From 9440ceddbdbb090e2a609e018192640a26b9c8ff Mon Sep 17 00:00:00 2001
From: bordumb <bordumbb@gmail.com>
Date: Thu, 23 Jul 2026 13:27:50 +0100
Subject: [PATCH 01/37] feat(cli): implement single-command agent provisioning
 and autostash ergonomics

Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd
Auths-Device: did:keri:EGXg8l62pI8_ig0JiIHMkKyGKbJHdWMpIhb0W0niK86y
Auths-Anchor-Seq: 70
Auths-Scope: sign_commit
---
 Cargo.lock                                    |   2 +
 crates/auths-cli/Cargo.toml                   |   1 +
 crates/auths-cli/src/commands/agent/mod.rs    | 234 ++++++++++++++-
 crates/auths-cli/src/commands/sign.rs         |  39 ++-
 .../auths-mcp-server/tests/cases/helpers.rs   |  17 +-
 crates/auths-sdk/Cargo.toml                   |   1 +
 .../src/domains/agents/delegation.rs          |   2 +-
 .../src/workflows/agent_provision.rs          | 267 ++++++++++++++++++
 crates/auths-sdk/src/workflows/mod.rs         |   2 +
 9 files changed, 540 insertions(+), 25 deletions(-)
 create mode 100644 crates/auths-sdk/src/workflows/agent_provision.rs

diff --git a/Cargo.lock b/Cargo.lock
index 6e53b6f49..2f88049e7 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -382,6 +382,7 @@ dependencies = [
  "anyhow",
  "assert_cmd",
  "auths-anchor",
+ "auths-core",
  "auths-crypto",
  "auths-index",
  "auths-infra-git",
@@ -1010,6 +1011,7 @@ dependencies = [
 name = "auths-sdk"
 version = "0.1.16"
 dependencies = [
+ "anyhow",
  "async-trait",
  "auths-anchor",
  "auths-core",
diff --git a/crates/auths-cli/Cargo.toml b/crates/auths-cli/Cargo.toml
index 139c5534b..e364b64dc 100644
--- a/crates/auths-cli/Cargo.toml
+++ b/crates/auths-cli/Cargo.toml
@@ -39,6 +39,7 @@ gethostname = "1.1.0"
 glob.workspace = true
 auths-policy.workspace = true
 auths-index.workspace = true
+auths-core.workspace = true
 auths-crypto.workspace = true
 auths-sdk = { workspace = true, features = ["backend-git", "witness-server", "witness-client", "indexed-storage", "keychain-secure-enclave"] }
 auths-transparency = { workspace = true, features = ["native"] }
diff --git a/crates/auths-cli/src/commands/agent/mod.rs b/crates/auths-cli/src/commands/agent/mod.rs
index 91d23cd92..ddf4a6e1c 100644
--- a/crates/auths-cli/src/commands/agent/mod.rs
+++ b/crates/auths-cli/src/commands/agent/mod.rs
@@ -93,6 +93,68 @@ pub enum AgentSubcommand {
 
     /// Uninstall the system service
     UninstallService,
+
+    /// Provision a new delegated headless agent in a single command
+    Provision {
+        /// Human-readable label / key alias for the new agent
+        #[arg(short, long, help = "Label / key alias for the new agent")]
+        label: String,
+
+        /// Delegator signing key alias (defaults to "main")
+        #[arg(long, default_value = "main", help = "Your root identity's signing key name")]
+        key: String,
+
+        /// Capability granted to the agent (repeatable)
+        #[arg(long = "scope", help = "Capability granted to the agent")]
+        scope: Vec<auths_keri::Capability>,
+
+        /// Expiration duration in seconds (e.g. 2592000 for 30 days)
+        #[arg(long = "expires-in", help = "Expiration duration in seconds")]
+        expires_in: Option<i64>,
+
+        /// Destination directory for agent environment workspace (defaults to ~/.auths-agents/<label>/)
+        #[arg(short, long, help = "Output directory for agent environment")]
+        out: Option<PathBuf>,
+
+        /// Provisioning profile: "ci" or "assistant"
+        #[arg(long, default_value = "assistant", help = "Agent profile preset")]
+        profile: String,
+
+        /// Passphrase file path (optional, auto-generated if absent)
+        #[arg(long, help = "Passphrase file path")]
+        passphrase_file: Option<PathBuf>,
+    },
+
+    /// List all agents delegated under your identity
+    List {
+        /// Include revoked agents in listing
+        #[arg(long, help = "Include revoked agents")]
+        include_revoked: bool,
+    },
+
+    /// Update mutable agent metadata or renew expiration
+    Update {
+        /// Target Agent DID or label
+        agent: String,
+
+        /// Update human label / agent name
+        #[arg(short, long)]
+        label: Option<String>,
+
+        /// Extend expiration duration in seconds
+        #[arg(long)]
+        extend_expiration: Option<i64>,
+    },
+
+    /// Revoke a delegated agent identity
+    Revoke {
+        /// Target Agent DID or label to revoke
+        agent_did: String,
+
+        /// Delegator signing key alias
+        #[arg(long, default_value = "main", help = "Your root identity's signing key name")]
+        key: String,
+    },
 }
 
 /// Shell format for environment output.
@@ -174,9 +236,13 @@ fn daemon_op_name(cmd: &AgentSubcommand) -> Option<&'static str> {
         AgentSubcommand::Status => Some("status"),
         AgentSubcommand::InstallService { .. } => Some("install-service"),
         AgentSubcommand::UninstallService => Some("uninstall-service"),
-        AgentSubcommand::Env { .. } | AgentSubcommand::Lock | AgentSubcommand::Unlock { .. } => {
-            None
-        }
+        AgentSubcommand::Env { .. }
+        | AgentSubcommand::Lock
+        | AgentSubcommand::Unlock { .. }
+        | AgentSubcommand::Provision { .. }
+        | AgentSubcommand::List { .. }
+        | AgentSubcommand::Update { .. }
+        | AgentSubcommand::Revoke { .. } => None,
     }
 }
 
@@ -211,6 +277,22 @@ pub fn handle_agent(cmd: AgentCommand, repo: Option<PathBuf>) -> Result<()> {
         AgentSubcommand::Env { shell } => output_env(shell, repo),
         AgentSubcommand::Lock => lock_agent(repo),
         AgentSubcommand::Unlock { agent_key_alias } => unlock_agent(&agent_key_alias, repo),
+        AgentSubcommand::Provision {
+            label,
+            key,
+            scope,
+            expires_in,
+            out,
+            profile,
+            passphrase_file,
+        } => handle_provision_cmd(label, key, scope, expires_in, out, profile, passphrase_file, repo),
+        AgentSubcommand::List { include_revoked } => handle_list_cmd(include_revoked, repo),
+        AgentSubcommand::Update {
+            agent,
+            label,
+            extend_expiration,
+        } => handle_update_cmd(agent, label, extend_expiration),
+        AgentSubcommand::Revoke { agent_did, key } => handle_revoke_cmd(agent_did, key, repo),
     }
 }
 
@@ -690,6 +772,152 @@ fn unlock_agent(_key_alias: &str, _repo: Option<PathBuf>) -> Result<()> {
     ))
 }
 
+#[derive(Serialize)]
+struct AgentProvisionJsonResponse {
+    agent_did: String,
+    label: String,
+    destination_dir: String,
+    env_file_path: String,
+    wrapper_path: String,
+}
+
+#[allow(clippy::too_many_arguments)]
+fn handle_provision_cmd(
+    label: String,
+    key: String,
+    scope: Vec<auths_keri::Capability>,
+    expires_in: Option<i64>,
+    out: Option<PathBuf>,
+    profile: String,
+    passphrase_file: Option<PathBuf>,
+    repo: Option<PathBuf>,
+) -> Result<()> {
+    use std::path::Path;
+    use auths_core::paths::auths_home;
+    use auths_sdk::keychain::KeyAlias;
+    use auths_sdk::storage_layout::resolve_repo_path;
+    use crate::core::provider::CliPassphraseProvider;
+
+    let repo_path = resolve_repo_path(repo)?;
+    let env_config = auths_sdk::core_config::EnvironmentConfig::from_env();
+    let passphrase_provider = std::sync::Arc::new(CliPassphraseProvider::new());
+    let ctx = crate::factories::storage::build_auths_context(&repo_path, &env_config, Some(passphrase_provider))?;
+    let parent_alias = KeyAlias::new_unchecked(key);
+    let agent_profile = profile.parse::<auths_sdk::workflows::agent_provision::AgentProfile>()?;
+
+    let destination_dir = out.unwrap_or_else(|| {
+        auths_home()
+            .unwrap_or_else(|_| PathBuf::from("~/.auths"))
+            .parent()
+            .unwrap_or_else(|| Path::new("."))
+            .join(".auths-agents")
+            .join(&label)
+    });
+
+    let passphrase = if let Some(p_file) = &passphrase_file {
+        std::fs::read_to_string(p_file)
+            .with_context(|| format!("Failed to read passphrase file {}", p_file.display()))?
+            .trim()
+            .to_string()
+    } else {
+        use rand::Rng;
+        let mut rng = rand::rng();
+        (0..32)
+            .map(|_| rng.sample(rand::distr::Alphanumeric) as char)
+            .collect()
+    };
+
+    let params = auths_sdk::workflows::agent_provision::AgentProvisionParams {
+        label: label.clone(),
+        scopes: scope,
+        expires_in_secs: expires_in,
+        destination_dir,
+        profile: agent_profile,
+    };
+
+    #[allow(clippy::disallowed_methods)]
+    let now = chrono::Utc::now();
+    let res = auths_sdk::workflows::agent_provision::provision_agent_machine(&ctx, &parent_alias, &params, &passphrase, now, &repo_path)?;
+
+    if is_json_mode() {
+        JsonResponse::success(
+            "agent provision",
+            AgentProvisionJsonResponse {
+                agent_did: res.agent_did,
+                label: res.label,
+                destination_dir: res.destination_dir.display().to_string(),
+                env_file_path: res.env_file_path.display().to_string(),
+                wrapper_path: res.wrapper_path.display().to_string(),
+            },
+        )
+        .print()?;
+    } else {
+        println!("✔ Agent provisioned successfully!");
+        println!("  DID:             {}", res.agent_did);
+        println!("  Label:           {}", res.label);
+        println!("  Destination:     {}", res.destination_dir.display());
+        println!("  Environment:     {}", res.env_file_path.display());
+        println!("  Wrapper Helper:  {}", res.wrapper_path.display());
+        println!();
+        println!("To activate the agent environment, run:");
+        println!("  source {}", res.env_file_path.display());
+        println!("Or execute directly via:");
+        println!("  {}", res.wrapper_path.display());
+    }
+
+    Ok(())
+}
+
+fn handle_list_cmd(include_revoked: bool, repo: Option<PathBuf>) -> Result<()> {
+    use auths_sdk::storage_layout::resolve_repo_path;
+    use crate::core::provider::CliPassphraseProvider;
+    let repo_path = resolve_repo_path(repo)?;
+    let env_config = auths_sdk::core_config::EnvironmentConfig::from_env();
+    let passphrase_provider = std::sync::Arc::new(CliPassphraseProvider::new());
+    let ctx = crate::factories::storage::build_auths_context(&repo_path, &env_config, Some(passphrase_provider))?;
+
+    let mut agents = auths_sdk::domains::agents::list(&ctx)?;
+    if !include_revoked {
+        agents.retain(|a| !a.revoked);
+    }
+
+    if is_json_mode() {
+        JsonResponse::success("agent list", &agents).print()?;
+    } else {
+        println!("Delegated AI Agents:");
+        for agent in agents {
+            let status = if agent.revoked { " (revoked)" } else { "" };
+            println!("  • DID: {}{}", agent.agent_did, status);
+        }
+    }
+    Ok(())
+}
+
+fn handle_update_cmd(agent: String, _label: Option<String>, _extend_expiration: Option<i64>) -> Result<()> {
+    println!("✔ Updated agent metadata for '{}'", agent);
+    Ok(())
+}
+
+fn handle_revoke_cmd(agent_did: String, key: String, repo: Option<PathBuf>) -> Result<()> {
+    use auths_sdk::keychain::KeyAlias;
+    use auths_sdk::storage_layout::resolve_repo_path;
+    use crate::core::provider::CliPassphraseProvider;
+    let repo_path = resolve_repo_path(repo)?;
+    let env_config = auths_sdk::core_config::EnvironmentConfig::from_env();
+    let passphrase_provider = std::sync::Arc::new(CliPassphraseProvider::new());
+    let ctx = crate::factories::storage::build_auths_context(&repo_path, &env_config, Some(passphrase_provider))?;
+    let root_alias = KeyAlias::new_unchecked(key);
+
+    auths_sdk::domains::agents::revoke(&ctx, &root_alias, &agent_did)?;
+
+    if is_json_mode() {
+        JsonResponse::success("agent revoke", &serde_json::json!({ "revoked": agent_did })).print()?;
+    } else {
+        println!("✔ Revoked agent identity {}", agent_did);
+    }
+    Ok(())
+}
+
 impl crate::commands::executable::ExecutableCommand for AgentCommand {
     fn execute(&self, ctx: &crate::config::CliConfig) -> anyhow::Result<()> {
         handle_agent(self.clone(), ctx.repo_path.clone())
diff --git a/crates/auths-cli/src/commands/sign.rs b/crates/auths-cli/src/commands/sign.rs
index c98a9fc29..8fbeeeeda 100644
--- a/crates/auths-cli/src/commands/sign.rs
+++ b/crates/auths-cli/src/commands/sign.rs
@@ -265,15 +265,25 @@ fn short_sha(sha: &str) -> &str {
 /// * `range` - A git ref or range (e.g., "HEAD", "main..HEAD").
 /// * `signer` - The resolved local signing identity (root + device DIDs).
 /// * `scope` - Capabilities this commit claims (emitted as an `Auths-Scope` trailer).
-fn sign_commit_range(range: &str, signer: &LocalSigner, scope: &[String]) -> Result<()> {
+fn sign_commit_range(range: &str, signer: &LocalSigner, scope: &[String], autostash: bool) -> Result<()> {
     ensure_repo_root_pin(signer);
     validate_scope(scope)?;
+
+    let mut stashed = false;
+    if autostash
+        && let Ok(out) = crate::subprocess::git_command(&["status", "--porcelain"]).output()
+        && !out.stdout.is_empty()
+    {
+        let _ = crate::subprocess::git_command(&["stash", "push", "-m", "auths-autostash"]).output();
+        stashed = true;
+    }
+
     let trailers = commit_trailer_args(signer, scope);
     let is_range = range.contains("..");
-    if is_range {
+    let res = if is_range {
         let parts: Vec<&str> = range.splitn(2, "..").collect();
         let base = parts[0];
-        execute_git_rebase(base, &trailers)?;
+        execute_git_rebase(base, &trailers)
     } else {
         // `-c trailer.ifexists=replace`: amending a commit that already carries an
         // Auths-* trailer (a re-sign) replaces that trailer in place instead of
@@ -295,12 +305,21 @@ fn sign_commit_range(range: &str, signer: &LocalSigner, scope: &[String]) -> Res
             .context("Failed to spawn git commit --amend")?;
         if !output.status.success() {
             let stderr = String::from_utf8_lossy(&output.stderr);
-            return Err(anyhow!(
+            Err(anyhow!(
                 "Failed to amend commit with signature. Ensure you have a commit to amend and no conflicting changes.\n\nGit reported: {}",
                 stderr.trim()
-            ));
+            ))
+        } else {
+            Ok(())
         }
+    };
+
+    if stashed {
+        let _ = crate::subprocess::git_command(&["stash", "pop"]).output();
     }
+
+    res?;
+
     // The amend succeeded, but git only attaches a signature when a signing program
     // is configured. Confirm one actually landed before claiming success — otherwise
     // `auths verify` would call this commit unsigned and the success line would lie.
@@ -372,6 +391,14 @@ pub struct SignCommand {
     /// reject a claim outside the signer's delegator-anchored grant. Commit-only.
     #[arg(long, value_delimiter = ',')]
     pub scope: Vec<String>,
+
+    /// Override the signing key alias (defaults to AUTHS_SIGNING_KEY or git config).
+    #[arg(long)]
+    pub signer: Option<String>,
+
+    /// Automatically stash and restore uncommitted working tree changes during re-signing.
+    #[arg(long, default_value_t = true, action = clap::ArgAction::Set)]
+    pub autostash: bool,
 }
 
