diff --git a/.auths/ci-bundle.json b/.auths/ci-bundle.json
index 50cb4d680..d91a36459 100644
--- a/.auths/ci-bundle.json
+++ b/.auths/ci-bundle.json
@@ -1,426 +1,137 @@
 {
-  "identity_did": "did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-  "public_key_hex": "03319793ee258fcf8fd518d8224bd39d381a004b586c84a63cc3a1be018477088f",
+  "identity_did": "did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b",
+  "public_key_hex": "023d45d337ebc9e39b790a22b458605781cd58a1786295e4bfef3b496a24d62d4c",
   "curve": "p256",
   "attestation_chain": [
     {
       "version": 1,
       "rid": ".auths",
-      "issuer": "did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "subject": "did:keri:EFBGdabu4x82TD_Wn9gI3qUpDjnK3idAz4qLRS2YmdQy",
+      "issuer": "did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b",
+      "subject": "did:keri:EJDqDJ7WkayddxOv4aP1c9ny3tyjWjSgguX2gCiVsKdf",
       "device_public_key": {
         "curve": "p256",
-        "key": "02f0b52b1829bb0a848dcfc7eec67d21bc032fdad711815c222363f7b9ff932800"
+        "key": "02a0f2201768ccf5a9679a0757eefe12b2995a9250954ff59b19967e3fed07a81e"
       },
-      "identity_signature": "ba82e88fd4da085bfb20122b3069ae7fce97e2618e32891e8f4f4e72a402d684e2a0a7f8cec16d1ed8e38a61291a547b2fbeabdaa799b1912624d107b7f59f8b",
-      "device_signature": "c9a04a5135642bb87804d24c27b2d50b51bd8aea22b99cfb5453e4db264dd24857404c44fead4ae13247e60ad83602bf407b31949f20c1977eee02acc4470547",
-      "expires_at": "2026-08-17T15:23:20Z",
-      "timestamp": "2026-07-18T15:23:24.735834Z",
+      "identity_signature": "db08d9e56557665e943907d4abe700393f59d2a3ecd0684cc48995e25dd36b6520dc2ca8eda1f5bfd9a4699884255e7d91d5ed8724b94575215ce9e0b59873d7",
+      "device_signature": "8c2fdc72fa7d422984cd9562af27ab44168c1169c91d7fbf664015e1616f636456a4855cb90a1b03ea2c517d2ac4bca251cab02ca24ab477d7a13ff01285a78e",
+      "timestamp": "2026-07-23T21:32:15.358487Z",
       "signer_type": "Agent"
-    },
-    {
-      "version": 1,
-      "rid": ".auths",
-      "issuer": "did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "subject": "did:key:zDnaekzsT4o4uSTMuQjKGKTcCvV6CdHUkkTYfcwCFZSZpsbtz",
-      "device_public_key": {
-        "curve": "p256",
-        "key": "03319793ee258fcf8fd518d8224bd39d381a004b586c84a63cc3a1be018477088f"
-      },
-      "identity_signature": "d32b80901ccd3f68f013144783768245a53ae144f1ba134731893b3385fa15adbffc4b2d05c7c104e4a9002f9364daade9710c10b20b37c302cc2341dd464c06",
-      "device_signature": "56441005f93c89afa5d817f07ae8b85ae9d25c12956ffe5f4f3a33e1ba603b66c785a33f3862ba1db503287190027af0d07794107f1a1a218b0ef822cfac3754",
-      "timestamp": "2026-06-19T14:18:34.160482Z",
-      "note": "Linked by auths-sdk setup"
     }
   ],
   "kel": [
     {
       "v": "KERI10JSON00012f_",
       "t": "icp",
-      "d": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "d": "EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b",
+      "i": "EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b",
       "s": "0",
       "kt": "1",
       "k": [
-        "1AAJAzGXk-4lj8-P1RjYIkvTnTgaAEtYbISmPMOhvgGEdwiP"
+        "1AAJAj1F0zfryeObeQoitFhgV4HNWKF4YpXkv-87SWok1i1M"
       ],
       "nt": "1",
       "n": [
-        "EGPZRt46kODI9PChbjPRnNxPurBLfRNJxNlqutsBUNFH"
+        "EA0RchGx-W5-lfcDIDiCjhLEDj4S5BeanHSrJwoPUrDJ"
       ],
       "bt": "0",
       "b": [],
       "c": [],
       "a": []
     },
-    {
-      "v": "KERI10JSON0000ff_",
-      "t": "ixn",
-      "d": "EEEA2-C23Lc2BAOhUqcFY38G2AtjCNHwH56ivk9Mst8l",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "1",
-      "p": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "a": [
-        {
-          "d": "EPbW1zoEt_Gxw2QJBtiuS0TGzdaQwkHe1fdKnjZ-WaO9"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON00013a_",
-      "t": "ixn",
-      "d": "EEfSEmwF2xMyUATv5yDcKdFaieSnIA-tEBr4-R2wxAjv",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "2",
-      "p": "EEEA2-C23Lc2BAOhUqcFY38G2AtjCNHwH56ivk9Mst8l",
-      "a": [
-        {
-          "i": "EPlN9Y8qKPDEq8gg80D6N_rCN3aANK6xAoMr8OTGJ1tR",
-          "s": "0",
-          "d": "EPlN9Y8qKPDEq8gg80D6N_rCN3aANK6xAoMr8OTGJ1tR"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON00013a_",
-      "t": "ixn",
-      "d": "EGhlOnTYWuh6TQAqAVIk2tZH4ZVqWYmJYOwtzBUCjl4W",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "3",
-      "p": "EEfSEmwF2xMyUATv5yDcKdFaieSnIA-tEBr4-R2wxAjv",
-      "a": [
-        {
-          "i": "EIv02OckbaGFpRONOurWMi_f5_Qf8unjgG5PnVCG2MiU",
-          "s": "0",
-          "d": "EIv02OckbaGFpRONOurWMi_f5_Qf8unjgG5PnVCG2MiU"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON00013a_",
-      "t": "ixn",
-      "d": "EDW6BakILqIdi4V3ZSSAUSfghoHkPs_RPoW2gIN7duAO",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "4",
-      "p": "EGhlOnTYWuh6TQAqAVIk2tZH4ZVqWYmJYOwtzBUCjl4W",
-      "a": [
-        {
-          "i": "EGpEBKDnvEUv0dsQ1MVaZbBq0qx8p1iLA4AFcNiPlk5M",
-          "s": "0",
-          "d": "EGpEBKDnvEUv0dsQ1MVaZbBq0qx8p1iLA4AFcNiPlk5M"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON00013a_",
-      "t": "ixn",
-      "d": "EGkVke_RT3jbpWAQ1lmBOXDjaCCB_mJ6LI4Rw1B8rN5Y",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "5",
-      "p": "EDW6BakILqIdi4V3ZSSAUSfghoHkPs_RPoW2gIN7duAO",
-      "a": [
-        {
-          "i": "EB46LmlwowYkoVNeSxMVs68LRc7g6vI1hsPnCUBtzKjt",
-          "s": "0",
-          "d": "EB46LmlwowYkoVNeSxMVs68LRc7g6vI1hsPnCUBtzKjt"
-        }
-      ]
-    },
     {
       "v": "KERI10JSON00013a_",
       "t": "ixn",
-      "d": "EDVMENEeyz5EkhDfCWjSP_ZMFuzJFJ3ofVvEr-WKQSN6",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "6",
-      "p": "EGkVke_RT3jbpWAQ1lmBOXDjaCCB_mJ6LI4Rw1B8rN5Y",
-      "a": [
-        {
-          "i": "EFBGdabu4x82TD_Wn9gI3qUpDjnK3idAz4qLRS2YmdQy",
-          "s": "0",
-          "d": "EFBGdabu4x82TD_Wn9gI3qUpDjnK3idAz4qLRS2YmdQy"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON000105_",
-      "t": "ixn",
-      "d": "EFXvPGjPvzLIKwWrAuvfH0akAfQf7060evdDYy9ezpgW",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "7",
-      "p": "EDVMENEeyz5EkhDfCWjSP_ZMFuzJFJ3ofVvEr-WKQSN6",
-      "a": [
-        {
-          "d": "agent:EFBGdabu4x82TD_Wn9gI3qUpDjnK3idAz4qLRS2YmdQy"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON00012e_",
-      "t": "ixn",
-      "d": "EMdZyZkadYolw2Wm87OYkUqrLcmUIDVrjE57hYdr1aS9",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "8",
-      "p": "EFXvPGjPvzLIKwWrAuvfH0akAfQf7060evdDYy9ezpgW",
-      "a": [
-        {
-          "d": "agentscope:EFBGdabu4x82TD_Wn9gI3qUpDjnK3idAz4qLRS2YmdQy:1786980200:sign_commit,sign_release"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON0000ff_",
-      "t": "ixn",
-      "d": "EHoKJCGZk960cpfR3GCV8La5wEB_7UUEQKVIsM54-u7r",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "9",
-      "p": "EMdZyZkadYolw2Wm87OYkUqrLcmUIDVrjE57hYdr1aS9",
-      "a": [
-        {
-          "d": "EF-P7CX_EyjZ85cbInn0B74kMMs8YjcbUwVj3USilFKY"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON0000ff_",
-      "t": "ixn",
-      "d": "EO0uFfkch9BKjPNzOB5vLZiO4GvytVAuBMY2HAjQahAK",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "a",
-      "p": "EHoKJCGZk960cpfR3GCV8La5wEB_7UUEQKVIsM54-u7r",
-      "a": [
-        {
-          "d": "EFBGdabu4x82TD_Wn9gI3qUpDjnK3idAz4qLRS2YmdQy"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON00013a_",
-      "t": "ixn",
-      "d": "EIGyARxCYrYKnchn_OsVWrzLK8eXfSLlqcVPl3ur8epp",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "b",
-      "p": "EO0uFfkch9BKjPNzOB5vLZiO4GvytVAuBMY2HAjQahAK",
+      "d": "EA7GcuFgAMkTpUURA5SNSoeg9Y0v9aGqBrqgF0u0EVuU",
+      "i": "EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b",
+      "s": "1",
+      "p": "EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b",
       "a": [
         {
-          "i": "EO1cBsYoV5izKvdIL6TstN5TOQl1hYN3WnhtAOh1lwAp",
+          "i": "EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6",
           "s": "0",
-          "d": "EO1cBsYoV5izKvdIL6TstN5TOQl1hYN3WnhtAOh1lwAp"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON000105_",
-      "t": "ixn",
-      "d": "EKvB1FemDJ0kEwiqhmTQljb5_clKGiQ9qjb5MilfuU2Q",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "c",
-      "p": "EIGyARxCYrYKnchn_OsVWrzLK8eXfSLlqcVPl3ur8epp",
-      "a": [
-        {
-          "d": "agent:EO1cBsYoV5izKvdIL6TstN5TOQl1hYN3WnhtAOh1lwAp"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON00012e_",
-      "t": "ixn",
-      "d": "EP0KgPUSLmYprFsHWfFbw0rxaIDq1ePdvSyImKVwxYkn",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "d",
-      "p": "EKvB1FemDJ0kEwiqhmTQljb5_clKGiQ9qjb5MilfuU2Q",
-      "a": [
-        {
-          "d": "agentscope:EO1cBsYoV5izKvdIL6TstN5TOQl1hYN3WnhtAOh1lwAp:1786981212:sign_commit,sign_release"
+          "d": "EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6"
         }
       ]
     }
   ],
   "kel_attachments": [
-    "2d4141424141417877504838766b56354c766b697652353842764a524a766e49416a53415a6331714e385a3072636c444d49317132454a4f754a6e61507931304d6b675f3363755f525a7570696639646565656459586a6455415f34",
-    "2d414142414144696a3038345f61366a637153616f63636e4a4d62305259495237634e725464354439355f612d754f59525f635051736b5457455049452d386777764f33576131687161754a643952706d3258752d71625368467155",
-    "2d4141424141414f705763614767782d2d4e75524d593853506f7a346d6850734c5247645752423962353645654954572d6e6b79544b695f76706c7241676857665875653169685f4147634b424c7257433378746676595534497369",
-    "2d41414241414463705f6b6a6c3551684c3067764266744b70587176554953714269443679533955694a5a4330315f6d43617a6c414d48324f794b2d3953304a44787462545a384f316a4a4234686679456d4d785572413269636f30",
-    "2d41414241414132704e4a43317138376a66743636476151503334344a7166337132627537397732684555634f684e4e7768622d30476b6741494d726d6b6d2d6a37426c305f462d4c487772527549486874394e6168472d4f333152",
-    "2d41414241414172347475664c3078463833436470306e685f675761492d6d4a5971705879665a52466969307269756b41657739743371644c78445548337768475755436c504f54305a7664537756564d794378586d78327a666136",
-    "2d4141424141427041646c717a662d75635a61394845736c6c626b546633444867457a717044696c486943486c2d6846775849554778486c453136695961305570792d6233625a6f695357624c555f316658573148484e5f6863374d",
-    "2d4141424141436d4b366f4a7335415946743639702d5a5552434c596a696f6447377233366a38326e6a3644572d7a6151496d3856745f35346a4c4d7556494f78587569387548754f4f4667705346514a2d36766e64507646727851",
-    "2d414142414141784b59343473366b59356b72446f495975417432526b4a4a357a657732744552505a49424e5371767167737454476e43757a5055564851744152584264704a7261767946685f39527831487172396a31384a2d4457",
-    "2d414142414141495f4b55594b4f73764e62326f4c7473556c6d61536965436b714f6b334b7935546c336c722d52574834653954525571786b63756a34375065726e536a615653742d6d47463771734453395764725178346d526d2d",
-    "2d4141424141425a484831596835716553506b744d56316a4e456673366f506561525f45727265354f706232756d4334772d46426f557850634c776f7361326a507a6d3969554448754e677a4d4d58314d42483334384c41724a7569",
-    "2d414142414142514b6478305f794a754657466c55704f3550714746316e303979762d6b2d35467873715043385a72745959745f357532734932445749744b6d4359434339306b7a4d532d556b584c4a7a7a454d4371696676724579",
-    "2d4141424141427a526777374658754d575a7354594a326b79784965447947327a63326c3170424d35436d6c475f5a4d64394c63646b417746693263774e4f7043433937416472624677724e774f4765356f584f443067535f634e44",
-    "2d414142414144575161325572665f635762554b72366250366a47626d4257386950554d395655425a4f71745f426a492d75656371564761495f664a3869384153754e55693872426d7076392d7475752d4b7243656876513043364d"
+    "2d4141424141425037505a4f515870356c4153365f7075744b5635546f5147344d336b2d65534936574c64727a595856432d3333744a4a70544562766959454b656c787865744a2d323164317174746b414739745f384b7372504277",
+    "2d414142414142367832385263744153785067334f5f6c537479564a564f4c6833623778424678684b553949663977334a4248794e4c44554c596b56396e437057416555457656796d5266497163787141566e696f446f7247574d35"
   ],
   "device_kels": [
     {
-      "did": "did:keri:EB46LmlwowYkoVNeSxMVs68LRc7g6vI1hsPnCUBtzKjt",
-      "kel": [
-        {
-          "v": "KERI10JSON00015f_",
-          "t": "dip",
-          "d": "EB46LmlwowYkoVNeSxMVs68LRc7g6vI1hsPnCUBtzKjt",
-          "i": "EB46LmlwowYkoVNeSxMVs68LRc7g6vI1hsPnCUBtzKjt",
-          "s": "0",
-          "kt": "1",
-          "k": [
-            "DNXo-V5u8_vuBzkKYoaRRCO2DnaqYbWlTqHvHRowIjSq"
-          ],
-          "nt": "1",
-          "n": [
-            "EMf_-qFIcaO8PCkHnTQ1kg7lsD5_QAsAj94Bo4Fu7UHi"
-          ],
-          "bt": "0",
-          "b": [],
-          "c": [],
-          "a": [],
-          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
-        }
-      ],
-      "kel_attachments": [
-        "2d414142414141533962696a475866547550686c48343344435532686659584844697644597937474a62394a5249776a31576f4f594a68784a4e4d6d66727636622d574b4e51485a59722d523270435031454f66423158764d2d6b4d2d47414230414141414141414141414141414141414141414141414645476b566b655f5254336a6270574151316c6d424f58446a614343425f6d4a364c49345277314238724e3559"
-      ]
-    },
-    {
-      "did": "did:keri:EFBGdabu4x82TD_Wn9gI3qUpDjnK3idAz4qLRS2YmdQy",
-      "kel": [
-        {
-          "v": "KERI10JSON00015f_",
-          "t": "dip",
-          "d": "EFBGdabu4x82TD_Wn9gI3qUpDjnK3idAz4qLRS2YmdQy",
-          "i": "EFBGdabu4x82TD_Wn9gI3qUpDjnK3idAz4qLRS2YmdQy",
-          "s": "0",
-          "kt": "1",
-          "k": [
-            "DM7Fn3BNMxniy7-3mPMsnGf-D0LzbfArArziOd2HJqm7"
-          ],
-          "nt": "1",
-          "n": [
-            "EF2b6jAzpSeVs_ClZbYSP-zCLnSyTSSPQ_XvadOCFiNt"
-          ],
-          "bt": "0",
-          "b": [],
-          "c": [],
-          "a": [],
-          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
-        }
-      ],
-      "kel_attachments": [
-        "2d414142414142637a74747658326335574d575a41785f6c6170454955654a4553736c3438326d5071724867306f734e324849684d622d68786d4b5a2d3671467a32615578753067657774516674637773724f684a6a47326568414b2d4741423041414141414141414141414141414141414141414141474544564d454e4565797a35456b68446643576a53505f5a4d46757a4a464a336f66567645722d574b51534e36"
-      ]
-    },
-    {
-      "did": "did:keri:EGpEBKDnvEUv0dsQ1MVaZbBq0qx8p1iLA4AFcNiPlk5M",
-      "kel": [
-        {
-          "v": "KERI10JSON00015f_",
-          "t": "dip",
-          "d": "EGpEBKDnvEUv0dsQ1MVaZbBq0qx8p1iLA4AFcNiPlk5M",
-          "i": "EGpEBKDnvEUv0dsQ1MVaZbBq0qx8p1iLA4AFcNiPlk5M",
-          "s": "0",
-          "kt": "1",
-          "k": [
-            "DM_3EYHf6RSHG-tdXVR_cU-Lvof3rkWYtT-PYhpU-IRe"
-          ],
-          "nt": "1",
-          "n": [
-            "ELnchwp59KdisZ-hIRguRa0t5dl1DigLxwxfr_qWHkHE"
-          ],
-          "bt": "0",
-          "b": [],
-          "c": [],
-          "a": [],
-          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
-        }
-      ],
-      "kel_attachments": [
-        "2d414142414142386f412d6750665f5761363035454339564c7970796a4c4a467570453167777555315f446a6d7450625739546a716b4c59636c77743733397142576a7a4174662d4b757738376a6e67796b597a384d6669535f30502d4741423041414141414141414141414141414141414141414141454544573642616b494c714964693456335a53534155536667686f486b50735f52506f573267494e376475414f"
-      ]
-    },
-    {
-      "did": "did:keri:EIv02OckbaGFpRONOurWMi_f5_Qf8unjgG5PnVCG2MiU",
-      "kel": [
-        {
-          "v": "KERI10JSON00015f_",
-          "t": "dip",
-          "d": "EIv02OckbaGFpRONOurWMi_f5_Qf8unjgG5PnVCG2MiU",
-          "i": "EIv02OckbaGFpRONOurWMi_f5_Qf8unjgG5PnVCG2MiU",
-          "s": "0",
-          "kt": "1",
-          "k": [
-            "DPYt_OxIt9CqR_4W3LHZLFm092qERcNr5F7716rbuy2h"
-          ],
-          "nt": "1",
-          "n": [
-            "EPz5DqpWQTuIHeVm92lv5aZ0IUeRuNrt1VNd65HWumph"
-          ],
-          "bt": "0",
-          "b": [],
-          "c": [],
-          "a": [],
-          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
-        }
-      ],
-      "kel_attachments": [
-        "2d4141424141434e58784447677344644b4e576c77796b726c6936546e42556863416a6a4b37795948556256796c5f4732483075716c35354b636d646c5665504e4e64786576355068546b454b59717447504e30484f4e54333351462d4741423041414141414141414141414141414141414141414141444547686c4f6e545957756836545141714156496b32745a48345a567157596d4a594f77747a4255436a6c3457"
-      ]
-    },
-    {
-      "did": "did:keri:EO1cBsYoV5izKvdIL6TstN5TOQl1hYN3WnhtAOh1lwAp",
-      "kel": [
-        {
-          "v": "KERI10JSON00015f_",
-          "t": "dip",
-          "d": "EO1cBsYoV5izKvdIL6TstN5TOQl1hYN3WnhtAOh1lwAp",
-          "i": "EO1cBsYoV5izKvdIL6TstN5TOQl1hYN3WnhtAOh1lwAp",
-          "s": "0",
-          "kt": "1",
-          "k": [
-            "DEd5DmPuvZG7EDCFZC8UtoDWWwsbxO8_hJbXMK1PPYPQ"
-          ],
-          "nt": "1",
-          "n": [
-            "EBpDD46IT-XapGnnZasYr_BEUfCA1xM_u2--i3c0SzYS"
-          ],
-          "bt": "0",
-          "b": [],
-          "c": [],
-          "a": [],
-          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
-        }
-      ],
-      "kel_attachments": [
-        "2d414142414142712d64486638466d33484662743575684461677869677675736d75563651547355435a56334a6d744d32583858764879542d3873416742584f4d34455979697a6d6c7a47556a4f546c5669397270536c615f444d4d2d47414230414141414141414141414141414141414141414141414c45494779415278435972594b6e63686e5f4f735657727a4c4b38655866534c6c716356506c33757238657070"
-      ]
-    },
-    {
-      "did": "did:keri:EPlN9Y8qKPDEq8gg80D6N_rCN3aANK6xAoMr8OTGJ1tR",
+      "did": "did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6",
       "kel": [
         {
-          "v": "KERI10JSON00015f_",
+          "v": "KERI10JSON000163_",
           "t": "dip",
-          "d": "EPlN9Y8qKPDEq8gg80D6N_rCN3aANK6xAoMr8OTGJ1tR",
-          "i": "EPlN9Y8qKPDEq8gg80D6N_rCN3aANK6xAoMr8OTGJ1tR",
+          "d": "EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6",
+          "i": "EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6",
           "s": "0",
           "kt": "1",
           "k": [
-            "DJj3LOcZEo0z7Gm1Lkxe9Emk98WG1wwTcLnC52Dx_J7n"
+            "1AAJA2ttXyx31_wfXFLDdeYnjfaFU2PmT3aSjIacdsCoO6c3"
           ],
           "nt": "1",
           "n": [
-            "EIsYqqpF-rTb-9NugFe8PBbJLgfUxGbrhbknzliu9EgC"
+            "EMg-xEysO1vCYcJCKG791YN4FPJrDOn2jkhb5jFRzG8y"
           ],
           "bt": "0",
           "b": [],
           "c": [],
           "a": [],
-          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
+          "di": "EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b"
+        },
+        {
+          "v": "KERI10JSON00013a_",
+          "t": "ixn",
+          "d": "EJPbhIBqY5VxOV0kO1hsVLUZlcjh60vCCkwRRQ5dwzMi",
+          "i": "EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6",
+          "s": "1",
+          "p": "EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6",
+          "a": [
+            {
+              "i": "EJDqDJ7WkayddxOv4aP1c9ny3tyjWjSgguX2gCiVsKdf",
+              "s": "0",
+              "d": "EJDqDJ7WkayddxOv4aP1c9ny3tyjWjSgguX2gCiVsKdf"
+            }
+          ]
+        },
+        {
+          "v": "KERI10JSON000105_",
+          "t": "ixn",
+          "d": "EIKLAKUZoY44glFWNL744n0QIFdJp4p-36E3fhtNPXBw",
+          "i": "EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6",
+          "s": "2",
+          "p": "EJPbhIBqY5VxOV0kO1hsVLUZlcjh60vCCkwRRQ5dwzMi",
+          "a": [
+            {
+              "d": "agent:EJDqDJ7WkayddxOv4aP1c9ny3tyjWjSgguX2gCiVsKdf"
+            }
+          ]
+        },
+        {
+          "v": "KERI10JSON0000ff_",
+          "t": "ixn",
+          "d": "EGDExK8SM8maWYo_RJbIMMgH6IWchAnS6HB38fJ2NNTR",
+          "i": "EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6",
+          "s": "3",
+          "p": "EIKLAKUZoY44glFWNL744n0QIFdJp4p-36E3fhtNPXBw",
+          "a": [
+            {
+              "d": "ELKhHhAifK_NHZP2S4uxeI8YuCwmRHSBX1BQKZNJRjN1"
+            }
+          ]
         }
       ],
       "kel_attachments": [
-        "2d414142414141414b643631664e503247624b37324c3057774d32583978474f303042613955496277786b4539475a676354304c3951332d6f315a50364a356c57674e454f5832534133554f50484836684d7546525247435f4d414d2d47414230414141414141414141414141414141414141414141414345456653456d774632784d7955415476357944634b6446616965536e49412d74454272342d52327778416a76"
+        "2d414142414143526a7864503836474c3263362d707550545769704c7436527371477854306f56776e705952434b535262654333366f4545686c4e706b376935544b6266483647536c6f2d48614d32425f76315a6f7955585a3154302d4741423041414141414141414141414141414141414141414141424541374763754667414d6b54705555524135534e536f65673959307639614771427271674630753045567555",
+        "2d4141424141427465337370536966496e7175386834535039764d593958565266576f6351384b7136386779573942664b334962565a53554d75586e676d4d546a4e44354c67306a6c6e4c69324d6e5a384e4d73386b326d704b424b",
+        "2d414142414142765f54326d315152756d704f61666f44514364464a79396c484f54554e776d36574b374d6f5f744279694c613164657675526e68674c683465586e68594e4b63395a2d784734492d5848415a585a534f596e4b3268",
+        "2d4141424141413046717851674d366a74315166444a336576525f364a4c414c64742d4875314146546b7277514a474844475a67714d6d7a334f4c536c44686767626f617a3542516753735677697550344c51554754666779477343"
       ]
     }
   ],
-  "bundle_timestamp": "2026-07-18T15:55:57.244316Z",
+  "bundle_timestamp": "2026-07-23T22:26:42.925901Z",
   "max_valid_for_secs": 31536000
 }
diff --git a/.auths/roots b/.auths/roots
index 26cc6d3d4..e2828478e 100644
--- a/.auths/roots
+++ b/.auths/roots
@@ -1,25 +1,3 @@
-did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd
-did:keri:EMCu26JE1Jm40kuNyWtCyTJu3CwC_2MBmiiFCIp6XN7t
-did:keri:ECorK2R66hdj9W3wzV0JYYPVm37iL_48lHnWF-_zXtfJ
-did:keri:EHZu-FvRR0yJF3tId3iJVN_XXlsNZdXg-ZSRchZHCcTS
-did:keri:EA-toxTnhpWcjgDGonNgzRRsHgyatvu4GXp8vQ9RZMD6
-did:keri:EJRwo0DQdzF6ggeznDh6113KlfMy-_KUF_9WfZ5Gh28e
-did:keri:EJR9zlO6FtsjRULj07wynEEUcN0AD1MmKI6A1U_uD10l
-did:keri:EN6HZUkHvWsaSgFKPKEDR8nMVV1Ef9zw1gbdtxOtLWDP
-did:keri:EGAeM5vBmzcFEzf3MVbOD_VKjMxC4GsoUarWUjz5J6li
-did:keri:ED-k2LMn90EN5DUQGCCGKGn-Bf9BXWLiao-nyLp9LAjH
-did:keri:ELiyxeCLBDgNKtYG_bfpnpCy2Lohqyv8M3TyMS8Zn9Tm
-did:keri:EL1CaAKTd-I7l6v8FO8FvWbFrgK_UMAUk5MQ-7YjPeHr
-did:keri:EJzyWbcg-u6v_4nc-R1XwfbblLqz1wBQpIHx_WNUTZgL
-did:keri:EJ35ubEJO6ZT4HDeFxKqcoAH1VE0MnA4Y_Mk_rniD_ku
-did:keri:ELS_t_TDI2vfNPkUjcatCqA8tSgQwYOv_h9OKvp5rvER
-did:keri:ENv6JMgfYFbr3J4nBOtcNNgpVZ5lmd6dUr_25wK4MJUM
-did:keri:EKHawavyEruvh0v3A2H5zLoLnOE2L3lAqzivN0kjZil3
-did:keri:EHMeiHXhVedvGhvFf5O71HoPskHArJXokxnx08PEr_CM
-did:keri:EF9goneG7pezrfCzYvEhEp_gSct_BZLmSZfrngNWxTqM
-did:keri:EC7fQlCP19mPRMx-lIpHhWCjKF12Z1aZ6VYYwUa8ZZ-M
-did:keri:EDa0hFOowB7PYAkUeiuRQiV1zaa1mpFbxQYf61r73Pii
-did:keri:EPsk0PCEQpa3ALIG1Oyiuxg8UfLbgma4QV16I-O6TnOc
-did:keri:EAZG0HqAzbydr1iAbnEPUhVC_IuB6vZXYBJagVXS2k9a
-did:keri:EKh1onK1bubyaWxHIWzr_yeOAtBm36ZGn0AXDYsBhrsq
-did:keri:EPmp6Nav8Z-_prJg0EShHnB396yJJtXmBr6hG647PxwJ
+did:keri:EGfg3puqwCzBD3rBSiMhO1HpDM26pmotVreI41Jl_1Eq
+did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b
+did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6
diff --git a/Cargo.lock b/Cargo.lock
index 6e53b6f49..2f88049e7 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -382,6 +382,7 @@ dependencies = [
  "anyhow",
  "assert_cmd",
  "auths-anchor",
+ "auths-core",
  "auths-crypto",
  "auths-index",
  "auths-infra-git",
@@ -1010,6 +1011,7 @@ dependencies = [
 name = "auths-sdk"
 version = "0.1.16"
 dependencies = [
+ "anyhow",
  "async-trait",
  "auths-anchor",
  "auths-core",
diff --git a/crates/auths-cli/Cargo.toml b/crates/auths-cli/Cargo.toml
index 139c5534b..e364b64dc 100644
--- a/crates/auths-cli/Cargo.toml
+++ b/crates/auths-cli/Cargo.toml
@@ -39,6 +39,7 @@ gethostname = "1.1.0"
 glob.workspace = true
 auths-policy.workspace = true
 auths-index.workspace = true
+auths-core.workspace = true
 auths-crypto.workspace = true
 auths-sdk = { workspace = true, features = ["backend-git", "witness-server", "witness-client", "indexed-storage", "keychain-secure-enclave"] }
 auths-transparency = { workspace = true, features = ["native"] }
diff --git a/crates/auths-cli/src/adapters/agent.rs b/crates/auths-cli/src/adapters/agent.rs
index f3e88e5ef..b4b678c89 100644
--- a/crates/auths-cli/src/adapters/agent.rs
+++ b/crates/auths-cli/src/adapters/agent.rs
@@ -11,7 +11,7 @@ use auths_sdk::crypto::{construct_sshsig_pem, construct_sshsig_signed_data};
 use auths_sdk::ports::agent::{AgentSigningError, AgentSigningPort};
 
