stado credentials vault

Invocation

stado credentials vault <COMMAND>

Purpose

The Skarbiec vault: which one this machine resolves to (`show`), which the fleet holds (`list`), what one holds (`items`), and keeping copies in step with the owner (`sync`, `retire`). Every write and every authoritative read here goes through one file, and `show` says which; before it the answer lived in a discovery rule and one environment variable and surfaced only as a refusal.

Required inputs and options

This command has no command-specific inputs or options.

Output and state effect

This command group selects one of the subcommands listed below; use its exact child invocation to perform an operation.

Refusals

Before dispatch, Stado refuses a missing required token shown in the invocation, an unknown option, or a value outside a listed value set; argument-usage failures exit with code 2.

Subcommands

show — Report which vault this machine's credential operations resolve to, and why. Exits non-zero when nothing resolves, so a script can gate on it
list — Which Skarbiec vaults the fleet holds: every registry host, or one
items — Nonsecret item metadata (names, kinds, states, tags; never a field value) from one vault: a local VAULT file, or with `--host` the vault that host holds, read with the read-only `skarbiec list`
sync — Pull a host's Skarbiec mirror into its declared live vault, or with --push publish the vault owner's live vault to the mirror
retire — Retire one vault file on a machine that reads the vault owner and holds none: compare it with the owner item by item and report what the owner lacks; with --apply move those items onto the owner, prove the owner holds every live item of the copy, and only then remove the file