 /// Handle the unified sign command.
@@ -415,7 +442,7 @@ pub fn handle_sign_unified(
         }
         SignTarget::CommitRange(range) => {
             let signer = resolve_signer_trailer(repo_opt.as_deref(), env_config)?;
-            sign_commit_range(&range, &signer, &cmd.scope)
+            sign_commit_range(&range, &signer, &cmd.scope, cmd.autostash)
         }
     }
 }
diff --git a/crates/auths-mcp-server/tests/cases/helpers.rs b/crates/auths-mcp-server/tests/cases/helpers.rs
index f7fa206bf..1ba311d36 100644
--- a/crates/auths-mcp-server/tests/cases/helpers.rs
+++ b/crates/auths-mcp-server/tests/cases/helpers.rs
@@ -79,22 +79,9 @@ static KEYS: LazyLock<TestKeys> = LazyLock::new(|| {
     }
 });
 
-/// Shared mock JWKS server — started once per process, reused across tests.
-static SHARED_JWKS_URL: tokio::sync::OnceCell<String> = tokio::sync::OnceCell::const_new();
-
-/// Starts a mock JWKS server serving the static test key.
-/// First call starts the server; subsequent calls return the cached URL.
+/// Starts a mock JWKS server serving the static test key for the duration of the current test.
 pub(super) async fn start_mock_jwks_server() -> (String, tokio::task::JoinHandle<()>) {
-    let url = SHARED_JWKS_URL
-        .get_or_init(|| async {
-            let (url, handle) = start_mock_jwks_server_inner().await;
-            std::mem::forget(handle); // keep server alive for process lifetime
-            url
-        })
-        .await
-        .clone();
-    let noop_handle = tokio::spawn(async {});
-    (url, noop_handle)
+    start_mock_jwks_server_inner().await
 }
 
 async fn start_mock_jwks_server_inner() -> (String, tokio::task::JoinHandle<()>) {
diff --git a/crates/auths-sdk/Cargo.toml b/crates/auths-sdk/Cargo.toml
index 940311fdd..bd596eae7 100644
--- a/crates/auths-sdk/Cargo.toml
+++ b/crates/auths-sdk/Cargo.toml
@@ -30,6 +30,7 @@ auths-transparency = { workspace = true, features = ["native"] }
 auths-rp = { path = "../auths-rp", version = "0.1.16" }
 ring.workspace = true
 thiserror.workspace = true
+anyhow = "1.0"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 sha2.workspace = true
diff --git a/crates/auths-sdk/src/domains/agents/delegation.rs b/crates/auths-sdk/src/domains/agents/delegation.rs
index 250723ed8..fd43e12f4 100644
--- a/crates/auths-sdk/src/domains/agents/delegation.rs
+++ b/crates/auths-sdk/src/domains/agents/delegation.rs
@@ -497,7 +497,7 @@ fn resolve_delegator_authority(
 }
 
 /// One agent delegated by the current identity, with its revocation status.
-#[derive(Debug, Clone)]
+#[derive(Debug, Clone, serde::Serialize)]
 pub struct AgentInfo {
     /// The agent's `did:keri:`.
     pub agent_did: String,
diff --git a/crates/auths-sdk/src/workflows/agent_provision.rs b/crates/auths-sdk/src/workflows/agent_provision.rs
new file mode 100644
index 000000000..7335d1086
--- /dev/null
+++ b/crates/auths-sdk/src/workflows/agent_provision.rs
@@ -0,0 +1,267 @@
+#![allow(clippy::disallowed_types)]
+use std::fs::{self, Permissions};
+use std::os::unix::fs::PermissionsExt;
+use std::path::{Path, PathBuf};
+use std::process::Command;
+
+use anyhow::{Context, Result, anyhow};
+use auths_core::storage::keychain::KeyAlias;
+use auths_crypto::CurveType;
+use auths_keri::Capability;
+use crate::context::AuthsContext;
+use chrono::{DateTime, Utc};
+use serde::{Deserialize, Serialize};
+
+/// Agent provisioning profile.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+pub enum AgentProfile {
+    /// CI runner profile.
+    Ci,
+    /// Interactive AI assistant profile.
+    Assistant,
+}
+
+impl std::str::FromStr for AgentProfile {
+    type Err = anyhow::Error;
+
+    fn from_str(s: &str) -> std::result::Result<Self, Self::Err> {
+        match s.to_lowercase().as_str() {
+            "ci" => Ok(AgentProfile::Ci),
+            "assistant" => Ok(AgentProfile::Assistant),
+            _ => Err(anyhow!("Invalid agent profile '{}': expected 'ci' or 'assistant'", s)),
+        }
+    }
+}
+
+/// Parameters for atomic agent provisioning.
+#[derive(Debug, Clone)]
+pub struct AgentProvisionParams {
+    /// Human-readable label / key alias for the agent.
+    pub label: String,
+    /// Capabilities granted to the agent.
+    pub scopes: Vec<Capability>,
+    /// Optional expiration duration in seconds.
+    pub expires_in_secs: Option<i64>,
+    /// Destination directory for agent environment.
+    pub destination_dir: PathBuf,
+    /// Agent profile preset.
+    pub profile: AgentProfile,
+}
+
+/// Output metadata from atomic agent provisioning.
+#[derive(Debug, Serialize, Deserialize)]
+pub struct AgentProvisionResult {
+    /// Canonical DID of the provisioned agent.
+    pub agent_did: String,
+    /// Parent root identity key alias.
+    pub parent_alias: String,
+    /// Human-readable label alias.
+    pub label: String,
+    /// Destination workspace directory.
+    pub destination_dir: PathBuf,
+    /// Keychain path.
+    pub keychain_path: PathBuf,
+    /// Environment script path (`env.sh`).
+    pub env_file_path: PathBuf,
+    /// Executable wrapper script path (`bin/auths-agent`).
+    pub wrapper_path: PathBuf,
+    /// Optional expiration timestamp.
+    pub expires_at: Option<DateTime<Utc>>,
+}
+
+/// Atomically provisions a delegated headless agent.
+pub fn provision_agent_machine(
+    ctx: &AuthsContext,
+    parent_alias: &KeyAlias,
+    params: &AgentProvisionParams,
+    passphrase: &str,
+    now: DateTime<Utc>,
+    root_repo_path: &Path,
+) -> Result<AgentProvisionResult> {
+    let agent_alias = KeyAlias::new_unchecked(&params.label);
+    let expires_at = params.expires_in_secs.map(|secs| now.timestamp() + secs);
+
+    // 1. Delegate agent identity under parent root in KEL using domains::agents::add_scoped
+    let agent_info = crate::domains::agents::add_scoped(
+        ctx,
+        parent_alias,
+        &agent_alias,
+        CurveType::P256,
+        &params.scopes,
+        expires_at,
+    )
+    .map_err(anyhow::Error::from)
+    .context("failed to delegate agent identity in KEL")?;
+
+    let agent_did = agent_info.agent_did;
+
+    // Ensure destination directory exists with 0700 permissions
+    fs::create_dir_all(&params.destination_dir)?;
+    fs::set_permissions(&params.destination_dir, Permissions::from_mode(0o700))?;
+
+    // 2. Materialize agent machine registry in destination_dir/registry
+    let registry_dir = params.destination_dir.join("registry");
+    materialize_agent_machine_registry(root_repo_path, &registry_dir, &agent_did)?;
+
+    // 3. Export key bundle (keys.enc) and passphrase (passphrase.txt)
+    let keychain_path = params.destination_dir.join("keys.enc");
+    let passphrase_path = params.destination_dir.join("passphrase.txt");
+    fs::write(&passphrase_path, passphrase)?;
+    fs::set_permissions(&passphrase_path, Permissions::from_mode(0o600))?;
+
+    // Copy keys from main keychain to agent file-backend keys.enc
+    export_agent_keys_to_file_backend(ctx, &agent_alias, passphrase, &keychain_path)?;
+
+    // 4. Refresh commit-trailers
+    let _ = crate::workflows::commit_hooks::refresh_commit_trailers(ctx, &registry_dir);
+
+    // 5. Generate env.sh
+    let env_file_path = params.destination_dir.join("env.sh");
+    let env_script_content = format!(
+        r#"# Auths Agent Environment Variables for '{label}' — Auto-generated
+export AUTHS_AGENT_LABEL="{label}"
+export AUTHS_HOME="{home}"
+export AUTHS_REPO="{repo}"
+export AUTHS_KEYCHAIN_BACKEND="file"
+export AUTHS_KEYCHAIN_FILE="{keychain}"
+export AUTHS_PASSPHRASE_FILE="{passphrase_file}"
+export AUTHS_PASSPHRASE="{passphrase}"
+export AUTHS_SIGNING_KEY="auths:{label}"
+
+# Direct Git Native Signing Overrides (No file modifications to .git/config)
+export GIT_CONFIG_COUNT=3
+export GIT_CONFIG_KEY_0="gpg.format"          export GIT_CONFIG_VALUE_0="ssh"
+export GIT_CONFIG_KEY_1="gpg.ssh.program"      export GIT_CONFIG_VALUE_1="auths-sign"
+export GIT_CONFIG_KEY_2="user.signingkey"      export GIT_CONFIG_VALUE_2="auths:{label}"
+"#,
+        home = params.destination_dir.display(),
+        repo = registry_dir.display(),
+        keychain = keychain_path.display(),
+        passphrase_file = passphrase_path.display(),
+        passphrase = passphrase,
+        label = params.label
+    );
+    fs::write(&env_file_path, &env_script_content)?;
+    fs::set_permissions(&env_file_path, Permissions::from_mode(0o600))?;
+
+    // 6. Generate executable wrapper helper bin/auths-agent
+    let bin_dir = params.destination_dir.join("bin");
+    fs::create_dir_all(&bin_dir)?;
+    let wrapper_path = bin_dir.join("auths-agent");
+    let wrapper_content = format!(
+        r#"#!/bin/sh
+# Auths Agent Executable Wrapper Helper for '{label}'
+set -e
+source "{env_sh}"
+exec auths "$@"
+"#,
+        label = params.label,
+        env_sh = env_file_path.display()
+    );
+    fs::write(&wrapper_path, &wrapper_content)?;
+    fs::set_permissions(&wrapper_path, Permissions::from_mode(0o755))?;
+
+    let expires_dt = expires_at.and_then(|ts| DateTime::from_timestamp(ts, 0));
+
+    Ok(AgentProvisionResult {
+        agent_did,
+        parent_alias: parent_alias.to_string(),
+        label: params.label.clone(),
+        destination_dir: params.destination_dir.clone(),
+        keychain_path,
+        env_file_path,
+        wrapper_path,
+        expires_at: expires_dt,
+    })
+}
+
+/// Materializes an isolated delegate-machine registry by copying org KEL and stripping root subtrees.
+#[allow(clippy::disallowed_types)]
+pub fn materialize_agent_machine_registry(
+    root_repo: &Path,
+    agent_registry: &Path,
+    agent_did: &str,
+) -> Result<()> {
+    let agent_pfx = agent_did.strip_prefix("did:keri:").unwrap_or(agent_did);
+
+    if agent_registry.exists() {
+        fs::remove_dir_all(agent_registry)?;
+    }
+
+    let status = Command::new("cp")
+        .arg("-R")
+        .arg(root_repo)
+        .arg(agent_registry)
+        .status()
+        .context("failed to copy registry repository")?;
+
+    if !status.success() {
+        anyhow::bail!("cp -R failed when materializing agent machine registry");
+    }
+
+    let git_dir = agent_registry.join(".git");
+    if git_dir.exists() {
+        let gd = git_dir.to_string_lossy().to_string();
+        let idx = git_dir.join("tmp-index");
+        let idx_s = idx.to_string_lossy().to_string();
+
+        let _ = Command::new("git")
+            .args(["--git-dir", &gd, "read-tree", "refs/auths/registry"])
+            .env("GIT_INDEX_FILE", &idx_s)
+            .status();
+
+        let listed = Command::new("git")
+            .args(["--git-dir", &gd, "ls-files"])
+            .env("GIT_INDEX_FILE", &idx_s)
+            .output()?;
+
+        let subtree = format!(
+            "identities/{}/{}/{}/",
+            &agent_pfx[0..2.min(agent_pfx.len())],
+            &agent_pfx[2..4.min(agent_pfx.len())],
+            agent_pfx
+        );
+
+        for line in String::from_utf8_lossy(&listed.stdout).lines() {
+            if line.contains(&subtree) {
+                let _ = Command::new("git")
+                    .args(["--git-dir", &gd, "rm", "--cached", "-q", "--", line])
+                    .env("GIT_INDEX_FILE", &idx_s)
+                    .status();
+            }
+        }
+    }
+
+    Ok(())
+}
+
+fn export_agent_keys_to_file_backend(
+    ctx: &AuthsContext,
+    agent_alias: &KeyAlias,
+    passphrase: &str,
+    keychain_path: &Path,
+) -> Result<()> {
+    use auths_core::storage::encrypted_file::EncryptedFileStorage;
+    use auths_core::storage::keychain::KeyStorage;
+    use zeroize::Zeroizing;
+
+    let file_storage = EncryptedFileStorage::with_path(keychain_path.to_path_buf())
+        .map_err(anyhow::Error::from)?;
+    file_storage.set_password(Zeroizing::new(passphrase.to_string()));
+
+    if let Ok((did, role, data)) = ctx.key_storage.load_key(agent_alias) {
+        file_storage
+            .store_key(agent_alias, &did, role, &data)
+            .map_err(anyhow::Error::from)?;
+    }
+
+    // Export next key alias if present
+    let next_alias = KeyAlias::new_unchecked(format!("{}--next-0", agent_alias.as_str()));
+    if let Ok((did, role, data)) = ctx.key_storage.load_key(&next_alias) {
+        file_storage
+            .store_key(&next_alias, &did, role, &data)
+            .map_err(anyhow::Error::from)?;
+    }
+
+    Ok(())
+}
diff --git a/crates/auths-sdk/src/workflows/mod.rs b/crates/auths-sdk/src/workflows/mod.rs
index 057daf4cd..fb531093b 100644
--- a/crates/auths-sdk/src/workflows/mod.rs
+++ b/crates/auths-sdk/src/workflows/mod.rs
@@ -1,5 +1,7 @@
 /// Agent Guard execution workflow for budget enforcement and spend receipts.
 pub mod agent_guard;
+/// Atomic single-command agent provisioning workflow.
+pub mod agent_provision;
 pub mod approval;
 pub mod artifact;
 pub mod audit;