 #[cfg(unix)]
-use crate::commands::agent::{ensure_agent_running, get_default_socket_path};
+use crate::commands::daemon::{ensure_agent_running, get_default_socket_path};
 
 /// CLI adapter that delegates signing to the Unix SSH agent.
 ///
diff --git a/crates/auths-cli/src/bin/sign.rs b/crates/auths-cli/src/bin/sign.rs
index 7653d9e2e..3bd169f37 100644
--- a/crates/auths-cli/src/bin/sign.rs
+++ b/crates/auths-cli/src/bin/sign.rs
@@ -111,12 +111,11 @@ fn validate_verify_option(opt: &str) -> Result<()> {
 }
 
 fn parse_key_identifier(key_file: &str) -> Result<String> {
-    if let Some(alias) = key_file.strip_prefix("auths:") {
-        if alias.is_empty() {
-            bail!("Invalid Auths key format: alias cannot be empty. Use 'auths:<alias>'");
-        }
-        Ok(alias.to_string())
-    } else {
+    let key_ref =
+        auths_sdk::keychain::SigningKeyRef::parse(key_file).map_err(|e| anyhow::anyhow!(e))?;
+
+    if !matches!(key_ref, auths_sdk::keychain::SigningKeyRef::Uri { ref scheme, .. } if scheme == "auths")
+    {
         bail!(
             "Unsupported key format: '{}'. \
              Auths keys should be specified as 'auths:<alias>' \
@@ -124,6 +123,8 @@ fn parse_key_identifier(key_file: &str) -> Result<String> {
             key_file
         );
     }
+
+    Ok(key_ref.bare_alias().as_str().to_string())
 }
 
 fn build_signing_context(alias: &str) -> Result<CommitSigningContext> {
diff --git a/crates/auths-cli/src/cli.rs b/crates/auths-cli/src/cli.rs
index 7567129bb..faf9952c8 100644
--- a/crates/auths-cli/src/cli.rs
+++ b/crates/auths-cli/src/cli.rs
@@ -10,6 +10,7 @@ use crate::commands::approval::ApprovalCommand;
 use crate::commands::artifact::ArtifactCommand;
 use crate::commands::audit::AuditCommand;
 use crate::commands::auth::AuthCommand;
+use crate::commands::daemon::DaemonCommand;
 
 use crate::commands::commit::CommitCmd;
 use crate::commands::completions::CompletionsCommand;
@@ -101,6 +102,7 @@ pub enum RootCommand {
     Verify(UnifiedVerifyCommand),
     Status(StatusCommand),
     Whoami(WhoamiCommand),
+    Agent(AgentCommand),
 
     // ── Setup & Troubleshooting ──
     Demo(DemoCommand),
@@ -162,7 +164,7 @@ pub enum RootCommand {
     #[command(hide = true)]
     Emergency(EmergencyCommand),
     #[command(hide = true)]
-    Agent(AgentCommand),
+    Daemon(DaemonCommand),
     /// Aggregate treasury cap across a manager's sub-delegated agents.
     Treasury(TreasuryCommand),
     /// Verify witness-network anchor evidence (duplicity proofs) offline.
diff --git a/crates/auths-cli/src/commands/agent/agent_prompt.md b/crates/auths-cli/src/commands/agent/agent_prompt.md
new file mode 100644
index 000000000..f9f974889
--- /dev/null
+++ b/crates/auths-cli/src/commands/agent/agent_prompt.md
@@ -0,0 +1,19 @@
+<auths_delegated_identity>
+You have been granted a delegated cryptographic identity ({{LABEL}}) to sign your git commits in this workspace.
+
+# Core Directive
+Whenever you execute a `git commit` on behalf of the user, you MUST sign it using this identity.
+
+# Activation Instructions
+Before running ANY git commands that require signing, you MUST activate your signing environment for the current shell session by sourcing your environment script:
+`source {{ENV_PATH}}`
+
+This script automatically handles:
+- Injecting your `AUTHS_PASSPHRASE` into the environment so you do not need to prompt the user.
+- Setting up temporary `GIT_CONFIG_COUNT` overrides to force git to use the `auths-sign` binary.
+
+# Constraints & Rules
+1. NEVER attempt to manually modify the repository's `.git/config` file to configure signing. The `env.sh` script handles this cleanly via environment variables.
+2. NEVER attempt to run `ssh-agent`, `ssh-add`, or interact with standard GPG tools. `auths-sign` is a custom headless signer that replaces them.
+3. If a commit fails with a signing error, verify that you sourced the `env.sh` file in the EXACT same bash session/subshell as the `git commit` command.
+</auths_delegated_identity>
diff --git a/crates/auths-cli/src/commands/agent/mod.rs b/crates/auths-cli/src/commands/agent/mod.rs
index 91d23cd92..867bb8ead 100644
--- a/crates/auths-cli/src/commands/agent/mod.rs
+++ b/crates/auths-cli/src/commands/agent/mod.rs
@@ -1,30 +1,17 @@
-//! SSH agent daemon commands (start, stop, status).
+//! Identity management for delegated headless agents.
 
-pub mod process;
-pub mod service;
-
-use anyhow::{Context, Result, anyhow};
-use clap::{Parser, Subcommand, ValueEnum};
-use serde::Serialize;
-use std::fs;
+use anyhow::{Context, Result};
+use clap::{Parser, Subcommand};
 use std::path::PathBuf;
 
-use crate::core::fs::{create_restricted_dir, write_sensitive_file};
 use crate::ux::format::{JsonResponse, is_json_mode};
-use process::{
-    cleanup_stale_files, is_process_running, read_pid_file, socket_is_connectable, write_pid_file,
-};
-use service::ServiceManager;
-
-const DEFAULT_SOCKET_NAME: &str = "agent.sock";
-const PID_FILE_NAME: &str = "agent.pid";
-const ENV_FILE_NAME: &str = "agent.env";
-const LOG_FILE_NAME: &str = "agent.log";
 
 #[derive(Parser, Debug, Clone)]
 #[command(
     name = "agent",
-    about = "SSH agent daemon management (start, stop, status)."
+    about = "Identity management for delegated headless agents.",
+    after_help = "If you are an AI Agent/LLM, run `auths agent list` to find your assigned label, \
+             then run `auths agent prompt --label <YOUR_LABEL>` to get started."
 )]
 pub struct AgentCommand {
     #[command(subcommand)]
@@ -33,701 +20,537 @@ pub struct AgentCommand {
 
 #[derive(Subcommand, Debug, Clone)]
 pub enum AgentSubcommand {
-    /// Start the SSH agent daemon
-    Start {
-        /// Custom socket path (default: ~/.auths/agent.sock)
-        #[arg(long, help = "Custom Unix socket path")]
-        socket: Option<PathBuf>,
-
-        /// Run in foreground (don't daemonize)
-        #[arg(long, help = "Run in foreground instead of daemonizing")]
-        foreground: bool,
-
-        /// Idle timeout (e.g., "30m", "1h", "0" for never)
-        #[arg(long, default_value = "30m", help = "Idle timeout before auto-lock")]
-        timeout: String,
+    /// Provision a new delegated headless agent in a single command
+    Provision {
+        /// Human-readable label / key alias for the new agent
+        #[arg(short, long, help = "Label / key alias for the new agent")]
+        label: Option<String>,
+
+        /// Delegator signing key alias (defaults to "main")
+        #[arg(long, help = "Your root identity's signing key name")]
+        key: Option<String>,
+
+        /// Capability granted to the agent (repeatable)
+        #[arg(long = "scope", help = "Capability granted to the agent")]
+        scope: Vec<auths_keri::Capability>,
+
+        /// Expiration duration in seconds (e.g. 2592000 for 30 days)
+        #[arg(long = "expires-in", help = "Expiration duration in seconds")]
+        expires_in: Option<i64>,
+
+        /// Destination directory for agent environment workspace (defaults to ~/.auths-agents/<label>/)
+        #[arg(short, long, help = "Output directory for agent environment")]
+        out: Option<PathBuf>,
+
+        /// Provisioning profile: "ci" or "assistant"
+        #[arg(long, help = "Agent profile preset")]
+        profile: Option<String>,
+
+        /// Passphrase file path (optional, auto-generated if absent)
+        #[arg(long, help = "Passphrase file path")]
+        passphrase_file: Option<PathBuf>,
     },
 
-    /// Stop the SSH agent daemon
-    Stop,
+    /// List all agents delegated under your identity
+    List {
+        /// Include revoked agents in listing
+        #[arg(long, help = "Include revoked agents")]
+        include_revoked: bool,
+    },
 
-    /// Show agent status
-    Status,
+    /// Update mutable agent metadata or renew expiration
+    Update {
+        /// Target Agent DID or label
+        agent: String,
 
-    /// Output shell environment for SSH_AUTH_SOCK (use with eval)
-    Env {
-        /// Shell format for output
-        #[arg(long, value_enum, default_value = "bash", help = "Shell format")]
-        shell: ShellFormat,
+        /// Update human label / agent name
+        #[arg(short, long)]
+        label: Option<String>,
+
+        /// Extend expiration duration in seconds
+        #[arg(long)]
+        extend_expiration: Option<i64>,
     },
 
-    /// Lock the agent (clear keys from memory)
-    Lock,
+    /// Revoke a delegated agent identity
+    Revoke {
+        /// Target Agent DID or label to revoke
+        agent_did: String,
 
-    /// Unlock the agent (re-load keys)
-    Unlock {
-        /// Key alias to unlock
+        /// Delegator signing key alias
         #[arg(
-            long = "agent-key-alias",
-            visible_alias = "key",
-            default_value = "default",
-            help = "Key alias to unlock"
+            long,
+            default_value = "main",
+            help = "Your root identity's signing key name"
         )]
-        agent_key_alias: String,
+        key: String,
     },
 
-    /// Install as a system service (launchd on macOS, systemd on Linux)
-    InstallService {
-        /// Don't install, just print the service file
-        #[arg(long, help = "Print service file without installing")]
-        dry_run: bool,
-
-        /// Force overwrite if service already exists
-        #[arg(long, help = "Overwrite existing service file")]
-        force: bool,
-
-        /// Service manager to use (auto-detect if not specified)
-        #[arg(long, value_enum, help = "Service manager (auto-detect by default)")]
-        manager: Option<ServiceManager>,
+    /// Generate a structured system prompt for an AI agent
+    Prompt {
+        /// The human-readable label / agent name
+        #[arg(short, long, help = "Label / agent name (e.g., auths-agent)")]
+        label: String,
     },
-
-    /// Uninstall the system service
-    UninstallService,
-}
-
-/// Shell format for environment output.
-#[derive(ValueEnum, Clone, Debug, Default)]
-pub enum ShellFormat {
-    #[default]
-    Bash,
-    Zsh,
-    Fish,
-}
-
-/// Status information about the agent.
-#[derive(Serialize, Debug)]
-pub struct AgentStatus {
-    pub running: bool,
-    pub pid: Option<u32>,
-    pub socket_path: Option<String>,
-    pub socket_exists: bool,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub uptime_secs: Option<u64>,
-}
-
-/// Ensures the SSH agent is running, starting it if necessary.
-///
-/// Returns `Ok(true)` if already running, `Ok(false)` if it was started.
-///
-/// Args:
-/// * `quiet`: Suppress startup messages.
-///
-/// Usage:
-/// ```ignore
-/// let was_running = ensure_agent_running(true)?;
-/// ```
-#[allow(dead_code)] // Used by bin/sign.rs (cross-target usage not tracked by lint)
-pub fn ensure_agent_running(quiet: bool) -> Result<bool> {
-    let socket_path = get_default_socket_path()?;
-    let pid_path = get_pid_file_path()?;
-
-    if let Some(pid) = read_pid_file(&pid_path)?
-        && is_process_running(pid)
-        && socket_is_connectable(&socket_path)
-    {
-        return Ok(true);
-    }
-
-    if !quiet {
-        eprintln!("Agent not running, starting...");
-    }
-
-    start_agent(None, false, "30m", quiet)?;
-
-    let timeout = std::time::Duration::from_secs(2);
-    let start = std::time::Instant::now();
-    while start.elapsed() < timeout {
-        if let Some(pid) = read_pid_file(&pid_path)?
-            && is_process_running(pid)
-            && socket_is_connectable(&socket_path)
-        {
-            if !quiet {
-                eprintln!("Agent started (PID {})", pid);
-            }
-            return Ok(false);
-        }
-        std::thread::sleep(std::time::Duration::from_millis(100));
-    }
-
-    Err(anyhow!("Failed to start agent within 2 seconds"))
-}
-
-/// The name of a per-machine daemon operation, or `None` for a store operation.
-///
-/// Daemon operations (start/stop/status/install-service/uninstall-service) act
-/// on the per-machine agent and cannot be scoped by `--repo`. Store operations
-/// (env/lock/unlock) read repo-scoped paths.
-fn daemon_op_name(cmd: &AgentSubcommand) -> Option<&'static str> {
-    match cmd {
-        AgentSubcommand::Start { .. } => Some("start"),
-        AgentSubcommand::Stop => Some("stop"),
-        AgentSubcommand::Status => Some("status"),
-        AgentSubcommand::InstallService { .. } => Some("install-service"),
-        AgentSubcommand::UninstallService => Some("uninstall-service"),
-        AgentSubcommand::Env { .. } | AgentSubcommand::Lock | AgentSubcommand::Unlock { .. } => {
-            None
-        }
-    }
 }
 
 pub fn handle_agent(cmd: AgentCommand, repo: Option<PathBuf>) -> Result<()> {
-    // Daemon operations are per-machine; `--repo` cannot scope them, so reject
-    // it rather than silently operate on the global agent.
-    if let Some(op) = daemon_op_name(&cmd.command)
-        && repo.is_some()
-    {
-        anyhow::bail!(
-            "`--repo` is not supported for `auths agent {}`; the agent daemon is per-machine \
-             and is selected by AUTHS_HOME, not by repository.",
-            op
-        );
-    }
-
     match cmd.command {
-        AgentSubcommand::Start {
-            socket,
-            foreground,
-            timeout,
-        } => start_agent(socket, foreground, &timeout, false),
-        AgentSubcommand::Stop => stop_agent(),
-        AgentSubcommand::Status => show_status(),
-        AgentSubcommand::InstallService {
-            dry_run,
-            force,
-            manager,
-        } => service::install_service(dry_run, force, manager),
-        AgentSubcommand::UninstallService => service::uninstall_service(),
-        // Store operations read repo-scoped paths; thread `--repo` through.
-        AgentSubcommand::Env { shell } => output_env(shell, repo),
-        AgentSubcommand::Lock => lock_agent(repo),
-        AgentSubcommand::Unlock { agent_key_alias } => unlock_agent(&agent_key_alias, repo),
+        AgentSubcommand::Provision {
+            label,
+            key,
+            scope,
+            expires_in,
+            out,
+            profile,
+            passphrase_file,
+        } => handle_provision_cmd(
+            label,
+            key,
+            scope,
+            expires_in,
+            out,
+            profile,
+            passphrase_file,
+            repo,
+        ),
+        AgentSubcommand::List { include_revoked } => handle_list_cmd(include_revoked, repo),
+        AgentSubcommand::Update {
+            agent,
+            label,
+            extend_expiration,
+        } => handle_update_cmd(agent, label, extend_expiration),
+        AgentSubcommand::Revoke { agent_did, key } => handle_revoke_cmd(agent_did, key, repo),
+        AgentSubcommand::Prompt { label } => handle_prompt_cmd(label),
     }
 }
 
-fn parse_timeout(s: &str) -> Result<std::time::Duration> {
-    use std::time::Duration;
-
-    let s = s.trim();
-    if s == "0" {
-        return Ok(Duration::ZERO);
-    }
-
-    let (num_str, suffix) = if let Some(stripped) = s.strip_suffix('s') {
-        (stripped, "s")
-    } else if let Some(stripped) = s.strip_suffix('m') {
-        (stripped, "m")
-    } else if let Some(stripped) = s.strip_suffix('h') {
-        (stripped, "h")
+#[derive(serde::Serialize)]
+struct AgentProvisionJsonResponse {
+    agent_did: String,
+    label: String,
+    destination_dir: String,
+    env_file_path: String,
+    wrapper_path: String,
+}
+
+#[allow(clippy::too_many_arguments)]
+fn handle_provision_cmd(
+    label: Option<String>,
+    key: Option<String>,
+    scope: Vec<auths_keri::Capability>,
+    expires_in: Option<i64>,
+    out: Option<PathBuf>,
+    profile: Option<String>,
+    passphrase_file: Option<PathBuf>,
+    repo: Option<PathBuf>,
+) -> Result<()> {
+    use crate::core::provider::CliPassphraseProvider;
+    use auths_sdk::paths::auths_home;
+    use auths_sdk::storage_layout::resolve_repo_path;
+    use std::path::Path;
+
+    let repo_path = resolve_repo_path(repo)?;
+    let env_config = auths_sdk::core_config::EnvironmentConfig::from_env();
+    let is_interactive = console::user_attended() && !is_json_mode();
+
+    let (label_str, key_str, profile_str, destination_dir) =
+        if is_interactive && (label.is_none() || key.is_none() || profile.is_none()) {
+            use dialoguer::{Input, Select};
+
+            let label_input = if let Some(l) = label {
+                l
+            } else {
+                Input::new()
+                    .with_prompt("Type a name for your agent")
+                    .interact_text()?
+            };
+
+            let key_input = if let Some(k) = key {
+                k
+            } else {
+                // Auto-detect active local signing key (defaults to main-device, omitting root hardware AID main)
+                let temp_provider = std::sync::Arc::new(CliPassphraseProvider::new());
+                let temp_ctx = crate::factories::storage::build_auths_context(
+                    &repo_path,
+                    &env_config,
+                    Some(temp_provider),
+                )?;
+                let aliases = temp_ctx.key_storage.list_aliases().unwrap_or_default();
+                if aliases.iter().any(|k| k.as_str() == "main-device") {
+                    "main-device".to_string()
+                } else if let Some(first_device) =
+                    aliases.iter().find(|k| k.as_str().ends_with("-device"))
+                {
+                    first_device.as_str().to_string()
+                } else {
+                    aliases
+                        .into_iter()
+                        .map(|k| k.as_str().to_string())
+                        .find(|k| !k.ends_with("--next-0") && k != "main")
+                        .unwrap_or_else(|| "main-device".to_string())
+                }
+            };
+
+            let profile_input = if let Some(p) = profile {
+                p
+            } else {
+                let profiles = vec![
+                    "assistant (Interactive AI assistant profile)",
+                    "ci (Headless CI runner profile)",
+                ];
+                let selection = Select::new()
+                    .with_prompt("Select agent profile preset")
+                    .items(&profiles)
+                    .default(0)
+                    .interact()?;
+                if selection == 0 {
+                    "assistant".to_string()
+                } else {
+                    "ci".to_string()
+                }
+            };
+
+            let out_input = out.unwrap_or_else(|| {
+                auths_home()
+                    .unwrap_or_else(|_| PathBuf::from("~/.auths"))
+                    .parent()
+                    .unwrap_or_else(|| Path::new("."))
+                    .join(".auths-agents")
+                    .join(&label_input)
+            });
+
+            (label_input, key_input, profile_input, out_input)
+        } else {
+            let label_val = label.unwrap_or_else(|| "agent-builder".to_string());
+            let key_val = key.unwrap_or_else(|| "main-device".to_string());
+            let profile_val = profile.unwrap_or_else(|| "assistant".to_string());
+            let out_val = out.unwrap_or_else(|| {
+                auths_home()
+                    .unwrap_or_else(|_| PathBuf::from("~/.auths"))
+                    .parent()
+                    .unwrap_or_else(|| Path::new("."))
+                    .join(".auths-agents")
+                    .join(&label_val)
+            });
+            (label_val, key_val, profile_val, out_val)
+        };
+
+    let key_ref = auths_sdk::keychain::SigningKeyRef::parse(&key_str)?;
+    let parent_alias = key_ref.bare_alias().clone();
+    let agent_profile =
+        profile_str.parse::<auths_sdk::workflows::agent_provision::AgentProfile>()?;
+
+    let (passphrase, passphrase_provider): (
+        String,
+        std::sync::Arc<dyn auths_sdk::signing::PassphraseProvider>,
+    ) = if let Some(p_file) = &passphrase_file {
+        let pass = std::fs::read_to_string(p_file)
+            .with_context(|| format!("Failed to read passphrase file {}", p_file.display()))?
+            .trim()
+            .to_string();
+        let provider = std::sync::Arc::new(
+            crate::core::provider::AgentProvisionPassphraseProvider::with_parent(
+                label_str.clone(),
+                zeroize::Zeroizing::new(pass.clone()),
+                key_str.clone(),
+                None,
+            ),
+        );
+        (pass, provider)
+    } else if is_interactive {
+        eprintln!("[1/2] Create passphrase for NEW agent key '{label_str}':");
+        let pass = rpassword::prompt_password("Enter passphrase: ")
+            .context("Failed to read passphrase from terminal")?;
+        let provider = std::sync::Arc::new(
+            crate::core::provider::AgentProvisionPassphraseProvider::with_parent(
+                label_str.clone(),
+                zeroize::Zeroizing::new(pass.clone()),
+                key_str.clone(),
+                None,
+            ),
+        );
+        (pass, provider)
     } else {
-        (s, "m")
-    };
-
-    let num: u64 = num_str
-        .parse()
-        .with_context(|| format!("Invalid timeout number: {}", num_str))?;
-
-    let secs = match suffix {
-        "s" => num,
-        "m" => num * 60,
-        "h" => num * 3600,
-        _ => return Err(anyhow!("Invalid timeout suffix: {}", suffix)),
+        use rand::Rng;
+        let mut rng = rand::rng();
+        let pass: String = (0..32)
+            .map(|_| rng.sample(rand::distr::Alphanumeric) as char)
+            .collect();
+        let provider = std::sync::Arc::new(
+            crate::core::provider::AgentProvisionPassphraseProvider::new(
+                label_str.clone(),
+                zeroize::Zeroizing::new(pass.clone()),
+            ),
+        );
+        (pass, provider)
     };
 
