-mesh managed audit-export Export redacted Network Authority audit events.
  • --db-path - Network Authority SQLite database path. default: Sentinel.UNSET
  • --output - Destination audit export path. default: Sentinel.UNSET
  • --format - Audit export format. default: jsonl
  • --event-type - Optional event type filter.
genesis-mesh managed backup Create a consistent SQLite backup using SQLite's online backup API.
  • --db-path - Network Authority SQLite database path. default: Sentinel.UNSET
  • --output - Destination backup path. default: Sentinel.UNSET
genesis-mesh managed restore Restore a Network Authority database from a backup file.
  • --db-path - Network Authority SQLite database path to replace. default: Sentinel.UNSET
  • --backup - Backup database to restore from. default: Sentinel.UNSET
  • --pre-restore-backup - Optional destination for a copy of the current DB before restore.
  • --yes - Confirm the offline restore operation. default: False
genesis-mesh na Run Network Authority operations. None
genesis-mesh na start Start a local Network Authority server from config.
  • --config - Config path.
  • --host - Bind host.
  • --port - Bind port.
  • --db-path - SQLite database path.
genesis-mesh proof Run and clean sovereign proof workflows. None
genesis-mesh proof canary Run, sign, and record a continuous cross-sovereign trust cycle.
  • --acceptor - Recognizing sovereign NA endpoint. default: Sentinel.UNSET
  • --issuer - Subject/issuing sovereign NA endpoint. default: Sentinel.UNSET
  • --acceptor-operator-key default: Sentinel.UNSET
  • --acceptor-operator-key-id default: operator-local
  • --issuer-operator-key default: Sentinel.UNSET
  • --issuer-operator-key-id default: operator-local
  • --receipt-signing-key default: Sentinel.UNSET
  • --receipt-signing-key-id default: na-local
  • --receipt default: Sentinel.UNSET
  • --audit-db default: Sentinel.UNSET
genesis-mesh proof cleanup Remove only proof artifacts from a Network Authority database.
  • --db-path - Network Authority SQLite database path. default: Sentinel.UNSET
  • --backup-path - Explicit backup destination path.
  • --backup-dir - Directory for timestamped DB backup.
  • --yes - Confirm cleanup without an interactive prompt. default: False
  • --format - Output format. default: table
genesis-mesh proof inspect Inspect and validate a redacted sovereign proof bundle.
  • --proof-bundle - Redacted proof bundle JSON path. default: Sentinel.UNSET
  • --connectome - Optional Connectome JSON artifact to cross-check.
  • --format - Output format. default: table
genesis-mesh proof remote Run the attestation -> treaty -> revocation proof against two endpoints.
  • --acceptor - Recognizing sovereign NA endpoint. default: Sentinel.UNSET
  • --issuer - Subject/issuing sovereign NA endpoint. default: Sentinel.UNSET
  • --acceptor-config - Config for acceptor admin signing.
  • --issuer-config - Config for issuer admin signing.
  • --operator-key - Shared operator private key for both NAs.
  • --operator-key-id - Shared operator key ID. default: operator-local
  • --acceptor-operator-key - Acceptor operator private key.
  • --acceptor-operator-key-id - Acceptor operator key ID.
  • --issuer-operator-key - Issuer operator private key.
  • --issuer-operator-key-id - Issuer operator key ID.
  • --role - Attested role to prove. default: role:service:maintainer
  • --subject-id - Subject ID for the proof attestation.
  • --subject-public-key - Subject public key. default: proof-subject-public-key
  • --claim - Extra proof claim as key=value. Repeatable. default: Sentinel.UNSET
  • --validity-hours - Proof artifact validity window. default: 24
  • --proof-bundle - Optional JSON proof bundle output path.
  • --adoption-proof - Require external-operator evidence fields. default: False
  • --acceptor-operator-label - Human label for the acceptor operator. default: unspecified
  • --issuer-operator-label - Human label for the issuer operator. default: unspecified
  • --acceptor-operator-type - Relationship of the acceptor operator to Genesis Core. default: unknown
  • --issuer-operator-type - Relationship of the issuer operator to Genesis Core. default: unknown
  • --issuer-controls-keys - Issuer operator confirms they control their keys. default: False
  • --issuer-controls-infrastructure - Issuer operator confirms they control their infrastructure. default: False
  • --operator-assistance-note - Onboarding assistance note for the proof bundle. Repeatable. default: Sentinel.UNSET
genesis-mesh send Send a message to a node through a peer WebSocket connection.
  • --to - Recipient node public key. default: Sentinel.UNSET
  • --via - Peer WebSocket endpoint (ws://host:port). default: Sentinel.UNSET
  • --message - Message text to send. default: Sentinel.UNSET
  • --config - Config path.
genesis-mesh sovereign Inspect public sovereign metadata. None
genesis-mesh sovereign inspect Fetch operator-safe public trust material for a sovereign.
  • --na, --endpoint - Network Authority URL. default: Sentinel.UNSET
  • --format - Output format. default: table
genesis-mesh status Show Network Authority and node status from config.
  • --config - Config path.
genesis-mesh supply-chain Verify portable maintainer trust for CI and release gates. None
genesis-mesh supply-chain verify Allow or deny a maintainer action using portable sovereign trust.
  • --attestation - Membership attestation JSON issued by the maintainer sovereign. default: Sentinel.UNSET
  • --treaty - Recognition treaty JSON from the accepting sovereign. default: Sentinel.UNSET
  • --treaty-issuer-public-key - Base64 public key accepted for the treaty issuer. default: Sentinel.UNSET
  • --project-id - Expected supply-chain project ID. default: Sentinel.UNSET
  • --repository - Optional expected repository claim.
  • --delegated-role - Expected delegated role claim. default: release-maintainer
  • --role - Required role in the attestation. default: role:supply-chain:release-maintainer
  • --revocation-feed - Optional signed sovereign revocation feed JSON. Repeatable. default: Sentinel.UNSET
  • --min-feed-sequence - Reject feeds at or below this sequence as stale.
  • --proof-bundle - Optional redacted JSON audit output path.
  • --format - Output format for CI logs. default: text
genesis-mesh treaty Inspect and manage direct-recognition treaty lifecycle. None
genesis-mesh treaty inspect Inspect one treaty and its lifecycle state.