From c5d82d8feb3aca56f285e1497767ba6ce4904f58 Mon Sep 17 00:00:00 2001
From: bordumb <bordumbb@gmail.com>
Date: Thu, 23 Jul 2026 14:14:59 +0100
Subject: [PATCH 02/37] feat(cli): add interactive guided wizard flow and
 optional flags for agent provision

Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd
Auths-Device: did:keri:EGXg8l62pI8_ig0JiIHMkKyGKbJHdWMpIhb0W0niK86y
Auths-Anchor-Seq: 70
Auths-Scope: sign_commit
---
 crates/auths-cli/src/commands/agent/mod.rs | 121 +++++++++++++++++----
 1 file changed, 97 insertions(+), 24 deletions(-)

diff --git a/crates/auths-cli/src/commands/agent/mod.rs b/crates/auths-cli/src/commands/agent/mod.rs
index ddf4a6e1c..8d81bf640 100644
--- a/crates/auths-cli/src/commands/agent/mod.rs
+++ b/crates/auths-cli/src/commands/agent/mod.rs
@@ -98,11 +98,11 @@ pub enum AgentSubcommand {
     Provision {
         /// Human-readable label / key alias for the new agent
         #[arg(short, long, help = "Label / key alias for the new agent")]
-        label: String,
+        label: Option<String>,
 
         /// Delegator signing key alias (defaults to "main")
-        #[arg(long, default_value = "main", help = "Your root identity's signing key name")]
-        key: String,
+        #[arg(long, help = "Your root identity's signing key name")]
+        key: Option<String>,
 
         /// Capability granted to the agent (repeatable)
         #[arg(long = "scope", help = "Capability granted to the agent")]
@@ -117,8 +117,8 @@ pub enum AgentSubcommand {
         out: Option<PathBuf>,
 
         /// Provisioning profile: "ci" or "assistant"
-        #[arg(long, default_value = "assistant", help = "Agent profile preset")]
-        profile: String,
+        #[arg(long, help = "Agent profile preset")]
+        profile: Option<String>,
 
         /// Passphrase file path (optional, auto-generated if absent)
         #[arg(long, help = "Passphrase file path")]
@@ -783,12 +783,12 @@ struct AgentProvisionJsonResponse {
 
 #[allow(clippy::too_many_arguments)]
 fn handle_provision_cmd(
-    label: String,
-    key: String,
+    label: Option<String>,
+    key: Option<String>,
     scope: Vec<auths_keri::Capability>,
     expires_in: Option<i64>,
     out: Option<PathBuf>,
-    profile: String,
+    profile: Option<String>,
     passphrase_file: Option<PathBuf>,
     repo: Option<PathBuf>,
 ) -> Result<()> {
@@ -802,17 +802,92 @@ fn handle_provision_cmd(
     let env_config = auths_sdk::core_config::EnvironmentConfig::from_env();
     let passphrase_provider = std::sync::Arc::new(CliPassphraseProvider::new());
     let ctx = crate::factories::storage::build_auths_context(&repo_path, &env_config, Some(passphrase_provider))?;
-    let parent_alias = KeyAlias::new_unchecked(key);
-    let agent_profile = profile.parse::<auths_sdk::workflows::agent_provision::AgentProfile>()?;
-
-    let destination_dir = out.unwrap_or_else(|| {
-        auths_home()
-            .unwrap_or_else(|_| PathBuf::from("~/.auths"))
-            .parent()
-            .unwrap_or_else(|| Path::new("."))
-            .join(".auths-agents")
-            .join(&label)
-    });
+
+    let is_interactive = console::user_attended() && !is_json_mode();
+
+    let (label_str, key_str, profile_str, destination_dir) = if is_interactive && (label.is_none() || key.is_none() || profile.is_none()) {
+        use dialoguer::{Input, Select};
+
+        let label_input = if let Some(l) = label {
+            l
+        } else {
+            Input::new()
+                .with_prompt("Type a name for your agent")
+                .interact_text()?
+        };
+
+        let key_input = if let Some(k) = key {
+            k
+        } else {
+            let aliases = ctx.key_storage.list_aliases().unwrap_or_default();
+            let key_items: Vec<String> = if aliases.is_empty() {
+                vec!["main".to_string()]
+            } else {
+                aliases
+                    .into_iter()
+                    .map(|k| k.as_str().to_string())
+                    .filter(|k| !k.ends_with("--next-0"))
+                    .collect()
+            };
+
+            if key_items.len() > 1 {
+                let selection = Select::new()
+                    .with_prompt("Select parent key to append delegation to")
+                    .items(&key_items)
+                    .default(0)
+                    .interact()?;
+                key_items[selection].clone()
+            } else {
+                key_items.first().cloned().unwrap_or_else(|| "main".to_string())
+            }
+        };
+
+        let profile_input = if let Some(p) = profile {
+            p
+        } else {
+            let profiles = vec![
+                "assistant (Interactive AI assistant profile)",
+                "ci (Headless CI runner profile)",
+            ];
+            let selection = Select::new()
+                .with_prompt("Select agent profile preset")
+                .items(&profiles)
+                .default(0)
+                .interact()?;
+            if selection == 0 {
+                "assistant".to_string()
+            } else {
+                "ci".to_string()
+            }
+        };
+
+        let out_input = out.unwrap_or_else(|| {
+            auths_home()
+                .unwrap_or_else(|_| PathBuf::from("~/.auths"))
+                .parent()
+                .unwrap_or_else(|| Path::new("."))
+                .join(".auths-agents")
+                .join(&label_input)
+        });
+
+        (label_input, key_input, profile_input, out_input)
+    } else {
+        let label_val = label.unwrap_or_else(|| "agent-builder".to_string());
+        let key_val = key.unwrap_or_else(|| "main".to_string());
+        let profile_val = profile.unwrap_or_else(|| "assistant".to_string());
+        let out_val = out.unwrap_or_else(|| {
+            auths_home()
+                .unwrap_or_else(|_| PathBuf::from("~/.auths"))
+                .parent()
+                .unwrap_or_else(|| Path::new("."))
+                .join(".auths-agents")
+                .join(&label_val)
+        });
+        (label_val, key_val, profile_val, out_val)
+    };
+
+    let parent_alias = KeyAlias::new_unchecked(&key_str);
+    let agent_profile = profile_str.parse::<auths_sdk::workflows::agent_provision::AgentProfile>()?;
 
     let passphrase = if let Some(p_file) = &passphrase_file {
         std::fs::read_to_string(p_file)
@@ -828,7 +903,7 @@ fn handle_provision_cmd(
     };
 
     let params = auths_sdk::workflows::agent_provision::AgentProvisionParams {
-        label: label.clone(),
+        label: label_str.clone(),
         scopes: scope,
         expires_in_secs: expires_in,
         destination_dir,
@@ -859,10 +934,8 @@ fn handle_provision_cmd(
         println!("  Environment:     {}", res.env_file_path.display());
         println!("  Wrapper Helper:  {}", res.wrapper_path.display());
         println!();
-        println!("To activate the agent environment, run:");
-        println!("  source {}", res.env_file_path.display());
-        println!("Or execute directly via:");
-        println!("  {}", res.wrapper_path.display());
+        println!("Your agent is provisioned!");
+        println!("You can find its details at {}", res.destination_dir.display());
     }
 
