brain verify proves that the blocks match their hashes and
module roots. auth status also asks whether valid, authorized SSH signatures support the claimed head. A brain may
therefore be intact and still be unsigned, unpinned or signed by a key outside its trust root.
Vitruvio never reads a private key. Signing uses an Ed25519 key already offered by ssh-agent:
auth keys is the identifier accepted by --sign-with and auth sign.
Start governed
Governance must be in the genesis; it cannot be asserted retroactively over an existing history. The concise path synthesizes revision 1 from one or more agent keys, gives them every signing scope and associates them with the configured actor:--sign-with and set --govern-quorum 2 when two independent keys must approve a trust-root change. For
separate scopes or subjects, author a TOML or JSON TrustRoot document and pass --trust-root root.toml. The root
travels in the snapshot; the consumer pins its digest, not a mutable list maintained elsewhere.
Signing is always explicit:
auth trust-root is the human-readable governance inventory: the root digest and revision, consumer pin, quorum,
each public-key fingerprint, its canonical subject, scopes and whether it is active at the inspected snapshot. Pass
--snapshot to audit an earlier version. It prints an explicit ungoverned result when no root exists; an unsigned
ungoverned brain is not thereby corrupt.
Choosing between a governed and an ungoverned brain is the first decision of the onboarding; this page is what the governed choice commits you to afterwards.
Rotation and revocation
For a distributed rotation, create the exact document once, send that immutable plan to the quorum, collect detached records, and commit the same bytes:auth rotate --trust-root next-root.toml --sign-with .... auth revoke distinguishes
prospective retirement (--retired-from) from compromise at an already published snapshot
(--compromised-from); they are intentionally not interchangeable.