  • --na - Network Authority endpoint. default: Sentinel.UNSET
  • --format - Output format. default: table
genesis-mesh treaty list List treaties with lifecycle state and expiry risk.
  • --na - Network Authority endpoint. default: Sentinel.UNSET
  • --issuer-sovereign-id - Filter by treaty issuer sovereign.
  • --subject-sovereign-id - Filter by treaty subject sovereign.
  • --status - Filter by persisted treaty status.
  • --format - Output format. default: table
genesis-mesh treaty renew Create a new treaty from an existing treaty and retire the old one.
  • --na - Network Authority endpoint. default: Sentinel.UNSET
  • --validity-hours - New treaty validity window. default: 24
  • --config - Config for operator signing.
  • --operator-key - Operator private key.
  • --operator-key-id - Operator key ID. default: operator-local
  • --yes - Renew without interactive confirmation. default: False
genesis-mesh treaty replace Create a replacement treaty with updated scope and retire the old one.
  • --na - Network Authority endpoint. default: Sentinel.UNSET
  • --role - Replacement role. Repeatable. default: Sentinel.UNSET
  • --accepted-status - Accepted status. Repeatable. default: Sentinel.UNSET
  • --claim - Replacement claim as key=value. Repeatable. default: Sentinel.UNSET
  • --validity-hours - New treaty validity window. default: 24
  • --config - Config for operator signing.
  • --operator-key - Operator private key.
  • --operator-key-id - Operator key ID. default: operator-local
  • --yes - Replace without interactive confirmation. default: False
genesis-mesh treaty revoke Revoke a persisted treaty through existing admin semantics.
  • --na - Network Authority endpoint. default: Sentinel.UNSET
  • --reason - Revocation reason. default: unspecified
  • --config - Config for operator signing.
  • --operator-key - Operator private key.
  • --operator-key-id - Operator key ID. default: operator-local
  • --yes - Revoke without interactive confirmation. default: False
genesis-mesh trust Evaluate trust decisions and issue portable signed evidence. None
genesis-mesh trust agree Relationship Agreement — Offer / Counter-offer / Acceptance protocol. None
genesis-mesh trust agree accept Accept an Offer or Counter-offer, producing an AgreementRecord.
  • --offer - CapabilityOffer JSON. Required for direct acceptance or counter validation.
  • --counter - CapabilityCounter JSON. When present, offerer accepts the counter.
  • --graph - Responder's graph (required for direct acceptance only).
  • --signing-key - Accepting party's Ed25519 private key. default: Sentinel.UNSET
  • --key-id - Key identifier. default: na-local
  • --output - Output path for the AgreementRecord JSON. default: Sentinel.UNSET
genesis-mesh trust agree cosign Add a second party's signature to finalize a half-signed AgreementRecord.
  • --agreement - Half-signed AgreementRecord JSON (from 'trust agree accept --offer'). default: Sentinel.UNSET
  • --signing-key - Co-signer's Ed25519 private key. default: Sentinel.UNSET
  • --key-id - Key identifier. default: na-local
  • --output - Output path for the finalized dual-signed AgreementRecord JSON. default: Sentinel.UNSET
genesis-mesh trust agree counter Build and sign a CapabilityCounter (Step 2, optional).
  • --offer - Path to the signed CapabilityOffer JSON. default: Sentinel.UNSET
  • --capability - Capability to include in counter-offer (must be subset of offer). Repeatable. default: Sentinel.UNSET
  • --scope - JSON scope override. Defaults to offer scope.
  • --valid-from - Override capability window start.
  • --valid-until - Override capability window end. Defaults to offer terms valid_until.
  • --freshness-floor - Freshness sequence the responder commits to. Defaults to offer value.
  • --graph - Responder's recognition-graph export JSON. default: Sentinel.UNSET
  • --signing-key - Path to responder's Ed25519 private key. default: Sentinel.UNSET
  • --key-id - Key identifier. default: na-local
  • --output - Output path for signed counter-offer JSON. default: Sentinel.UNSET
genesis-mesh trust agree offer Build and sign a CapabilityOffer (Step 1 of Relationship Agreement).
  • --from - Offerer sovereign ID. default: Sentinel.UNSET
  • --to - Responder sovereign ID. default: Sentinel.UNSET
  • --capability - Capability identifier to request. Repeatable. default: Sentinel.UNSET
  • --scope - JSON object of scope constraints, e.g. '{"delegation": false}'. default: {}
  • --valid-from - Capability window start (ISO datetime). Defaults to now.
  • --valid-until - Capability window end (ISO datetime). default: Sentinel.UNSET
  • --freshness-floor - Minimum revocation-feed sequence the responder must guarantee. default: 0
  • --graph - Offerer's recognition-graph export JSON. default: Sentinel.UNSET
  • --signing-key - Path to offerer's Ed25519 private key. default: Sentinel.UNSET
  • --key-id - Key identifier. default: na-local
  • --offer-expires-hours - Hours from now before the offer expires (default: 24). default: 24
  • --output - Output path for signed offer JSON. default: Sentinel.UNSET
genesis-mesh trust agree verify Verify dual signatures + evidence on an AgreementRecord.
  • --agreement - Path to the AgreementRecord JSON. default: Sentinel.UNSET
  • --offerer-public-key - Offerer's public key: base64 or path to public key file. default: Sentinel.UNSET
  • --responder-public-key - Responder's public key: base64 or path to public key file. default: Sentinel.UNSET
  • --graph - Optional: recognition-graph export to enforce graph-digest binding.
  • --format - Output format. default: table
genesis-mesh trust attest Verifiable logic attestation — bind execution context to capabilities. None
genesis-mesh trust attest create Create a signed ModelAttestation declaring current execution context.
  • --agent-sovereign - Agent sovereign ID signing this attestation. default: Sentinel.UNSET
  • --model-id - Model identifier (e.g. "claude-sonnet-4-6"). default: Sentinel.UNSET
  • --model-version - Model version tag (e.g. "20251001"). default: Sentinel.UNSET
  • --system-prompt-file - Path to file containing the exact system prompt (UTF-8). default: Sentinel.UNSET
  • --tool-id - Tool ID available to the agent. Pass once per tool. default: Sentinel.UNSET
  • --token-id - Optional IBCT token_id to bind to this attestation.