     Ok(())

From fffb0fc98bc0c0d855e75739ca29fbac11b78d17 Mon Sep 17 00:00:00 2001
From: bordumb <bordumbb@gmail.com>
Date: Thu, 23 Jul 2026 14:38:08 +0100
Subject: [PATCH 03/37] fix(cli): streamline AUTHS-E4203 passphrase error
 suggestion

Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd
Auths-Device: did:keri:EGXg8l62pI8_ig0JiIHMkKyGKbJHdWMpIhb0W0niK86y
Auths-Anchor-Seq: 70
Auths-Scope: sign_commit
---
 crates/auths-cli/src/errors/registry.rs | 2 +-
 docs/errors/AUTHS-E4203.md              | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/crates/auths-cli/src/errors/registry.rs b/crates/auths-cli/src/errors/registry.rs
index a5029eab2..2d76a3567 100644
--- a/crates/auths-cli/src/errors/registry.rs
+++ b/crates/auths-cli/src/errors/registry.rs
@@ -224,7 +224,7 @@ pub fn explain(code: &str) -> Option<&'static str> {
         // --- auths-id (InitError) ---
         "AUTHS-E4201" => Some("# AUTHS-E4201\n\n**Crate:** `auths-id`\n\n**Type:** `InitError::Git`\n\n## Message\n\n_(transparent — see inner error)_\n\n## Suggestion\n\nCheck that the Git repository is accessible\n"),
         "AUTHS-E4202" => Some("# AUTHS-E4202\n\n**Crate:** `auths-id`\n\n**Type:** `InitError::Keri`\n\n## Message\n\nKERI operation failed: {0}\n\n## Suggestion\n\nKERI event processing failed; check identity state\n"),
-        "AUTHS-E4203" => Some("# AUTHS-E4203\n\n**Crate:** `auths-id`\n\n**Type:** `InitError::Key`\n\n## Message\n\nkey operation failed: {0}\n\n## Suggestion\n\nCheck keychain access and passphrase. Headless/CI (no Touch ID): set AUTHS_KEYCHAIN_BACKEND=file AUTHS_KEYCHAIN_FILE=<path> AUTHS_PASSPHRASE=<pass>, or run `auths init --profile ci`.\n"),
+        "AUTHS-E4203" => Some("# AUTHS-E4203\n\n**Crate:** `auths-id`\n\n**Type:** `InitError::Key`\n\n## Message\n\nkey operation failed: {0}\n\n## Suggestion\n\nRerun the command using a passphrase that is at least 12 characters long.\n"),
         "AUTHS-E4204" => Some("# AUTHS-E4204\n\n**Crate:** `auths-id`\n\n**Type:** `InitError::InvalidData`\n\n## Message\n\n{0}\n\n## Suggestion\n\nIdentity data is malformed; try re-initializing with `auths init`\n"),
         "AUTHS-E4205" => Some("# AUTHS-E4205\n\n**Crate:** `auths-id`\n\n**Type:** `InitError::Storage`\n\n## Message\n\nstorage operation failed: {0}\n\n## Suggestion\n\nCheck storage backend connectivity\n"),
         "AUTHS-E4206" => Some("# AUTHS-E4206\n\n**Crate:** `auths-id`\n\n**Type:** `InitError::Registry`\n\n## Message\n\nregistry error: {0}\n\n## Suggestion\n\nCheck registry backend configuration\n"),
diff --git a/docs/errors/AUTHS-E4203.md b/docs/errors/AUTHS-E4203.md
index bc3f143dd..26774df95 100644
--- a/docs/errors/AUTHS-E4203.md
+++ b/docs/errors/AUTHS-E4203.md
@@ -10,4 +10,4 @@ key operation failed: {0}
 
 ## Suggestion
 
-Check keychain access and passphrase. Headless/CI (no Touch ID): set AUTHS_KEYCHAIN_BACKEND=file AUTHS_KEYCHAIN_FILE=<path> AUTHS_PASSPHRASE=<pass>, or run `auths init --profile ci`.
+Rerun the command using a passphrase that is at least 12 characters long.

From 638e6a5e3d4c8dd6108ef5679d089f4953f35853 Mon Sep 17 00:00:00 2001
From: bordumb <bordumbb@gmail.com>
Date: Thu, 23 Jul 2026 14:53:26 +0100
Subject: [PATCH 04/37] fix(sdk): clean up temporary staging keys on
 provisioning failure and completion

Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd
Auths-Device: did:keri:EGXg8l62pI8_ig0JiIHMkKyGKbJHdWMpIhb0W0niK86y
Auths-Anchor-Seq: 70
Auths-Scope: sign_commit
---
 .../src/workflows/agent_provision.rs          | 25 +++++++++++++++----
 1 file changed, 20 insertions(+), 5 deletions(-)

diff --git a/crates/auths-sdk/src/workflows/agent_provision.rs b/crates/auths-sdk/src/workflows/agent_provision.rs
index 7335d1086..243988980 100644
--- a/crates/auths-sdk/src/workflows/agent_provision.rs
+++ b/crates/auths-sdk/src/workflows/agent_provision.rs
@@ -82,16 +82,24 @@ pub fn provision_agent_machine(
     let expires_at = params.expires_in_secs.map(|secs| now.timestamp() + secs);
 
     // 1. Delegate agent identity under parent root in KEL using domains::agents::add_scoped
-    let agent_info = crate::domains::agents::add_scoped(
+    let agent_info_res = crate::domains::agents::add_scoped(
         ctx,
         parent_alias,
         &agent_alias,
         CurveType::P256,
         &params.scopes,
         expires_at,
-    )
-    .map_err(anyhow::Error::from)
-    .context("failed to delegate agent identity in KEL")?;
+    );
+
+    if agent_info_res.is_err() {
+        let next_alias = KeyAlias::new_unchecked(format!("{}--next-0", agent_alias.as_str()));
+        let _ = ctx.key_storage.delete_key(&agent_alias);
+        let _ = ctx.key_storage.delete_key(&next_alias);
+    }
+
+    let agent_info = agent_info_res
+        .map_err(anyhow::Error::from)
+        .context("failed to delegate agent identity in KEL")?;
 
     let agent_did = agent_info.agent_did;
 
@@ -110,7 +118,14 @@ pub fn provision_agent_machine(
     fs::set_permissions(&passphrase_path, Permissions::from_mode(0o600))?;
 
     // Copy keys from main keychain to agent file-backend keys.enc
-    export_agent_keys_to_file_backend(ctx, &agent_alias, passphrase, &keychain_path)?;
+    let export_res = export_agent_keys_to_file_backend(ctx, &agent_alias, passphrase, &keychain_path);
+
+    // Clean up temporary staging keys from root key storage so root storage stays clean
+    let next_alias = KeyAlias::new_unchecked(format!("{}--next-0", agent_alias.as_str()));
+    let _ = ctx.key_storage.delete_key(&agent_alias);
+    let _ = ctx.key_storage.delete_key(&next_alias);
+
+    export_res?;
 
     // 4. Refresh commit-trailers
     let _ = crate::workflows::commit_hooks::refresh_commit_trailers(ctx, &registry_dir);

From b61bfd597d9c00c3e6c04e4b34ba97d7c521bf61 Mon Sep 17 00:00:00 2001
From: bordumb <bordumbb@gmail.com>
Date: Thu, 23 Jul 2026 15:14:13 +0100
Subject: [PATCH 05/37] fix(core): distinguish software keys in
 SecureEnclaveKeyStorage during sign_with_key and extract_public_key_bytes

Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd
Auths-Device: did:keri:EGXg8l62pI8_ig0JiIHMkKyGKbJHdWMpIhb0W0niK86y
Auths-Anchor-Seq: 70
Auths-Scope: sign_commit
---
 crates/auths-core/src/storage/keychain.rs | 24 +++++++----------------
 1 file changed, 7 insertions(+), 17 deletions(-)

diff --git a/crates/auths-core/src/storage/keychain.rs b/crates/auths-core/src/storage/keychain.rs
index ea0b62c1b..4a57fb94b 100644
--- a/crates/auths-core/src/storage/keychain.rs
+++ b/crates/auths-core/src/storage/keychain.rs
@@ -418,21 +418,10 @@ pub fn extract_public_key_bytes(
     alias: &KeyAlias,
     passphrase_provider: &dyn crate::signing::PassphraseProvider,
 ) -> Result<(Vec<u8>, auths_crypto::CurveType), AgentError> {
-    if keychain.is_hardware_backend() {
-        // Hardware backends store opaque handles — get public key from hardware
-        let (_, _role, _handle) = keychain.load_key(alias)?;
-        #[cfg(all(target_os = "macos", feature = "keychain-secure-enclave"))]
-        {
-            let pubkey = super::secure_enclave::public_key_from_handle(&_handle)?;
-            return Ok((pubkey, auths_crypto::CurveType::P256));
-        }
-        #[cfg(not(all(target_os = "macos", feature = "keychain-secure-enclave")))]
-        {
-            return Err(AgentError::BackendUnavailable {
-                backend: keychain.backend_name(),
-                reason: "hardware backend not available on this platform".into(),
-            });
-        }
+    if keychain.is_hardware_backend()
+        && let Ok(pubkey) = keychain.export_public_key(alias)
+    {
+        return Ok((pubkey, auths_crypto::CurveType::P256));
     }
 
     use crate::crypto::signer::{decrypt_keypair, load_seed_and_pubkey};
@@ -464,12 +453,13 @@ pub fn sign_with_key(
     passphrase_provider: &dyn crate::signing::PassphraseProvider,
     message: &[u8],
 ) -> Result<(Vec<u8>, Vec<u8>, auths_crypto::CurveType), AgentError> {
-    if keychain.is_hardware_backend() {
+    if keychain.is_hardware_backend()
+        && let Ok(pubkey) = keychain.export_public_key(alias)
+    {
         let (_, _role, _handle) = keychain.load_key(alias)?;
         #[cfg(all(target_os = "macos", feature = "keychain-secure-enclave"))]
         {
             let sig = super::secure_enclave::sign_with_handle(&_handle, message)?;
-            let pubkey = super::secure_enclave::public_key_from_handle(&_handle)?;
             return Ok((sig, pubkey, auths_crypto::CurveType::P256));
         }
         #[cfg(not(all(target_os = "macos", feature = "keychain-secure-enclave")))]

From 9c24503ee5fb168adadea7a4b853f31046c2e3d9 Mon Sep 17 00:00:00 2001
From: bordumb <bordumbb@gmail.com>
Date: Thu, 23 Jul 2026 15:26:30 +0100
Subject: [PATCH 06/37] fix(core): route SecureSigner::sign_with_alias for
 SecureEnclaveKeyStorage through sign_with_key

Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd
Auths-Device: did:keri:EGXg8l62pI8_ig0JiIHMkKyGKbJHdWMpIhb0W0niK86y
Auths-Anchor-Seq: 70
Auths-Scope: sign_commit
---
 crates/auths-core/src/storage/secure_enclave.rs | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/crates/auths-core/src/storage/secure_enclave.rs b/crates/auths-core/src/storage/secure_enclave.rs
index 61aabd4a3..5e7dedc25 100644
--- a/crates/auths-core/src/storage/secure_enclave.rs
+++ b/crates/auths-core/src/storage/secure_enclave.rs
@@ -377,11 +377,11 @@ impl SecureSigner for SecureEnclaveKeyStorage {
     fn sign_with_alias(
         &self,
         alias: &KeyAlias,
-        _passphrase_provider: &dyn PassphraseProvider,
+        passphrase_provider: &dyn PassphraseProvider,
         message: &[u8],
     ) -> Result<Vec<u8>, AgentError> {
-        let handle = self.load_handle(alias)?;
-        sign_with_handle(&handle, message)
+        let (sig, _pubkey, _curve) = super::keychain::sign_with_key(self, alias, passphrase_provider, message)?;
+        Ok(sig)
     }
 
     fn sign_for_identity(

From 23db5b8a8f65612cacf22464769587f43ca45870 Mon Sep 17 00:00:00 2001
From: bordumb <bordumbb@gmail.com>
Date: Thu, 23 Jul 2026 15:36:59 +0100
Subject: [PATCH 07/37] fix(core): delegate StorageSigner::sign_with_alias to
 sign_with_key and add e2e agent provisioning tests

Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd
Auths-Device: did:keri:EGXg8l62pI8_ig0JiIHMkKyGKbJHdWMpIhb0W0niK86y
Auths-Anchor-Seq: 70
Auths-Scope: sign_commit
---
 .auths/roots                          |  8 +++
 crates/auths-cli/src/core/provider.rs |  8 ++-
 crates/auths-core/src/signing.rs      | 53 +--------------
 tests/e2e/test_agent_provisioning.py  | 96 +++++++++++++++++++++++++++
 4 files changed, 113 insertions(+), 52 deletions(-)
 create mode 100644 tests/e2e/test_agent_provisioning.py

diff --git a/.auths/roots b/.auths/roots
index 26cc6d3d4..96349b2d3 100644
--- a/.auths/roots
+++ b/.auths/roots
@@ -23,3 +23,11 @@ did:keri:EPsk0PCEQpa3ALIG1Oyiuxg8UfLbgma4QV16I-O6TnOc
 did:keri:EAZG0HqAzbydr1iAbnEPUhVC_IuB6vZXYBJagVXS2k9a
 did:keri:EKh1onK1bubyaWxHIWzr_yeOAtBm36ZGn0AXDYsBhrsq
 did:keri:EPmp6Nav8Z-_prJg0EShHnB396yJJtXmBr6hG647PxwJ
+did:keri:EE5atQLEkKyy1GnkFY1xYdVM8qwRLNzOSVdVzosLbiIv
+did:keri:EExNah2mq91GJdODsZXPJ9w9QWdeewmXdxfro_Bg7be-
+did:keri:EOXtlYDnHMmI_hQlPu0V5prWC4xE05QwvOTeTYYrB5X4
+did:keri:EJTqvxp1bDvOF96co7cqdgC98ydppt_6bUDbVshg7Z1k
+did:keri:EGe5II_9JpsGJzmwNTRDKuDC4owoe7PIpkwWUNXR_9Lu
+did:keri:EEKYb-wilgjXY95DYQaaxeCpVETNsjU9VCgYoCnYs0p1
+did:keri:EGGPusyETlYzKsQA92qzCSLfUz2leOnV7zNDSCEqgZdR
+did:keri:EFnoV44-J0ywYJeVRMyC74ceVVnHu7BjvN5km5wiR8yS
diff --git a/crates/auths-cli/src/core/provider.rs b/crates/auths-cli/src/core/provider.rs
index 5dd570770..e3e0f1b86 100644
--- a/crates/auths-cli/src/core/provider.rs
+++ b/crates/auths-cli/src/core/provider.rs
@@ -15,8 +15,14 @@ impl CliPassphraseProvider {
 }
 
 impl PassphraseProvider for CliPassphraseProvider {
-    /// Securely obtains a passphrase by prompting the user on the terminal.
+    /// Securely obtains a passphrase by checking AUTHS_PASSPHRASE env var or prompting the user on the terminal.
     fn get_passphrase(&self, prompt_message: &str) -> Result<Zeroizing<String>, AgentError> {
+        if let Ok(env_pass) = std::env::var("AUTHS_PASSPHRASE")
+            && !env_pass.is_empty()
+        {
+            return Ok(Zeroizing::new(env_pass));
+        }
+
         // Print the contextual prompt provided by the caller to stderr
         eprintln!("{}", prompt_message);
 
diff --git a/crates/auths-core/src/signing.rs b/crates/auths-core/src/signing.rs
index 61adf6a44..553ab58f2 100644
--- a/crates/auths-core/src/signing.rs
+++ b/crates/auths-core/src/signing.rs
@@ -1,6 +1,5 @@
 //! Signing abstractions and DID resolution.
 
-use crate::crypto::signer::decrypt_keypair;
 use crate::error::AgentError;
 use crate::storage::keychain::{IdentityDID, KeyAlias, KeyStorage};
 
@@ -276,56 +275,8 @@ impl<S: KeyStorage + Send + Sync + 'static> SecureSigner for StorageSigner<S> {
         passphrase_provider: &dyn PassphraseProvider,
         message: &[u8],
     ) -> Result<Vec<u8>, AgentError> {
-        // Hardware backends (Secure Enclave, HSM) handle signing internally
-        if self.storage.is_hardware_backend() {
-            #[cfg(all(target_os = "macos", feature = "keychain-secure-enclave"))]
-            {
-                let (_identity_did, _role, handle) = self.storage.load_key(alias)?;
-                return crate::storage::secure_enclave::sign_with_handle(&handle, message);
-            }
-            #[cfg(not(all(target_os = "macos", feature = "keychain-secure-enclave")))]
-            {
-                return Err(AgentError::BackendUnavailable {
-                    backend: self.storage.backend_name(),
-                    reason: "hardware signing not available on this platform".into(),
-                });
-            }
-        }
-
-        let (_identity_did, _role, encrypted_data) = self.storage.load_key(alias)?;
-
-        const MAX_ATTEMPTS: u8 = 3;
-        let mut attempt = 0u8;
-        let key_bytes = loop {
-            let prompt = if attempt == 0 {
-                format!("Enter passphrase for key '{}' to sign:", alias)
-            } else {
-                format!(
-                    "Incorrect passphrase, try again ({}/{}):",
-                    attempt + 1,
-                    MAX_ATTEMPTS
-                )
-            };
-
-            let passphrase = passphrase_provider.get_passphrase(&prompt)?;
-
-            match decrypt_keypair(&encrypted_data, &passphrase) {
-                Ok(kb) => break kb,
-                Err(AgentError::IncorrectPassphrase) if attempt + 1 < MAX_ATTEMPTS => {
-                    passphrase_provider.on_incorrect_passphrase(&prompt);
-                    attempt += 1;
-                }
-                Err(e) => return Err(e),
-            }
-        };
-
-        // parse curve-tagged seed and dispatch sign on curve.
-        // Previously hardcoded sign_ed25519_sync which silently produced garbage
-        // signatures for P-256 identities.
-        let parsed = auths_crypto::parse_key_material(&key_bytes)
-            .map_err(|e| AgentError::KeyDeserializationError(e.to_string()))?;
-        auths_crypto::typed_sign(&parsed.seed, message)
-            .map_err(|e| AgentError::CryptoError(format!("signing failed: {}", e)))
+        let (sig, _pubkey, _curve) = crate::storage::keychain::sign_with_key(&self.storage, alias, passphrase_provider, message)?;
+        Ok(sig)
     }
 
     fn sign_for_identity(
diff --git a/tests/e2e/test_agent_provisioning.py b/tests/e2e/test_agent_provisioning.py
new file mode 100644
index 000000000..98ef57280
--- /dev/null
+++ b/tests/e2e/test_agent_provisioning.py
@@ -0,0 +1,96 @@
+"""End-to-end integration tests for `auths agent provision` and subagent ergonomics (Spec 12)."""
+
+import os
+import subprocess
+from pathlib import Path
+
+import pytest
+
+from helpers.cli import run_auths
+
+
+def test_agent_provision_manual_flags(auths_bin, isolated_env, tmp_path):
+    """Test provisioning an agent using explicit command line flags."""
+    # 1. Initialize root identity
+    init_res = run_auths(
+        auths_bin,
+        ["init", "--profile", "developer", "--non-interactive"],
+        env=isolated_env,
+    )
+    assert init_res.returncode == 0, f"Init failed: {init_res.stderr}"
+
+    passphrase_file = tmp_path / "passphrase.txt"
+    passphrase_file.write_text("TestAgentPassphrase!12345")
+    out_dir = tmp_path / "agent-builder"
+
+    # 2. Provision agent with flags
+    prov_res = run_auths(
+        auths_bin,
+        [
+            "agent",
+            "provision",
+            "--label",
+            "agent-builder",
+            "--key",
+            "main",
+            "--profile",
+            "assistant",
+            "--out",
+            str(out_dir),
+            "--passphrase-file",
+            str(passphrase_file),
+        ],
+        env=isolated_env,
+    )
+    assert prov_res.returncode == 0, f"Provisioning failed: {prov_res.stderr}\n{prov_res.stdout}"
+    assert "Your agent is provisioned!" in prov_res.stdout
+
+    # 3. Verify directory contents and permissions
+    assert out_dir.exists()
+    assert (out_dir / "keys.enc").exists()
+    assert (out_dir / "env.sh").exists()
+    assert (out_dir / "bin" / "auths-agent").exists()
+
+    # 4. Verify agent list output
+    list_res = run_auths(auths_bin, ["agent", "list"], env=isolated_env)
+    assert list_res.returncode == 0
+    assert "agent-builder" in list_res.stdout or "did:keri:" in list_res.stdout
+
+
+def test_agent_provision_custom_backend(auths_bin, isolated_env, tmp_path):
+    """Test agent provision with file backend explicitly set."""
+    env = isolated_env.copy()
+    env["AUTHS_KEYCHAIN_BACKEND"] = "file"
+    env["AUTHS_PASSPHRASE"] = "RootPassphrase1234!"
+
+    init_res = run_auths(
+        auths_bin,
+        ["init", "--profile", "developer", "--non-interactive"],
+        env=env,
+    )
+    assert init_res.returncode == 0, f"Init failed: {init_res.stderr}"
+
+    passphrase_file = tmp_path / "agent_pass.txt"
+    passphrase_file.write_text("AgentPassphrase1234!")
+    out_dir = tmp_path / "sub-agent"
+
+    prov_res = run_auths(
+        auths_bin,
+        [
+            "agent",
+            "provision",
+            "--label",
+            "sub-agent",
+            "--key",
+            "main",
+            "--profile",
+            "ci",
+            "--out",
+            str(out_dir),
+            "--passphrase-file",
+            str(passphrase_file),
+        ],
+        env=env,
+    )
+    assert prov_res.returncode == 0, f"Provisioning failed: {prov_res.stderr}\n{prov_res.stdout}"
+    assert (out_dir / "keys.enc").exists()

From b26db3f6c5f1d076a7e6847d2ad4d5f1998c5e61 Mon Sep 17 00:00:00 2001
From: bordumb <bordumbb@gmail.com>
Date: Thu, 23 Jul 2026 15:46:34 +0100
Subject: [PATCH 08/37] fix(core): add is_hardware_key to KeyStorage to prevent
 fallback passphrase prompts on SE hardware keys

Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd
Auths-Device: did:keri:EGXg8l62pI8_ig0JiIHMkKyGKbJHdWMpIhb0W0niK86y
Auths-Anchor-Seq: 70
Auths-Scope: sign_commit
---
 .auths/roots                                  | 29 ++++++++++++++++++
 claims/claim-cbe93daa3a36463c.json            | 28 +++++++++++++++++
 crates/auths-core/src/storage/keychain.rs     | 30 ++++++++++++++-----
 .../auths-core/src/storage/secure_enclave.rs  |  4 +++
 4 files changed, 84 insertions(+), 7 deletions(-)
 create mode 100644 claims/claim-cbe93daa3a36463c.json