-    Ok(Duration::from_secs(secs))
-}
-
-fn get_auths_dir() -> Result<PathBuf> {
-    auths_sdk::paths::auths_home().map_err(|e| anyhow!(e))
-}
-
-/// Resolve the agent's storage directory, honoring a `--repo` override.
-///
-/// `None` preserves the default (`AUTHS_HOME` / `~/.auths`); `Some(path)`
-/// scopes the agent's socket/pid/env files to that registry.
-///
-/// Args:
-/// * `repo`: The optional `--repo` override.
-///
-/// Usage:
-/// ```ignore
-/// let dir = get_auths_dir_for_repo(ctx.repo_path.clone())?;
-/// ```
-fn get_auths_dir_for_repo(repo: Option<PathBuf>) -> Result<PathBuf> {
-    match repo {
-        Some(_) => auths_sdk::storage_layout::resolve_repo_path(repo)
-            .context("Failed to resolve the repository path for the agent store"),
-        None => get_auths_dir(),
-    }
-}
-
-fn get_socket_path_for_repo(repo: Option<PathBuf>) -> Result<PathBuf> {
-    Ok(get_auths_dir_for_repo(repo)?.join(DEFAULT_SOCKET_NAME))
-}
-
-fn get_pid_file_path_for_repo(repo: Option<PathBuf>) -> Result<PathBuf> {
-    Ok(get_auths_dir_for_repo(repo)?.join(PID_FILE_NAME))
-}
-
-/// Get the default socket path.
-pub fn get_default_socket_path() -> Result<PathBuf> {
-    Ok(get_auths_dir()?.join(DEFAULT_SOCKET_NAME))
-}
-
-fn get_pid_file_path() -> Result<PathBuf> {
-    Ok(get_auths_dir()?.join(PID_FILE_NAME))
-}
-
-fn get_env_file_path() -> Result<PathBuf> {
-    Ok(get_auths_dir()?.join(ENV_FILE_NAME))
-}
-
-pub(crate) fn get_log_file_path() -> Result<PathBuf> {
-    Ok(get_auths_dir()?.join(LOG_FILE_NAME))
-}
-
-fn start_agent(
-    socket_path: Option<PathBuf>,
-    foreground: bool,
-    timeout_str: &str,
-    quiet: bool,
-) -> Result<()> {
-    let auths_dir = get_auths_dir()?;
-    create_restricted_dir(&auths_dir)
-        .with_context(|| format!("Failed to create auths directory: {:?}", auths_dir))?;
+    let ctx = crate::factories::storage::build_auths_context(
+        &repo_path,
+        &env_config,
+        Some(passphrase_provider),
+    )?;
 
-    let socket = match socket_path {
-        Some(s) => s,
-        None => get_default_socket_path()?,
+    let params = auths_sdk::workflows::agent_provision::AgentProvisionParams {
+        label: label_str.clone(),
+        scopes: scope,
+        expires_in_secs: expires_in,
+        destination_dir,
+        profile: agent_profile,
     };
-    let pid_path = get_pid_file_path()?;
-    let env_path = get_env_file_path()?;
-    let timeout = parse_timeout(timeout_str)?;
-
-    if let Some(pid) = read_pid_file(&pid_path)? {
-        if is_process_running(pid) {
-            return Err(anyhow!(
-                "Agent already running (PID {}). Use 'auths agent stop' first.",
-                pid
-            ));
-        }
-        let _ = fs::remove_file(&pid_path);
-    }
 
-    match fs::remove_file(&socket) {
-        Ok(()) => {}
-        Err(e) if e.kind() == std::io::ErrorKind::NotFound => {}
-        Err(e) => {
-            return Err(anyhow!("Failed to remove stale socket {:?}: {}", socket, e));
-        }
-    }
-
-    if foreground {
-        run_agent_foreground(&socket, &pid_path, &env_path, timeout)
-    } else {
-        daemonize_agent(&socket, &env_path, timeout_str, quiet)
-    }
-}
+    #[allow(clippy::disallowed_methods)]
+    let now = chrono::Utc::now();
+    let res = auths_sdk::workflows::agent_provision::provision_agent_machine(
+        &ctx,
+        &parent_alias,
+        &params,
+        &passphrase,
+        now,
+        &repo_path,
+    )?;
 
-#[cfg(unix)]
-fn run_agent_foreground(
-    socket: &std::path::Path,
-    pid_path: &std::path::Path,
-    env_path: &std::path::Path,
-    timeout: std::time::Duration,
-) -> Result<()> {
-    use auths_sdk::agent_core::AgentHandle;
-    use std::sync::Arc;
-
-    let pid = std::process::id();
-    write_pid_file(pid_path, pid)?;
-
-    let socket_str = socket
-        .to_str()
-        .ok_or_else(|| anyhow!("Socket path is not valid UTF-8"))?;
-    let env_content = format!("export SSH_AUTH_SOCK=\"{}\"\n", socket_str);
-    write_sensitive_file(env_path, &env_content)
-        .with_context(|| format!("Failed to write env file: {:?}", env_path))?;
-
-    eprintln!("Starting SSH agent (foreground)...");
-    eprintln!("Socket: {}", socket_str);
-    eprintln!("PID: {}", pid);
-    if timeout.is_zero() {
-        eprintln!("Idle timeout: disabled");
+    if is_json_mode() {
+        JsonResponse::success(
+            "agent provision",
+            AgentProvisionJsonResponse {
+                agent_did: res.agent_did,
+                label: res.label,
+                destination_dir: res.destination_dir.display().to_string(),
+                env_file_path: res.env_file_path.display().to_string(),
+                wrapper_path: res.wrapper_path.display().to_string(),
+            },
+        )
+        .print()?;
     } else {
-        eprintln!("Idle timeout: {:?}", timeout);
+        println!("✔ Agent provisioned successfully!");
+        println!("  DID:             {}", res.agent_did);
+        println!("  Label:           {}", res.label);
+        println!("  Destination:     {}", res.destination_dir.display());
+        println!("  Environment:     {}", res.env_file_path.display());
+        println!("  Wrapper Helper:  {}", res.wrapper_path.display());
+        println!();
+        println!("Your agent is provisioned!");
+        println!(
+            "You can find its details at {}",
+            res.destination_dir.display()
+        );
     }
-    eprintln!();
-    eprintln!("To use this agent in your shell:");
-    eprintln!("  eval $(cat {})", env_path.display());
-    eprintln!("  # or");
-    eprintln!("  export SSH_AUTH_SOCK=\"{}\"", socket_str);
-    eprintln!();
-    eprintln!("Press Ctrl+C to stop.");
-
-    let handle = Arc::new(AgentHandle::with_pid_file_and_timeout(
-        socket.to_path_buf(),
-        pid_path.to_path_buf(),
-        timeout,
-    ));
-
-    let authorizer = build_sign_authorizer({
-        use std::io::IsTerminal;
-        std::io::stdin().is_terminal()
-    });
-
-    let rt = tokio::runtime::Runtime::new().context("Failed to create tokio runtime")?;
-    let result = rt.block_on(async {
-        auths_sdk::agent_core::start_agent_listener_with_handle(handle.clone(), authorizer).await
-    });
-
-    cleanup_stale_files(&[pid_path, env_path, socket]);
-
-    result.map_err(|e| anyhow!("Agent error: {}", e))
-}
 
-/// Builds the per-request signing authorizer for the agent. An interactive agent gates
-/// each new connecting process behind an approval prompt (so an unlocked agent does not
-/// grant silent signing to every same-user process); a daemonized / non-interactive
-/// agent is permissive, since there is no human present to approve.
-///
-/// Args:
-/// * `interactive`: whether the agent has a terminal to prompt on.
-///
-/// Usage:
-/// ```ignore
-/// let auth = build_sign_authorizer(std::io::stdin().is_terminal());
-/// ```
-#[cfg(unix)]
-fn build_sign_authorizer(
-    interactive: bool,
-) -> std::sync::Arc<dyn auths_sdk::agent_core::SignAuthorizer> {
-    if interactive {
-        std::sync::Arc::new(auths_sdk::agent_core::PerCallerAuthorizer::new(
-            approve_caller,
-        ))
-    } else {
-        std::sync::Arc::new(auths_sdk::agent_core::AllowAllSigning)
-    }
-}
-
-/// Prompts the operator to approve signing for a newly connected caller. Returns true to
-/// approve and pin that caller for the unlock window.
-///
-/// Args:
-/// * `peer`: the connecting process's identity.
-///
-/// Usage:
-/// ```ignore
-/// let approved = approve_caller(&peer);
-/// ```
-#[cfg(unix)]
-fn approve_caller(peer: &auths_sdk::agent_core::PeerIdentity) -> bool {
-    let who = match peer.pid {
-        Some(pid) => format!("process pid {pid} (uid {})", peer.uid),
-        None => format!("a process (uid {})", peer.uid),
-    };
-    eprintln!("\nauths agent: a new caller — {who} — is requesting a signature.");
-    dialoguer::Confirm::new()
-        .with_prompt("Approve signing for this caller?")
-        .default(false)
-        .interact()
-        .unwrap_or(false)
-}
-
-#[cfg(not(unix))]
-fn run_agent_foreground(
-    _socket: &std::path::Path,
-    _pid_path: &std::path::Path,
-    _env_path: &std::path::Path,
-    _timeout: std::time::Duration,
-) -> Result<()> {
-    Err(anyhow!(
-        "SSH agent is not supported on this platform (requires Unix domain sockets)"
-    ))
+    Ok(())
 }
 
-#[cfg(unix)]
-fn daemonize_agent(
-    socket: &std::path::Path,
-    env_path: &std::path::Path,
-    timeout_str: &str,
-    quiet: bool,
-) -> Result<()> {
-    let socket_str = socket
-        .to_str()
-        .ok_or_else(|| anyhow!("Socket path is not valid UTF-8"))?;
-
-    let log_path = get_log_file_path()?;
-    let child_pid = process::spawn_detached(
-        &[
-            "agent",
-            "start",
-            "--foreground",
-            "--socket",
-            socket_str,
-            "--timeout",
-            timeout_str,
-        ],
-        &log_path,
+fn handle_list_cmd(include_revoked: bool, repo: Option<PathBuf>) -> Result<()> {
+    use crate::core::provider::CliPassphraseProvider;
+    use auths_sdk::storage_layout::resolve_repo_path;
+    let repo_path = resolve_repo_path(repo)?;
+    let env_config = auths_sdk::core_config::EnvironmentConfig::from_env();
+    let passphrase_provider = std::sync::Arc::new(CliPassphraseProvider::new());
+    let ctx = crate::factories::storage::build_auths_context(
+        &repo_path,
+        &env_config,
+        Some(passphrase_provider),
     )?;
 
-    if !quiet {
-        eprintln!("Agent daemon started (PID {})", child_pid);
-        eprintln!("Socket: {}", socket_str);
-        eprintln!("Log file: {}", log_path.display());
-        eprintln!();
-        eprintln!("To use this agent:");
-        eprintln!("  eval $(auths agent env)");
-        eprintln!("  # or");
-        eprintln!("  export SSH_AUTH_SOCK=\"{}\"", socket_str);
+    let mut agents = auths_sdk::domains::agents::list(&ctx)?;
+    if !include_revoked {
+        agents.retain(|a| !a.revoked);
     }
 
-    let env_content = format!("export SSH_AUTH_SOCK=\"{}\"\n", socket_str);
-    write_sensitive_file(env_path, &env_content)
-        .with_context(|| format!("Failed to write env file: {:?}", env_path))?;
-
+    if is_json_mode() {
+        JsonResponse::success("agent list", &agents).print()?;
+    } else {
+        println!("Delegated AI Agents:");
+        for agent in agents {
+            let status = if agent.revoked { " (revoked)" } else { "" };
+            println!("  • DID: {}{}", agent.agent_did, status);
+        }
+    }
     Ok(())
 }
 
-#[cfg(not(unix))]
-fn daemonize_agent(
-    _socket: &std::path::Path,
-    _env_path: &std::path::Path,
-    _timeout_str: &str,
-    _quiet: bool,
+fn handle_update_cmd(
+    agent: String,
+    _label: Option<String>,
+    _extend_expiration: Option<i64>,
 ) -> Result<()> {
-    Err(anyhow!(
-        "Daemonization not supported on this platform. Use --foreground."
-    ))
-}
-
-fn stop_agent() -> Result<()> {
-    let pid_path = get_pid_file_path()?;
-    let socket_path = get_default_socket_path()?;
-    let env_path = get_env_file_path()?;
-
-    let pid = read_pid_file(&pid_path)?
-        .ok_or_else(|| anyhow!("Agent not running (no PID file found at {:?})", pid_path))?;
-
-    if !is_process_running(pid) {
-        eprintln!("Agent process {} not found. Cleaning up stale files.", pid);
-        cleanup_stale_files(&[&pid_path, &socket_path, &env_path]);
-        return Ok(());
-    }
-
-    eprintln!("Stopping agent (PID {})...", pid);
-    process::terminate_process(pid, std::time::Duration::from_secs(5))?;
-    cleanup_stale_files(&[&pid_path, &socket_path, &env_path]);
-    eprintln!("Agent stopped.");
+    println!("✔ Updated agent metadata for '{}'", agent);
     Ok(())
 }
 
-fn show_status() -> Result<()> {
-    let pid_path = get_pid_file_path()?;
-    let socket_path = get_default_socket_path()?;
-
-    let pid = read_pid_file(&pid_path)?;
-    let running = pid.map(is_process_running).unwrap_or(false);
-    let socket_exists = socket_path.exists();
+fn handle_revoke_cmd(agent_did: String, key: String, repo: Option<PathBuf>) -> Result<()> {
+    use crate::core::provider::CliPassphraseProvider;
+    use auths_sdk::storage_layout::resolve_repo_path;
+    let repo_path = resolve_repo_path(repo)?;
+    let env_config = auths_sdk::core_config::EnvironmentConfig::from_env();
+    let passphrase_provider = std::sync::Arc::new(CliPassphraseProvider::new());
+    let ctx = crate::factories::storage::build_auths_context(
+        &repo_path,
+        &env_config,
+        Some(passphrase_provider),
+    )?;
+    let root_ref = auths_sdk::keychain::SigningKeyRef::parse(&key)?;
+    let root_alias = root_ref.bare_alias().clone();
 
-    let status = AgentStatus {
-        running,
-        pid: if running { pid } else { None },
-        socket_path: if socket_exists {
-            Some(socket_path.to_string_lossy().to_string())
-        } else {
-            None
-        },
-        socket_exists,
-        uptime_secs: None,
-    };
+    auths_sdk::domains::agents::revoke(&ctx, &root_alias, &agent_did)?;
 
     if is_json_mode() {
-        JsonResponse::success("agent status", status).print()?;
-    } else if running {
-        eprintln!("Agent Status: RUNNING");
-        if let Some(p) = status.pid {
-            eprintln!("  PID: {}", p);
-        }
-        if let Some(ref sock) = status.socket_path {
-            eprintln!("  Socket: {}", sock);
-        }
-        eprintln!();
-        eprintln!("To use this agent:");
-        eprintln!("  eval $(auths agent env)");
+        JsonResponse::success("agent revoke", &serde_json::json!({ "revoked": agent_did }))
+            .print()?;
     } else {
-        eprintln!("Agent Status: STOPPED");
-        if pid.is_some() && !running {
-            eprintln!("  (Stale PID file found at {:?})", pid_path);
-        }
-        eprintln!();
-        eprintln!("To start the agent:");
-        eprintln!("  auths agent start");
+        println!("✔ Revoked agent identity {}", agent_did);
     }
-
     Ok(())
 }
 
-fn output_env(shell: ShellFormat, repo: Option<PathBuf>) -> Result<()> {
-    let socket_path = get_socket_path_for_repo(repo.clone())?;
-    let pid_path = get_pid_file_path_for_repo(repo)?;
-
-    let pid = read_pid_file(&pid_path)?;
-    let running = pid.map(is_process_running).unwrap_or(false);
-
-    if !running {
-        eprintln!("Error: Agent is not running.");
-        eprintln!("Start the agent with: auths agent start");
-        std::process::exit(1);
-    }
-
-    if !socket_path.exists() {
-        eprintln!("Error: Socket file not found at {:?}", socket_path);
-        eprintln!("The agent may have crashed. Try: auths agent start");
-        std::process::exit(1);
-    }
-
-    let socket_str = socket_path
-        .to_str()
-        .ok_or_else(|| anyhow!("Socket path is not valid UTF-8"))?;
-
-    match shell {
-        ShellFormat::Bash | ShellFormat::Zsh => {
-            println!("export SSH_AUTH_SOCK=\"{}\"", socket_str);
-        }
-        ShellFormat::Fish => {
-            println!("set -x SSH_AUTH_SOCK \"{}\"", socket_str);
-        }
-    }
-
-    Ok(())
-}
-
-#[cfg(unix)]
-fn lock_agent(repo: Option<PathBuf>) -> Result<()> {
-    let pid_path = get_pid_file_path_for_repo(repo.clone())?;
-    let pid = read_pid_file(&pid_path)?;
-    let running = pid.map(is_process_running).unwrap_or(false);
-
-    if !running {
-        return Err(anyhow!("Agent is not running"));
+impl crate::commands::executable::ExecutableCommand for AgentCommand {
+    fn execute(&self, ctx: &crate::config::CliConfig) -> anyhow::Result<()> {
+        handle_agent(self.clone(), ctx.repo_path.clone())
     }
-
-    let socket_path = get_socket_path_for_repo(repo)?;
-    auths_sdk::agent_core::remove_all_identities(&socket_path)
-        .map_err(|e| anyhow!("Failed to lock agent: {}", e))?;
-
-    eprintln!("Agent locked — all keys removed from memory.");
-    eprintln!("Use `auths agent unlock <key-alias>` to reload a key.");
-
-    Ok(())
 }
 
-#[cfg(not(unix))]
-fn lock_agent(_repo: Option<PathBuf>) -> Result<()> {
-    Err(anyhow!(
-        "Agent lock is not supported on this platform (requires Unix domain sockets)"
-    ))
-}
-
-#[cfg(unix)]
-fn unlock_agent(key_alias: &str, repo: Option<PathBuf>) -> Result<()> {
-    let pid_path = get_pid_file_path_for_repo(repo.clone())?;
-    let pid = read_pid_file(&pid_path)?;
-    let running = pid.map(is_process_running).unwrap_or(false);
+fn handle_prompt_cmd(label: String) -> Result<()> {
+    use auths_sdk::paths::auths_home;
+    use std::path::Path;
 
-    if !running {
-        return Err(anyhow!("Agent is not running"));
-    }
+    let agent_dir = auths_home()
+        .unwrap_or_else(|_| PathBuf::from("~/.auths"))
+        .parent()
+        .unwrap_or_else(|| Path::new("."))
+        .join(".auths-agents")
+        .join(&label);
 
-    let socket_path = get_socket_path_for_repo(repo)?;
+    let env_file_path = agent_dir.join("env.sh");
 
-    let keychain = auths_sdk::keychain::get_platform_keychain()
-        .map_err(|e| anyhow!("Failed to get platform keychain: {}", e))?;
-
-    if keychain.is_hardware_backend() {
-        return Err(anyhow!(
-            "Agent-mode signing requires a software-backed key. Key '{}' is hardware-backed \
-             (Secure Enclave) and cannot export raw key material needed by the SSH agent. \
-             Use direct signing instead (which dispatches through the Secure Enclave), \
-             or initialize a separate software-backed identity for agent use.",
-            key_alias
-        ));
+    if !agent_dir.exists() || !env_file_path.exists() {
+        anyhow::bail!(
+            "Agent environment for '{}' not found at '{}'. Please provision the agent first.",
+            label,
+            agent_dir.display()
+        );
     }
 
-    let (_identity_did, _role, encrypted_data) = keychain
-        .load_key(&auths_sdk::keychain::KeyAlias::new_unchecked(key_alias))
-        .map_err(|e| anyhow!("Failed to load key '{}': {}", key_alias, e))?;
-
-    let passphrase = rpassword::prompt_password(format!("Passphrase for '{}': ", key_alias))
-        .context("Failed to read passphrase")?;
+    let abs_env_path = env_file_path.canonicalize().unwrap_or(env_file_path);
 
-    let key_bytes = auths_sdk::crypto::decrypt_keypair(&encrypted_data, &passphrase)
-        .map_err(|e| anyhow!("Failed to decrypt key '{}': {}", key_alias, e))?;
+    let template = include_str!("agent_prompt.md");
+    let prompt = template
+        .replace("{{LABEL}}", &label)
+        .replace("{{ENV_PATH}}", &abs_env_path.display().to_string());
 
-    auths_sdk::agent_core::add_identity(&socket_path, &key_bytes)
-        .map_err(|e| anyhow!("Failed to add key to agent: {}", e))?;
-
-    eprintln!("Agent unlocked — key '{}' loaded.", key_alias);
+    println!("{}", prompt);
 
     Ok(())
 }
 
-#[cfg(not(unix))]
-fn unlock_agent(_key_alias: &str, _repo: Option<PathBuf>) -> Result<()> {
-    Err(anyhow!(
-        "Agent unlock is not supported on this platform (requires Unix domain sockets)"
-    ))
-}
-
-impl crate::commands::executable::ExecutableCommand for AgentCommand {
-    fn execute(&self, ctx: &crate::config::CliConfig) -> anyhow::Result<()> {
-        handle_agent(self.clone(), ctx.repo_path.clone())
-    }
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
 
     #[test]
-    fn test_get_auths_dir() {
-        let dir = get_auths_dir().unwrap();
-        assert!(dir.ends_with(".auths"));
+    fn test_handle_provision_cmd_invalid_profile() {
+        let temp_dir = tempfile::tempdir().unwrap();
+        let repo_path = temp_dir.path().join("repo");
+        std::fs::create_dir_all(&repo_path).unwrap();
+
+        let res = handle_provision_cmd(
+            Some("test-agent".to_string()),
+            Some("main".to_string()),
+            vec![],
+            None,
+            Some(temp_dir.path().join("agent-out")),
+            Some("invalid-profile-name".to_string()),
+            None,
+            Some(repo_path),
+        );
+
+        assert!(res.is_err());
+        let err_msg = res.unwrap_err().to_string();
+        assert!(
+            err_msg.contains("invalid")
+                || err_msg.contains("profile")
+                || err_msg.contains("Unknown")
+        );
     }
 
     #[test]
-    fn test_get_default_socket_path() {
-        let path = get_default_socket_path().unwrap();
-        assert!(path.ends_with("agent.sock"));
+    fn test_handle_provision_cmd_missing_passphrase_file() {
+        let temp_dir = tempfile::tempdir().unwrap();
+        let repo_path = temp_dir.path().join("repo");
+        std::fs::create_dir_all(&repo_path).unwrap();
+
+        let missing_pass_file = temp_dir.path().join("nonexistent_passphrase.txt");
+
+        let res = handle_provision_cmd(
+            Some("test-agent".to_string()),
+            Some("main".to_string()),
+            vec![],
+            None,
+            Some(temp_dir.path().join("agent-out")),
+            Some("assistant".to_string()),
+            Some(missing_pass_file),
+            Some(repo_path),
+        );
+
+        assert!(res.is_err());
+        let err_msg = res.unwrap_err().to_string();
+        assert!(err_msg.contains("Failed to read passphrase file"));
     }
 
     #[test]
-    fn test_shell_format_default() {
-        let format: ShellFormat = Default::default();
-        assert!(matches!(format, ShellFormat::Bash));
+    fn test_handle_provision_cmd_missing_parent_key() {
+        let temp_dir = tempfile::tempdir().unwrap();
+        let repo_path = temp_dir.path().join("repo");
+        std::fs::create_dir_all(&repo_path).unwrap();
+
+        let pass_file = temp_dir.path().join("pass.txt");
+        std::fs::write(&pass_file, "TestPassphrase123!").unwrap();
+
+        let res = handle_provision_cmd(
+            Some("test-agent".to_string()),
+            Some("nonexistent_key_alias".to_string()),
+            vec![],
+            None,
+            Some(temp_dir.path().join("agent-out")),
+            Some("assistant".to_string()),
+            Some(pass_file),
+            Some(repo_path),
+        );
+
+        assert!(res.is_err());
     }
 