  • --valid-for - Attestation validity in seconds (default 300). default: 300
  • --signing-key - Agent Ed25519 signing key file. default: Sentinel.UNSET
  • --output - Output path for the signed ModelAttestation JSON. default: Sentinel.UNSET
genesis-mesh trust attest policy Create a signed AttestationPolicy defining permitted execution contexts.
  • --operator-sovereign - Operator sovereign ID signing this policy. default: Sentinel.UNSET
  • --allow-model - Permitted model_id. Pass once per model. Empty = any model allowed. default: Sentinel.UNSET
  • --allow-prompt-hash - Permitted system_prompt_hash (hex). Pass once per hash. default: Sentinel.UNSET
  • --allow-tool-hash - Permitted tool_manifest_hash (hex). Pass once per hash. default: Sentinel.UNSET
  • --require-bound-token - Require attestation.token_id to be set. default: False
  • --valid-until - Policy validity end (ISO 8601, e.g. 2027-01-01T00:00:00Z). default: Sentinel.UNSET
  • --signing-key - Operator Ed25519 signing key file. default: Sentinel.UNSET
  • --output - Output path for the signed AttestationPolicy JSON. default: Sentinel.UNSET
genesis-mesh trust attest verify Verify a ModelAttestation against an AttestationPolicy.
  • --attestation - ModelAttestation JSON file. default: Sentinel.UNSET
  • --policy - AttestationPolicy JSON file. default: Sentinel.UNSET
  • --public-key - Agent public key (base64 string). Pass once per key. default: Sentinel.UNSET
  • --format - Output format. default: human
genesis-mesh trust consensus Distributed consensus authorization — K-of-N validator threshold (opt-in). None
genesis-mesh trust consensus assemble Assemble K-of-N ValidatorVotes into a signed ConsensusProof.
  • --proof - JustificationProof JSON being voted on. default: Sentinel.UNSET
  • --vote - ValidatorVote JSON files (supply once per vote). default: Sentinel.UNSET
  • --threshold - K: number of approvals required. default: Sentinel.UNSET
  • --validators - Comma-separated list of named validator sovereign IDs. default: Sentinel.UNSET
  • --signing-key - Assembler's signing key file. default: Sentinel.UNSET
  • --assembler - Assembler sovereign ID (key_id). default: Sentinel.UNSET
  • --valid-for - ConsensusProof validity in seconds (default 300). default: 300
  • --output - Output path for the signed ConsensusProof JSON. default: Sentinel.UNSET
genesis-mesh trust consensus assess-cascade Assess cascade risk on a set of ValidatorVotes without assembling a proof.
  • --vote - ValidatorVote JSON files to assess (supply once per vote). default: Sentinel.UNSET
  • --threshold - CascadeScore threshold above which assembly would be blocked. default: 0.4
  • --deliberation-seconds - Expected deliberation window in seconds (used for TCS). default: 30.0
  • --format - Output format. default: human
genesis-mesh trust consensus issue-identity Derive a short-lived EphemeralExecutionIdentity from a ConsensusProof.
  • --consensus - ConsensusProof JSON. default: Sentinel.UNSET
  • --bearer - Sovereign ID authorized to use this identity. default: Sentinel.UNSET
  • --cap - Allowed capability (supply once per cap). default: Sentinel.UNSET
  • --signing-key - Issuer's signing key file. default: Sentinel.UNSET
  • --issuer - Issuer sovereign ID. default: Sentinel.UNSET
  • --valid-for - Identity validity in seconds (default 120). default: 120
  • --output - Output path for the signed EphemeralExecutionIdentity JSON. default: Sentinel.UNSET
genesis-mesh trust consensus verify Verify a ConsensusProof signature and threshold.
  • --consensus - ConsensusProof JSON to verify. default: Sentinel.UNSET
  • --assembler-key - Base64-encoded Ed25519 public key(s) of the assembler. default: Sentinel.UNSET
  • --validator-key - Validator public keys as 'id:b64key' pairs. default: Sentinel.UNSET
  • --proof - Optional JustificationProof for cross-check.
  • --format - Output format. default: human
genesis-mesh trust consensus verify-identity Verify an EphemeralExecutionIdentity for a specific capability and bearer.
  • --identity - EphemeralExecutionIdentity JSON. default: Sentinel.UNSET
  • --issuer-key - Base64-encoded Ed25519 public key(s) of the issuer. default: Sentinel.UNSET
  • --capability - Capability to check access for. default: Sentinel.UNSET
  • --bearer - Expected bearer sovereign ID. default: Sentinel.UNSET
  • --format - Output format. default: human
genesis-mesh trust consensus vote Cast a signed validator vote on a JustificationProof.
  • --proof - JustificationProof JSON to vote on. default: Sentinel.UNSET
  • --validator - Sovereign ID of the validator casting this vote. default: Sentinel.UNSET
  • --approve, --reject - Cast an approval (default) or rejection. default: True
  • --reason - Optional vote reason string.
  • --signing-key - Validator's signing key file (base64 Ed25519). default: Sentinel.UNSET
  • --output - Output path for the signed ValidatorVote JSON. default: Sentinel.UNSET
genesis-mesh trust context Relationship Context — authorize a capability invocation under an Agreement. None
genesis-mesh trust context evaluate Run the BoundaryEngine on a ContextRecord and produce a signed BoundaryDecision.
  • --context - ContextRecord JSON to evaluate. default: Sentinel.UNSET
  • --agreement - AgreementRecord JSON. default: Sentinel.UNSET
  • --operator - Operator sovereign ID (signs the BoundaryDecision). default: Sentinel.UNSET
  • --signing-key - Operator's Ed25519 private key. default: Sentinel.UNSET
  • --key-id - Key identifier. default: na-local
  • --decision-valid-seconds - Seconds a positive decision is valid (default: 300). default: 300
  • --output - Output path for the signed BoundaryDecision JSON. default: Sentinel.UNSET
genesis-mesh trust context request Create a ContextRecord asserting a capability invocation request.