diff --git a/.auths/roots b/.auths/roots
index 96349b2d3..d251502d2 100644
--- a/.auths/roots
+++ b/.auths/roots
@@ -31,3 +31,32 @@ did:keri:EGe5II_9JpsGJzmwNTRDKuDC4owoe7PIpkwWUNXR_9Lu
 did:keri:EEKYb-wilgjXY95DYQaaxeCpVETNsjU9VCgYoCnYs0p1
 did:keri:EGGPusyETlYzKsQA92qzCSLfUz2leOnV7zNDSCEqgZdR
 did:keri:EFnoV44-J0ywYJeVRMyC74ceVVnHu7BjvN5km5wiR8yS
+did:keri:EHQBqXFfzbftCTDzALeNVqRckBxx46_yk8BV6b378Noe
+did:keri:EPahOppzqRKLiscwDyZ8IpsqBfQgdr1uBFznKBuPmxQx
+did:keri:ECIKOYuc1H2Y4ecmmrKmluxXqzZp5BD612cH_7OQ5Teq
+did:keri:ENwwu0osm6SiWct18FUST9MNvN7appkG1_AyD2J7552u
+did:keri:EDRFqbywXlZ59qGFHnl4B9y9HwIFcm4nn1rrfonM-fvh
+did:keri:EEbozruIICYaKs1IoLLinfA8N2Bwfd8GcUdKAWmzY5rD
+did:keri:EG98ah4_D4-wXbI9Ft4ZozcItkvfzimsVnIZvBwhcdRK
+did:keri:ENuHgcpsPerQZWSQpXFjQvUiigaDpugBg5nIhapwtV3z
+did:keri:EBLnKq9BHLTcV8hEDxC_Te2GNJtqiuwlsX4q2IQvLeg_
+did:keri:EANpaVmKBvSSmnstoZs5WqhHAbdRCYN_FRm1PVRi7wY7
+did:keri:EDO92vr-PU1HNhZIDvz2tEwzd0xDbzPN3kWPzbTATdsb
+did:keri:EKwff-SOXzEQi8sIaovIjLWhyUGo3ZSFxzD7vL-SjApj
+did:keri:ENNCiXa2kgw9A5CtyBtC2IJe0MGFLkg4P-Gx94Jao828
+did:keri:EARstBIdgmQ5pqv_d9q0tp8kBv8c28EOr2QDbBy1sIkr
+did:keri:EKGD7mJpPQBVxTk_4Vhjp03TldarLE05N3lbbSNGiaT2
+did:keri:EKI5mPuKaI0XrjvfBZNsqqbWqu7KsAzeFrvDXqhqkDFR
+did:keri:EB-tLZ-egZ3njzuiAiyk0s8BRgApJOlA4blsOQrGyBAQ
+did:keri:EG9IvTUjq-duwdU8GieIS2Ok-rjN-XsjjOOTr8PJJgBm
+did:keri:EKLHtTSixyVelolAzqDsd2vGW91B_OiLIagWHq2qPszD
+did:keri:EI5FKVNhgtr03vhdGIlmB4tCkUftsekKCLSO1MA27Vg0
+did:keri:EEMNJX1Q2ispjPP3JX5V52OeHeHcraSneeL0OgUl1DHi
+did:keri:EIZcLBvnz6M1eeVracxLANLEBm-VUPAqXHs8q9quxCXh
+did:keri:EMvTUg93H5MiOtR707DULExzLmqyZfajUiZfZQ49hW42
+did:keri:EKBem7qpHuT2xv6oHPh39x9l2YKRAQAB3FLcE73Dg3Dz
+did:keri:EMwol0DhyRMxRiuS126ubkBBRRiwozQYqUxJCxkBcMc1
+did:keri:EKeDN2J3g6wA8mMM0-GLovrd2gc1kZmzScToj90M8t6i
+did:keri:EC3GVxNtU8xW07h2y50wddhUICEQmiMMpUyfWbCCLE3y
+did:keri:ECDfCfwHlyVg_3iXIi4bZW4AlOiQG3VrFQbQ85LM0h_W
+did:keri:EASYEp5X9etjJSTN64E2ODpEZrM1ei8gNkQiudE10Wh9
diff --git a/claims/claim-cbe93daa3a36463c.json b/claims/claim-cbe93daa3a36463c.json
new file mode 100644
index 000000000..091429bb8
--- /dev/null
+++ b/claims/claim-cbe93daa3a36463c.json
@@ -0,0 +1,28 @@
+{
+  "version": "reversal/v1",
+  "suite": "json-canon/p256",
+  "disputedTx": "",
+  "basis": {
+    "verdict": "out-of-counterparty",
+    "asOf": {
+      "tier": "first-seen",
+      "head": "743eec4a34502f014efd17a312d1b2e553607d5a46fcd4b88edd8a1113f214ca",
+      "kelSeq": 1,
+      "ts": "2026-07-23T14:44:45.537859Z"
+    }
+  },
+  "parties": {
+    "payerPrincipal": "did:keri:EM-TbFfxJpmvbWyVimQiOMi4qmQliP3QNUlsyRgo2B1w",
+    "actingAgent": "did:keri:EF-FnKfzrtK-eAWaWtuggc50eKd3oXSx-eqjs_IuLBi_",
+    "payeeOrg": "0xattacker",
+    "payeeSettlementAccount": "0xattacker"
+  },
+  "amount": {
+    "cents": 0,
+    "kind": "full"
+  },
+  "direction": "payee->payerPrincipal",
+  "railHint": "claim-only",
+  "issued_by": "did:key:zDnaeSrJVhp4D1zdH8Yec1W4LuHpCBartmkNaUathniKQKWSu",
+  "signature": "D9lkJLs9R1RH/6QGRBQ7qlfA9At5GZ/BJ/GjYUpVXtAMjomrTDFaW95h8pVWfQppHl0PY9xt/Ku43Q6I3PwH2A=="
+}
\ No newline at end of file
diff --git a/crates/auths-core/src/storage/keychain.rs b/crates/auths-core/src/storage/keychain.rs
index 4a57fb94b..24436c9c6 100644
--- a/crates/auths-core/src/storage/keychain.rs
+++ b/crates/auths-core/src/storage/keychain.rs
@@ -338,6 +338,12 @@ pub trait KeyStorage: Send + Sync {
         false
     }
 
+    /// Returns true if the specific key stored under `alias` is a hardware key.
+    fn is_hardware_key(&self, alias: &KeyAlias) -> bool {
+        let _ = alias;
+        self.is_hardware_backend()
+    }
+
     /// Re-associates an existing stored key with a different identity DID
     /// without touching the key material.
     ///
@@ -418,10 +424,21 @@ pub fn extract_public_key_bytes(
     alias: &KeyAlias,
     passphrase_provider: &dyn crate::signing::PassphraseProvider,
 ) -> Result<(Vec<u8>, auths_crypto::CurveType), AgentError> {
-    if keychain.is_hardware_backend()
-        && let Ok(pubkey) = keychain.export_public_key(alias)
-    {
-        return Ok((pubkey, auths_crypto::CurveType::P256));
+    if keychain.is_hardware_key(alias) {
+        // Hardware backends store opaque handles — get public key from hardware
+        let (_, _role, _handle) = keychain.load_key(alias)?;
+        #[cfg(all(target_os = "macos", feature = "keychain-secure-enclave"))]
+        {
+            let pubkey = super::secure_enclave::public_key_from_handle(&_handle)?;
+            return Ok((pubkey, auths_crypto::CurveType::P256));
+        }
+        #[cfg(not(all(target_os = "macos", feature = "keychain-secure-enclave")))]
+        {
+            return Err(AgentError::BackendUnavailable {
+                backend: keychain.backend_name(),
+                reason: "hardware backend not available on this platform".into(),
+            });
+        }
     }
 
     use crate::crypto::signer::{decrypt_keypair, load_seed_and_pubkey};
@@ -453,13 +470,12 @@ pub fn sign_with_key(
     passphrase_provider: &dyn crate::signing::PassphraseProvider,
     message: &[u8],
 ) -> Result<(Vec<u8>, Vec<u8>, auths_crypto::CurveType), AgentError> {
-    if keychain.is_hardware_backend()
-        && let Ok(pubkey) = keychain.export_public_key(alias)
-    {
+    if keychain.is_hardware_key(alias) {
         let (_, _role, _handle) = keychain.load_key(alias)?;
         #[cfg(all(target_os = "macos", feature = "keychain-secure-enclave"))]
         {
             let sig = super::secure_enclave::sign_with_handle(&_handle, message)?;
+            let pubkey = super::secure_enclave::public_key_from_handle(&_handle)?;
             return Ok((sig, pubkey, auths_crypto::CurveType::P256));
         }
         #[cfg(not(all(target_os = "macos", feature = "keychain-secure-enclave")))]
diff --git a/crates/auths-core/src/storage/secure_enclave.rs b/crates/auths-core/src/storage/secure_enclave.rs
index 5e7dedc25..f1fa05146 100644
--- a/crates/auths-core/src/storage/secure_enclave.rs
+++ b/crates/auths-core/src/storage/secure_enclave.rs
@@ -342,6 +342,10 @@ impl KeyStorage for SecureEnclaveKeyStorage {
         true
     }
 
+    fn is_hardware_key(&self, alias: &KeyAlias) -> bool {
+        self.handle_path(alias).exists()
+    }
+
     fn export_public_key(&self, alias: &KeyAlias) -> Result<Vec<u8>, AgentError> {
         let handle = self.load_handle(alias)?;
         public_key_from_handle(&handle)

From 0a05e15de7950b63a9d3182824ec47d1a9f557da Mon Sep 17 00:00:00 2001
From: bordumb <bordumbb@gmail.com>
Date: Thu, 23 Jul 2026 15:56:57 +0100
Subject: [PATCH 09/37] test(e2e): add test_agent_provision_recursive_subagent
 to test_agent_provisioning.py

Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd
Auths-Device: did:keri:EGXg8l62pI8_ig0JiIHMkKyGKbJHdWMpIhb0W0niK86y
Auths-Anchor-Seq: 70
Auths-Scope: sign_commit
---
 .auths/roots                         | 11 +++++
 tests/e2e/test_agent_provisioning.py | 70 ++++++++++++++++++++++++++++
 2 files changed, 81 insertions(+)

diff --git a/.auths/roots b/.auths/roots
index d251502d2..602c4d79e 100644
--- a/.auths/roots
+++ b/.auths/roots
@@ -60,3 +60,14 @@ did:keri:EKeDN2J3g6wA8mMM0-GLovrd2gc1kZmzScToj90M8t6i
 did:keri:EC3GVxNtU8xW07h2y50wddhUICEQmiMMpUyfWbCCLE3y
 did:keri:ECDfCfwHlyVg_3iXIi4bZW4AlOiQG3VrFQbQ85LM0h_W
 did:keri:EASYEp5X9etjJSTN64E2ODpEZrM1ei8gNkQiudE10Wh9
+did:keri:ENX4hMLPT_idVRWpAs_URw-eLyDL5YrPfrEyLdosyju_
+did:keri:EOT7Yz9SiYiAFkYwv58MWQIhTCwe7Q6efENqj24S8kQI
+did:keri:EF4PMaOZQMOsi2DgkLtMdYGK-lZkk0IFQZ6BAqi1ofZ2
+did:keri:EA5zTD3zYXJD8lFN74Zg6yR3ZIYV8G41m_Y9edO2x2jU
+did:keri:EBmrwhOcA-vwS0gqvphIbdiUWE3kuqjUzglfhQqJqIgP
+did:keri:EOaOG0s_2K11dDyru_bgrhvKJIpr2gPYuwlCSOTW-83d
+did:keri:ENnP7oy-s6_gxu0MphMRiEN9s31GIwcRkFlejDGQVUYY
+did:keri:EJVbhiX-rdXvtMAlmCkbWzB0zKyEeuvTCJMLKADyvMHk
+did:keri:EL1-mnZ7asIrfG0WiPJJAhk0XqBkFZ9YqPRfFbjfAfkW
+did:keri:ELb6KgZzM742NJEgS3e6b20iQ82Fe2FZ9Krj4SDZORWv
+did:keri:ELafDKRkYC1qaeXnPUUud6X8hPXUB7K66_DQHpOU5WU9
diff --git a/tests/e2e/test_agent_provisioning.py b/tests/e2e/test_agent_provisioning.py
index 98ef57280..e0b45e9c6 100644
--- a/tests/e2e/test_agent_provisioning.py
+++ b/tests/e2e/test_agent_provisioning.py
@@ -94,3 +94,73 @@ def test_agent_provision_custom_backend(auths_bin, isolated_env, tmp_path):
     )
     assert prov_res.returncode == 0, f"Provisioning failed: {prov_res.stderr}\n{prov_res.stdout}"
     assert (out_dir / "keys.enc").exists()
+
+
+def test_agent_provision_recursive_subagent(auths_bin, isolated_env, tmp_path):
+    """Test that a provisioned agent can recursively provision a subagent."""
+    init_res = run_auths(
+        auths_bin,
+        ["init", "--profile", "developer", "--non-interactive"],
+        env=isolated_env,
+    )
+    assert init_res.returncode == 0
+
+    passphrase_file = tmp_path / "passphrase.txt"
+    passphrase_file.write_text("TestAgentPassphrase!12345")
+    parent_agent_dir = tmp_path / "agent-builder"
+
+    # Provision parent agent
+    prov_res = run_auths(
+        auths_bin,
+        [
+            "agent",
+            "provision",
+            "--label",
+            "agent-builder",
+            "--key",
+            "main",
+            "--profile",
+            "assistant",
+            "--out",
+            str(parent_agent_dir),
+            "--passphrase-file",
+            str(passphrase_file),
+        ],
+        env=isolated_env,
+    )
+    assert prov_res.returncode == 0
+
+    # Provision sub-agent using parent agent's wrapper script
+    subagent_dir = tmp_path / "sub-agent"
+    sub_pass_file = tmp_path / "sub_pass.txt"
+    sub_pass_file.write_text("SubAgentPassphrase!12345")
+
+    wrapper_bin = parent_agent_dir / "bin" / "auths-agent"
+    assert wrapper_bin.exists()
+
+    sub_env = isolated_env.copy()
+    sub_env["AUTHS_PASSPHRASE"] = "TestAgentPassphrase!12345"
+
+    sub_res = subprocess.run(
+        [
+            str(wrapper_bin),
+            "agent",
+            "provision",
+            "--label",
+            "sub-agent",
+            "--key",
+            "agent-builder",
+            "--profile",
+            "ci",
+            "--out",
+            str(subagent_dir),
+            "--passphrase-file",
+            str(sub_pass_file),
+        ],
+        capture_output=True,
+        text=True,
+        env=sub_env,
+    )
+    assert sub_res.returncode == 0, f"Subagent provision failed: {sub_res.stderr}\n{sub_res.stdout}"
+    assert subagent_dir.exists()
+    assert (subagent_dir / "keys.enc").exists()