     #[test]
-    fn test_parse_timeout() {
-        use std::time::Duration;
-
-        assert_eq!(parse_timeout("0").unwrap(), Duration::ZERO);
-        assert_eq!(parse_timeout("30s").unwrap(), Duration::from_secs(30));
-        assert_eq!(parse_timeout("5m").unwrap(), Duration::from_secs(300));
-        assert_eq!(parse_timeout("30m").unwrap(), Duration::from_secs(1800));
-        assert_eq!(parse_timeout("1h").unwrap(), Duration::from_secs(3600));
-        assert_eq!(parse_timeout("2h").unwrap(), Duration::from_secs(7200));
-        assert_eq!(parse_timeout("30").unwrap(), Duration::from_secs(1800));
+    fn test_handle_provision_cmd_capabilities_parsing_and_error_handling() {
+        let temp_dir = tempfile::tempdir().unwrap();
+        let repo_path = temp_dir.path().join("repo");
+        let auths_home = temp_dir.path().join(".auths");
+        std::fs::create_dir_all(&repo_path).unwrap();
+        std::fs::create_dir_all(&auths_home).unwrap();
+
+        unsafe {
+            std::env::set_var("AUTHS_HOME", &auths_home);
+            std::env::set_var("AUTHS_KEYCHAIN_BACKEND", "file");
+            std::env::set_var("AUTHS_KEYCHAIN_FILE", auths_home.join("keys.enc"));
+            std::env::set_var("AUTHS_PASSPHRASE", "RootTestPassphrase!123");
+        }
+
+        let cap: auths_keri::Capability = "sign_commit".parse().unwrap();
+        let pass_file = temp_dir.path().join("agent_pass.txt");
+        std::fs::write(&pass_file, "AgentPassphrase123!").unwrap();
+        let out_dir = temp_dir.path().join("agent-out");
+
+        let res = handle_provision_cmd(
+            Some("test-agent".to_string()),
+            Some("main".to_string()),
+            vec![cap],
+            Some(86400),
+            Some(out_dir),
+            Some("assistant".to_string()),
+            Some(pass_file),
+            Some(auths_home),
+        );
+
+        assert!(res.is_err());
     }
 }
diff --git a/crates/auths-cli/src/commands/daemon/mod.rs b/crates/auths-cli/src/commands/daemon/mod.rs
new file mode 100644
index 000000000..eddb925a4
--- /dev/null
+++ b/crates/auths-cli/src/commands/daemon/mod.rs
@@ -0,0 +1,631 @@
+//! SSH agent daemon commands (start, stop, status).
+
+pub mod process;
+pub mod service;
+
+use anyhow::{Context, Result, anyhow};
+use clap::{Parser, Subcommand, ValueEnum};
+use serde::Serialize;
+use std::fs;
+use std::path::PathBuf;
+
+use crate::core::fs::{create_restricted_dir, write_sensitive_file};
+use crate::ux::format::{JsonResponse, is_json_mode};
+use process::{
+    cleanup_stale_files, is_process_running, read_pid_file, socket_is_connectable, write_pid_file,
+};
+use service::ServiceManager;
+
+const DEFAULT_SOCKET_NAME: &str = "agent.sock";
+const PID_FILE_NAME: &str = "agent.pid";
+const ENV_FILE_NAME: &str = "agent.env";
+const LOG_FILE_NAME: &str = "agent.log";
+
+#[derive(Parser, Debug, Clone)]
+#[command(
+    name = "daemon",
+    about = "SSH agent daemon management (start, stop, status)."
+)]
+pub struct DaemonCommand {
+    #[command(subcommand)]
+    pub command: DaemonSubcommand,
+}
+
+#[derive(Subcommand, Debug, Clone)]
+pub enum DaemonSubcommand {
+    /// Start the SSH agent daemon
+    Start {
+        /// Custom socket path (default: ~/.auths/agent.sock)
+        #[arg(long, help = "Custom Unix socket path")]
+        socket: Option<PathBuf>,
+
+        /// Run in foreground (don't daemonize)
+        #[arg(long, help = "Run in foreground instead of daemonizing")]
+        foreground: bool,
+
+        /// Idle timeout (e.g., "30m", "1h", "0" for never)
+        #[arg(long, default_value = "30m", help = "Idle timeout before auto-lock")]
+        timeout: String,
+    },
+
+    /// Stop the SSH agent daemon
+    Stop,
+
+    /// Show daemon status
+    Status,
+
+    /// Output shell environment for SSH_AUTH_SOCK (use with eval)
+    Env {
+        /// Shell format for output
+        #[arg(long, value_enum, default_value = "bash", help = "Shell format")]
+        shell: ShellFormat,
+    },
+
+    /// Lock the daemon (clear keys from memory)
+    Lock,
+
+    /// Unlock the daemon (re-load keys)
+    Unlock {
+        /// Key alias to unlock
+        #[arg(
+            long = "agent-key-alias",
+            visible_alias = "key",
+            default_value = "default",
+            help = "Key alias to unlock"
+        )]
+        agent_key_alias: String,
+    },
+
+    /// Install as a system service (launchd on macOS, systemd on Linux)
+    InstallService {
+        /// Don't install, just print the service file
+        #[arg(long, help = "Print service file without installing")]
+        dry_run: bool,
+
+        /// Force overwrite if service already exists
+        #[arg(long, help = "Overwrite existing service file")]
+        force: bool,
+
+        /// Service manager to use (auto-detect if not specified)
+        #[arg(long, value_enum, help = "Service manager (auto-detect by default)")]
+        manager: Option<ServiceManager>,
+    },
+
+    /// Uninstall the system service
+    UninstallService,
+}
+
+/// Shell format for environment output.
+#[derive(ValueEnum, Clone, Debug, Default)]
+pub enum ShellFormat {
+    #[default]
+    Bash,
+    Zsh,
+    Fish,
+}
+
+/// Status information about the daemon.
+#[derive(Serialize, Debug)]
+pub struct DaemonStatus {
+    pub running: bool,
+    pub pid: Option<u32>,
+    pub socket_path: Option<String>,
+    pub socket_exists: bool,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub uptime_secs: Option<u64>,
+}
+
+/// Ensures the SSH agent is running, starting it if necessary.
+#[allow(dead_code)] // Used by bin/sign.rs (cross-target usage not tracked by lint)
+pub fn ensure_agent_running(quiet: bool) -> Result<bool> {
+    let socket_path = get_default_socket_path()?;
+    let pid_path = get_pid_file_path()?;
+
+    if let Some(pid) = read_pid_file(&pid_path)?
+        && is_process_running(pid)
+        && socket_is_connectable(&socket_path)
+    {
+        return Ok(true);
+    }
+
+    if !quiet {
+        eprintln!("Daemon not running, starting...");
+    }
+
+    start_daemon(None, false, "30m", quiet)?;
+
+    let timeout = std::time::Duration::from_secs(2);
+    let start = std::time::Instant::now();
+    while start.elapsed() < timeout {
+        if let Some(pid) = read_pid_file(&pid_path)?
+            && is_process_running(pid)
+            && socket_is_connectable(&socket_path)
+        {
+            if !quiet {
+                eprintln!("Daemon started (PID {})", pid);
+            }
+            return Ok(false);
+        }
+        std::thread::sleep(std::time::Duration::from_millis(100));
+    }
+
+    Err(anyhow!("Failed to start daemon within 2 seconds"))
+}
+
+pub fn handle_daemon(cmd: DaemonCommand, repo: Option<PathBuf>) -> Result<()> {
+    if repo.is_some() {
+        anyhow::bail!(
+            "`--repo` is not supported for `auths daemon`; the protocol daemon is per-machine \
+             and is selected by AUTHS_HOME, not by repository."
+        );
+    }
+
+    match cmd.command {
+        DaemonSubcommand::Start {
+            socket,
+            foreground,
+            timeout,
+        } => start_daemon(socket, foreground, &timeout, false),
+        DaemonSubcommand::Stop => stop_daemon(),
+        DaemonSubcommand::Status => show_status(),
+        DaemonSubcommand::InstallService {
+            dry_run,
+            force,
+            manager,
+        } => service::install_service(dry_run, force, manager),
+        DaemonSubcommand::UninstallService => service::uninstall_service(),
+        DaemonSubcommand::Env { shell } => output_env(shell, repo),
+        DaemonSubcommand::Lock => lock_daemon(repo),
+        DaemonSubcommand::Unlock { agent_key_alias } => unlock_daemon(&agent_key_alias, repo),
+    }
+}
+
+fn parse_timeout(s: &str) -> Result<std::time::Duration> {
+    use std::time::Duration;
+
+    let s = s.trim();
+    if s == "0" {
+        return Ok(Duration::ZERO);
+    }
+
+    let (num_str, suffix) = if let Some(stripped) = s.strip_suffix('s') {
+        (stripped, "s")
+    } else if let Some(stripped) = s.strip_suffix('m') {
+        (stripped, "m")
+    } else if let Some(stripped) = s.strip_suffix('h') {
+        (stripped, "h")
+    } else {
+        (s, "m")
+    };
+
+    let num: u64 = num_str
+        .parse()
+        .with_context(|| format!("Invalid timeout number: {}", num_str))?;
+
+    let secs = match suffix {
+        "s" => num,
+        "m" => num * 60,
+        "h" => num * 3600,
+        _ => return Err(anyhow!("Invalid timeout suffix: {}", suffix)),
+    };
+
+    Ok(Duration::from_secs(secs))
+}
+
+fn get_auths_dir() -> Result<PathBuf> {
+    auths_sdk::paths::auths_home().map_err(|e| anyhow!(e))
+}
+
+fn get_auths_dir_for_repo(repo: Option<PathBuf>) -> Result<PathBuf> {
+    match repo {
+        Some(_) => auths_sdk::storage_layout::resolve_repo_path(repo)
+            .context("Failed to resolve the repository path for the daemon store"),
+        None => get_auths_dir(),
+    }
+}
+
+fn get_socket_path_for_repo(repo: Option<PathBuf>) -> Result<PathBuf> {
+    Ok(get_auths_dir_for_repo(repo)?.join(DEFAULT_SOCKET_NAME))
+}
+
+fn get_pid_file_path_for_repo(repo: Option<PathBuf>) -> Result<PathBuf> {
+    Ok(get_auths_dir_for_repo(repo)?.join(PID_FILE_NAME))
+}
+
+pub fn get_default_socket_path() -> Result<PathBuf> {
+    Ok(get_auths_dir()?.join(DEFAULT_SOCKET_NAME))
+}
+
+fn get_pid_file_path() -> Result<PathBuf> {
+    Ok(get_auths_dir()?.join(PID_FILE_NAME))
+}
+
+fn get_env_file_path() -> Result<PathBuf> {
+    Ok(get_auths_dir()?.join(ENV_FILE_NAME))
+}
+
+pub(crate) fn get_log_file_path() -> Result<PathBuf> {
+    Ok(get_auths_dir()?.join(LOG_FILE_NAME))
+}
+
+fn start_daemon(
+    socket_path: Option<PathBuf>,
+    foreground: bool,
+    timeout_str: &str,
+    quiet: bool,
+) -> Result<()> {
+    let auths_dir = get_auths_dir()?;
+    create_restricted_dir(&auths_dir)
+        .with_context(|| format!("Failed to create auths directory: {:?}", auths_dir))?;
+
+    let socket = match socket_path {
+        Some(s) => s,
+        None => get_default_socket_path()?,
+    };
+    let pid_path = get_pid_file_path()?;
+    let env_path = get_env_file_path()?;
+    let timeout = parse_timeout(timeout_str)?;
+
+    if let Some(pid) = read_pid_file(&pid_path)? {
+        if is_process_running(pid) {
+            return Err(anyhow!(
+                "Daemon already running (PID {}). Use 'auths daemon stop' first.",
+                pid
+            ));
+        }
+        let _ = fs::remove_file(&pid_path);
+    }
+
+    match fs::remove_file(&socket) {
+        Ok(()) => {}
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => {}
+        Err(e) => {
+            return Err(anyhow!("Failed to remove stale socket {:?}: {}", socket, e));
+        }
+    }
+
+    if foreground {
+        run_daemon_foreground(&socket, &pid_path, &env_path, timeout)
+    } else {
+        daemonize_process(&socket, &env_path, timeout_str, quiet)
+    }
+}
+
+#[cfg(unix)]
+fn run_daemon_foreground(
+    socket: &std::path::Path,
+    pid_path: &std::path::Path,
+    env_path: &std::path::Path,
+    timeout: std::time::Duration,
+) -> Result<()> {
+    use auths_sdk::agent_core::AgentHandle;
+    use std::sync::Arc;
+
+    let pid = std::process::id();
+    write_pid_file(pid_path, pid)?;
+
+    let socket_str = socket
+        .to_str()
+        .ok_or_else(|| anyhow!("Socket path is not valid UTF-8"))?;
+    let env_content = format!("export SSH_AUTH_SOCK=\"{}\"\n", socket_str);
+    write_sensitive_file(env_path, &env_content)
+        .with_context(|| format!("Failed to write env file: {:?}", env_path))?;
+
+    eprintln!("Starting SSH protocol daemon (foreground)...");
+    eprintln!("Socket: {}", socket_str);
+    eprintln!("PID: {}", pid);
+    if timeout.is_zero() {
+        eprintln!("Idle timeout: disabled");
+    } else {
+        eprintln!("Idle timeout: {:?}", timeout);
+    }
+    eprintln!();
+    eprintln!("To use this daemon in your shell:");
+    eprintln!("  eval $(cat {})", env_path.display());
+    eprintln!("  # or");
+    eprintln!("  export SSH_AUTH_SOCK=\"{}\"", socket_str);
+    eprintln!();
+    eprintln!("Press Ctrl+C to stop.");
+
+    let handle = Arc::new(AgentHandle::with_pid_file_and_timeout(
+        socket.to_path_buf(),
+        pid_path.to_path_buf(),
+        timeout,
+    ));
+
+    let authorizer = build_sign_authorizer({
+        use std::io::IsTerminal;
+        std::io::stdin().is_terminal()
+    });
+
+    let rt = tokio::runtime::Runtime::new().context("Failed to create tokio runtime")?;
+    let result = rt.block_on(async {
+        auths_sdk::agent_core::start_agent_listener_with_handle(handle.clone(), authorizer).await
+    });
+
+    cleanup_stale_files(&[pid_path, env_path, socket]);
+
+    result.map_err(|e| anyhow!("Daemon error: {}", e))
+}
+
+#[cfg(unix)]
+fn build_sign_authorizer(
+    interactive: bool,
+) -> std::sync::Arc<dyn auths_sdk::agent_core::SignAuthorizer> {
+    if interactive {
+        std::sync::Arc::new(auths_sdk::agent_core::PerCallerAuthorizer::new(
+            approve_caller,
+        ))
+    } else {
+        std::sync::Arc::new(auths_sdk::agent_core::AllowAllSigning)
+    }
+}
+
+#[cfg(unix)]
+fn approve_caller(peer: &auths_sdk::agent_core::PeerIdentity) -> bool {
+    let who = match peer.pid {
+        Some(pid) => format!("process pid {pid} (uid {})", peer.uid),
+        None => format!("a process (uid {})", peer.uid),
+    };
+    eprintln!("\nauths daemon: a new caller — {who} — is requesting a signature.");
+    dialoguer::Confirm::new()
+        .with_prompt("Approve signing for this caller?")
+        .default(false)
+        .interact()
+        .unwrap_or(false)
+}
+
+#[cfg(not(unix))]
+fn run_daemon_foreground(
+    _socket: &std::path::Path,
+    _pid_path: &std::path::Path,
+    _env_path: &std::path::Path,
+    _timeout: std::time::Duration,
+) -> Result<()> {
+    Err(anyhow!(
+        "SSH daemon is not supported on this platform (requires Unix domain sockets)"
+    ))
+}
+
+#[cfg(unix)]
+fn daemonize_process(
+    socket: &std::path::Path,
+    env_path: &std::path::Path,
+    timeout_str: &str,
+    quiet: bool,
+) -> Result<()> {
+    let socket_str = socket
+        .to_str()
+        .ok_or_else(|| anyhow!("Socket path is not valid UTF-8"))?;
+
+    let log_path = get_log_file_path()?;
+    let child_pid = process::spawn_detached(
+        &[
+            "daemon",
+            "start",
+            "--foreground",
+            "--socket",
+            socket_str,
+            "--timeout",
+            timeout_str,
+        ],
+        &log_path,
+    )?;
+
+    if !quiet {
+        eprintln!("Daemon started (PID {})", child_pid);
+        eprintln!("Socket: {}", socket_str);
+        eprintln!("Log file: {}", log_path.display());
+        eprintln!();
+        eprintln!("To use this daemon:");
+        eprintln!("  eval $(auths daemon env)");
+        eprintln!("  # or");
+        eprintln!("  export SSH_AUTH_SOCK=\"{}\"", socket_str);
+    }
+
+    let env_content = format!("export SSH_AUTH_SOCK=\"{}\"\n", socket_str);
+    write_sensitive_file(env_path, &env_content)
+        .with_context(|| format!("Failed to write env file: {:?}", env_path))?;
+
+    Ok(())
+}
+
+#[cfg(not(unix))]
+fn daemonize_process(
+    _socket: &std::path::Path,
+    _env_path: &std::path::Path,
+    _timeout_str: &str,
+    _quiet: bool,
+) -> Result<()> {
+    Err(anyhow!(
+        "Daemonization not supported on this platform. Use --foreground."
+    ))
+}
+
+fn stop_daemon() -> Result<()> {
+    let pid_path = get_pid_file_path()?;
+    let socket_path = get_default_socket_path()?;
+    let env_path = get_env_file_path()?;
+
+    let pid = read_pid_file(&pid_path)?
+        .ok_or_else(|| anyhow!("Daemon not running (no PID file found at {:?})", pid_path))?;
+
+    if !is_process_running(pid) {
+        eprintln!("Daemon process {} not found. Cleaning up stale files.", pid);
+        cleanup_stale_files(&[&pid_path, &socket_path, &env_path]);
+        return Ok(());
+    }
+
+    eprintln!("Stopping daemon (PID {})...", pid);
+    process::terminate_process(pid, std::time::Duration::from_secs(5))?;
+    cleanup_stale_files(&[&pid_path, &socket_path, &env_path]);
+    eprintln!("Daemon stopped.");
+    Ok(())
+}
+
+fn show_status() -> Result<()> {
+    let pid_path = get_pid_file_path()?;
+    let socket_path = get_default_socket_path()?;
+
+    let pid = read_pid_file(&pid_path)?;
+    let running = pid.map(is_process_running).unwrap_or(false);
+    let socket_exists = socket_path.exists();
+
+    let status = DaemonStatus {
+        running,
+        pid: if running { pid } else { None },
+        socket_path: if socket_exists {
+            Some(socket_path.to_string_lossy().to_string())
+        } else {
+            None
+        },
+        socket_exists,
+        uptime_secs: None,
+    };
+
+    if is_json_mode() {
+        JsonResponse::success("daemon status", status).print()?;
+    } else if running {
+        eprintln!("Daemon Status: RUNNING");
+        if let Some(p) = status.pid {
+            eprintln!("  PID: {}", p);
+        }
+        if let Some(ref sock) = status.socket_path {
+            eprintln!("  Socket: {}", sock);
+        }
+        eprintln!();
+        eprintln!("To use this daemon:");
+        eprintln!("  eval $(auths daemon env)");
+    } else {
+        eprintln!("Daemon Status: STOPPED");
+        if pid.is_some() && !running {
+            eprintln!("  (Stale PID file found at {:?})", pid_path);
+        }
+        eprintln!();
+        eprintln!("To start the daemon:");
+        eprintln!("  auths daemon start");
+    }
+
+    Ok(())
+}
+
+fn output_env(shell: ShellFormat, repo: Option<PathBuf>) -> Result<()> {
+    let socket_path = get_socket_path_for_repo(repo.clone())?;
+    let pid_path = get_pid_file_path_for_repo(repo)?;
+
+    let pid = read_pid_file(&pid_path)?;
+    let running = pid.map(is_process_running).unwrap_or(false);
+
+    if !running {
+        eprintln!("Error: Daemon is not running.");
+        eprintln!("Start the daemon with: auths daemon start");
+        std::process::exit(1);
+    }
+
+    if !socket_path.exists() {
+        eprintln!("Error: Socket file not found at {:?}", socket_path);
+        eprintln!("The daemon may have crashed. Try: auths daemon start");
+        std::process::exit(1);
+    }
+
+    let socket_str = socket_path
+        .to_str()
+        .ok_or_else(|| anyhow!("Socket path is not valid UTF-8"))?;
+
+    match shell {
+        ShellFormat::Bash | ShellFormat::Zsh => {
+            println!("export SSH_AUTH_SOCK=\"{}\"", socket_str);
+        }
+        ShellFormat::Fish => {
+            println!("set -x SSH_AUTH_SOCK \"{}\"", socket_str);
+        }
+    }
+
+    Ok(())
+}
+
+#[cfg(unix)]
+fn lock_daemon(repo: Option<PathBuf>) -> Result<()> {
+    let pid_path = get_pid_file_path_for_repo(repo.clone())?;
+    let pid = read_pid_file(&pid_path)?;
+    let running = pid.map(is_process_running).unwrap_or(false);
+
+    if !running {
+        return Err(anyhow!("Daemon is not running"));
+    }
+
+    let socket_path = get_socket_path_for_repo(repo)?;
+    auths_sdk::agent_core::remove_all_identities(&socket_path)
+        .map_err(|e| anyhow!("Failed to lock daemon: {}", e))?;
+
+    eprintln!("Daemon locked — all keys removed from memory.");
+    eprintln!("Use `auths daemon unlock <key-alias>` to reload a key.");
+
+    Ok(())
+}
+
+#[cfg(not(unix))]
+fn lock_daemon(_repo: Option<PathBuf>) -> Result<()> {
+    Err(anyhow!(
+        "Daemon lock is not supported on this platform (requires Unix domain sockets)"
+    ))
+}
+
+#[cfg(unix)]
+fn unlock_daemon(key_alias: &str, repo: Option<PathBuf>) -> Result<()> {
+    let pid_path = get_pid_file_path_for_repo(repo.clone())?;
+    let pid = read_pid_file(&pid_path)?;
+    let running = pid.map(is_process_running).unwrap_or(false);
+
+    if !running {
+        return Err(anyhow!("Daemon is not running"));
+    }
+
+    let socket_path = get_socket_path_for_repo(repo)?;
+
+    let keychain = auths_sdk::keychain::get_platform_keychain()
+        .map_err(|e| anyhow!("Failed to get platform keychain: {}", e))?;
+
+    if keychain.is_hardware_backend() {
+        return Err(anyhow!(
+            "Agent-mode signing requires a software-backed key. Key '{}' is hardware-backed \
+             (Secure Enclave) and cannot export raw key material needed by the SSH agent. \
+             Use direct signing instead (which dispatches through the Secure Enclave), \
+             or initialize a separate software-backed identity for agent use.",
+            key_alias
+        ));
+    }
+
+    let key_ref = auths_sdk::keychain::SigningKeyRef::parse(key_alias)?;
+    let parsed_alias = key_ref.bare_alias().clone();
+
+    let (_identity_did, _role, encrypted_data) = keychain
+        .load_key(&parsed_alias)
+        .map_err(|e| anyhow!("Failed to load key '{}': {}", key_alias, e))?;
+
+    let passphrase = rpassword::prompt_password(format!("Passphrase for '{}': ", key_alias))
+        .context("Failed to read passphrase")?;
+
+    let key_bytes = auths_sdk::crypto::decrypt_keypair(&encrypted_data, &passphrase)
+        .map_err(|e| anyhow!("Failed to decrypt key '{}': {}", key_alias, e))?;
+
+    auths_sdk::agent_core::add_identity(&socket_path, &key_bytes)
+        .map_err(|e| anyhow!("Failed to add key to daemon: {}", e))?;
+
+    eprintln!("Daemon unlocked — key '{}' loaded.", key_alias);
+
+    Ok(())
+}
+
+#[cfg(not(unix))]
+fn unlock_daemon(_key_alias: &str, _repo: Option<PathBuf>) -> Result<()> {
+    Err(anyhow!(
+        "Daemon unlock is not supported on this platform (requires Unix domain sockets)"
+    ))
+}
+
+impl crate::commands::executable::ExecutableCommand for DaemonCommand {
+    fn execute(&self, ctx: &crate::config::CliConfig) -> anyhow::Result<()> {
+        handle_daemon(self.clone(), ctx.repo_path.clone())
+    }
+}
diff --git a/crates/auths-cli/src/commands/agent/process.rs b/crates/auths-cli/src/commands/daemon/process.rs
similarity index 100%
rename from crates/auths-cli/src/commands/agent/process.rs
rename to crates/auths-cli/src/commands/daemon/process.rs
diff --git a/crates/auths-cli/src/commands/agent/service.rs b/crates/auths-cli/src/commands/daemon/service.rs
similarity index 96%
rename from crates/auths-cli/src/commands/agent/service.rs
rename to crates/auths-cli/src/commands/daemon/service.rs
index 0bc1e624a..5b1b646e5 100644
--- a/crates/auths-cli/src/commands/agent/service.rs
+++ b/crates/auths-cli/src/commands/daemon/service.rs
@@ -86,7 +86,7 @@ fn get_launchd_plist_path() -> Result<PathBuf> {
     Ok(home
         .join("Library")
         .join("LaunchAgents")
-        .join("com.auths.agent.plist"))
+        .join("com.auths.daemon.plist"))
 }
 
 fn get_systemd_unit_path() -> Result<PathBuf> {
@@ -95,7 +95,7 @@ fn get_systemd_unit_path() -> Result<PathBuf> {
         .join(".config")
         .join("systemd")
         .join("user")
-        .join("auths-agent.service"))
+        .join("auths-daemon.service"))
 }
 
 fn generate_launchd_plist() -> Result<String> {
@@ -120,7 +120,7 @@ fn generate_launchd_plist() -> Result<String> {
 <plist version="1.0">
 <dict>
     <key>Label</key>
-    <string>com.auths.agent</string>
+    <string>com.auths.daemon</string>
     <key>ProgramArguments</key>
     <array>
         <string>{exe}</string>
@@ -163,7 +163,7 @@ Documentation=https://github.com/auths-rs/auths
 
 [Service]
 Type=simple
-ExecStart={exe} agent start --foreground
+ExecStart={exe} daemon start --foreground
 Restart=on-failure
 RestartSec=5
 
@@ -256,7 +256,7 @@ fn install_systemd_service(dry_run: bool, force: bool) -> Result<()> {
     eprintln!();
     eprintln!("To enable and start the service:");
     eprintln!("  systemctl --user daemon-reload");
-    eprintln!("  systemctl --user enable --now auths-agent");
+    eprintln!("  systemctl --user enable --now auths-daemon");
     eprintln!();
     eprintln!("The agent will start automatically on login.");
 
@@ -308,7 +308,7 @@ fn uninstall_systemd_service() -> Result<()> {
 
     eprintln!("Stopping and disabling systemd service...");
     let _ = std::process::Command::new("systemctl")
-        .args(["--user", "disable", "--now", "auths-agent"])
+        .args(["--user", "disable", "--now", "auths-daemon"])
         .status();
 
     fs::remove_file(&unit_path)
diff --git a/crates/auths-cli/src/commands/device/pair/mod.rs b/crates/auths-cli/src/commands/device/pair/mod.rs
index 121ff0b82..6010cc594 100644
--- a/crates/auths-cli/src/commands/device/pair/mod.rs
+++ b/crates/auths-cli/src/commands/device/pair/mod.rs
@@ -131,7 +131,7 @@ pub fn handle_pair(
     // if the agent can't start (perms, disk full, etc.), we proceed
     // via the passphrase provider path — never abort pair on agent
     // startup failure.
-    if let Err(e) = crate::commands::agent::ensure_agent_running(true) {
+    if let Err(e) = crate::commands::daemon::ensure_agent_running(true) {
         log::debug!("auths-agent auto-start skipped: {e}");
     }
 
diff --git a/crates/auths-cli/src/commands/id/migrate.rs b/crates/auths-cli/src/commands/id/migrate.rs
index 77824a41a..d3b90eb6e 100644
--- a/crates/auths-cli/src/commands/id/migrate.rs
+++ b/crates/auths-cli/src/commands/id/migrate.rs
@@ -483,7 +483,7 @@ fn perform_gpg_migration(
                 attestation_path.display()
             ));
             out.println("  2. Start using Auths for new commits:");
-            out.println("     auths agent start");
+            out.println("     auths daemon start");
             out.println("  3. Existing GPG-signed commits remain verifiable");
 
