vilice authorize

vilice authorize — Admit a named actor at a scope

Admits a named actor by writing one forced-command line into vilice's
authorized_keys. The key is the identity and the forced command is the
scope; there is no token to store and no shell to reach.

Scopes form a ladder — a higher one grants those below it:

  observe   read the record: status, logs, verify, record
  operate   deploy and lifecycle
  grant     mint and revoke keys, and nothing else

No scope is a shell. A key that sends no command is refused, which is
what makes the record complete: nothing acts on this box without an
entry being written first. If you want a real shell, use your own
account — that is a different named actor with its own trail.

authorized_keys is the rights ledger. Read it and you see every actor
and its ceiling. vilice actors reads it back.

Usage:
  vilice authorize <pubkey> --client <name> --scope <observe|operate|grant>

Flags:
  --client <name>  The actor's name. This is what lands in the record.
  --scope <scope>  observe, operate, or grant. (ssh is the retired name for
                   the top rung and still reads as grant.)

Examples:
  Admit the console so it can deploy.
    vilice authorize "$(cat console.pub)" --client console --scope operate

  Let a CI job read the record and nothing more.
    vilice authorize "$(cat ci.pub)" --client ci --scope observe

Scope:  grant — the top rung; mints and revokes keys. No scope grants a shell
Record: written before the command runs