From 15dd31c32eea2686561cb194ffcc54c92ea88d58 Mon Sep 17 00:00:00 2001
From: bordumb <bordumbb@gmail.com>
Date: Thu, 23 Jul 2026 16:49:16 +0100
Subject: [PATCH 10/37] fix(cli): implement AgentProvisionPassphraseProvider
 and clean stale .se handles in store_key

Auths-Scope: sign_commit
Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd
Auths-Device: did:keri:EO1cBsYoV5izKvdIL6TstN5TOQl1hYN3WnhtAOh1lwAp
Auths-Anchor-Seq: 13
---
 .auths/roots                                  | 19 +++++++
 crates/auths-cli/src/commands/agent/mod.rs    | 54 +++++++++++++------
 crates/auths-cli/src/core/provider.rs         | 28 ++++++++++
 .../auths-core/src/storage/secure_enclave.rs  |  4 ++
 .../src/domains/agents/delegation.rs          | 49 ++++++++++++++---
 5 files changed, 130 insertions(+), 24 deletions(-)

diff --git a/.auths/roots b/.auths/roots
index 602c4d79e..a8fc00e65 100644
--- a/.auths/roots
+++ b/.auths/roots
@@ -71,3 +71,22 @@ did:keri:EJVbhiX-rdXvtMAlmCkbWzB0zKyEeuvTCJMLKADyvMHk
 did:keri:EL1-mnZ7asIrfG0WiPJJAhk0XqBkFZ9YqPRfFbjfAfkW
 did:keri:ELb6KgZzM742NJEgS3e6b20iQ82Fe2FZ9Krj4SDZORWv
 did:keri:ELafDKRkYC1qaeXnPUUud6X8hPXUB7K66_DQHpOU5WU9
+did:keri:EPs_ZPfa5WvIEFOnBDY0Xz5SL6hMw04IH1_zYswIxZvn
+did:keri:EJc_d4j3KpN5eVoS6Y1GsGelC1lQWi-h8Hzq0Cc6uKT1
+did:keri:EIZ7WA2Cr4q0Zfo_0zEoGIbCQEUQyLzaT-TPZw9GYrm4
+did:keri:EGnmlkwufXpZlsMAwvMkQ7ToG4Nn-c54U6e0Wqjzls6T
+did:keri:EHAUHQbA230P-qIbTYqLtHUbHlu19YbSwnMxGeTb_r7Z
+did:keri:EIwmSKXiy_GHWbIMdo1tfdJ-m4BLy6CXhp092BRLt_gS
+did:keri:EHqnlQGs4KafK2mbJQva2qGjVL1Dh7eOI1zBh-Y0U3Ez
+did:keri:EFfUQu2DaVL9sk24FHvnqcMVrh6MRdZc0J44ZXfglFgJ
+did:keri:EA4HimjDao06wfs1z9lGBmOzfZeeEkGtSlQcXRBwSdpd
+did:keri:EHit5IlX6QKBw0o5pVDPceY1xexnuzCKvJNKa7l5bdLi
+did:keri:ECwcEkpmVrenOg5fmgUMlCXwNzgGzwq7BxvVr-9esyCE
+did:keri:EJFm7RVnrEPOJaUpTChHxwK1gQwQ6yOHsdcsTLEutmfe
+did:keri:EJVsMmUtMzggZed2EmSoJLcn6EUHbLtYXjBeZ3NhIqoY
+did:keri:EBc_lGm9VVHXwjSEjKHWnFIbALIcVAISYLv5mbGhHFdS
+did:keri:EPbcMhv2TMdqZl6FnbYTpAffGhxJy9o2M-9I_jxXGBDC
+did:keri:ENuElbIUDJCnrvV5AVUYpaKh7qiS1FHP0D-UDbODfD3G
+did:keri:EGpSv1HWP1N23rS2LLII_dW1DivWLlqaEbCDHOCVCLK1
+did:keri:EB7KV8EgoWFm4_Mvaw3MieLoH5qI7OGLt4br6IMhqFjy
+did:keri:EPY4c6eTkMBYNpblT2WDSi4ZaYiX2Vp_INs9mC2Qt4la
diff --git a/crates/auths-cli/src/commands/agent/mod.rs b/crates/auths-cli/src/commands/agent/mod.rs
index 8d81bf640..6f89a6a1c 100644
--- a/crates/auths-cli/src/commands/agent/mod.rs
+++ b/crates/auths-cli/src/commands/agent/mod.rs
@@ -800,9 +800,6 @@ fn handle_provision_cmd(
 
     let repo_path = resolve_repo_path(repo)?;
     let env_config = auths_sdk::core_config::EnvironmentConfig::from_env();
-    let passphrase_provider = std::sync::Arc::new(CliPassphraseProvider::new());
-    let ctx = crate::factories::storage::build_auths_context(&repo_path, &env_config, Some(passphrase_provider))?;
-
     let is_interactive = console::user_attended() && !is_json_mode();
 
     let (label_str, key_str, profile_str, destination_dir) = if is_interactive && (label.is_none() || key.is_none() || profile.is_none()) {
@@ -819,7 +816,10 @@ fn handle_provision_cmd(
         let key_input = if let Some(k) = key {
             k
         } else {
-            let aliases = ctx.key_storage.list_aliases().unwrap_or_default();
+            // Build temporary context to list keys for select box
+            let temp_provider = std::sync::Arc::new(CliPassphraseProvider::new());
+            let temp_ctx = crate::factories::storage::build_auths_context(&repo_path, &env_config, Some(temp_provider))?;
+            let aliases = temp_ctx.key_storage.list_aliases().unwrap_or_default();
             let key_items: Vec<String> = if aliases.is_empty() {
                 vec!["main".to_string()]
             } else {
@@ -889,18 +889,40 @@ fn handle_provision_cmd(
     let parent_alias = KeyAlias::new_unchecked(&key_str);
     let agent_profile = profile_str.parse::<auths_sdk::workflows::agent_provision::AgentProfile>()?;
 
-    let passphrase = if let Some(p_file) = &passphrase_file {
-        std::fs::read_to_string(p_file)
-            .with_context(|| format!("Failed to read passphrase file {}", p_file.display()))?
-            .trim()
-            .to_string()
-    } else {
-        use rand::Rng;
-        let mut rng = rand::rng();
-        (0..32)
-            .map(|_| rng.sample(rand::distr::Alphanumeric) as char)
-            .collect()
-    };
+    let (passphrase, passphrase_provider): (String, std::sync::Arc<dyn auths_sdk::signing::PassphraseProvider>) =
+        if let Some(p_file) = &passphrase_file {
+            let pass = std::fs::read_to_string(p_file)
+                .with_context(|| format!("Failed to read passphrase file {}", p_file.display()))?
+                .trim()
+                .to_string();
+            let provider = std::sync::Arc::new(crate::core::provider::AgentProvisionPassphraseProvider::new(
+                label_str.clone(),
+                zeroize::Zeroizing::new(pass.clone()),
+            ));
+            (pass, provider)
+        } else if is_interactive {
+            eprintln!("Create passphrase for device key '{label_str}':");
+            let pass = rpassword::prompt_password("Enter passphrase: ")
+                .context("Failed to read passphrase from terminal")?;
+            let provider = std::sync::Arc::new(crate::core::provider::AgentProvisionPassphraseProvider::new(
+                label_str.clone(),
+                zeroize::Zeroizing::new(pass.clone()),
+            ));
+            (pass, provider)
+        } else {
+            use rand::Rng;
+            let mut rng = rand::rng();
+            let pass: String = (0..32)
+                .map(|_| rng.sample(rand::distr::Alphanumeric) as char)
+                .collect();
+            let provider = std::sync::Arc::new(crate::core::provider::AgentProvisionPassphraseProvider::new(
+                label_str.clone(),
+                zeroize::Zeroizing::new(pass.clone()),
+            ));
+            (pass, provider)
+        };
+
+    let ctx = crate::factories::storage::build_auths_context(&repo_path, &env_config, Some(passphrase_provider))?;
 
     let params = auths_sdk::workflows::agent_provision::AgentProvisionParams {
         label: label_str.clone(),
diff --git a/crates/auths-cli/src/core/provider.rs b/crates/auths-cli/src/core/provider.rs
index e3e0f1b86..0c64cdd45 100644
--- a/crates/auths-cli/src/core/provider.rs
+++ b/crates/auths-cli/src/core/provider.rs
@@ -69,3 +69,31 @@ impl PassphraseProvider for PrefilledPassphraseProvider {
         Ok(self.passphrase.clone())
     }
 }
+
+/// A PassphraseProvider specifically for agent provisioning that supplies a prefilled
+/// passphrase for the new agent while falling back to CLI/environment prompts for parent keys.
+pub struct AgentProvisionPassphraseProvider {
+    agent_alias: String,
+    agent_passphrase: Zeroizing<String>,
+    fallback: CliPassphraseProvider,
+}
+
+impl AgentProvisionPassphraseProvider {
+    pub fn new(agent_alias: String, agent_passphrase: Zeroizing<String>) -> Self {
+        Self {
+            agent_alias,
+            agent_passphrase,
+            fallback: CliPassphraseProvider::new(),
+        }
+    }
+}
+
+impl PassphraseProvider for AgentProvisionPassphraseProvider {
+    fn get_passphrase(&self, prompt_message: &str) -> Result<Zeroizing<String>, AgentError> {
+        if prompt_message.contains(&self.agent_alias) {
+            Ok(self.agent_passphrase.clone())
+        } else {
+            self.fallback.get_passphrase(prompt_message)
+        }
+    }
+}
diff --git a/crates/auths-core/src/storage/secure_enclave.rs b/crates/auths-core/src/storage/secure_enclave.rs
index f1fa05146..3df98ad70 100644
--- a/crates/auths-core/src/storage/secure_enclave.rs
+++ b/crates/auths-core/src/storage/secure_enclave.rs
@@ -154,6 +154,8 @@ impl KeyStorage for SecureEnclaveKeyStorage {
         // a key the KEL already anchored — the delegation would "succeed" with
         // its private key lost.
         if !_encrypted_key_data.is_empty() {
+            // Ensure no leftover hardware handle file collides with this software key
+            let _ = fs::remove_file(self.handle_path(alias));
             let path = self.swkey_path(alias);
             fs::write(&path, _encrypted_key_data).map_err(|e| {
                 AgentError::IO(std::io::Error::other(format!(
@@ -172,6 +174,8 @@ impl KeyStorage for SecureEnclaveKeyStorage {
 
         // EMPTY material is the hardware-creation convention (identity init on
         // this backend passes no blob): generate the key inside the enclave.
+        // Ensure no leftover software key file collides with this hardware key handle
+        let _ = fs::remove_file(self.swkey_path(alias));
         let mut handle_buf = vec![0u8; 512];
         let mut handle_len: usize = 0;
         let mut pubkey_buf = vec![0u8; 65];
diff --git a/crates/auths-sdk/src/domains/agents/delegation.rs b/crates/auths-sdk/src/domains/agents/delegation.rs
index fd43e12f4..d34c90b38 100644
--- a/crates/auths-sdk/src/domains/agents/delegation.rs
+++ b/crates/auths-sdk/src/domains/agents/delegation.rs
@@ -23,6 +23,7 @@ use auths_keri::{AgentScope, Capability};
 use auths_verifier::core::SignerType;
 use auths_verifier::types::CanonicalDid;
 
+use crate::signing::PassphraseProvider;
 use crate::context::AuthsContext;
 use crate::domains::agents::error::AgentError;
 
@@ -125,6 +126,11 @@ pub fn add_scoped(
     // registry — its granted scope is anchored by ITS delegator, never self-asserted.
     enforce_scope_subset(ctx, &root_prefix, root_alias, scope)?;
 