             Ok(())
@@ -893,7 +893,7 @@ fn perform_ssh_migration(
 
             out.print_heading("Next Steps");
             out.println("  1. Start using Auths for new commits:");
-            out.println("     auths agent start");
+            out.println("     auths daemon start");
             out.println("  2. Existing SSH-signed commits remain verifiable");
             out.println(
                 "  3. Run 'auths verify HEAD' after your next commit to confirm it verifies",
diff --git a/crates/auths-cli/src/commands/init/display.rs b/crates/auths-cli/src/commands/init/display.rs
index e9cc30c7f..788acb336 100644
--- a/crates/auths-cli/src/commands/init/display.rs
+++ b/crates/auths-cli/src/commands/init/display.rs
@@ -124,8 +124,8 @@ pub(crate) fn display_agent_result(out: &Output, result: &auths_sdk::result::Age
     out.println(&format!("  Capabilities: {}", cap_display.join(", ")));
     out.newline();
     out.print_success("Agent is ready to sign commits!");
-    out.println("  Start the agent: auths agent start");
-    out.println("  Check status: auths agent status");
+    out.println("  Start the agent: auths daemon start");
+    out.println("  Check status: auths daemon status");
 }
 
 pub(crate) fn display_agent_dry_run(
diff --git a/crates/auths-cli/src/commands/mod.rs b/crates/auths-cli/src/commands/mod.rs
index 34e8cb83e..c3a0c255a 100644
--- a/crates/auths-cli/src/commands/mod.rs
+++ b/crates/auths-cli/src/commands/mod.rs
@@ -9,6 +9,7 @@ pub mod artifact;
 pub mod audit;
 pub mod auth;
 pub mod cache;
+pub mod daemon;
 
 pub mod commit;
 pub mod completions;
diff --git a/crates/auths-cli/src/commands/sign.rs b/crates/auths-cli/src/commands/sign.rs
index c98a9fc29..c9c296a08 100644
--- a/crates/auths-cli/src/commands/sign.rs
+++ b/crates/auths-cli/src/commands/sign.rs
@@ -142,7 +142,7 @@ fn execute_git_rebase(base: &str, trailers: &[String]) -> Result<()> {
     // Auths-* trailer replaces it in place rather than appending a second copy, so
     // a re-signed commit (the recovery rewrite) keeps exactly one trailer per token.
     let exec_cmd = format!(
-        "git -c trailer.ifexists=replace commit --amend --no-edit --no-verify{trailer_flags}"
+        "git -c trailer.ifexists=replace commit --amend -C HEAD --no-verify{trailer_flags}"
     );
     let output = crate::subprocess::git_command(&["rebase", "--exec", &exec_cmd, base])
         .output()
@@ -265,15 +265,31 @@ fn short_sha(sha: &str) -> &str {
 /// * `range` - A git ref or range (e.g., "HEAD", "main..HEAD").
 /// * `signer` - The resolved local signing identity (root + device DIDs).
 /// * `scope` - Capabilities this commit claims (emitted as an `Auths-Scope` trailer).
-fn sign_commit_range(range: &str, signer: &LocalSigner, scope: &[String]) -> Result<()> {
+fn sign_commit_range(
+    range: &str,
+    signer: &LocalSigner,
+    scope: &[String],
+    autostash: bool,
+) -> Result<()> {
     ensure_repo_root_pin(signer);
     validate_scope(scope)?;
+
+    let mut stashed = false;
+    if autostash
+        && let Ok(out) = crate::subprocess::git_command(&["status", "--porcelain"]).output()
+        && !out.stdout.is_empty()
+    {
+        let _ =
+            crate::subprocess::git_command(&["stash", "push", "-m", "auths-autostash"]).output();
+        stashed = true;
+    }
+
     let trailers = commit_trailer_args(signer, scope);
     let is_range = range.contains("..");
-    if is_range {
+    let res = if is_range {
         let parts: Vec<&str> = range.splitn(2, "..").collect();
         let base = parts[0];
-        execute_git_rebase(base, &trailers)?;
+        execute_git_rebase(base, &trailers)
     } else {
         // `-c trailer.ifexists=replace`: amending a commit that already carries an
         // Auths-* trailer (a re-sign) replaces that trailer in place instead of
@@ -295,12 +311,21 @@ fn sign_commit_range(range: &str, signer: &LocalSigner, scope: &[String]) -> Res
             .context("Failed to spawn git commit --amend")?;
         if !output.status.success() {
             let stderr = String::from_utf8_lossy(&output.stderr);
-            return Err(anyhow!(
+            Err(anyhow!(
                 "Failed to amend commit with signature. Ensure you have a commit to amend and no conflicting changes.\n\nGit reported: {}",
                 stderr.trim()
-            ));
+            ))
+        } else {
+            Ok(())
         }
+    };
+
+    if stashed {
+        let _ = crate::subprocess::git_command(&["stash", "pop"]).output();
     }
+
+    res?;
+
     // The amend succeeded, but git only attaches a signature when a signing program
     // is configured. Confirm one actually landed before claiming success — otherwise
     // `auths verify` would call this commit unsigned and the success line would lie.
@@ -372,6 +397,14 @@ pub struct SignCommand {
     /// reject a claim outside the signer's delegator-anchored grant. Commit-only.
     #[arg(long, value_delimiter = ',')]
     pub scope: Vec<String>,
+
+    /// Override the signing key alias (defaults to AUTHS_SIGNING_KEY or git config).
+    #[arg(long)]
+    pub signer: Option<String>,
+
+    /// Automatically stash and restore uncommitted working tree changes during re-signing.
+    #[arg(long, default_value_t = true, action = clap::ArgAction::Set)]
+    pub autostash: bool,
 }
 
 /// Handle the unified sign command.
@@ -415,7 +448,7 @@ pub fn handle_sign_unified(
         }
         SignTarget::CommitRange(range) => {
             let signer = resolve_signer_trailer(repo_opt.as_deref(), env_config)?;
-            sign_commit_range(&range, &signer, &cmd.scope)
+            sign_commit_range(&range, &signer, &cmd.scope, cmd.autostash)
         }
     }
 }
diff --git a/crates/auths-cli/src/commands/status.rs b/crates/auths-cli/src/commands/status.rs
index d8f5351fe..8c9c21c6a 100644
--- a/crates/auths-cli/src/commands/status.rs
+++ b/crates/auths-cli/src/commands/status.rs
@@ -31,7 +31,7 @@ use nix::unistd::Pid;
 Next Steps:
   If no identity: run `auths init`
   If no devices: run `auths pair` to link this machine
-  If agent not running: run `auths agent start`
+  If agent not running: run `auths daemon start`
 
 Related:
   auths init   — Initialize your identity
diff --git a/crates/auths-cli/src/commands/verify_commit.rs b/crates/auths-cli/src/commands/verify_commit.rs
index 0d53e601d..1fbe35e56 100644
--- a/crates/auths-cli/src/commands/verify_commit.rs
+++ b/crates/auths-cli/src/commands/verify_commit.rs
@@ -436,19 +436,29 @@ async fn resolve_signer_kel(
     bundle_kels: &[BundleKel],
     did: &str,
 ) -> Result<Vec<Event>, String> {
-    // Stateless first: a bundle that carries the signer's KEL (the root's or a
-    // delegated device's) satisfies resolution without any identity store (CI
-    // runners). Prefix binding is still enforced, so a tampered bundle cannot
-    // smuggle a foreign KEL.
-    if let Some(bundle) = bundle_kels.iter().find(|b| b.did == did) {
-        let prefix = auths_sdk::keri::parse_did_keri(did).map_err(|e| e.to_string())?;
-        auths_sdk::keri::verify_prefix_binding(&prefix, &bundle.events)
-            .map_err(|e| e.to_string())?;
-        return Ok(bundle.events.clone());
+    let local_res = auths_sdk::keri::KelResolverChain::local(registry).resolve_kel(did);
+    let bundle_opt = bundle_kels.iter().find(|b| b.did == did);
+
+    match (local_res, bundle_opt) {
+        (Ok(local_events), Some(bundle)) => {
+            let prefix = auths_sdk::keri::parse_did_keri(did).map_err(|e| e.to_string())?;
+            auths_sdk::keri::verify_prefix_binding(&prefix, &bundle.events)
+                .map_err(|e| e.to_string())?;
+            if local_events.len() >= bundle.events.len() {
+                Ok(local_events)
+            } else {
+                Ok(bundle.events.clone())
+            }
+        }
+        (Ok(local_events), None) => Ok(local_events),
+        (Err(_), Some(bundle)) => {
+            let prefix = auths_sdk::keri::parse_did_keri(did).map_err(|e| e.to_string())?;
+            auths_sdk::keri::verify_prefix_binding(&prefix, &bundle.events)
+                .map_err(|e| e.to_string())?;
+            Ok(bundle.events.clone())
+        }
+        (Err(e), None) => Err(e.to_string()),
     }
-    auths_sdk::keri::KelResolverChain::local(registry)
-        .resolve_kel(did)
-        .map_err(|e| e.to_string())
 }
 
 /// Verify a single commit against the replayed KEL.
@@ -712,9 +722,10 @@ pub(crate) async fn commit_trusted_via_bundle(
             .map(|(did, events)| BundleKel { did, events }),
     );
 
-    let auths_home = auths_sdk::paths::auths_home().map_err(|e| e.to_string())?;
+    let repo_path =
+        auths_sdk::storage_layout::resolve_repo_path(None).map_err(|e| e.to_string())?;
     let registry =
-        GitRegistryBackend::from_config_unchecked(RegistryConfig::single_tenant(&auths_home));
+        GitRegistryBackend::from_config_unchecked(RegistryConfig::single_tenant(&repo_path));
     let device_kel = resolve_signer_kel(&registry, &bundle_kels, &device_did)
         .await
         .map_err(|e| format!("device KEL for {device_did} could not be resolved: {e}"))?;
@@ -727,7 +738,7 @@ pub(crate) async fn commit_trusted_via_bundle(
         .map_err(|e| format!("root KEL for {root_did} could not be resolved: {e}"))?;
 
     let provider = auths_crypto::RingCryptoProvider;
-    let receipt_lookup = GitWitnessReceiptLookup::new(&auths_home);
+    let receipt_lookup = GitWitnessReceiptLookup::new(&repo_path);
     let witnessed = verify_commit_against_kel_witnessed_scoped(
         raw_commit.as_bytes(),
         &device_kel,
diff --git a/crates/auths-cli/src/core/provider.rs b/crates/auths-cli/src/core/provider.rs
index 5dd570770..1c6463e70 100644
--- a/crates/auths-cli/src/core/provider.rs
+++ b/crates/auths-cli/src/core/provider.rs
@@ -15,27 +15,46 @@ impl CliPassphraseProvider {
 }
 
 impl PassphraseProvider for CliPassphraseProvider {
-    /// Securely obtains a passphrase by prompting the user on the terminal.
+    /// Securely obtains a passphrase by checking AUTHS_PASSPHRASE env var or prompting the user on the terminal.
     fn get_passphrase(&self, prompt_message: &str) -> Result<Zeroizing<String>, AgentError> {
+        if let Ok(env_pass) = std::env::var("AUTHS_PASSPHRASE")
+            && !env_pass.is_empty()
+        {
+            return Ok(Zeroizing::new(env_pass));
+        }
+
         // Print the contextual prompt provided by the caller to stderr
-        eprintln!("{}", prompt_message);
+        let formatted_prompt = if prompt_message.starts_with("Enter passphrase for key ") {
+            let key_name = prompt_message
+                .trim_start_matches("Enter passphrase for key '")
+                .split('\'')
+                .next()
+                .unwrap_or("parent");
+            format!(
+                "[2/2] Enter EXISTING passphrase for parent key '{key_name}' (created during `auths init`):"
+            )
+        } else {
+            prompt_message.to_string()
+        };
+        eprintln!("{}", formatted_prompt);
 
         // Use rpassword to prompt securely
         let password = rpassword::prompt_password("Enter passphrase: ")
             .context("Failed to read passphrase from terminal") // Add context using anyhow
             .map_err(|e| {
-                // Map the anyhow::Error (wrapping std::io::Error) to AgentError
-                // Consider adding a specific AgentError variant like UserInputCancelled or IOFailed
-                eprintln!("Error reading passphrase: {:?}", e); // Log the specific error
-                // For now, map generic IO errors. A more specific mapping could be done.
                 if let Some(io_err) = e.downcast_ref::<std::io::Error>() {
-                    // Example: Check for specific kinds like Interrupted if needed
-                    // if io_err.kind() == std::io::ErrorKind::Interrupted {
-                    //     return AgentError::UserInputCancelled;
-                    // }
-                    AgentError::IO(std::io::Error::new(io_err.kind(), format!("{}", e))) // Create a new IO error to own the message
+                    if io_err.raw_os_error() == Some(6) {
+                        eprintln!("\nHeadless environment detected. Run `auths agent prompt` to configure your environment.\n");
+                        return AgentError::IO(std::io::Error::new(
+                            io_err.kind(),
+                            "Headless environment detected. No terminal available for passphrase prompt.",
+                        ));
+                    }
+                    eprintln!("Error reading passphrase: {:?}", e);
+                    AgentError::IO(std::io::Error::new(io_err.kind(), format!("{}", e)))
                 } else {
-                    AgentError::SecurityError(format!("Failed to get passphrase: {}", e)) // Fallback
+                    eprintln!("Error reading passphrase: {:?}", e);
+                    AgentError::SecurityError(format!("Failed to get passphrase: {}", e))
                 }
             })?;
 
@@ -63,3 +82,76 @@ impl PassphraseProvider for PrefilledPassphraseProvider {
         Ok(self.passphrase.clone())
     }
 }
+
+/// A PassphraseProvider specifically for agent provisioning that supplies a prefilled
+/// passphrase for the new agent while caching and managing passphrases for parent keys.
+pub struct AgentProvisionPassphraseProvider {
+    agent_alias: String,
+    agent_passphrase: Zeroizing<String>,
+    parent_alias: Option<String>,
+    parent_passphrase: std::sync::Mutex<Option<Zeroizing<String>>>,
+    fallback: CliPassphraseProvider,
+}
+
+impl AgentProvisionPassphraseProvider {
+    pub fn new(agent_alias: String, agent_passphrase: Zeroizing<String>) -> Self {
+        Self {
+            agent_alias,
+            agent_passphrase,
+            parent_alias: None,
+            parent_passphrase: std::sync::Mutex::new(None),
+            fallback: CliPassphraseProvider::new(),
+        }
+    }
+
+    pub fn with_parent(
+        agent_alias: String,
+        agent_passphrase: Zeroizing<String>,
+        parent_alias: String,
+        parent_passphrase: Option<Zeroizing<String>>,
+    ) -> Self {
+        Self {
+            agent_alias,
+            agent_passphrase,
+            parent_alias: Some(parent_alias),
+            parent_passphrase: std::sync::Mutex::new(parent_passphrase),
+            fallback: CliPassphraseProvider::new(),
+        }
+    }
+}
+
+impl PassphraseProvider for AgentProvisionPassphraseProvider {
+    fn get_passphrase(&self, prompt_message: &str) -> Result<Zeroizing<String>, AgentError> {
+        if prompt_message.contains(&self.agent_alias) {
+            return Ok(self.agent_passphrase.clone());
+        }
+
+        if let Some(ref parent) = self.parent_alias
+            && (prompt_message.contains(parent.as_str())
+                || (parent.ends_with("-device")
+                    && prompt_message.contains(parent.trim_end_matches("-device"))))
+        {
+            let mut guard = self
+                .parent_passphrase
+                .lock()
+                .unwrap_or_else(|e| e.into_inner());
+            if let Some(ref pass) = *guard {
+                return Ok(pass.clone());
+            }
+            let pass = self.fallback.get_passphrase(prompt_message)?;
+            *guard = Some(pass.clone());
+            return Ok(pass);
+        }
+
+        let mut guard = self
+            .parent_passphrase
+            .lock()
+            .unwrap_or_else(|e| e.into_inner());
+        if let Some(ref pass) = *guard {
+            return Ok(pass.clone());
+        }
+        let pass = self.fallback.get_passphrase(prompt_message)?;
+        *guard = Some(pass.clone());
+        Ok(pass)
+    }
+}
diff --git a/crates/auths-cli/src/errors/registry.rs b/crates/auths-cli/src/errors/registry.rs
index a5029eab2..da204fbc4 100644
--- a/crates/auths-cli/src/errors/registry.rs
+++ b/crates/auths-cli/src/errors/registry.rs
@@ -97,7 +97,7 @@ pub fn explain(code: &str) -> Option<&'static str> {
 
         // --- auths-core (AgentError) ---
         "AUTHS-E3001" => Some("# AUTHS-E3001\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::KeyNotFound`\n\n## Message\n\nKey not found\n\n## Suggestion\n\nRun `auths key list` to see available keys\n"),
-        "AUTHS-E3002" => Some("# AUTHS-E3002\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::IncorrectPassphrase`\n\n## Message\n\nIncorrect passphrase\n\n## Suggestion\n\nCheck your passphrase and try again. Set AUTHS_PASSPHRASE for automation, or run `auths agent start` for session caching\n"),
+        "AUTHS-E3002" => Some("# AUTHS-E3002\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::IncorrectPassphrase`\n\n## Message\n\nIncorrect passphrase\n\n## Suggestion\n\nCheck your passphrase and try again. Set AUTHS_PASSPHRASE for automation\n"),
         "AUTHS-E3003" => Some("# AUTHS-E3003\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::MissingPassphrase`\n\n## Message\n\nMissing Passphrase\n\n## Suggestion\n\nProvide a passphrase with --passphrase or set AUTHS_PASSPHRASE\n"),
         "AUTHS-E3004" => Some("# AUTHS-E3004\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::SecurityError`\n\n## Message\n\nSecurity error: {0}\n\n## Suggestion\n\nRun `auths doctor` to check system keychain access and security configuration\n"),
         "AUTHS-E3005" => Some("# AUTHS-E3005\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::CryptoError`\n\n## Message\n\nCrypto error: {0}\n\n## Suggestion\n\nA cryptographic operation failed; check key material with `auths key list`\n"),
@@ -114,7 +114,7 @@ pub fn explain(code: &str) -> Option<&'static str> {
         "AUTHS-E3016" => Some("# AUTHS-E3016\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::StorageLocked`\n\n## Message\n\nStorage is locked, authentication required\n\n## Suggestion\n\nAuthenticate with your platform keychain\n"),
         "AUTHS-E3017" => Some("# AUTHS-E3017\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::BackendInitFailed`\n\n## Message\n\nFailed to initialize keychain backend: {backend} - {error}\n\n## Suggestion\n\nRun `auths doctor` to diagnose keychain issues\n"),
         "AUTHS-E3018" => Some("# AUTHS-E3018\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::CredentialTooLarge`\n\n## Message\n\nCredential too large for backend (max {max_bytes} bytes, got {actual_bytes})\n\n## Suggestion\n\nReduce the credential size or use file-based storage with AUTHS_KEYCHAIN_BACKEND=file\n"),
-        "AUTHS-E3019" => Some("# AUTHS-E3019\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::AgentLocked`\n\n## Message\n\nAgent is locked. Unlock with 'auths agent unlock' or restart the agent.\n\n## Suggestion\n\nRun `auths agent unlock` or restart with `auths agent start`\n"),
+        "AUTHS-E3019" => Some("# AUTHS-E3019\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::AgentLocked`\n\n## Message\n\nAgent is locked. Unlock with 'auths agent unlock' or restart the agent.\n\n## Suggestion\n\nRun `auths agent provision` to configure a new agent session\n"),
         "AUTHS-E3020" => Some("# AUTHS-E3020\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::WeakPassphrase`\n\n## Message\n\nPassphrase too weak: {0}\n\n## Suggestion\n\nUse at least 12 characters with uppercase, lowercase, and a digit or symbol\n"),
         "AUTHS-E3021" => Some("# AUTHS-E3021\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::HsmPinLocked`\n\n## Message\n\nHSM PIN is locked — reset required\n\n## Suggestion\n\nReset the HSM PIN using your HSM vendor's admin tools\n"),
         "AUTHS-E3022" => Some("# AUTHS-E3022\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::HsmDeviceRemoved`\n\n## Message\n\nHSM device removed\n\n## Suggestion\n\nReconnect the HSM device and try again\n"),
diff --git a/crates/auths-cli/src/main.rs b/crates/auths-cli/src/main.rs
index 57ceed72a..b24606495 100644
--- a/crates/auths-cli/src/main.rs
+++ b/crates/auths-cli/src/main.rs
@@ -121,6 +121,7 @@ fn run() -> Result<()> {
         RootCommand::Auth(cmd) => cmd.execute(&ctx),
         // Internal
         RootCommand::Emergency(cmd) => cmd.execute(&ctx),
+        RootCommand::Daemon(cmd) => cmd.execute(&ctx),
         RootCommand::Agent(cmd) => cmd.execute(&ctx),
         RootCommand::Treasury(cmd) => cmd.execute(&ctx),
         RootCommand::Anchor(cmd) => cmd.execute(&ctx),
@@ -155,7 +156,7 @@ struct CommandGroup {
 const HELP_GROUPS: &[CommandGroup] = &[
     CommandGroup {
         heading: "Primary",
-        commands: &["init", "sign", "verify", "status", "whoami"],
+        commands: &["init", "sign", "verify", "status", "whoami", "agent"],
     },
     CommandGroup {
         heading: "Setup & Troubleshooting",
@@ -214,7 +215,6 @@ fn print_grouped_help(show_all: bool) -> Result<()> {
         // Internal commands (always hidden, even in --help-all context)
         let internal = [
             "emergency",
-            "agent",
             "witness",
             "scim",
             "commit",
diff --git a/crates/auths-cli/tests/cases/e2e_git_hook.rs b/crates/auths-cli/tests/cases/e2e_git_hook.rs
new file mode 100644
index 000000000..f39c14fad
--- /dev/null
+++ b/crates/auths-cli/tests/cases/e2e_git_hook.rs
@@ -0,0 +1,85 @@
+use crate::cases::helpers::TestEnv;
+
+#[test]
+fn test_e2e_agent_commit_hook() {
+    let env = TestEnv::new();
+    env.init_identity();
+
+    let output = env
+        .cmd("auths")
+        .args([
+            "agent",
+            "provision",
+            "--label",
+            "ci-agent",
+            "--profile",
+            "ci",
+        ])
+        .output()
+        .unwrap();
+
+    assert!(
+        output.status.success(),
+        "Agent provision failed: {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+
+    let env_sh_path = env.home.path().join(".auths-agents/ci-agent/env.sh");
+    assert!(env_sh_path.exists(), "env.sh should be generated");
+
+    std::fs::write(env.repo_path.join("dummy.txt"), "hello e2e test").unwrap();
+
+    let output = env.git_cmd().args(["add", "dummy.txt"]).output().unwrap();
+    assert!(output.status.success(), "Git add failed");
+
+    // Execute bash that sources the env.sh to emulate the actual execution environment.
+    let mut bash_cmd = std::process::Command::new("bash");
+    bash_cmd.current_dir(&env.repo_path);
+
+    // We need to inject the same PATH that TestEnv uses so it can find auths and auths-sign
+    let path = std::env::var("PATH").unwrap_or_default();
+    let target_dir = assert_cmd::cargo::cargo_bin("auths-sign");
+    let bin_dir = target_dir.parent().unwrap().to_path_buf();
+    let env_path = format!("{}:{}", bin_dir.display(), path);
+
+    bash_cmd
+        .env("HOME", env.home.path())
+        .env("PATH", env_path)
+        // Ensure no global configs leak in
+        .env("GIT_CONFIG_NOSYSTEM", "1")
+        .env("GIT_CONFIG_GLOBAL", env.home.path().join(".gitconfig"))
+        .arg("-c")
+        .arg("source ~/.auths-agents/ci-agent/env.sh && git commit -m 'Test commit'");
+
+    let output = bash_cmd.output().unwrap();
+    assert!(
+        output.status.success(),
+        "Bash commit failed:\nstdout: {}\nstderr: {}",
+        String::from_utf8_lossy(&output.stdout),
+        String::from_utf8_lossy(&output.stderr)
+    );
+
+    // Verify the commit object
+    let output = env
+        .git_cmd()
+        .args(["cat-file", "commit", "HEAD"])
+        .output()
+        .unwrap();
+    assert!(output.status.success());
+    let stdout = String::from_utf8(output.stdout).unwrap();
+
+    // The prepare-commit-msg hook should have injected these
+    assert!(
+        stdout.contains("Auths-Id: did:keri:"),
+        "Missing Auths-Id trailer in commit object"
+    );
+    assert!(
+        stdout.contains("Auths-Device: did:keri:"),
+        "Missing Auths-Device trailer in commit object"
+    );
+    // The gpg.ssh.program (auths-sign) should have attached the signature
+    assert!(
+        stdout.contains("-----BEGIN SSH SIGNATURE-----"),
+        "Missing SSH signature block in commit object"
+    );
+}
diff --git a/crates/auths-cli/tests/cases/mod.rs b/crates/auths-cli/tests/cases/mod.rs
index dddbade67..c8c388c43 100644
--- a/crates/auths-cli/tests/cases/mod.rs
+++ b/crates/auths-cli/tests/cases/mod.rs
@@ -1,6 +1,7 @@
 mod clap_collision;
 mod config_repo;
 mod doctor;
+mod e2e_git_hook;
 mod expand_rotate;
 mod forgery_resistance;
 mod golden_path;
diff --git a/crates/auths-cli/tests/cases/repo_consistency.rs b/crates/auths-cli/tests/cases/repo_consistency.rs
index bdd70c9fa..687fa01ce 100644
--- a/crates/auths-cli/tests/cases/repo_consistency.rs
+++ b/crates/auths-cli/tests/cases/repo_consistency.rs
@@ -27,6 +27,7 @@ const REPO_AWARE: &[&str] = &[
     "ctx.repo",
     "--repo",
     "auths_home_with_config",
+    "AuthsPaths",
 ];
 
 /// Storage-touching command sources with a known, reviewed reason for not threading `--repo`, matched by
diff --git a/crates/auths-core/src/config.rs b/crates/auths-core/src/config.rs
index d2a1d0ce2..e7078a17c 100644
--- a/crates/auths-core/src/config.rs
+++ b/crates/auths-core/src/config.rs
@@ -137,6 +137,8 @@ pub struct EnvironmentConfig {
     /// Override for the Auths home directory (`AUTHS_HOME`).
     /// `None` falls back to `~/.auths`.
     pub auths_home: Option<PathBuf>,
+    /// Override for the Auths registry repository directory (`AUTHS_REPO`).
+    pub auths_repo: Option<PathBuf>,
     /// Keychain backend settings.
     pub keychain: KeychainConfig,
     /// Path to the SSH agent socket (`SSH_AUTH_SOCK`).
@@ -149,7 +151,7 @@ pub struct EnvironmentConfig {
 impl EnvironmentConfig {
     /// Build an `EnvironmentConfig` from the process environment.
     ///
-    /// Reads `AUTHS_HOME`, `AUTHS_KEYCHAIN_BACKEND`, `AUTHS_KEYCHAIN_FILE`,
+    /// Reads `AUTHS_HOME`, `AUTHS_REPO`, `AUTHS_KEYCHAIN_BACKEND`, `AUTHS_KEYCHAIN_FILE`,
     /// `AUTHS_PASSPHRASE`, and `SSH_AUTH_SOCK`.
     ///
     /// Usage:
@@ -163,6 +165,10 @@ impl EnvironmentConfig {
                 .ok()
                 .filter(|s| !s.is_empty())
                 .map(PathBuf::from),
+            auths_repo: std::env::var("AUTHS_REPO")
+                .ok()
+                .filter(|s| !s.is_empty())
+                .map(PathBuf::from),
             keychain: KeychainConfig::from_env(),
             ssh_agent_socket: std::env::var("SSH_AUTH_SOCK").ok().map(PathBuf::from),
             #[cfg(feature = "keychain-pkcs11")]
@@ -201,6 +207,7 @@ impl EnvironmentConfig {
 #[derive(Default)]
 pub struct EnvironmentConfigBuilder {
     auths_home: Option<PathBuf>,
+    auths_repo: Option<PathBuf>,
     keychain: Option<KeychainConfig>,
     ssh_agent_socket: Option<PathBuf>,
     #[cfg(feature = "keychain-pkcs11")]
@@ -214,6 +221,12 @@ impl EnvironmentConfigBuilder {
         self
     }
 