  • --agreement - AgreementRecord JSON this context is under. default: Sentinel.UNSET
  • --capability - Capability identifier to invoke (must be in agreed_terms.capabilities). default: Sentinel.UNSET
  • --requester - Requester sovereign ID. default: Sentinel.UNSET
  • --provider - Provider sovereign ID. default: Sentinel.UNSET
  • --params - JSON object of provider-defined request parameters. default: {}
  • --freshness-seq - Current revocation-feed sequence number (default: 0). default: 0
  • --output - Output path for the ContextRecord JSON. default: Sentinel.UNSET
genesis-mesh trust context verify Verify a BoundaryDecision's operator signature and expiry.
  • --decision - BoundaryDecision JSON to verify. default: Sentinel.UNSET
  • --operator-public-key - Operator public key (base64 or file). default: Sentinel.UNSET
  • --format - Output format. default: table
genesis-mesh trust data Data usage attestation — license policies, access intents, and records. None
genesis-mesh trust data intent Create a signed DataAccessIntent.
  • --agent-sovereign default: Sentinel.UNSET
  • --decision-id default: Sentinel.UNSET
  • --source - Source as 'id:type:owner[:tag1,tag2]' default: Sentinel.UNSET
  • --access-type default: Sentinel.UNSET
  • --volume-bytes
  • --valid-for-seconds default: 300
  • --signing-key default: Sentinel.UNSET
  • --output default: Sentinel.UNSET
genesis-mesh trust data policy Create a signed DataLicensePolicy.
  • --licensor-sovereign default: Sentinel.UNSET
  • --licensee-sovereign default: Sentinel.UNSET
  • --allow-source default: Sentinel.UNSET
  • --allow-access default: Sentinel.UNSET
  • --prohibit-tag default: Sentinel.UNSET
  • --max-volume-bytes
  • --valid-for-hours default: 24
  • --signing-key default: Sentinel.UNSET
  • --output default: Sentinel.UNSET
genesis-mesh trust data record Create a signed DataAccessRecord from a completed access.
  • --intent default: Sentinel.UNSET
  • --source - Source as 'id:type:owner[:tag1,tag2]' default: Sentinel.UNSET
  • --access-type default: Sentinel.UNSET
  • --volume-bytes
  • --signing-key default: Sentinel.UNSET
  • --output default: Sentinel.UNSET
genesis-mesh trust data verify Verify a DataAccessIntent against a DataLicensePolicy.
  • --intent default: Sentinel.UNSET
  • --policy default: Sentinel.UNSET
  • --public-key - Agent Ed25519 public key (base64). Pass once per key. default: Sentinel.UNSET
  • --format default: human
genesis-mesh trust decide Evaluate a trust decision between two sovereigns over a graph export.
  • --graph - Recognition-graph export JSON (from /trust/graph or `proof export-graph`). default: Sentinel.UNSET
  • --from - Source sovereign ID. default: Sentinel.UNSET
  • --to - Target sovereign ID. default: Sentinel.UNSET
  • --role - Role to check against treaty scope. Repeatable. default: Sentinel.UNSET
  • --format - Output format. default: table
genesis-mesh trust delegate Attenuable Delegation Chains — delegate rights from an AgreementRecord. None
genesis-mesh trust delegate cosign Add the delegate's signature and evidence to finalize a delegation.
  • --delegation - Half-signed DelegatedAgreementRecord JSON. default: Sentinel.UNSET
  • --graph - Delegate's recognition-graph export JSON. default: Sentinel.UNSET
  • --signing-key - Delegate's Ed25519 private key. default: Sentinel.UNSET
  • --key-id - Key identifier. default: na-local
  • --output - Output path for the finalized dual-signed DelegatedAgreementRecord JSON. default: Sentinel.UNSET
genesis-mesh trust delegate create Build and sign a DelegatedAgreementRecord (delegator's step).
  • --agreement - Root AgreementRecord JSON to delegate from.
  • --parent-delegation - Parent DelegatedAgreementRecord JSON (for chained delegation).
  • --from - Delegator's sovereign ID (must be a party in the parent record). default: Sentinel.UNSET
  • --to - Delegate's sovereign ID (party receiving authority). default: Sentinel.UNSET
  • --capability - Capability to delegate (must be subset of parent). Repeatable. default: Sentinel.UNSET
  • --scope - JSON scope override. Defaults to parent terms scope.
  • --valid-from - Delegated capability window start. Defaults to now.
  • --valid-until - Delegated capability window end (≤ parent expires_at). default: Sentinel.UNSET
  • --freshness-floor - Freshness commitment. Defaults to parent terms value.
  • --graph - Delegator's recognition-graph export JSON. default: Sentinel.UNSET
  • --signing-key - Delegator's Ed25519 private key. default: Sentinel.UNSET
  • --key-id - Key identifier. default: na-local
  • --output - Output path for the half-signed DelegatedAgreementRecord JSON. default: Sentinel.UNSET
genesis-mesh trust delegate verify Verify a full delegation chain from root AgreementRecord to terminal.
  • --agreement - Root AgreementRecord JSON. default: Sentinel.UNSET
  • --delegation - DelegatedAgreementRecord JSON(s) in chain order (root → terminal). Repeatable. default: Sentinel.UNSET
  • --offerer-public-key - Root agreement offerer public key (base64 or file). default: Sentinel.UNSET
  • --responder-public-key - Root agreement responder public key (base64 or file). default: Sentinel.UNSET
  • --key - sovereign_id:public_key_b64 pair for hop signature verification. Repeatable. default: Sentinel.UNSET
  • --format - Output format. default: table
genesis-mesh trust disclose Selective disclosure capability proofs (Merkle-based membership proofs). None
genesis-mesh trust disclose commit Build and sign a Merkle commitment over an agreement's capabilities.
  • --agreement - Path to AgreementRecord JSON. default: Sentinel.UNSET
  • --signing-key - Base64-encoded Ed25519 signing key file. default: Sentinel.UNSET
  • --output - Path to write the signed CapabilityCommitment JSON. default: Sentinel.UNSET
  • --issuer - Sovereign ID of the commitment issuer. default: Sentinel.UNSET
genesis-mesh trust disclose nullify Issue a single-use nullifier for a capability proof.
