Generated from the Techstack v0.39.0 release (source
49677b729cb9). For an installed version, techstack api <command> --help is authoritative.techstack api workers approve
Approve pending worker.techstack api workers identity upgrade approve
Approve the key a legacy server proposed. Binds the pending key named bykey_thumbprint, which makes the worker key-bound (bearer-only requests are denied afterwards). Requires the owner and a fresh multi-factor sign-in (at most 300 seconds old). The approving subject and time are recorded with the identity and logged. 409 identity_upgrade_not_pending when no unexpired pending key has that fingerprint.
techstack api workers identity upgrade reject
Discard the key a legacy server proposed. The owner’s reset when the pending key is not the server’s own: the proposal is discarded and must be made again. Rotating the server credential ends the holder’s access to the bind endpoint.techstack api workers identity upgrade-status
Show whether a server still needs its identity key approved. For the owner of the worker.identity_binding=legacy_bearer with code=guard_identity_upgrade_required means the server authenticates with its bearer credential alone and is observe-only; pending carries the fingerprint of the key the server proposed, which the owner compares with the fingerprint the Guard logs on the server. A worker of another tenant or owner is 404.
techstack api workers identity upgrades
List the owner’s servers that wait for an identity key approval. For the owner. Each entry is a server of theirs that proposed a key and is observe-only until that exact key is approved withapproveWorkerIdentityUpgrade (fresh multi-factor sign-in required). Entries carry the hostname and the key fingerprint to compare with the one the Guard logs on the server. Listing grants nothing.
techstack api workers list
List registered workers (filtered by owner).techstack api workers outcomes list
List the unresolved operation outcomes of one kombify Guard. Lists the operations of an owned worker whose outcome is unknown: the kombify Guard recorded that the effect may or may not have happened and no observation settled it. Each one fences further changes on the server.state is reconciling while the Guard still tries to settle it and needs_operator once it stayed unresolved past the configured time (TECHSTACK_GUARD_OUTCOME_NEEDS_OPERATOR_AFTER, default 30 minutes). The time only changes how the outcome is shown; it never releases the fence. Another tenant’s or owner’s worker is 404.
techstack api workers outcomes resolve
Release an unresolved kombify Guard operation outcome. Commits an append-only operator resolution revision for an operation whose outcome is unknown and releases the worker’s fence.disposition is verified_applied (the effect is in place), verified_not_applied (nothing happened) or accept_unknown (release without a verified outcome); note records what was verified. The actor is the authenticated subject and is recorded with the revision; a Guard cannot commit these dispositions. A fresh multi-factor sign-in (at most 300 seconds old) is required. expected_revision must be the revision the list returned, otherwise 409 outcome_revision_stale. The body is decoded strictly: exact keys, no unknown fields.