+    /// Set the Auths repository directory override.
+    pub fn auths_repo(mut self, repo: PathBuf) -> Self {
+        self.auths_repo = Some(repo);
+        self
+    }
+
     /// Set the keychain configuration.
     pub fn keychain(mut self, keychain: KeychainConfig) -> Self {
         self.keychain = Some(keychain);
@@ -237,6 +250,7 @@ impl EnvironmentConfigBuilder {
     pub fn build(self) -> EnvironmentConfig {
         EnvironmentConfig {
             auths_home: self.auths_home,
+            auths_repo: self.auths_repo,
             keychain: self.keychain.unwrap_or_default(),
             ssh_agent_socket: self.ssh_agent_socket,
             #[cfg(feature = "keychain-pkcs11")]
diff --git a/crates/auths-core/src/error.rs b/crates/auths-core/src/error.rs
index 01c3deb5b..7dbd2369d 100644
--- a/crates/auths-core/src/error.rs
+++ b/crates/auths-core/src/error.rs
@@ -166,9 +166,9 @@ impl AuthsErrorInfo for AgentError {
     fn suggestion(&self) -> Option<&'static str> {
         match self {
             Self::KeyNotFound => Some("Run `auths key list` to see available keys"),
-            Self::IncorrectPassphrase => Some(
-                "Check your passphrase and try again. Set AUTHS_PASSPHRASE for automation, or run `auths agent start` for session caching",
-            ),
+            Self::IncorrectPassphrase => {
+                Some("Check your passphrase and try again. Set AUTHS_PASSPHRASE for automation")
+            }
             Self::MissingPassphrase => {
                 Some("Provide a passphrase with --passphrase or set AUTHS_PASSPHRASE")
             }
@@ -181,7 +181,7 @@ impl AuthsErrorInfo for AgentError {
             }
             Self::GitError(_) => Some("Ensure you're in a Git repository"),
             Self::AgentLocked => {
-                Some("Run `auths agent unlock` or restart with `auths agent start`")
+                Some("Run `auths agent provision` to configure a new agent session")
             }
             Self::UserInputCancelled => {
                 Some("Run the command again and provide the required input")
diff --git a/crates/auths-core/src/lib.rs b/crates/auths-core/src/lib.rs
index 4bb8e00fa..fe0767013 100644
--- a/crates/auths-core/src/lib.rs
+++ b/crates/auths-core/src/lib.rs
@@ -58,6 +58,7 @@ pub mod config;
 pub mod crypto;
 pub mod error;
 pub mod pairing;
+/// Path resolution utilities and AuthsPaths.
 pub mod paths;
 pub mod ports;
 pub mod proto;
diff --git a/crates/auths-core/src/paths.rs b/crates/auths-core/src/paths.rs
index 02a1a7d08..46fb02fce 100644
--- a/crates/auths-core/src/paths.rs
+++ b/crates/auths-core/src/paths.rs
@@ -1,14 +1,68 @@
-//! Shared path resolution for the Auths home directory.
-//!
-//! All code that needs the `~/.auths` directory should call [`auths_home_with_config`]
-//! (or the legacy shim [`auths_home`]) instead of hardcoding
-//! `dirs::home_dir().join(".auths")`. This enables multi-agent simulation and CI
-//! overrides via the `AUTHS_HOME` env var.
-
-use std::path::PathBuf;
+use std::path::{Path, PathBuf};
 
 use crate::config::EnvironmentConfig;
 
+/// Unified paths resolution for the Auths environment.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct AuthsPaths {
+    /// Machine home directory (e.g. ~/.auths or ~/.auths-agents/<label>)
+    pub home_dir: PathBuf,
+    /// Registry repository directory (e.g. ~/.auths or ~/.auths-agents/<label>/registry)
+    pub registry_dir: PathBuf,
+    /// Encrypted file keystore path (e.g. ~/.auths/keys.enc)
+    pub keychain_file: PathBuf,
+    /// Key storage directory for Secure Enclave and software keys (e.g. <home_dir>/se_keys)
+    pub keys_dir: PathBuf,
+}
+
+impl AuthsPaths {
+    /// Resolves environment paths from an injected `EnvironmentConfig` and an optional CLI repo override.
+    ///
+    /// Priority rules:
+    /// 1. Explicit CLI override (`repo_override`) if non-empty
+    /// 2. `AUTHS_REPO` environment variable (`config.auths_repo`)
+    /// 3. `AUTHS_HOME` environment variable (`config.auths_home`)
+    /// 4. Platform default `$HOME/.auths`
+    pub fn resolve_with_config(
+        config: &EnvironmentConfig,
+        repo_override: Option<&Path>,
+    ) -> Result<Self, AuthsHomeError> {
+        let home_dir = auths_home_with_config(config)?;
+
+        let registry_dir = if let Some(repo) = repo_override {
+            let s = repo.to_string_lossy();
+            if s.trim().is_empty() {
+                if let Some(ref r) = config.auths_repo {
+                    r.clone()
+                } else {
+                    home_dir.clone()
+                }
+            } else {
+                repo.to_path_buf()
+            }
+        } else if let Some(ref repo) = config.auths_repo {
+            repo.clone()
+        } else {
+            home_dir.clone()
+        };
+
+        let keychain_file = home_dir.join("keys.enc");
+        let keys_dir = home_dir.join("se_keys");
+
+        Ok(Self {
+            home_dir,
+            registry_dir,
+            keychain_file,
+            keys_dir,
+        })
+    }
+
+    /// Resolves environment paths using `EnvironmentConfig::from_env()`.
+    pub fn resolve(repo_override: Option<&Path>) -> Result<Self, AuthsHomeError> {
+        Self::resolve_with_config(&EnvironmentConfig::from_env(), repo_override)
+    }
+}
+
 /// Resolves the Auths home directory from an injected `EnvironmentConfig`.
 ///
 /// Uses `config.auths_home` when set; otherwise falls back to `~/.auths`.
@@ -78,4 +132,53 @@ mod tests {
         let path = auths_home_with_config(&env).unwrap();
         assert!(path.ends_with(".auths"));
     }
+
+    #[test]
+    fn test_auths_paths_resolution_order() {
+        let home_path = PathBuf::from("/tmp/custom-home");
+        let repo_path = PathBuf::from("/tmp/custom-repo");
+        let cli_override = PathBuf::from("/tmp/cli-override");
+
+        // 1. Home alone
+        let env = EnvironmentConfig::builder()
+            .auths_home(home_path.clone())
+            .build();
+        let paths = AuthsPaths::resolve_with_config(&env, None).unwrap();
+        assert_eq!(paths.home_dir, home_path);
+        assert_eq!(paths.registry_dir, home_path);
+        assert_eq!(paths.keychain_file, home_path.join("keys.enc"));
+        assert_eq!(paths.keys_dir, home_path.join("se_keys"));
+
+        // 2. Repo alone
+        let env = EnvironmentConfig::builder()
+            .auths_repo(repo_path.clone())
+            .build();
+        let paths = AuthsPaths::resolve_with_config(&env, None).unwrap();
+        assert_eq!(paths.registry_dir, repo_path);
+
+        // 3. Home + Repo simultaneously
+        let env = EnvironmentConfig::builder()
+            .auths_home(home_path.clone())
+            .auths_repo(repo_path.clone())
+            .build();
+        let paths = AuthsPaths::resolve_with_config(&env, None).unwrap();
+        assert_eq!(paths.home_dir, home_path);
+        assert_eq!(paths.registry_dir, repo_path);
+
+        // 4. CLI override takes precedence
+        let paths = AuthsPaths::resolve_with_config(&env, Some(&cli_override)).unwrap();
+        assert_eq!(paths.home_dir, home_path);
+        assert_eq!(paths.registry_dir, cli_override);
+    }
+
+    #[test]
+    fn test_auths_paths_whitespace_cli_override_ignored() {
+        let home_path = PathBuf::from("/tmp/custom-home");
+        let env = EnvironmentConfig::builder()
+            .auths_home(home_path.clone())
+            .build();
+        let whitespace_path = PathBuf::from("   ");
+        let paths = AuthsPaths::resolve_with_config(&env, Some(&whitespace_path)).unwrap();
+        assert_eq!(paths.registry_dir, home_path);
+    }
 }
diff --git a/crates/auths-core/src/signing.rs b/crates/auths-core/src/signing.rs
index 61adf6a44..cf511872b 100644
--- a/crates/auths-core/src/signing.rs
+++ b/crates/auths-core/src/signing.rs
@@ -1,6 +1,5 @@
 //! Signing abstractions and DID resolution.
 
-use crate::crypto::signer::decrypt_keypair;
 use crate::error::AgentError;
 use crate::storage::keychain::{IdentityDID, KeyAlias, KeyStorage};
 
@@ -276,56 +275,13 @@ impl<S: KeyStorage + Send + Sync + 'static> SecureSigner for StorageSigner<S> {
         passphrase_provider: &dyn PassphraseProvider,
         message: &[u8],
     ) -> Result<Vec<u8>, AgentError> {
-        // Hardware backends (Secure Enclave, HSM) handle signing internally
-        if self.storage.is_hardware_backend() {
-            #[cfg(all(target_os = "macos", feature = "keychain-secure-enclave"))]
-            {
-                let (_identity_did, _role, handle) = self.storage.load_key(alias)?;
-                return crate::storage::secure_enclave::sign_with_handle(&handle, message);
-            }
-            #[cfg(not(all(target_os = "macos", feature = "keychain-secure-enclave")))]
-            {
-                return Err(AgentError::BackendUnavailable {
-                    backend: self.storage.backend_name(),
-                    reason: "hardware signing not available on this platform".into(),
-                });
-            }
-        }
-
-        let (_identity_did, _role, encrypted_data) = self.storage.load_key(alias)?;
-
-        const MAX_ATTEMPTS: u8 = 3;
-        let mut attempt = 0u8;
-        let key_bytes = loop {
-            let prompt = if attempt == 0 {
-                format!("Enter passphrase for key '{}' to sign:", alias)
-            } else {
-                format!(
-                    "Incorrect passphrase, try again ({}/{}):",
-                    attempt + 1,
-                    MAX_ATTEMPTS
-                )
-            };
-
-            let passphrase = passphrase_provider.get_passphrase(&prompt)?;
-
-            match decrypt_keypair(&encrypted_data, &passphrase) {
-                Ok(kb) => break kb,
-                Err(AgentError::IncorrectPassphrase) if attempt + 1 < MAX_ATTEMPTS => {
-                    passphrase_provider.on_incorrect_passphrase(&prompt);
-                    attempt += 1;
-                }
-                Err(e) => return Err(e),
-            }
-        };
-
-        // parse curve-tagged seed and dispatch sign on curve.
-        // Previously hardcoded sign_ed25519_sync which silently produced garbage
-        // signatures for P-256 identities.
-        let parsed = auths_crypto::parse_key_material(&key_bytes)
-            .map_err(|e| AgentError::KeyDeserializationError(e.to_string()))?;
-        auths_crypto::typed_sign(&parsed.seed, message)
-            .map_err(|e| AgentError::CryptoError(format!("signing failed: {}", e)))
+        let (sig, _pubkey, _curve) = crate::storage::keychain::sign_with_key(
+            &self.storage,
+            alias,
+            passphrase_provider,
+            message,
+        )?;
+        Ok(sig)
     }
 
     fn sign_for_identity(
diff --git a/crates/auths-core/src/storage/keychain.rs b/crates/auths-core/src/storage/keychain.rs
index ea0b62c1b..30e886950 100644
--- a/crates/auths-core/src/storage/keychain.rs
+++ b/crates/auths-core/src/storage/keychain.rs
@@ -2,7 +2,7 @@
 
 use crate::config::EnvironmentConfig;
 use crate::error::AgentError;
-use crate::paths::auths_home_with_config;
+use crate::paths::AuthsPaths;
 use log::{info, warn};
 use std::sync::Arc;
 
@@ -203,6 +203,60 @@ impl PartialEq<String> for KeyAlias {
     }
 }
 
+/// A strongly typed reference to a signing key, which could either be a bare alias
+/// or a fully qualified URI.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum SigningKeyRef {
+    /// A raw key alias with no scheme prefix (e.g. `main-device`).
+    Alias(KeyAlias),
+    /// A key identifier specified as a URI (e.g. `auths:main-device`).
+    Uri {
+        /// The scheme parsed from the URI.
+        scheme: String,
+        /// The parsed key alias.
+        alias: KeyAlias,
+    },
+}
+
+impl SigningKeyRef {
+    /// Parses a string into a `SigningKeyRef`.
+    pub fn parse(input: &str) -> Result<Self, AgentError> {
+        if let Some(rest) = input.strip_prefix("auths:") {
+            if rest.is_empty() {
+                return Err(AgentError::InvalidInput(
+                    "Invalid Auths key format: alias cannot be empty. Use 'auths:<alias>'".into(),
+                ));
+            }
+            if rest.contains(':') {
+                return Err(AgentError::InvalidInput(
+                    "Invalid Auths key format: alias cannot contain colons".into(),
+                ));
+            }
+            let alias = KeyAlias::new(rest)?;
+            Ok(Self::Uri {
+                scheme: "auths".to_string(),
+                alias,
+            })
+        } else if input.contains(':') {
+            Err(AgentError::InvalidInput(format!(
+                "Unsupported key scheme or format in '{}'. Only 'auths:<alias>' or bare alias allowed.",
+                input
+            )))
+        } else {
+            let alias = KeyAlias::new(input)?;
+            Ok(Self::Alias(alias))
+        }
+    }
+
+    /// Extracts the underlying bare key alias, regardless of how it was specified.
+    pub fn bare_alias(&self) -> &KeyAlias {
+        match self {
+            Self::Alias(alias) => alias,
+            Self::Uri { alias, .. } => alias,
+        }
+    }
+}
+
 /// Migrate a legacy single-key alias `{alias}` to the multi-key form
 /// `{alias}--0`.
 ///
@@ -338,6 +392,12 @@ pub trait KeyStorage: Send + Sync {
         false
     }
 
+    /// Returns true if the specific key stored under `alias` is a hardware key.
+    fn is_hardware_key(&self, alias: &KeyAlias) -> bool {
+        let _ = alias;
+        self.is_hardware_backend()
+    }
+
     /// Re-associates an existing stored key with a different identity DID
     /// without touching the key material.
     ///
@@ -418,7 +478,7 @@ pub fn extract_public_key_bytes(
     alias: &KeyAlias,
     passphrase_provider: &dyn crate::signing::PassphraseProvider,
 ) -> Result<(Vec<u8>, auths_crypto::CurveType), AgentError> {
-    if keychain.is_hardware_backend() {
+    if keychain.is_hardware_key(alias) {
         // Hardware backends store opaque handles — get public key from hardware
         let (_, _role, _handle) = keychain.load_key(alias)?;
         #[cfg(all(target_os = "macos", feature = "keychain-secure-enclave"))]
@@ -464,7 +524,7 @@ pub fn sign_with_key(
     passphrase_provider: &dyn crate::signing::PassphraseProvider,
     message: &[u8],
 ) -> Result<(Vec<u8>, Vec<u8>, auths_crypto::CurveType), AgentError> {
-    if keychain.is_hardware_backend() {
+    if keychain.is_hardware_key(alias) {
         let (_, _role, _handle) = keychain.load_key(alias)?;
         #[cfg(all(target_os = "macos", feature = "keychain-secure-enclave"))]
         {
@@ -560,9 +620,9 @@ fn get_platform_default(
         #[cfg(feature = "keychain-secure-enclave")]
         {
             if super::secure_enclave::is_available()
-                && let Ok(home) = auths_home_with_config(config)
+                && let Ok(paths) = AuthsPaths::resolve_with_config(config, None)
             {
-                match super::secure_enclave::SecureEnclaveKeyStorage::new(&home) {
+                match super::secure_enclave::SecureEnclaveKeyStorage::new(&paths.home_dir) {
                     Ok(storage) => {
                         log::info!("Using Secure Enclave (Touch ID signing)");
                         return Ok(Box::new(storage));
@@ -665,12 +725,13 @@ fn get_backend_by_name(
         #[cfg(all(target_os = "macos", feature = "keychain-secure-enclave"))]
         "secure-enclave" => {
             info!("Using Secure Enclave backend (AUTHS_KEYCHAIN_BACKEND=secure-enclave)");
-            let home =
-                auths_home_with_config(config).map_err(|e| AgentError::BackendInitFailed {
+            let paths = AuthsPaths::resolve_with_config(config, None).map_err(|e| {
+                AgentError::BackendInitFailed {
                     backend: "secure-enclave",
-                    error: format!("failed to resolve auths home: {e}"),
-                })?;
-            let storage = super::secure_enclave::SecureEnclaveKeyStorage::new(&home)?;
+                    error: format!("failed to resolve auths paths: {e}"),
+                }
+            })?;
+            let storage = super::secure_enclave::SecureEnclaveKeyStorage::new(&paths.home_dir)?;
             Ok(Box::new(storage))
         }
         _ => {
@@ -686,7 +747,7 @@ fn get_backend_by_name(
 /// Construct an `EncryptedFileStorage` from the provided config.
 ///
 /// Uses `config.keychain.file_path` when set; otherwise resolves the default
-/// path from `config.auths_home` (or `~/.auths/keys.enc`).
+/// path from `AuthsPaths::resolve_with_config`.
 /// Sets the password from `config.keychain.passphrase` when present.
 fn new_encrypted_file_storage(
     config: &EnvironmentConfig,
@@ -694,9 +755,9 @@ fn new_encrypted_file_storage(
     let storage = if let Some(ref path) = config.keychain.file_path {
         EncryptedFileStorage::with_path(path.clone())?
     } else {
-        let home =
-            auths_home_with_config(config).map_err(|e| AgentError::StorageError(e.to_string()))?;
-        EncryptedFileStorage::new(&home)?
+        let paths = AuthsPaths::resolve_with_config(config, None)
+            .map_err(|e: crate::paths::AuthsHomeError| AgentError::StorageError(e.to_string()))?;
+        EncryptedFileStorage::with_path(paths.keychain_file)?
     };
 
     if let Some(ref passphrase) = config.keychain.passphrase {
@@ -790,6 +851,23 @@ impl KeyStorage for Arc<dyn KeyStorage + Send + Sync> {
     fn is_hardware_backend(&self) -> bool {
         self.as_ref().is_hardware_backend()
     }
+    // Forward to inner storage so backends like SecureEnclave can distinguish software vs hardware keys
+    fn is_hardware_key(&self, alias: &KeyAlias) -> bool {
+        self.as_ref().is_hardware_key(alias)
+    }
+    fn rebind_identity(
+        &self,
+        alias: &KeyAlias,
+        identity_did: &IdentityDID,
+    ) -> Result<(), AgentError> {
+        self.as_ref().rebind_identity(alias, identity_did)
+    }
+    fn export_public_key(&self, alias: &KeyAlias) -> Result<Vec<u8>, AgentError> {
+        self.as_ref().export_public_key(alias)
+    }
+    fn sign_raw(&self, alias: &KeyAlias, message: &[u8]) -> Result<Vec<u8>, AgentError> {
+        self.as_ref().sign_raw(alias, message)
+    }
 }
 
 impl KeyStorage for Box<dyn KeyStorage + Send + Sync> {
@@ -835,6 +913,23 @@ impl KeyStorage for Box<dyn KeyStorage + Send + Sync> {
     fn is_hardware_backend(&self) -> bool {
         self.as_ref().is_hardware_backend()
     }
+    // Forward to inner storage so backends like SecureEnclave can distinguish software vs hardware keys
+    fn is_hardware_key(&self, alias: &KeyAlias) -> bool {
+        self.as_ref().is_hardware_key(alias)
+    }
+    fn rebind_identity(
+        &self,
+        alias: &KeyAlias,
+        identity_did: &IdentityDID,
+    ) -> Result<(), AgentError> {
+        self.as_ref().rebind_identity(alias, identity_did)
+    }
+    fn export_public_key(&self, alias: &KeyAlias) -> Result<Vec<u8>, AgentError> {
+        self.as_ref().export_public_key(alias)
+    }
+    fn sign_raw(&self, alias: &KeyAlias, message: &[u8]) -> Result<Vec<u8>, AgentError> {
+        self.as_ref().sign_raw(alias, message)
+    }
 }
 
 #[cfg(test)]
@@ -1026,4 +1121,91 @@ mod tests {
         assert_eq!(agents.len(), 1);
         assert_eq!(agents[0].as_str(), "deploy-agent");
     }
+
+    struct MockHardwareKeyStorage;
+    impl KeyStorage for MockHardwareKeyStorage {
+        fn store_key(
+            &self,
+            _: &KeyAlias,
+            _: &IdentityDID,
+            _: KeyRole,
+            _: &[u8],
+        ) -> Result<(), AgentError> {
+            Ok(())
+        }
+        fn load_key(&self, _: &KeyAlias) -> Result<(IdentityDID, KeyRole, Vec<u8>), AgentError> {
+            Err(AgentError::StorageError("not found".into()))
+        }
+        fn delete_key(&self, _: &KeyAlias) -> Result<(), AgentError> {
+            Ok(())
+        }
+        fn list_aliases(&self) -> Result<Vec<KeyAlias>, AgentError> {
+            Ok(vec![])
+        }
+        fn list_aliases_for_identity(&self, _: &IdentityDID) -> Result<Vec<KeyAlias>, AgentError> {
+            Ok(vec![])
+        }
+        fn get_identity_for_alias(&self, _: &KeyAlias) -> Result<IdentityDID, AgentError> {
+            Err(AgentError::StorageError("not found".into()))
+        }
+        fn backend_name(&self) -> &'static str {
+            "MockHardware"
+        }
+        fn is_hardware_backend(&self) -> bool {
+            true
+        }
+        fn is_hardware_key(&self, alias: &KeyAlias) -> bool {
+            // Returns false for software key aliases to simulate software/hardware key differentiation
+            alias.as_str() != "software-key"
+        }
+    }
+
+    #[test]
+    fn test_arc_and_box_forward_is_hardware_key() {
+        let mock = MockHardwareKeyStorage;
+        let hw_alias = KeyAlias::new_unchecked("hardware-key");
+        let sw_alias = KeyAlias::new_unchecked("software-key");
+
+        let arc_storage: Arc<dyn KeyStorage + Send + Sync> = Arc::new(mock);
+        assert!(arc_storage.is_hardware_key(&hw_alias));
+        assert!(!arc_storage.is_hardware_key(&sw_alias));
+
+        let box_storage: Box<dyn KeyStorage + Send + Sync> = Box::new(MockHardwareKeyStorage);
+        assert!(box_storage.is_hardware_key(&hw_alias));
+        assert!(!box_storage.is_hardware_key(&sw_alias));
+    }
+
+    #[test]
+    fn test_signing_key_ref_parsing() {
+        // Valid bare alias
+        let ref1 = SigningKeyRef::parse("agent-label").unwrap();
+        assert!(matches!(ref1, SigningKeyRef::Alias(ref a) if a.as_str() == "agent-label"));
+        assert_eq!(ref1.bare_alias().as_str(), "agent-label");
+
+        // Valid auths uri
+        let ref2 = SigningKeyRef::parse("auths:agent-label").unwrap();
+        match &ref2 {
+            SigningKeyRef::Uri { scheme, alias } => {
+                assert_eq!(scheme, "auths");
+                assert_eq!(alias.as_str(), "agent-label");
+            }
+            _ => panic!("Expected Uri variant"),
+        }
+        assert_eq!(ref2.bare_alias().as_str(), "agent-label");
+
+        // Invalid schemes
+        let err = SigningKeyRef::parse("http:agent-label").unwrap_err();
+        assert!(err.to_string().contains("Unsupported key scheme"));
+
+        let err = SigningKeyRef::parse("ssh:key").unwrap_err();
+        assert!(err.to_string().contains("Unsupported key scheme"));
+
+        // Invalid multiple colons
+        let err = SigningKeyRef::parse("auths:foo:bar").unwrap_err();
+        assert!(err.to_string().contains("cannot contain colons"));
+
+        // Empty alias string
+        let err = SigningKeyRef::parse("auths:").unwrap_err();
+        assert!(err.to_string().contains("alias cannot be empty"));
+    }
 }
diff --git a/crates/auths-core/src/storage/secure_enclave.rs b/crates/auths-core/src/storage/secure_enclave.rs
index 61aabd4a3..579329231 100644
--- a/crates/auths-core/src/storage/secure_enclave.rs
+++ b/crates/auths-core/src/storage/secure_enclave.rs
@@ -154,6 +154,11 @@ impl KeyStorage for SecureEnclaveKeyStorage {
         // a key the KEL already anchored — the delegation would "succeed" with
         // its private key lost.
         if !_encrypted_key_data.is_empty() {
+            // Ensure no leftover hardware handle file or cached handle collides with this software key
+            let _ = fs::remove_file(self.handle_path(alias));
+            if let Ok(mut cache) = self.handle_cache.lock() {
+                cache.remove(alias.as_str());
+            }
             let path = self.swkey_path(alias);
             fs::write(&path, _encrypted_key_data).map_err(|e| {
                 AgentError::IO(std::io::Error::other(format!(
@@ -172,6 +177,8 @@ impl KeyStorage for SecureEnclaveKeyStorage {
 
         // EMPTY material is the hardware-creation convention (identity init on
         // this backend passes no blob): generate the key inside the enclave.
+        // Ensure no leftover software key file collides with this hardware key handle
+        let _ = fs::remove_file(self.swkey_path(alias));
         let mut handle_buf = vec![0u8; 512];
         let mut handle_len: usize = 0;
         let mut pubkey_buf = vec![0u8; 65];
@@ -221,18 +228,23 @@ impl KeyStorage for SecureEnclaveKeyStorage {
     }
 
     fn load_key(&self, alias: &KeyAlias) -> Result<(IdentityDID, KeyRole, Vec<u8>), AgentError> {
-        // A software item (delegated/imported key) loads its encrypted blob; a
-        // hardware key loads its opaque handle. Handle wins if both exist.
-        let handle = if self.handle_path(alias).exists() {
-            self.load_handle(alias)?
-        } else {
+        // A software key (swkey_path) loads its passphrase-encrypted blob; a
+        // hardware key (handle_path) loads its opaque handle.
+        let handle = if self.swkey_path(alias).exists() {
             let sw = self.swkey_path(alias);
             fs::read(&sw).map_err(|e| {
                 AgentError::StorageError(format!(
-                    "SE key handle not found for '{}': {e}",
+                    "SE software key file read failed for '{}': {e}",
                     alias.as_str()
                 ))
             })?
+        } else if self.handle_path(alias).exists() {
+            self.load_handle(alias)?
+        } else {
+            return Err(AgentError::StorageError(format!(
+                "SE key not found for '{}'",
+                alias.as_str()
+            )));
         };
 
         // Read metadata. A key whose identity binding is missing must not load under a
@@ -342,12 +354,36 @@ impl KeyStorage for SecureEnclaveKeyStorage {
         true
     }
 