  • --proof - Path to CapabilityMembershipProof JSON. default: Sentinel.UNSET
  • --signing-key - Base64-encoded Ed25519 signing key file. default: Sentinel.UNSET
  • --prover - Sovereign ID of the nullifier issuer. default: Sentinel.UNSET
  • --valid-for - Nullifier validity in seconds (default 60). default: 60
  • --output - Path to write the CapabilityNullifier JSON. default: Sentinel.UNSET
genesis-mesh trust disclose prove Generate a Merkle membership proof for one capability.
  • --capability - The single capability to prove membership for. default: Sentinel.UNSET
  • --agreement - Path to AgreementRecord JSON (full capability set, kept local). default: Sentinel.UNSET
  • --commitment - Path to the signed CapabilityCommitment JSON. default: Sentinel.UNSET
  • --prover - Sovereign ID of the prover. default: Sentinel.UNSET
  • --output - Path to write the CapabilityMembershipProof JSON. default: Sentinel.UNSET
genesis-mesh trust disclose verify Verify a CapabilityMembershipProof against its commitment.
  • --proof - Path to CapabilityMembershipProof JSON. default: Sentinel.UNSET
  • --commitment - Path to CapabilityCommitment JSON. default: Sentinel.UNSET
  • --verify-key - Base64-encoded Ed25519 public key(s) of the commitment issuer. default: Sentinel.UNSET
  • --format - Output format. default: human
genesis-mesh trust discover Sovereign overlay discovery — DNS-free peer announcement and lookup. None
genesis-mesh trust discover announce Create and sign a sovereign overlay discovery record.
  • --sovereign-id default: Sentinel.UNSET
  • --na-public-key - Ed25519 public key (base64) of this sovereign's NA. default: Sentinel.UNSET
  • --endpoint - Reachable endpoint (pass once per endpoint). default: Sentinel.UNSET
  • --capabilities-hash - SHA-256 of the sovereign's capability manifest hash. default: Sentinel.UNSET
  • --sequence-no default: 1
  • --valid-for-hours default: 24
  • --signing-key default: Sentinel.UNSET
  • --output default: Sentinel.UNSET
genesis-mesh trust discover feed Build a signed DiscoveryFeed from one or more record files.
  • --record - OverlayDiscoveryRecord JSON file (pass once per record). default: Sentinel.UNSET
  • --operator-sovereign default: Sentinel.UNSET
  • --valid-for-hours default: 6
  • --signing-key default: Sentinel.UNSET
  • --output default: Sentinel.UNSET
genesis-mesh trust discover merge Merge incoming discovery records into a local cache file.
  • --cache - Existing cache JSON file (need not exist for first run). default: Sentinel.UNSET
  • --incoming - Incoming OverlayDiscoveryRecord JSON file. default: Sentinel.UNSET
  • --output default: Sentinel.UNSET
genesis-mesh trust discover verify Verify a signed OverlayDiscoveryRecord.
  • --record default: Sentinel.UNSET
  • --known-sequence-no
  • --format default: human
genesis-mesh trust evidence Evaluate trust and emit a signed TrustEvidence record.
  • --graph - Recognition-graph export JSON used for the decision. default: Sentinel.UNSET
  • --from - Source sovereign ID. default: Sentinel.UNSET
  • --to - Target sovereign ID. default: Sentinel.UNSET
  • --role - Role to check against treaty scope. Repeatable. default: Sentinel.UNSET
  • --issuer-sovereign - Sovereign ID signing this evidence. default: Sentinel.UNSET
  • --signing-key - Path to the issuer Ed25519 private key. default: Sentinel.UNSET
  • --key-id - Key identifier recorded in the evidence signature. default: na-local
  • --output - Output path for the signed TrustEvidence JSON. default: Sentinel.UNSET
  • --format - Console summary format. default: table
genesis-mesh trust execution Execution Evidence — record and verify tamper-evident execution chains. None
genesis-mesh trust execution record Create and sign an ExecutionEvidence record.
  • --decision - BoundaryDecision JSON that authorized this execution. default: Sentinel.UNSET
  • --capability - Capability identifier that was executed. default: Sentinel.UNSET
  • --executor - Executor sovereign ID. default: Sentinel.UNSET
  • --outcome - Execution outcome. default: success
  • --outcome-detail - Optional human-readable outcome detail.
  • --params - JSON object of execution parameters. default: {}
  • --sequence - Sequence number (1-based, must increment by 1 within a decision). default: Sentinel.UNSET
  • --prior - Path to the prior ExecutionEvidence JSON (for chain linking).
  • --signing-key - Executor's Ed25519 private key. default: Sentinel.UNSET
  • --key-id - Key identifier. default: na-local
  • --output - Output path for the signed ExecutionEvidence JSON. default: Sentinel.UNSET
genesis-mesh trust execution verify Verify a chain of ExecutionEvidence records.
  • --decision-id - Expected BoundaryDecision ID for all records in the chain. default: Sentinel.UNSET
  • --evidence - ExecutionEvidence JSON files in chain order (seq 1, 2, 3, ...). Repeatable. default: Sentinel.UNSET
  • --key - sovereign_id:public_key_b64 pair for executor verification. Repeatable. default: Sentinel.UNSET
  • --expected-capability - If set, all records must execute this capability.
  • --format - Output format. default: table
genesis-mesh trust freshness Freshness Proofs — issue and verify bounded-latency revocation attestations. None
genesis-mesh trust freshness issue Issue a signed FreshnessProof for a revocation feed.
  • --feed-sovereign - Sovereign whose revocation feed is being attested. default: Sentinel.UNSET
  • --feed-sequence - Current feed sequence number. default: Sentinel.UNSET
  • --feed-digest - SHA-256 hex of feed state. Omit to use a placeholder digest.
  • --issuer-sovereign - Issuer sovereign ID. default: Sentinel.UNSET
  • --valid-for - Proof validity window in seconds (default 300). default: 300
  • --signing-key - Issuer's Ed25519 private key. default: Sentinel.UNSET
  • --key-id - Key identifier. default: na-local
  • --output - Output path for the signed FreshnessProof JSON. default: Sentinel.UNSET
genesis-mesh trust freshness verify Verify a FreshnessProof.
  • --proof - Path to the FreshnessProof JSON. default: Sentinel.UNSET
  • --issuer-key - Issuer public key (base64 or path). Repeatable. default: Sentinel.UNSET
  • --required-sequence - Minimum feed_sequence needed. default: Sentinel.UNSET
  • --at-time - ISO 8601 UTC timestamp to check expiry against (default: now).
  • --format - Output format. default: table
genesis-mesh trust guard GenesisGuard — process-level execution mediation sidecar. None
genesis-mesh trust guard request Submit an ExecutionMediationRequest to a running GenesisGuard daemon.
  • --capability default: Sentinel.UNSET
  • --decision default: Sentinel.UNSET
  • --token - The agent's signed InvocationToken. Required: the guard will not mediate a request that does not carry one.
  • --command - Subprocess command (pass once per arg). default: Sentinel.UNSET
  • --allow-env - Env var key to allow in subprocess. default: Sentinel.UNSET
  • --signing-key default: Sentinel.UNSET
  • --socket-host default: 127.0.0.1
  • --socket-port default: Sentinel.UNSET
  • --output default: Sentinel.UNSET
genesis-mesh trust guard start Start GenesisGuard daemon (foreground; Ctrl-C to stop).
  • --guard-sovereign default: Sentinel.UNSET
  • --signing-key default: Sentinel.UNSET
  • --port default: 0
  • --host default: 127.0.0.1
  • --token-issuer-key - Invocation-token issuer key as issuer-id=base64-public-key or issuer-id=path. Repeatable. Required to mediate any request. default: Sentinel.UNSET
  • --command-allowlist - Allowed command line (pass once per command). Matched against the whole command, not the program name. End an entry with '...' to allow a variable tail, e.g. 'python /opt/report.py ...'. default: Sentinel.UNSET
genesis-mesh trust guard verify Verify a signed MediatedExecutionReceipt.
  • --receipt default: Sentinel.UNSET
  • --guard-key - Guard's Ed25519 public key (base64). default: Sentinel.UNSET
  • --format default: human
genesis-mesh trust integrity Context-injection defense — commit and verify execution context. None
genesis-mesh trust integrity commit Commit to a base context before execution begins.
  • --agent-sovereign - Agent sovereign ID signing this record. default: Sentinel.UNSET
  • --decision-id - BoundaryDecision ID this commitment belongs to. default: Sentinel.UNSET
  • --system-prompt-file - Path to the system prompt file (UTF-8). default: Sentinel.UNSET
  • --max-turns - Maximum number of user/assistant turns expected (default 20). default: 20
  • --max-tool-results - Maximum number of tool result turns expected (default 50). default: 50
  • --max-total-tokens - Hard token cap for the entire execution (default 8192). default: 8192
  • --valid-for - Commitment validity in seconds (default 600). default: 600
  • --signing-key - Agent Ed25519 signing key file. default: Sentinel.UNSET
  • --output - Output path for the signed ContextIntegrityRecord JSON. default: Sentinel.UNSET
genesis-mesh trust integrity verify Verify final context matches the committed base plus declared segments.
  • --record - ContextIntegrityRecord JSON file. default: Sentinel.UNSET
  • --final-context - ContextTree JSON representing the final execution context. default: Sentinel.UNSET
  • --segment - JSON string for each observed ContextAppendSegment. Pass once per segment. default: Sentinel.UNSET
  • --public-key - Agent public key (base64). Pass once per key. default: Sentinel.UNSET
  • --format - Output format. default: human
genesis-mesh trust interop Interop bridges — convert GM records to SPIFFE, W3C VC, and JWT formats. None
genesis-mesh trust interop to-jwt Convert a BoundaryDecision to a signed EdDSA JWT.
  • --decision - BoundaryDecision JSON to encode as JWT. default: Sentinel.UNSET
  • --signing-key - Ed25519 private key for JWT signature. default: Sentinel.UNSET
  • --key-id - JWT key ID (kid header). default: gm-bridge
  • --output - Output path for the JWT string. default: Sentinel.UNSET
genesis-mesh trust interop to-spiffe Convert an AgreementRecord to a SPIFFE SVID-like JSON.
  • --agreement - AgreementRecord JSON to convert. default: Sentinel.UNSET
  • --output - Output path for the SVID-like JSON. default: Sentinel.UNSET
genesis-mesh trust interop to-vc Convert an AgreementRecord or TrustEvidence to a W3C Verifiable Credential.
  • --agreement - AgreementRecord JSON to convert.
  • --evidence - TrustEvidence JSON to convert.
  • --output - Output path for the VC JSON. default: Sentinel.UNSET
genesis-mesh trust justify Sign and verify Justification Proofs for BoundaryEngine decisions. None
genesis-mesh trust justify sign Sign a GateTrace into a JustificationProof.
  • --decision - Path to the signed BoundaryDecision JSON. default: Sentinel.UNSET
  • --trace - Path to the GateTrace JSON. default: Sentinel.UNSET
  • --signing-key - Path to the operator Ed25519 private key. default: Sentinel.UNSET
  • --key-id - Key identifier recorded in the proof signature. default: operator
  • --output - Output path for the signed JustificationProof JSON. default: Sentinel.UNSET
genesis-mesh trust justify verify Verify the signature on a JustificationProof.
  • --proof - Path to the signed JustificationProof JSON. default: Sentinel.UNSET
  • --verify-key - Issuer public key: base64 string or path to a public key file. default: Sentinel.UNSET
  • --decision - Optional BoundaryDecision JSON to cross-check decision_id and gate counts.
  • --format - Output format. default: table
genesis-mesh trust oversight Human Oversight — evaluate policies, propose, approve, and verify high-stakes actions. None
genesis-mesh trust oversight approve Human custodian approves a HumanApprovalRequest.
  • --request - Path to the signed HumanApprovalRequest JSON. default: Sentinel.UNSET
  • --policy - Path to the HumanOversightPolicy JSON. default: Sentinel.UNSET
  • --signing-key - Human custodian Ed25519 private key. default: Sentinel.UNSET
  • --key-id - Key identifier in the commitment signature. default: human
  • --note - Optional approval note.