+    fn is_hardware_key(&self, alias: &KeyAlias) -> bool {
+        self.handle_path(alias).exists() && !self.swkey_path(alias).exists()
+    }
+
     fn export_public_key(&self, alias: &KeyAlias) -> Result<Vec<u8>, AgentError> {
+        if !self.is_hardware_key(alias) {
+            let (_, _role, encrypted) = self.load_key(alias)?;
+            // Software key: for export_public_key without passphrase prompt,
+            // attempt decrypting with empty passphrase if stored unencrypted or
+            // load PKCS8 seed info.
+            use crate::crypto::signer::load_seed_and_pubkey;
+            if let Ok((_, pubkey, _)) = load_seed_and_pubkey(&encrypted) {
+                return Ok(pubkey);
+            }
+            return Err(AgentError::StorageError(format!(
+                "software key '{}' requires passphrase to derive public key",
+                alias.as_str()
+            )));
+        }
         let handle = self.load_handle(alias)?;
         public_key_from_handle(&handle)
     }
 
     fn sign_raw(&self, alias: &KeyAlias, message: &[u8]) -> Result<Vec<u8>, AgentError> {
+        if !self.is_hardware_key(alias) {
+            return Err(AgentError::StorageError(format!(
+                "software key '{}' requires passphrase provider for sign_with_alias",
+                alias.as_str()
+            )));
+        }
         let handle = self.load_handle(alias)?;
         sign_with_handle(&handle, message)
     }
@@ -377,11 +413,12 @@ impl SecureSigner for SecureEnclaveKeyStorage {
     fn sign_with_alias(
         &self,
         alias: &KeyAlias,
-        _passphrase_provider: &dyn PassphraseProvider,
+        passphrase_provider: &dyn PassphraseProvider,
         message: &[u8],
     ) -> Result<Vec<u8>, AgentError> {
-        let handle = self.load_handle(alias)?;
-        sign_with_handle(&handle, message)
+        let (sig, _pubkey, _curve) =
+            super::keychain::sign_with_key(self, alias, passphrase_provider, message)?;
+        Ok(sig)
     }
 
     fn sign_for_identity(
@@ -444,3 +481,44 @@ pub fn sign_with_handle(handle: &[u8], message: &[u8]) -> Result<Vec<u8>, AgentE
     sig_buf.truncate(sig_len);
     Ok(sig_buf)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tempfile::TempDir;
+
+    #[test]
+    fn test_software_key_precedence_over_stale_hardware_handle() {
+        let temp = TempDir::new().unwrap();
+        let keys_dir = temp.path().join("se_keys");
+        fs::create_dir_all(&keys_dir).unwrap();
+
+        let storage = SecureEnclaveKeyStorage {
+            keys_dir: keys_dir.clone(),
+            handle_cache: Mutex::new(HashMap::new()),
+        };
+
+        let alias = KeyAlias::new_unchecked("main-device");
+        let did = IdentityDID::try_from("did:keri:test-did").unwrap();
+
+        // Write a stale .se handle file
+        fs::write(storage.handle_path(&alias), b"stale-se-handle").unwrap();
+
+        // Store a software key with non-empty encrypted data
+        let sw_data = b"encrypted-software-key-material";
+        storage
+            .store_key(&alias, &did, KeyRole::Primary, sw_data)
+            .unwrap();
+
+        // 1. is_hardware_key must be FALSE when .swkey exists
+        assert!(!storage.is_hardware_key(&alias));
+
+        // 2. load_key must return the software key material, not the stale handle
+        let (loaded_did, _role, loaded_data) = storage.load_key(&alias).unwrap();
+        assert_eq!(loaded_did, did);
+        assert_eq!(loaded_data, sw_data);
+
+        // 3. handle_path file must have been deleted by store_key
+        assert!(!storage.handle_path(&alias).exists());
+    }
+}
diff --git a/crates/auths-id/src/storage/layout.rs b/crates/auths-id/src/storage/layout.rs
index f4fffe06d..f709198d9 100644
--- a/crates/auths-id/src/storage/layout.rs
+++ b/crates/auths-id/src/storage/layout.rs
@@ -336,19 +336,17 @@ use crate::storage::registry::shard::sanitize_did;
 /// `~/.auths` work correctly (the shell does not expand tildes when they
 /// arrive via clap default values or programmatic callers).
 #[cfg(feature = "git-storage")]
-#[allow(clippy::disallowed_methods)] // INVARIANT: designated home-dir resolution for repo path
 pub fn resolve_repo_path(repo_arg: Option<PathBuf>) -> Result<PathBuf, StorageError> {
-    match repo_arg {
-        Some(pathbuf) if !pathbuf.as_os_str().is_empty() => {
-            auths_utils::path::expand_tilde(&pathbuf)
-                .map_err(|e| StorageError::NotFound(e.to_string()))
+    let expanded = repo_arg.and_then(|p| {
+        if p.as_os_str().is_empty() {
+            None
+        } else {
+            auths_utils::path::expand_tilde(&p).ok()
         }
-        _ => {
-            let home = dirs::home_dir()
-                .ok_or_else(|| StorageError::NotFound("Could not find HOME directory".into()))?;
-            Ok(home.join(TOOL_PATH))
-        }
-    }
+    });
+    auths_core::paths::AuthsPaths::resolve(expanded.as_deref())
+        .map(|p| p.registry_dir)
+        .map_err(|e| StorageError::NotFound(e.to_string()))
 }
 
 /// Creates a Git namespace prefix string for a given DID.
diff --git a/crates/auths-mcp-server/tests/cases/helpers.rs b/crates/auths-mcp-server/tests/cases/helpers.rs
index f7fa206bf..1ba311d36 100644
--- a/crates/auths-mcp-server/tests/cases/helpers.rs
+++ b/crates/auths-mcp-server/tests/cases/helpers.rs
@@ -79,22 +79,9 @@ static KEYS: LazyLock<TestKeys> = LazyLock::new(|| {
     }
 });
 
-/// Shared mock JWKS server — started once per process, reused across tests.
-static SHARED_JWKS_URL: tokio::sync::OnceCell<String> = tokio::sync::OnceCell::const_new();
-
-/// Starts a mock JWKS server serving the static test key.
-/// First call starts the server; subsequent calls return the cached URL.
+/// Starts a mock JWKS server serving the static test key for the duration of the current test.
 pub(super) async fn start_mock_jwks_server() -> (String, tokio::task::JoinHandle<()>) {
-    let url = SHARED_JWKS_URL
-        .get_or_init(|| async {
-            let (url, handle) = start_mock_jwks_server_inner().await;
-            std::mem::forget(handle); // keep server alive for process lifetime
-            url
-        })
-        .await
-        .clone();
-    let noop_handle = tokio::spawn(async {});
-    (url, noop_handle)
+    start_mock_jwks_server_inner().await
 }
 
 async fn start_mock_jwks_server_inner() -> (String, tokio::task::JoinHandle<()>) {
diff --git a/crates/auths-sdk/Cargo.toml b/crates/auths-sdk/Cargo.toml
index 940311fdd..bd596eae7 100644
--- a/crates/auths-sdk/Cargo.toml
+++ b/crates/auths-sdk/Cargo.toml
@@ -30,6 +30,7 @@ auths-transparency = { workspace = true, features = ["native"] }
 auths-rp = { path = "../auths-rp", version = "0.1.16" }
 ring.workspace = true
 thiserror.workspace = true
+anyhow = "1.0"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 sha2.workspace = true
diff --git a/crates/auths-sdk/src/domains/agents/delegation.rs b/crates/auths-sdk/src/domains/agents/delegation.rs
index 250723ed8..3563a6c19 100644
--- a/crates/auths-sdk/src/domains/agents/delegation.rs
+++ b/crates/auths-sdk/src/domains/agents/delegation.rs
@@ -25,6 +25,7 @@ use auths_verifier::types::CanonicalDid;
 
 use crate::context::AuthsContext;
 use crate::domains::agents::error::AgentError;
+use crate::signing::PassphraseProvider;
 
 /// Result of adding a delegated agent.
 #[derive(Debug, Clone)]
@@ -107,11 +108,19 @@ pub fn add_scoped(
             .map_err(|e| AgentError::IdentityNotFound {
                 did: format!("identity load failed: {e}"),
             })?;
-    let root_prefix = parse_did_keri(managed.controller_did.as_str()).map_err(|e| {
-        AgentError::IdentityNotFound {
-            did: format!("invalid root did:keri: {e}"),
-        }
-    })?;
+    let (parent_did, _, _) =
+        ctx.key_storage
+            .load_key(root_alias)
+            .map_err(|e| AgentError::IdentityNotFound {
+                did: format!(
+                    "parent key alias '{}' load failed: {e}",
+                    root_alias.as_str()
+                ),
+            })?;
+    let root_prefix =
+        parse_did_keri(parent_did.as_str()).map_err(|e| AgentError::IdentityNotFound {
+            did: format!("invalid parent did:keri: {e}"),
+        })?;
     let (_pk, root_curve) = extract_public_key_bytes(
         ctx.key_storage.as_ref(),
         root_alias,
@@ -125,6 +134,11 @@ pub fn add_scoped(
     // registry — its granted scope is anchored by ITS delegator, never self-asserted.
     enforce_scope_subset(ctx, &root_prefix, root_alias, scope)?;
 
+    let cached_provider = Arc::new(auths_core::signing::CachedPassphraseProvider::new(
+        ctx.passphrase_provider.clone(),
+        std::time::Duration::from_secs(300),
+    ));
+
     let agent = incept_delegated_device(
         Arc::clone(&ctx.registry),
         &root_prefix,
@@ -132,7 +146,7 @@ pub fn add_scoped(
         root_curve,
         agent_alias,
         agent_curve,
-        ctx.passphrase_provider.as_ref(),
+        cached_provider.as_ref(),
         ctx.key_storage.as_ref(),
     )
     .map_err(AgentError::DelegationError)?;
@@ -145,7 +159,7 @@ pub fn add_scoped(
         root_alias,
         root_curve,
         &agent.device_prefix,
-        ctx.passphrase_provider.as_ref(),
+        cached_provider.as_ref(),
         ctx.key_storage.as_ref(),
     )
     .map_err(AgentError::DelegationError)?;
@@ -162,7 +176,7 @@ pub fn add_scoped(
                 capabilities: scope.to_vec(),
                 expires_at,
             },
-            ctx.passphrase_provider.as_ref(),
+            cached_provider.as_ref(),
             ctx.key_storage.as_ref(),
         )
         .map_err(AgentError::DelegationError)?;
@@ -172,8 +186,9 @@ pub fn add_scoped(
     // agent), persisted and KEL-anchored through the same path device links
     // use. Exported identity bundles then carry a walkable delegation chain —
     // a provenance leg independent of the KEL events themselves.
-    record_delegation_attestation(
+    record_delegation_attestation_with_provider(
         ctx,
+        cached_provider.as_ref(),
         &managed.controller_did,
         &managed.storage_id,
         root_alias,
@@ -321,7 +336,7 @@ pub fn add_bulk(
 /// This is what puts a programmatically delegated agent into the identity's
 /// attestation chain.
 #[allow(clippy::too_many_arguments)]
-fn record_delegation_attestation(
+pub fn record_delegation_attestation(
     ctx: &AuthsContext,
     identity_did: &IdentityDID,
     rid: &str,
@@ -331,12 +346,35 @@ fn record_delegation_attestation(
     agent_did: &IdentityDID,
     expires_at: Option<i64>,
 ) -> Result<(), AgentError> {
-    let (agent_pk, agent_pk_curve) = extract_public_key_bytes(
-        ctx.key_storage.as_ref(),
-        agent_alias,
+    record_delegation_attestation_with_provider(
+        ctx,
         ctx.passphrase_provider.as_ref(),
+        identity_did,
+        rid,
+        root_alias,
+        root_prefix,
+        agent_alias,
+        agent_did,
+        expires_at,
     )
-    .map_err(AgentError::CryptoError)?;
+}
+
+/// Record a delegation attestation using a custom passphrase provider.
+#[allow(clippy::too_many_arguments)]
+pub fn record_delegation_attestation_with_provider(
+    ctx: &AuthsContext,
+    passphrase_provider: &dyn PassphraseProvider,
+    identity_did: &IdentityDID,
+    rid: &str,
+    root_alias: &KeyAlias,
+    root_prefix: &auths_id::keri::types::Prefix,
+    agent_alias: &KeyAlias,
+    agent_did: &IdentityDID,
+    expires_at: Option<i64>,
+) -> Result<(), AgentError> {
+    let (agent_pk, agent_pk_curve) =
+        extract_public_key_bytes(ctx.key_storage.as_ref(), agent_alias, passphrase_provider)
+            .map_err(AgentError::CryptoError)?;
     let now = ctx.clock.now();
     let meta = AttestationMetadata {
         timestamp: Some(now),
@@ -364,7 +402,7 @@ fn record_delegation_attestation(
             oidc_binding: None,
         },
         &signer,
-        ctx.passphrase_provider.as_ref(),
+        passphrase_provider,
     )
     .map_err(AgentError::AttestationError)?;
     let mut batch = auths_id::storage::registry::backend::AtomicWriteBatch::new();
@@ -373,7 +411,7 @@ fn record_delegation_attestation(
         ctx.registry.as_ref(),
         &signer,
         root_alias,
-        ctx.passphrase_provider.as_ref(),
+        passphrase_provider,
         root_prefix,
         &attestation,
         &mut batch,
@@ -497,7 +535,7 @@ fn resolve_delegator_authority(
 }
 
 /// One agent delegated by the current identity, with its revocation status.
-#[derive(Debug, Clone)]
+#[derive(Debug, Clone, serde::Serialize)]
 pub struct AgentInfo {
     /// The agent's `did:keri:`.
     pub agent_did: String,
diff --git a/crates/auths-sdk/src/domains/identity/local.rs b/crates/auths-sdk/src/domains/identity/local.rs
index c1a574942..b93d06ef1 100644
--- a/crates/auths-sdk/src/domains/identity/local.rs
+++ b/crates/auths-sdk/src/domains/identity/local.rs
@@ -53,6 +53,44 @@ impl LocalSigner {
 /// // commit trailer: `Auths-Id: {signer.root_did}` + `Auths-Device: {signer.signer_did}`
 /// ```
 pub fn resolve_local_signer(ctx: &AuthsContext) -> Result<LocalSigner, SetupError> {
+    // Explicit signing key override (e.g., delegated agent `AUTHS_SIGNING_KEY="auths:agent-label"`).
+    if let Ok(key_alias_str) = std::env::var("AUTHS_SIGNING_KEY") {
+        let key_ref = auths_core::storage::keychain::SigningKeyRef::parse(&key_alias_str)
+            .map_err(|e| SetupError::InvalidSetupConfig(e.to_string()))?;
+        let alias = key_ref.bare_alias().clone();
+        if let Ok(key_info) = ctx.key_storage.load_key(&alias) {
+            let agent_did = key_info.0.to_string();
+            let agent_prefix = auths_id::keri::parse_did_keri(&agent_did)
+                .map_err(|e| SetupError::InvalidSetupConfig(format!("invalid agent DID: {e}")))?;
+
+            let (root_did, anchor_seq) = if let Ok(managed) = ctx.identity_storage.load_identity() {
+                let rd = managed.controller_did.to_string();
+                let seq = root_tip_seq(ctx, &rd);
+                (rd, seq)
+            } else if let Ok(auths_id::keri::Event::Dip(dip)) =
+                ctx.registry.get_event(&agent_prefix, 0)
+            {
+                let rd = format!("did:keri:{}", dip.di);
+                let seq = root_tip_seq(ctx, &rd);
+                (rd, seq)
+            } else {
+                return Err(SetupError::InvalidSetupConfig(format!(
+                    "AUTHS_SIGNING_KEY '{key_alias_str}' delegation info not found in registry"
+                )));
+            };
+
+            return Ok(LocalSigner {
+                signer_did: agent_did,
+                root_did,
+                anchor_seq,
+            });
+        } else {
+            return Err(SetupError::InvalidSetupConfig(format!(
+                "AUTHS_SIGNING_KEY '{key_alias_str}' not found in key storage"
+            )));
+        }
+    }
+
     // Root machine: prefer this root's delegated device #0 as the signer (its own AID,
     // distinct from the root) so identity_did != device_did. Fall back to the root
     // signing directly (a root identity with no delegated device — e.g. CI).
diff --git a/crates/auths-sdk/src/keychain.rs b/crates/auths-sdk/src/keychain.rs
index 3d25ebed1..71af84fee 100644
--- a/crates/auths-sdk/src/keychain.rs
+++ b/crates/auths-sdk/src/keychain.rs
@@ -4,7 +4,7 @@ pub use auths_core::crypto::encryption::{PASSPHRASE_POLICY_HINT, validate_passph
 pub use auths_core::storage::encrypted_file::EncryptedFileStorage;
 pub use auths_core::storage::keychain;
 pub use auths_core::storage::keychain::{
-    KeyAlias, KeyRole, KeyStorage, extract_public_key_bytes, get_platform_keychain,
+    KeyAlias, KeyRole, KeyStorage, SigningKeyRef, extract_public_key_bytes, get_platform_keychain,
     get_platform_keychain_with_config, migrate_legacy_alias, sign_with_key,
 };
 pub use auths_core::storage::passphrase_cache::{get_passphrase_cache, parse_duration_str};
diff --git a/crates/auths-sdk/src/paths.rs b/crates/auths-sdk/src/paths.rs
index 9a27c125f..b7890bb60 100644
--- a/crates/auths-sdk/src/paths.rs
+++ b/crates/auths-sdk/src/paths.rs
@@ -2,28 +2,13 @@
 
 use std::path::PathBuf;
 
-use auths_core::paths::AuthsHomeError;
-
-pub use auths_core::paths::{auths_home, auths_home_with_config};
+pub use auths_core::paths::{AuthsHomeError, AuthsPaths, auths_home, auths_home_with_config};
 
 /// Resolve the registry (local storage) directory for a command, honoring an explicit `--repo` override.
 ///
-/// When `override_path` is `Some` (the user passed `--repo <dir>`), that directory is used verbatim, so
-/// the command's identity store and existing-identity check are scoped to it rather than silently
-/// falling back to the default `~/.auths`. When `None`, the default home is used.
-///
-/// Args:
-/// * `override_path`: the `--repo` override, if the user supplied one.
-///
-/// Usage:
-/// ```ignore
-/// let registry_path = resolve_registry_path(ctx.repo_path.clone())?;
-/// ```
+/// Delegates to `AuthsPaths::resolve(override_path.as_deref())`.
 pub fn resolve_registry_path(override_path: Option<PathBuf>) -> Result<PathBuf, AuthsHomeError> {
-    match override_path {
-        Some(p) => Ok(p),
-        None => auths_home(),
-    }
+    AuthsPaths::resolve(override_path.as_deref()).map(|p| p.registry_dir)
 }
 
 #[cfg(test)]
diff --git a/crates/auths-sdk/src/workflows/agent_provision.rs b/crates/auths-sdk/src/workflows/agent_provision.rs
new file mode 100644
index 000000000..6a138e975
--- /dev/null
+++ b/crates/auths-sdk/src/workflows/agent_provision.rs
@@ -0,0 +1,409 @@
+#![allow(clippy::disallowed_types)]
+use std::fs;
+use std::os::unix::fs::PermissionsExt;
+use std::path::{Path, PathBuf};
+use std::process::Command;
+
+use crate::context::AuthsContext;
+use anyhow::{Context, Result, anyhow};
+use auths_core::storage::keychain::KeyAlias;
+use auths_crypto::CurveType;
+use auths_keri::Capability;
+use chrono::{DateTime, Utc};
+use serde::{Deserialize, Serialize};
+
+/// Agent provisioning profile.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+pub enum AgentProfile {
+    /// CI runner profile.
+    Ci,
+    /// Interactive AI assistant profile.
+    Assistant,
+}
+
+impl std::str::FromStr for AgentProfile {
+    type Err = anyhow::Error;
+
+    fn from_str(s: &str) -> std::result::Result<Self, Self::Err> {
+        match s.to_lowercase().as_str() {
+            "ci" => Ok(AgentProfile::Ci),
+            "assistant" => Ok(AgentProfile::Assistant),
+            _ => Err(anyhow!(
+                "Invalid agent profile '{}': expected 'ci' or 'assistant'",
+                s
+            )),
+        }
+    }
+}
+
+/// Parameters for atomic agent provisioning.
+#[derive(Debug, Clone)]
+pub struct AgentProvisionParams {
+    /// Human-readable label / key alias for the agent.
+    pub label: String,
+    /// Capabilities granted to the agent.
+    pub scopes: Vec<Capability>,
+    /// Optional expiration duration in seconds.
+    pub expires_in_secs: Option<i64>,
+    /// Destination directory for agent environment.
+    pub destination_dir: PathBuf,
+    /// Agent profile preset.
+    pub profile: AgentProfile,
+}
+
+/// Output metadata from atomic agent provisioning.
+#[derive(Debug, Serialize, Deserialize)]
+pub struct AgentProvisionResult {
+    /// Canonical DID of the provisioned agent.
+    pub agent_did: String,
+    /// Parent root identity key alias.
+    pub parent_alias: String,
+    /// Human-readable label alias.
+    pub label: String,
+    /// Destination workspace directory.
+    pub destination_dir: PathBuf,
+    /// Keychain path.
+    pub keychain_path: PathBuf,
+    /// Environment script path (`env.sh`).
+    pub env_file_path: PathBuf,
+    /// Executable wrapper script path (`bin/auths-agent`).
+    pub wrapper_path: PathBuf,
+    /// Optional expiration timestamp.
+    pub expires_at: Option<DateTime<Utc>>,
+}
+
+/// Atomically provisions a delegated headless agent.
+pub fn provision_agent_machine(
+    ctx: &AuthsContext,
+    parent_alias: &KeyAlias,
+    params: &AgentProvisionParams,
+    passphrase: &str,
+    now: DateTime<Utc>,
+    root_repo_path: &Path,
+) -> Result<AgentProvisionResult> {
+    let agent_alias = KeyAlias::new_unchecked(&params.label);
+    let expires_at = params.expires_in_secs.map(|secs| now.timestamp() + secs);
+
+    // 1. Delegate agent identity under parent root in KEL using domains::agents::add_scoped
+    let agent_info_res = crate::domains::agents::add_scoped(
+        ctx,
+        parent_alias,
+        &agent_alias,
+        CurveType::P256,
+        &params.scopes,
+        expires_at,
+    );
+
+    if agent_info_res.is_err() {
+        let next_alias = KeyAlias::new_unchecked(format!("{}--next-0", agent_alias.as_str()));
+        let _ = ctx.key_storage.delete_key(&agent_alias);
+        let _ = ctx.key_storage.delete_key(&next_alias);
+    }
+
+    let agent_info = agent_info_res
+        .map_err(anyhow::Error::from)
+        .context("failed to delegate agent identity in KEL")?;
+
+    let agent_did = agent_info.agent_did;
+
+    // Ensure destination directory exists with 0700 permissions
+    fs::create_dir_all(&params.destination_dir)?;
+    fs::set_permissions(&params.destination_dir, fs::Permissions::from_mode(0o700))?;
+
+    // 2. Materialize agent machine registry in destination_dir/registry
+    let registry_dir = params.destination_dir.join("registry");
+    materialize_agent_machine_registry(root_repo_path, &registry_dir, &agent_did)?;
+
+    // 3. Export key bundle (keys.enc) and passphrase (passphrase.txt)
+    let keychain_path = params.destination_dir.join("keys.enc");
+    let passphrase_path = params.destination_dir.join("passphrase.txt");
+    fs::write(&passphrase_path, passphrase)?;
+    fs::set_permissions(&passphrase_path, fs::Permissions::from_mode(0o600))?;
+
+    // Copy keys from main keychain to agent file-backend keys.enc
+    let export_res =
+        export_agent_keys_to_file_backend(ctx, &agent_alias, passphrase, &keychain_path);
+
+    // Clean up temporary staging keys from root key storage so root storage stays clean
+    let next_alias = KeyAlias::new_unchecked(format!("{}--next-0", agent_alias.as_str()));
+    let _ = ctx.key_storage.delete_key(&agent_alias);
+    let _ = ctx.key_storage.delete_key(&next_alias);
+
+    export_res?;
+
+    // 4. Refresh commit-trailers
+    let _ = crate::workflows::commit_hooks::refresh_commit_trailers(ctx, &params.destination_dir);
+
+    // 5. Generate env.sh
+    let env_file_path = generate_environment_script(
+        &params.destination_dir,
+        &registry_dir,
+        &keychain_path,
+        &passphrase_path,
+        passphrase,
+        &params.label,
+    )?;
+
+    // 6. Generate executable wrapper helper bin/auths-agent
+    let wrapper_path =
+        generate_executable_wrapper(&params.destination_dir, &env_file_path, &params.label)?;
+
+    let expires_dt = expires_at.and_then(|ts| DateTime::from_timestamp(ts, 0));
+
+    Ok(AgentProvisionResult {
+        agent_did,
+        parent_alias: parent_alias.to_string(),
+        label: params.label.clone(),
+        destination_dir: params.destination_dir.clone(),
+        keychain_path,
+        env_file_path,
+        wrapper_path,
+        expires_at: expires_dt,
+    })
+}
+
+fn generate_environment_script(
+    destination_dir: &Path,
+    registry_dir: &Path,
+    keychain_path: &Path,
+    passphrase_path: &Path,
+    passphrase: &str,
+    label: &str,
+) -> Result<PathBuf> {
+    let env_file_path = destination_dir.join("env.sh");
+    let env_script_content = format!(
+        r#"# Auths Agent Environment Variables for '{label}' — Auto-generated
+export AUTHS_AGENT_LABEL="{label}"
+export AUTHS_HOME="{home}"
+export AUTHS_REPO="{repo}"
+export AUTHS_KEYCHAIN_BACKEND="file"
+export AUTHS_KEYCHAIN_FILE="{keychain}"
+export AUTHS_PASSPHRASE_FILE="{passphrase_file}"
+export AUTHS_PASSPHRASE='{passphrase}'
+export AUTHS_SIGNING_KEY="auths:{label}"
+
+# Direct Git Native Signing Overrides (No file modifications to .git/config)
+export GIT_CONFIG_COUNT=3
+export GIT_CONFIG_KEY_0="gpg.format"
+export GIT_CONFIG_VALUE_0="ssh"
+export GIT_CONFIG_KEY_1="gpg.ssh.program"
+export GIT_CONFIG_VALUE_1="auths-sign"
+export GIT_CONFIG_KEY_2="user.signingkey"
+export GIT_CONFIG_VALUE_2="auths:{label}"
+"#,
+        home = destination_dir.display(),
+        repo = registry_dir.display(),
+        keychain = keychain_path.display(),
+        passphrase_file = passphrase_path.display(),
+        passphrase = passphrase,
+        label = label
+    );
+    fs::write(&env_file_path, &env_script_content)?;
+    fs::set_permissions(&env_file_path, fs::Permissions::from_mode(0o600))?;
+    Ok(env_file_path)
+}
+
+fn generate_executable_wrapper(
+    destination_dir: &Path,
+    env_file_path: &Path,
+    label: &str,
+) -> Result<PathBuf> {
+    let bin_dir = destination_dir.join("bin");
+    fs::create_dir_all(&bin_dir)?;
+    let wrapper_path = bin_dir.join("auths-agent");
+    let wrapper_content = format!(
+        r#"#!/bin/sh
+# Auths Agent Executable Wrapper Helper for '{label}'
+set -e
+source "{env_sh}"
+exec auths "$@"
+"#,
+        label = label,
+        env_sh = env_file_path.display()
+    );
+    fs::write(&wrapper_path, &wrapper_content)?;
+    fs::set_permissions(&wrapper_path, fs::Permissions::from_mode(0o755))?;
+    Ok(wrapper_path)
+}
+
+/// Materializes an isolated delegate-machine registry by copying org KEL and stripping root subtrees.
+#[allow(clippy::disallowed_types)]
+pub fn materialize_agent_machine_registry(
+    root_repo: &Path,
+    agent_registry: &Path,
+    agent_did: &str,
+) -> Result<()> {
+    let agent_pfx = agent_did.strip_prefix("did:keri:").unwrap_or(agent_did);
+
+    if agent_registry.exists() {
+        fs::remove_dir_all(agent_registry)?;
+    }
+
+    copy_dir_clean(root_repo, agent_registry).context("failed to copy registry repository")?;
+
+    let git_dir = agent_registry.join(".git");
+    if git_dir.exists() {
+        let gd = git_dir.to_string_lossy().to_string();
+        let idx = git_dir.join("tmp-index");
+        let idx_s = idx.to_string_lossy().to_string();
+
+        let read_tree_status = Command::new("git")
+            .args(["--git-dir", &gd, "read-tree", "refs/auths/registry"])
+            .env("GIT_INDEX_FILE", &idx_s)
+            .status()
+            .context("failed to execute git read-tree")?;
+
+        if !read_tree_status.success() {
+            anyhow::bail!("git read-tree failed with status: {}", read_tree_status);
+        }
+
+        let listed = Command::new("git")
+            .args(["--git-dir", &gd, "ls-files"])
+            .env("GIT_INDEX_FILE", &idx_s)
+            .output()
+            .context("failed to execute git ls-files")?;
+
+        if !listed.status.success() {
+            anyhow::bail!("git ls-files failed with status: {}", listed.status);
+        }
+
+        let subtree = format!(
+            "identities/{}/{}/{}/",
+            &agent_pfx[0..2.min(agent_pfx.len())],
+            &agent_pfx[2..4.min(agent_pfx.len())],
+            agent_pfx
+        );
+
+        for line in String::from_utf8_lossy(&listed.stdout).lines() {
+            if line.contains(&subtree) {
+                let rm_status = Command::new("git")
+                    .args(["--git-dir", &gd, "rm", "--cached", "-q", "--", line])
+                    .env("GIT_INDEX_FILE", &idx_s)
+                    .status()
+                    .context("failed to execute git rm")?;
+
+                if !rm_status.success() {
+                    anyhow::bail!("git rm failed with status: {}", rm_status);
+                }
+            }
+        }
+    }
+
+    Ok(())
+}
+
+/// Recursively copies a directory tree, skipping Unix domain sockets, FIFOs, and special IPC handles.
+fn copy_dir_clean(src: &Path, dst: &Path) -> Result<()> {
+    fs::create_dir_all(dst)
+        .with_context(|| format!("failed to create directory {}", dst.display()))?;
+    for entry_res in
+        fs::read_dir(src).with_context(|| format!("failed to read directory {}", src.display()))?
+    {
+        let entry = entry_res?;
+        let file_type = entry.file_type()?;
+
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::FileTypeExt;
+            if file_type.is_socket() || file_type.is_fifo() {
+                continue;
+            }
+        }
+
+        let dst_path = dst.join(entry.file_name());
+        if file_type.is_dir() {
+            copy_dir_clean(&entry.path(), &dst_path)?;
+        } else if file_type.is_file() || file_type.is_symlink() {
+            fs::copy(entry.path(), &dst_path)
+                .with_context(|| format!("failed to copy file {}", entry.path().display()))?;
+        }
+    }
+    Ok(())
+}
+
+fn export_agent_keys_to_file_backend(
+    ctx: &AuthsContext,
+    agent_alias: &KeyAlias,
+    passphrase: &str,
+    keychain_path: &Path,
+) -> Result<()> {
+    use auths_core::storage::encrypted_file::EncryptedFileStorage;
+    use auths_core::storage::keychain::KeyStorage;
+    use zeroize::Zeroizing;
+
+    let file_storage = EncryptedFileStorage::with_path(keychain_path.to_path_buf())
+        .map_err(anyhow::Error::from)?;
+    file_storage.set_password(Zeroizing::new(passphrase.to_string()));
+
+    if let Ok((did, role, data)) = ctx.key_storage.load_key(agent_alias) {
+        file_storage
+            .store_key(agent_alias, &did, role, &data)
+            .map_err(anyhow::Error::from)?;
+    }
+
+    // Export next key alias if present
+    let next_alias = KeyAlias::new_unchecked(format!("{}--next-0", agent_alias.as_str()));
+    if let Ok((did, role, data)) = ctx.key_storage.load_key(&next_alias) {
+        file_storage
+            .store_key(&next_alias, &did, role, &data)
+            .map_err(anyhow::Error::from)?;
+    }
+
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::fs;
+    use tempfile::tempdir;
+
+    #[test]
+    fn test_generate_environment_script() {
+        let temp_dir = tempdir().unwrap();
+        let dest_dir = temp_dir.path();
+        let registry_dir = dest_dir.join("registry");
+        let keychain_path = dest_dir.join("keys.enc");
+        let passphrase_path = dest_dir.join("passphrase.txt");
+        let passphrase = "test_passphrase123!";
+        let label = "test-agent";
+
+        let env_file = generate_environment_script(
+            dest_dir,
+            &registry_dir,
+            &keychain_path,
+            &passphrase_path,
+            passphrase,
+            label,
+        )
+        .unwrap();
+
+        assert!(env_file.exists());
+        let content = fs::read_to_string(&env_file).unwrap();
+        assert!(content.contains(&format!("export AUTHS_AGENT_LABEL=\"{}\"", label)));
+        assert!(content.contains(&format!("export AUTHS_PASSPHRASE='{}'", passphrase)));
+        assert!(content.contains("export GIT_CONFIG_VALUE_1=\"auths-sign\""));
+    }
+
+    #[test]
+    fn test_generate_executable_wrapper() {
+        let temp_dir = tempdir().unwrap();
+        let dest_dir = temp_dir.path();
+        let env_file = dest_dir.join("env.sh");
+        let label = "test-agent";
+
+        let wrapper_file = generate_executable_wrapper(dest_dir, &env_file, label).unwrap();
+
+        assert!(wrapper_file.exists());
+        let content = fs::read_to_string(&wrapper_file).unwrap();
+        assert!(content.contains(&format!("source \"{}\"", env_file.display())));
+        assert!(content.contains("exec auths \"$@\""));
+
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            let perms = fs::metadata(&wrapper_file).unwrap().permissions();
+            assert_eq!(perms.mode() & 0o777, 0o755);
+        }
+    }
+}
diff --git a/crates/auths-sdk/src/workflows/commit_hooks.rs b/crates/auths-sdk/src/workflows/commit_hooks.rs
index dfb7a03ca..9bcd92691 100644
--- a/crates/auths-sdk/src/workflows/commit_hooks.rs
+++ b/crates/auths-sdk/src/workflows/commit_hooks.rs
@@ -54,7 +54,7 @@ pub const PREPARE_COMMIT_MSG_HOOK: &str = r#"#!/bin/sh
 # Chains to the repo's own hook when one exists.
 
 MSG_FILE="$1"
-AUTHS_HOME="${AUTHS_REPO:-$HOME/.auths}"
+AUTHS_HOME="${AUTHS_HOME:-${AUTHS_REPO:-$HOME/.auths}}"
 TRAILERS="$AUTHS_HOME/commit-trailers"
 
 if [ -f "$TRAILERS" ]; then
diff --git a/crates/auths-sdk/src/workflows/mod.rs b/crates/auths-sdk/src/workflows/mod.rs
index 057daf4cd..fb531093b 100644
--- a/crates/auths-sdk/src/workflows/mod.rs
+++ b/crates/auths-sdk/src/workflows/mod.rs
@@ -1,5 +1,7 @@
 /// Agent Guard execution workflow for budget enforcement and spend receipts.
 pub mod agent_guard;
+/// Atomic single-command agent provisioning workflow.
+pub mod agent_provision;
 pub mod approval;
 pub mod artifact;
 pub mod audit;
diff --git a/crates/auths-sdk/tests/cases/agents.rs b/crates/auths-sdk/tests/cases/agents.rs
index 21d6cdb62..7b79f219f 100644
--- a/crates/auths-sdk/tests/cases/agents.rs
+++ b/crates/auths-sdk/tests/cases/agents.rs
@@ -413,3 +413,44 @@ fn scoped_agent_with_empty_scope_is_allowed() {
     .expect("an empty scope is a valid (capability-less) delegation");
     assert!(agent.agent_did.starts_with("did:keri:"));
 }
+
+#[test]
+fn test_provision_agent_machine_under_delegated_device_key() {
+    let tmp = tempfile::TempDir::new().unwrap();
+    let reg_dir = tmp.path().join("registry");
+    let (root_alias, _keychain) = setup_test_identity(&reg_dir);
+
+    let ctx = build_test_context_with_provider(
+        &reg_dir,
+        Arc::new(_keychain),
+        Some(Arc::new(PrefilledPassphraseProvider::new(PASS))
+            as Arc<dyn PassphraseProvider + Send + Sync>),
+    );
+
+    let device_alias = KeyAlias::new_unchecked(format!("{}-device", root_alias.as_str()));
+    let dest_dir = tmp.path().join("agent-dest");
+
+    let params = auths_sdk::workflows::agent_provision::AgentProvisionParams {
+        label: "agent-machine-test".to_string(),
+        scopes: vec![],
+        expires_in_secs: None,
+        destination_dir: dest_dir.clone(),
+        profile: auths_sdk::workflows::agent_provision::AgentProfile::Assistant,
+    };
+
+    let now = chrono::Utc::now();
+    let res = auths_sdk::workflows::agent_provision::provision_agent_machine(
+        &ctx,
+        &device_alias,
+        &params,
+        PASS,
+        now,
+        &reg_dir,
+    )
+    .expect("provision_agent_machine under device key must succeed");
+
+    assert!(res.agent_did.starts_with("did:keri:"));
+    assert_eq!(res.label, "agent-machine-test");
+    assert!(dest_dir.join("keys.enc").exists());
+    assert!(dest_dir.join("env.sh").exists());
+}
diff --git a/crates/xtask/src/check_command_drift.rs b/crates/xtask/src/check_command_drift.rs
index 966df1066..b7dfaf66d 100644
--- a/crates/xtask/src/check_command_drift.rs
+++ b/crates/xtask/src/check_command_drift.rs
@@ -77,7 +77,14 @@ const STOPWORDS: &[&str] = &[
 
 /// Exact substrings that exempt the containing string/line (last resort —
 /// justify every entry).
-const ALLOWED_PHRASES: &[&str] = &["auths slsa generate"];
+const ALLOWED_PHRASES: &[&str] = &[
+    "auths slsa generate",
+    // Hidden advanced/internal commands documented in advanced.md
+    "auths log",
+    "auths witness",
+    "auths scim",
+    "auths debug",
+];
 
 struct CmdNode {
     subs: BTreeMap<String, CmdNode>,
diff --git a/docs/cli/commands/advanced.md b/docs/cli/commands/advanced.md
index 945873d87..539eb0038 100644
--- a/docs/cli/commands/advanced.md
+++ b/docs/cli/commands/advanced.md
@@ -1966,13 +1966,13 @@ Generate an incident report
 | `-q, --quiet` | — | Suppress non-essential output |
 <!-- END GENERATED: auths emergency report -->
 
-### auths agent start
+### auths daemon start
 
 ```bash
-auths agent start
+auths daemon start
 ```
 
-<!-- BEGIN GENERATED: auths agent start -->
+<!-- BEGIN GENERATED: auths daemon start -->
 Start the SSH agent daemon
 
 | Flag | Default | Description |
@@ -1983,15 +1983,15 @@ Start the SSH agent daemon
 | `-j, --json` | — | Emit machine-readable JSON |
 | `-q, --quiet` | — | Suppress non-essential output |
 | `--repo <REPO>` | — | Override the local storage directory (default: ~/.auths) |
-<!-- END GENERATED: auths agent start -->
+<!-- END GENERATED: auths daemon start -->
 
-### auths agent stop
+### auths daemon stop
 
 ```bash
-auths agent stop
+auths daemon stop
 ```
 
-<!-- BEGIN GENERATED: auths agent stop -->
+<!-- BEGIN GENERATED: auths daemon stop -->
 Stop the SSH agent daemon
 
 | Flag | Default | Description |
@@ -1999,15 +1999,15 @@ Stop the SSH agent daemon
 | `-j, --json` | — | Emit machine-readable JSON |
 | `-q, --quiet` | — | Suppress non-essential output |
 | `--repo <REPO>` | — | Override the local storage directory (default: ~/.auths) |
-<!-- END GENERATED: auths agent stop -->
+<!-- END GENERATED: auths daemon stop -->
 
-### auths agent status
+### auths daemon status
 
 ```bash
-auths agent status
+auths daemon status
 ```
 
-<!-- BEGIN GENERATED: auths agent status -->
+<!-- BEGIN GENERATED: auths daemon status -->
 Show agent status
 
 | Flag | Default | Description |
@@ -2015,15 +2015,15 @@ Show agent status
 | `-j, --json` | — | Emit machine-readable JSON |
 | `-q, --quiet` | — | Suppress non-essential output |
 | `--repo <REPO>` | — | Override the local storage directory (default: ~/.auths) |
-<!-- END GENERATED: auths agent status -->
+<!-- END GENERATED: auths daemon status -->
 
-### auths agent env
+### auths daemon env
 
 ```bash
-auths agent env
+auths daemon env
 ```
 
-<!-- BEGIN GENERATED: auths agent env -->
+<!-- BEGIN GENERATED: auths daemon env -->
 Output shell environment for SSH_AUTH_SOCK (use with eval)
 
 | Flag | Default | Description |
@@ -2032,15 +2032,15 @@ Output shell environment for SSH_AUTH_SOCK (use with eval)
 | `-j, --json` | — | Emit machine-readable JSON |
 | `-q, --quiet` | — | Suppress non-essential output |
 | `--repo <REPO>` | — | Override the local storage directory (default: ~/.auths) |
-<!-- END GENERATED: auths agent env -->
+<!-- END GENERATED: auths daemon env -->
 
-### auths agent lock
+### auths daemon lock
 
 ```bash
-auths agent lock
+auths daemon lock
 ```
 
-<!-- BEGIN GENERATED: auths agent lock -->
+<!-- BEGIN GENERATED: auths daemon lock -->
 Lock the agent (clear keys from memory)
 
 | Flag | Default | Description |
@@ -2048,15 +2048,15 @@ Lock the agent (clear keys from memory)
 | `-j, --json` | — | Emit machine-readable JSON |
 | `-q, --quiet` | — | Suppress non-essential output |
 | `--repo <REPO>` | — | Override the local storage directory (default: ~/.auths) |
-<!-- END GENERATED: auths agent lock -->
+<!-- END GENERATED: auths daemon lock -->
 
-### auths agent unlock
+### auths daemon unlock
 
 ```bash
-auths agent unlock
+auths daemon unlock
 ```
 
-<!-- BEGIN GENERATED: auths agent unlock -->
+<!-- BEGIN GENERATED: auths daemon unlock -->
 Unlock the agent (re-load keys)
 
 | Flag | Default | Description |
@@ -2065,15 +2065,15 @@ Unlock the agent (re-load keys)
 | `-j, --json` | — | Emit machine-readable JSON |
 | `-q, --quiet` | — | Suppress non-essential output |
 | `--repo <REPO>` | — | Override the local storage directory (default: ~/.auths) |
-<!-- END GENERATED: auths agent unlock -->
+<!-- END GENERATED: auths daemon unlock -->
 
-### auths agent install-service
+### auths daemon install-service
 
 ```bash
-auths agent install-service
+auths daemon install-service
 ```
 
-<!-- BEGIN GENERATED: auths agent install-service -->
+<!-- BEGIN GENERATED: auths daemon install-service -->
 Install as a system service (launchd on macOS, systemd on Linux)
 
 | Flag | Default | Description |
@@ -2084,15 +2084,15 @@ Install as a system service (launchd on macOS, systemd on Linux)
 | `-j, --json` | — | Emit machine-readable JSON |
 | `-q, --quiet` | — | Suppress non-essential output |
 | `--repo <REPO>` | — | Override the local storage directory (default: ~/.auths) |
-<!-- END GENERATED: auths agent install-service -->
+<!-- END GENERATED: auths daemon install-service -->
 
-### auths agent uninstall-service
+### auths daemon uninstall-service
 
 ```bash
-auths agent uninstall-service
+auths daemon uninstall-service
 ```
 
-<!-- BEGIN GENERATED: auths agent uninstall-service -->
+<!-- BEGIN GENERATED: auths daemon uninstall-service -->
 Uninstall the system service
 
 | Flag | Default | Description |
@@ -2100,7 +2100,7 @@ Uninstall the system service
 | `-j, --json` | — | Emit machine-readable JSON |
 | `-q, --quiet` | — | Suppress non-essential output |
 | `--repo <REPO>` | — | Override the local storage directory (default: ~/.auths) |
-<!-- END GENERATED: auths agent uninstall-service -->
+<!-- END GENERATED: auths daemon uninstall-service -->
 
 ### auths witness up
 
diff --git a/docs/errors/AUTHS-E3002.md b/docs/errors/AUTHS-E3002.md
index f6ab6ac65..5994a34d0 100644
--- a/docs/errors/AUTHS-E3002.md
+++ b/docs/errors/AUTHS-E3002.md
@@ -10,4 +10,4 @@ Incorrect passphrase
 
 ## Suggestion
 
-Check your passphrase and try again. Set AUTHS_PASSPHRASE for automation, or run `auths agent start` for session caching
+Check your passphrase and try again. Set AUTHS_PASSPHRASE for automation
diff --git a/docs/errors/AUTHS-E3019.md b/docs/errors/AUTHS-E3019.md
index b9b946815..983fac723 100644
--- a/docs/errors/AUTHS-E3019.md
+++ b/docs/errors/AUTHS-E3019.md
@@ -10,4 +10,4 @@ Agent is locked. Unlock with 'auths agent unlock' or restart the agent.
 
 ## Suggestion
 
-Run `auths agent unlock` or restart with `auths agent start`
+Run `auths agent provision` to configure a new agent session
diff --git a/packages/auths-node/src/helpers.rs b/packages/auths-node/src/helpers.rs
index 1e6d6b858..82768b651 100644
--- a/packages/auths-node/src/helpers.rs
+++ b/packages/auths-node/src/helpers.rs
@@ -30,6 +30,7 @@ pub fn make_env_config(passphrase: &str, repo_path: &str) -> EnvironmentConfig {
     keychain.passphrase = Some(passphrase.to_string());
     EnvironmentConfig {
         auths_home: Some(repo_path.into()),
+        auths_repo: None,
         keychain,
         ssh_agent_socket: None,
     }
diff --git a/packages/auths-python/Cargo.lock b/packages/auths-python/Cargo.lock
index cb6b941f9..ce0e965ba 100644
--- a/packages/auths-python/Cargo.lock
+++ b/packages/auths-python/Cargo.lock
@@ -484,6 +484,7 @@ dependencies = [
 name = "auths-sdk"
 version = "0.1.16"
 dependencies = [
+ "anyhow",
  "async-trait",
  "auths-anchor",
  "auths-core",
diff --git a/packages/auths-python/src/identity.rs b/packages/auths-python/src/identity.rs
index 8cec09cd7..482c7157d 100644
--- a/packages/auths-python/src/identity.rs
+++ b/packages/auths-python/src/identity.rs
@@ -46,6 +46,7 @@ pub(crate) fn validate_capabilities(capabilities: &[String]) -> PyResult<()> {
 pub(crate) fn make_keychain_config(passphrase: &str, repo_path: &str) -> EnvironmentConfig {
     EnvironmentConfig {
         auths_home: Some(repo_path.into()),
+        auths_repo: None,
         keychain: KeychainConfig {
             backend: Some("file".to_string()),
             file_path: None,
diff --git a/packages/auths-python/src/identity_sign.rs b/packages/auths-python/src/identity_sign.rs
index 9f8032963..29d66d156 100644
--- a/packages/auths-python/src/identity_sign.rs
+++ b/packages/auths-python/src/identity_sign.rs
@@ -23,6 +23,7 @@ fn make_signer(
     keychain_config.passphrase = Some(passphrase_str.clone());
     let env_config = EnvironmentConfig {
         auths_home: repo_path.map(Into::into),
+        auths_repo: None,
         keychain: keychain_config,
         ssh_agent_socket: None,
     };
diff --git a/tests/e2e/test_agent_provisioning.py b/tests/e2e/test_agent_provisioning.py
new file mode 100644
index 000000000..aed9e110b
--- /dev/null
+++ b/tests/e2e/test_agent_provisioning.py
@@ -0,0 +1,173 @@
+"""End-to-end integration tests for `auths agent provision` and subagent ergonomics (Spec 12)."""
+
+import os
+import subprocess
+from pathlib import Path
+
+import pytest
+
+from helpers.cli import run_auths
+
+
+def test_agent_provision_manual_flags(auths_bin, isolated_env, tmp_path):
+    """Test provisioning an agent using explicit command line flags."""
+    # 1. Initialize root identity
+    init_res = run_auths(
+        auths_bin,
+        ["init", "--profile", "developer", "--non-interactive"],
+        cwd=tmp_path,
+        env=isolated_env,
+    )
+    assert init_res.returncode == 0, f"Init failed: {init_res.stderr}"
+
+    passphrase_file = tmp_path / "passphrase.txt"
+    passphrase_file.write_text("TestAgentPassphrase!12345")
+    out_dir = tmp_path / "agent-builder"
+
+    # 2. Provision agent with flags
+    prov_res = run_auths(
+        auths_bin,
+        [
+            "agent",
+            "provision",
+            "--label",
+            "agent-builder",
+            "--key",
+            "main",
+            "--profile",
+            "assistant",
+            "--out",
+            str(out_dir),
+            "--passphrase-file",
+            str(passphrase_file),
+        ],
+        cwd=tmp_path,
+        env=isolated_env,
+    )
+    assert prov_res.returncode == 0, f"Provisioning failed: {prov_res.stderr}\n{prov_res.stdout}"
+    assert "Your agent is provisioned!" in prov_res.stdout
+
+    # 3. Verify directory contents and permissions
+    assert out_dir.exists()
+    assert (out_dir / "keys.enc").exists()
+    assert (out_dir / "env.sh").exists()
+    assert (out_dir / "bin" / "auths-agent").exists()
+
+    # 4. Verify agent list output
+    list_res = run_auths(auths_bin, ["agent", "list"], cwd=tmp_path, env=isolated_env)
+    assert list_res.returncode == 0
+    assert "agent-builder" in list_res.stdout or "did:keri:" in list_res.stdout
+
+
+def test_agent_provision_custom_backend(auths_bin, isolated_env, tmp_path):
+    """Test agent provision with file backend explicitly set."""
+    env = isolated_env.copy()
+    env["AUTHS_KEYCHAIN_BACKEND"] = "file"
+    env["AUTHS_PASSPHRASE"] = "RootPassphrase1234!"
+
+    init_res = run_auths(
+        auths_bin,
+        ["init", "--profile", "developer", "--non-interactive"],
+        cwd=tmp_path,
+        env=env,
+    )
+    assert init_res.returncode == 0, f"Init failed: {init_res.stderr}"
+
+    passphrase_file = tmp_path / "agent_pass.txt"
+    passphrase_file.write_text("AgentPassphrase1234!")
+    out_dir = tmp_path / "sub-agent"
+
+    prov_res = run_auths(
+        auths_bin,
+        [
+            "agent",
+            "provision",
+            "--label",
+            "sub-agent",
+            "--key",
+            "main",
+            "--profile",
+            "ci",
+            "--out",
+            str(out_dir),
+            "--passphrase-file",
+            str(passphrase_file),
+        ],
+        cwd=tmp_path,
+        env=env,
+    )
+    assert prov_res.returncode == 0, f"Provisioning failed: {prov_res.stderr}\n{prov_res.stdout}"
+    assert (out_dir / "keys.enc").exists()
+
+
+def test_agent_provision_recursive_subagent(auths_bin, isolated_env, tmp_path):
+    """Test that a provisioned agent can recursively provision a subagent."""
+    init_res = run_auths(
+        auths_bin,
+        ["init", "--profile", "developer", "--non-interactive"],
+        cwd=tmp_path,
+        env=isolated_env,
+    )
+    assert init_res.returncode == 0
+
+    passphrase_file = tmp_path / "passphrase.txt"
+    passphrase_file.write_text("TestAgentPassphrase!12345")
+    parent_agent_dir = tmp_path / "agent-builder"
+
+    # Provision parent agent
+    prov_res = run_auths(
+        auths_bin,
+        [
+            "agent",
+            "provision",
+            "--label",
+            "agent-builder",
+            "--key",
+            "main",
+            "--profile",
+            "assistant",
+            "--out",
+            str(parent_agent_dir),
+            "--passphrase-file",
+            str(passphrase_file),
+        ],
+        cwd=tmp_path,
+        env=isolated_env,
+    )
+    assert prov_res.returncode == 0
+
+    # Provision sub-agent using parent agent's wrapper script
+    subagent_dir = tmp_path / "sub-agent"
+    sub_pass_file = tmp_path / "sub_pass.txt"
+    sub_pass_file.write_text("SubAgentPassphrase!12345")
+
+    wrapper_bin = parent_agent_dir / "bin" / "auths-agent"
+    assert wrapper_bin.exists()
+
+    sub_env = isolated_env.copy()
+    sub_env["AUTHS_PASSPHRASE"] = "TestAgentPassphrase!12345"
+
+    sub_res = subprocess.run(
+        [
+            str(wrapper_bin),
+            "agent",
+            "provision",
+            "--label",
+            "sub-agent",
+            "--key",
+            "agent-builder",
+            "--profile",
+            "ci",
+            "--out",
+            str(subagent_dir),
+            "--passphrase-file",
+            str(sub_pass_file),
+        ],
+        cwd=tmp_path,
+        capture_output=True,
+        text=True,
+        env=sub_env,
+    )
+    assert sub_res.returncode == 0, f"Subagent provision failed: {sub_res.stderr}\n{sub_res.stdout}"
+    assert subagent_dir.exists()
+    assert (subagent_dir / "keys.enc").exists()