  • --commitment-valid-for - Commitment validity seconds (default: 600). default: 600
  • --output - Output path for the DualSignedCommitment JSON. default: Sentinel.UNSET
genesis-mesh trust oversight evaluate Evaluate a HumanOversightPolicy against a proposed action.
  • --policy - Path to the HumanOversightPolicy JSON. default: Sentinel.UNSET
  • --action - Path to the proposed action JSON (must include 'capability' key). default: Sentinel.UNSET
  • --requester - Requesting sovereign ID. default: Sentinel.UNSET
  • --recent-count - Recent action count (for frequency_limit check). default: 0
  • --anomaly - Set the anomaly flag (forces block). default: False
  • --format - Output format. default: table
genesis-mesh trust oversight propose Sign and emit a HumanApprovalRequest for a high-stakes action.
  • --policy - Path to the HumanOversightPolicy JSON. default: Sentinel.UNSET
  • --action - Path to the proposed action JSON. default: Sentinel.UNSET
  • --requester - Requesting sovereign ID. default: Sentinel.UNSET
  • --signing-key - Agent Ed25519 private key. default: Sentinel.UNSET
  • --key-id - Key identifier in the request signature. default: agent
  • --approval-window - Seconds the human has to approve (default: 300). default: 300
  • --recent-count default: 0
  • --anomaly default: False
  • --output - Output path for the signed HumanApprovalRequest JSON. default: Sentinel.UNSET
genesis-mesh trust oversight reject Human custodian rejects a HumanApprovalRequest.
  • --request - Path to the signed HumanApprovalRequest JSON. default: Sentinel.UNSET
  • --policy - Path to the HumanOversightPolicy JSON. default: Sentinel.UNSET
  • --signing-key - Human custodian Ed25519 private key. default: Sentinel.UNSET
  • --key-id default: human
  • --note - Optional rejection note.
  • --output - Output path for the HumanApprovalResponse JSON. default: Sentinel.UNSET
genesis-mesh trust oversight verify Verify both signatures on a DualSignedCommitment.
  • --commitment - Path to the DualSignedCommitment JSON. default: Sentinel.UNSET
  • --agent-key - Agent public key: base64 string or path to file. default: Sentinel.UNSET
  • --human-key - Human custodian public key: base64 string or path to file. default: Sentinel.UNSET
  • --request - Optional HumanApprovalRequest JSON to cross-check request_id.
  • --format - Output format. default: table
genesis-mesh trust privacy Communication privacy — normalize outbound message metadata. None
genesis-mesh trust privacy apply Apply a privacy profile to a payload and headers, producing a MetadataEnvelope.
  • --payload - Payload file to normalize. default: Sentinel.UNSET
  • --headers - JSON file containing headers dict (optional).
  • --profile - CommunicationPrivacyProfile JSON file. default: Sentinel.UNSET
  • --signing-key - Ed25519 signing key file. default: Sentinel.UNSET
  • --output-envelope - Output path for the signed MetadataEnvelope JSON. default: Sentinel.UNSET
  • --output-payload - Output path for the normalized payload bytes. default: Sentinel.UNSET
genesis-mesh trust privacy profile Create a signed CommunicationPrivacyProfile.
  • --sovereign-id - Sovereign ID this profile belongs to. default: Sentinel.UNSET
  • --bucket-seconds - Timestamp bucket size in seconds (default 5). default: 5
  • --block-bytes - Message length padding block size in bytes (default 256). default: 256
  • --allow-header - Header key to retain (beyond GM-required). Pass once per key. default: Sentinel.UNSET
  • --no-strip-headers - Disable header stripping. default: False
  • --no-normalize-timestamps - Disable timestamp bucketing. default: False
  • --no-normalize-length - Disable message length normalization. default: False
  • --signing-key - Ed25519 signing key file. default: Sentinel.UNSET
  • --output - Output path for the CommunicationPrivacyProfile JSON. default: Sentinel.UNSET
genesis-mesh trust privacy scan List header keys that would be stripped by the privacy profile.
  • --headers - JSON file containing headers dict to inspect. default: Sentinel.UNSET
  • --profile - CommunicationPrivacyProfile JSON file. default: Sentinel.UNSET
  • --format - Output format. default: human
genesis-mesh trust purge Ephemeral identity purge protocol — verifiable deletion of expired identities. None
genesis-mesh trust purge prove Generate a Merkle inclusion proof for a NullificationReceipt.
  • --receipt-id - receipt_id of the receipt to prove. default: Sentinel.UNSET
  • --receipts-file - JSON array of NullificationReceipts (same order used in register). default: Sentinel.UNSET
  • --registry - NullificationRegistryRoot JSON. default: Sentinel.UNSET
  • --output - Output path for the NullificationInclusionProof JSON. default: Sentinel.UNSET
genesis-mesh trust purge receipt Create a signed NullificationReceipt for an expired EphemeralExecutionIdentity.
  • --identity - EphemeralExecutionIdentity JSON file to purge. default: Sentinel.UNSET
  • --purging-sovereign - Sovereign ID performing the purge. default: Sentinel.UNSET
  • --signing-key - Ed25519 signing key file. default: Sentinel.UNSET
  • --output - Output path for the signed NullificationReceipt JSON. default: Sentinel.UNSET
genesis-mesh trust purge register Batch NullificationReceipts into a signed Merkle registry root.
  • --receipt - NullificationReceipt JSON file. Pass once per receipt. default: Sentinel.UNSET
  • --operator-sovereign - Operator sovereign ID signing the registry. default: Sentinel.UNSET
  • --signing-key - Ed25519 signing key file. default: Sentinel.UNSET
  • --output - Output path for the signed NullificationRegistryRoot JSON. default: Sentinel.UNSET
  • --output-receipts - Optional: output path for the ordered receipts list JSON (for proof generation).
genesis-mesh trust purge verify Verify a Merkle inclusion proof against a NullificationRegistryRoot.
  • --proof - NullificationInclusionProof JSON. default: Sentinel.UNSET
  • --registry - NullificationRegistryRoot JSON. default: Sentinel.UNSET
  • --receipt - NullificationReceipt JSON for the claimed receipt_id. default: Sentinel.UNSET
  • --public-key - Operator public key (base64). Pass once per key. default: Sentinel.UNSET
  • --format - Output format. default: human
genesis-mesh trust risk Peer risk signals — local EWMA over execution history (not a reputation system). None
genesis-mesh trust risk assess-seed Assess whether a counterparty's update history matches adversarial seed patterns.
  • --signal - PeerRiskSignal JSON file. default: Sentinel.UNSET
  • --history - RiskSignalUpdate JSON files (pass once per update). default: Sentinel.UNSET
  • --seed-threshold - Seed probability threshold for isolation (default 0.5). default: 0.5
  • --format - Output format. default: human
genesis-mesh trust risk create Create a new signed PeerRiskSignal for a counterparty.
  • --from-sovereign - Sovereign ID of the signal owner. default: Sentinel.UNSET
  • --to-sovereign - Sovereign ID of the counterparty being observed. default: Sentinel.UNSET
  • --signing-key - Base64-encoded Ed25519 signing key file. default: Sentinel.UNSET
  • --initial-signal - Starting signal value in [0.0, 1.0] (default 0.5). default: 0.5
  • --alpha - EWMA smoothing factor (default 0.2). default: 0.2
  • --decay-lambda - Exponential decay rate per day (default 0.05). default: 0.05
  • --output - Output path for the signed PeerRiskSignal JSON. default: Sentinel.UNSET
genesis-mesh trust risk decay Apply time decay to a PeerRiskSignal without a new evidence update.
  • --signal - Current PeerRiskSignal JSON. default: Sentinel.UNSET
  • --signing-key - Signal owner's signing key file. default: Sentinel.UNSET
  • --output - Output path for the decayed PeerRiskSignal JSON. default: Sentinel.UNSET
genesis-mesh trust risk show Display current PeerRiskSignal state.
  • --signal - PeerRiskSignal JSON to display. default: Sentinel.UNSET
  • --format - Output format. default: human
genesis-mesh trust risk update Update a PeerRiskSignal from an ExecutionEvidence outcome.
  • --signal - Current PeerRiskSignal JSON. default: Sentinel.UNSET
  • --evidence - ExecutionEvidence JSON providing the outcome. default: Sentinel.UNSET
  • --signing-key - Signal owner's signing key file. default: Sentinel.UNSET
  • --output - Output path for the updated PeerRiskSignal JSON. default: Sentinel.UNSET
  • --output-update - Optional path to write the RiskSignalUpdate JSON.
  • --output-anomaly - Optional path to write a RiskAnomaly JSON if one is detected.
genesis-mesh trust token Invocation-Bound Capability Tokens — issue, verify, and record usage. None
genesis-mesh trust token issue Issue a signed Invocation-Bound Capability Token (IBCT).
  • --agreement - AgreementRecord JSON that grants the capabilities. default: Sentinel.UNSET
  • --bearer - Sovereign ID that will use the token. default: Sentinel.UNSET
  • --caps - Comma-separated capability identifiers to grant. default: Sentinel.UNSET
  • --signing-key - Issuer's Ed25519 private key. default: Sentinel.UNSET
  • --key-id - Key identifier for the signature. default: na-local
  • --valid-for - Token lifetime in seconds (default 300). default: 300
  • --max-invocations - Budget cap: maximum number of allowed uses. Omit for unlimited.
  • --constraint - Policy constraint string. Repeatable. Supported: not_before:ISO8601, peer_sovereign:sovereign_id default: Sentinel.UNSET
  • --delegation - DelegatedAgreementRecord JSON when the token is derived from a delegation.
  • --output - Output path for the signed InvocationToken JSON. default: Sentinel.UNSET
genesis-mesh trust token record-use Record a single token invocation.
  • --token - InvocationToken JSON for this use. default: Sentinel.UNSET
  • --action - Short label for the invoked action. default: Sentinel.UNSET
  • --outcome - Outcome of the invocation. default: success
  • --signing-key - Bearer's Ed25519 private key. default: Sentinel.UNSET
  • --key-id - Key identifier for the signature. default: na-local
  • --prior - Prior InvocationUseRecord JSON for use-chain linking.
  • --output - Output path for the signed InvocationUseRecord JSON. default: Sentinel.UNSET
genesis-mesh trust token verify Verify an InvocationToken for a specific capability invocation.
  • --token - InvocationToken JSON to verify. default: Sentinel.UNSET
  • --verify-key - Issuer public key: base64 string or path to a public key file. default: Sentinel.UNSET
  • --capability - Capability the bearer wants to invoke. default: Sentinel.UNSET
  • --bearer - Claimed bearer sovereign ID. default: Sentinel.UNSET
  • --use-record - InvocationUseRecord JSON files (for budget checking). Repeatable. default: Sentinel.UNSET
  • --format default: table
genesis-mesh trust verify-evidence Verify the signature on a TrustEvidence record.
  • --evidence - Path to the signed TrustEvidence JSON. default: Sentinel.UNSET
  • --public-key - Issuer public key: base64 string or path to a public key file. default: Sentinel.UNSET
  • --graph - Optional: graph export to enforce graph-digest binding.
  • --format - Output format. default: table
genesis-mesh trust-bundle Export, inspect, and validate public sovereign trust bundles. None
genesis-mesh trust-bundle export Export public sovereign trust material into one JSON bundle.
  • --na - Network Authority endpoint. default: Sentinel.UNSET
  • --output - Bundle output path. default: Sentinel.UNSET
  • --include-revocation-feed, --no-include-revocation-feed - Include the public sovereign revocation feed. default: True
  • --format - Output format. default: table
genesis-mesh trust-bundle import Import a bundle into local review evidence without granting trust.
  • --bundle - Bundle JSON path. default: Sentinel.UNSET
  • --na - Optional live NA endpoint to compare against.
  • --output - Optional review receipt output path.
  • --format - Output format. default: table
genesis-mesh trust-bundle inspect Inspect a trust bundle without contacting a Network Authority.
  • --bundle - Bundle JSON path. default: Sentinel.UNSET
  • --format - Output format. default: table
genesis-mesh trust-bundle validate Validate trust bundle structure and optional live endpoint consistency.
  • --bundle - Bundle JSON path. default: Sentinel.UNSET
  • --na - Optional live NA endpoint to compare against.
  • --format - Output format. default: table
No CLI commands match the current search.