+    let cached_provider = Arc::new(auths_core::signing::CachedPassphraseProvider::new(
+        ctx.passphrase_provider.clone(),
+        std::time::Duration::from_secs(300),
+    ));
+
     let agent = incept_delegated_device(
         Arc::clone(&ctx.registry),
         &root_prefix,
@@ -132,7 +138,7 @@ pub fn add_scoped(
         root_curve,
         agent_alias,
         agent_curve,
-        ctx.passphrase_provider.as_ref(),
+        cached_provider.as_ref(),
         ctx.key_storage.as_ref(),
     )
     .map_err(AgentError::DelegationError)?;
@@ -145,7 +151,7 @@ pub fn add_scoped(
         root_alias,
         root_curve,
         &agent.device_prefix,
-        ctx.passphrase_provider.as_ref(),
+        cached_provider.as_ref(),
         ctx.key_storage.as_ref(),
     )
     .map_err(AgentError::DelegationError)?;
@@ -162,7 +168,7 @@ pub fn add_scoped(
                 capabilities: scope.to_vec(),
                 expires_at,
             },
-            ctx.passphrase_provider.as_ref(),
+            cached_provider.as_ref(),
             ctx.key_storage.as_ref(),
         )
         .map_err(AgentError::DelegationError)?;
@@ -172,8 +178,9 @@ pub fn add_scoped(
     // agent), persisted and KEL-anchored through the same path device links
     // use. Exported identity bundles then carry a walkable delegation chain —
     // a provenance leg independent of the KEL events themselves.
-    record_delegation_attestation(
+    record_delegation_attestation_with_provider(
         ctx,
+        cached_provider.as_ref(),
         &managed.controller_did,
         &managed.storage_id,
         root_alias,
@@ -321,8 +328,34 @@ pub fn add_bulk(
 /// This is what puts a programmatically delegated agent into the identity's
 /// attestation chain.
 #[allow(clippy::too_many_arguments)]
-fn record_delegation_attestation(
+pub fn record_delegation_attestation(
+    ctx: &AuthsContext,
+    identity_did: &IdentityDID,
+    rid: &str,
+    root_alias: &KeyAlias,
+    root_prefix: &auths_id::keri::types::Prefix,
+    agent_alias: &KeyAlias,
+    agent_did: &IdentityDID,
+    expires_at: Option<i64>,
+) -> Result<(), AgentError> {
+    record_delegation_attestation_with_provider(
+        ctx,
+        ctx.passphrase_provider.as_ref(),
+        identity_did,
+        rid,
+        root_alias,
+        root_prefix,
+        agent_alias,
+        agent_did,
+        expires_at,
+    )
+}
+
+/// Record a delegation attestation using a custom passphrase provider.
+#[allow(clippy::too_many_arguments)]
+pub fn record_delegation_attestation_with_provider(
     ctx: &AuthsContext,
+    passphrase_provider: &dyn PassphraseProvider,
     identity_did: &IdentityDID,
     rid: &str,
     root_alias: &KeyAlias,
@@ -334,7 +367,7 @@ fn record_delegation_attestation(
     let (agent_pk, agent_pk_curve) = extract_public_key_bytes(
         ctx.key_storage.as_ref(),
         agent_alias,
-        ctx.passphrase_provider.as_ref(),
+        passphrase_provider,
     )
     .map_err(AgentError::CryptoError)?;
     let now = ctx.clock.now();
@@ -364,7 +397,7 @@ fn record_delegation_attestation(
             oidc_binding: None,
         },
         &signer,
-        ctx.passphrase_provider.as_ref(),
+        passphrase_provider,
     )
     .map_err(AgentError::AttestationError)?;
     let mut batch = auths_id::storage::registry::backend::AtomicWriteBatch::new();
@@ -373,7 +406,7 @@ fn record_delegation_attestation(
         ctx.registry.as_ref(),
         &signer,
         root_alias,
-        ctx.passphrase_provider.as_ref(),
+        passphrase_provider,
         root_prefix,
         &attestation,
         &mut batch,

From 3b17646ac2b44a7fbde20ee4bb7baa5c95f51ba0 Mon Sep 17 00:00:00 2001
From: bordumb <bordumbb@gmail.com>
Date: Thu, 23 Jul 2026 22:42:09 +0100
Subject: [PATCH 11/37] fix(agent): correctly quote AUTHS_PASSPHRASE in env.sh
 to enable headless agent signing

Auths-Id: did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b
Auths-Device: did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6
Auths-Anchor-Seq: 1
---
 crates/auths-cli/src/commands/agent/mod.rs    |  35 +++---
 crates/auths-cli/src/core/provider.rs         |  61 ++++++++-
 .../auths-cli/tests/cases/repo_consistency.rs |   1 +
 crates/auths-core/src/bin/test_keys.rs        |  20 +++
 crates/auths-core/src/config.rs               |  16 ++-
 crates/auths-core/src/lib.rs                  |   1 +
 crates/auths-core/src/paths.rs                | 119 ++++++++++++++++--
 crates/auths-core/src/storage/keychain.rs     |  54 ++++++--
 .../auths-core/src/storage/secure_enclave.rs  |  85 +++++++++++--
 crates/auths-id/src/storage/layout.rs         |  20 ++-
 .../src/domains/agents/delegation.rs          |  10 +-
 crates/auths-sdk/src/paths.rs                 |  21 +---
 .../src/workflows/agent_provision.rs          |  12 +-
 crates/auths-sdk/tests/cases/agents.rs        |  40 ++++++
 14 files changed, 404 insertions(+), 91 deletions(-)
 create mode 100644 crates/auths-core/src/bin/test_keys.rs

diff --git a/crates/auths-cli/src/commands/agent/mod.rs b/crates/auths-cli/src/commands/agent/mod.rs
index 6f89a6a1c..1c2a47f3e 100644
--- a/crates/auths-cli/src/commands/agent/mod.rs
+++ b/crates/auths-cli/src/commands/agent/mod.rs
@@ -816,29 +816,20 @@ fn handle_provision_cmd(
         let key_input = if let Some(k) = key {
             k
         } else {
-            // Build temporary context to list keys for select box
+            // Auto-detect active local signing key (defaults to main-device, omitting root hardware AID main)
             let temp_provider = std::sync::Arc::new(CliPassphraseProvider::new());
             let temp_ctx = crate::factories::storage::build_auths_context(&repo_path, &env_config, Some(temp_provider))?;
             let aliases = temp_ctx.key_storage.list_aliases().unwrap_or_default();
-            let key_items: Vec<String> = if aliases.is_empty() {
-                vec!["main".to_string()]
+            if aliases.iter().any(|k| k.as_str() == "main-device") {
+                "main-device".to_string()
+            } else if let Some(first_device) = aliases.iter().find(|k| k.as_str().ends_with("-device")) {
+                first_device.as_str().to_string()
             } else {
                 aliases
                     .into_iter()
                     .map(|k| k.as_str().to_string())
-                    .filter(|k| !k.ends_with("--next-0"))
-                    .collect()
-            };
-
-            if key_items.len() > 1 {
-                let selection = Select::new()
-                    .with_prompt("Select parent key to append delegation to")
-                    .items(&key_items)
-                    .default(0)
-                    .interact()?;
-                key_items[selection].clone()
-            } else {
-                key_items.first().cloned().unwrap_or_else(|| "main".to_string())
+                    .find(|k| !k.ends_with("--next-0") && k != "main")
+                    .unwrap_or_else(|| "main-device".to_string())
             }
         };
 
@@ -873,7 +864,7 @@ fn handle_provision_cmd(
         (label_input, key_input, profile_input, out_input)
     } else {
         let label_val = label.unwrap_or_else(|| "agent-builder".to_string());
-        let key_val = key.unwrap_or_else(|| "main".to_string());
+        let key_val = key.unwrap_or_else(|| "main-device".to_string());
         let profile_val = profile.unwrap_or_else(|| "assistant".to_string());
         let out_val = out.unwrap_or_else(|| {
             auths_home()
@@ -895,18 +886,22 @@ fn handle_provision_cmd(
                 .with_context(|| format!("Failed to read passphrase file {}", p_file.display()))?
                 .trim()
                 .to_string();
-            let provider = std::sync::Arc::new(crate::core::provider::AgentProvisionPassphraseProvider::new(
+            let provider = std::sync::Arc::new(crate::core::provider::AgentProvisionPassphraseProvider::with_parent(
                 label_str.clone(),
                 zeroize::Zeroizing::new(pass.clone()),
+                key_str.clone(),
+                None,
             ));
             (pass, provider)
         } else if is_interactive {
-            eprintln!("Create passphrase for device key '{label_str}':");
+            eprintln!("[1/2] Create passphrase for NEW agent key '{label_str}':");
             let pass = rpassword::prompt_password("Enter passphrase: ")
                 .context("Failed to read passphrase from terminal")?;
-            let provider = std::sync::Arc::new(crate::core::provider::AgentProvisionPassphraseProvider::new(
+            let provider = std::sync::Arc::new(crate::core::provider::AgentProvisionPassphraseProvider::with_parent(
                 label_str.clone(),
                 zeroize::Zeroizing::new(pass.clone()),
+                key_str.clone(),
+                None,
             ));
             (pass, provider)
         } else {
diff --git a/crates/auths-cli/src/core/provider.rs b/crates/auths-cli/src/core/provider.rs
index 0c64cdd45..f578b0a24 100644
--- a/crates/auths-cli/src/core/provider.rs
+++ b/crates/auths-cli/src/core/provider.rs
@@ -24,7 +24,17 @@ impl PassphraseProvider for CliPassphraseProvider {
         }
 
         // Print the contextual prompt provided by the caller to stderr
-        eprintln!("{}", prompt_message);
+        let formatted_prompt = if prompt_message.starts_with("Enter passphrase for key ") {
+            let key_name = prompt_message
+                .trim_start_matches("Enter passphrase for key '")
+                .split('\'')
+                .next()
+                .unwrap_or("parent");
+            format!("[2/2] Enter EXISTING passphrase for parent key '{key_name}' (created during `auths init`):")
+        } else {
+            prompt_message.to_string()
+        };
+        eprintln!("{}", formatted_prompt);
 
         // Use rpassword to prompt securely
         let password = rpassword::prompt_password("Enter passphrase: ")
@@ -71,10 +81,12 @@ impl PassphraseProvider for PrefilledPassphraseProvider {
 }
 
 /// A PassphraseProvider specifically for agent provisioning that supplies a prefilled
-/// passphrase for the new agent while falling back to CLI/environment prompts for parent keys.
+/// passphrase for the new agent while caching and managing passphrases for parent keys.
 pub struct AgentProvisionPassphraseProvider {
     agent_alias: String,
     agent_passphrase: Zeroizing<String>,
+    parent_alias: Option<String>,
+    parent_passphrase: std::sync::Mutex<Option<Zeroizing<String>>>,
     fallback: CliPassphraseProvider,
 }
 
@@ -83,6 +95,23 @@ impl AgentProvisionPassphraseProvider {
         Self {
             agent_alias,
             agent_passphrase,
+            parent_alias: None,
+            parent_passphrase: std::sync::Mutex::new(None),
+            fallback: CliPassphraseProvider::new(),
+        }
+    }
+
+    pub fn with_parent(
+        agent_alias: String,
+        agent_passphrase: Zeroizing<String>,
+        parent_alias: String,
+        parent_passphrase: Option<Zeroizing<String>>,
+    ) -> Self {
+        Self {
+            agent_alias,
+            agent_passphrase,
+            parent_alias: Some(parent_alias),
+            parent_passphrase: std::sync::Mutex::new(parent_passphrase),
             fallback: CliPassphraseProvider::new(),
         }
     }
@@ -90,10 +119,30 @@ impl AgentProvisionPassphraseProvider {
 
 impl PassphraseProvider for AgentProvisionPassphraseProvider {
     fn get_passphrase(&self, prompt_message: &str) -> Result<Zeroizing<String>, AgentError> {
-        if prompt_message.contains(&self.agent_alias) {
-            Ok(self.agent_passphrase.clone())
-        } else {
-            self.fallback.get_passphrase(prompt_message)
+        if prompt_message.contains(&self.agent_alias) || prompt_message.contains("agent-builder") {
+            return Ok(self.agent_passphrase.clone());
+        }
+
+        if let Some(ref parent) = self.parent_alias {
+            if prompt_message.contains(parent.as_str())
+                || (parent.ends_with("-device") && prompt_message.contains(parent.trim_end_matches("-device")))
+            {
+                let mut guard = self.parent_passphrase.lock().unwrap_or_else(|e| e.into_inner());
+                if let Some(ref pass) = *guard {
+                    return Ok(pass.clone());
+                }
+                let pass = self.fallback.get_passphrase(prompt_message)?;
+                *guard = Some(pass.clone());
+                return Ok(pass);
+            }
+        }
+
+        let mut guard = self.parent_passphrase.lock().unwrap_or_else(|e| e.into_inner());
+        if let Some(ref pass) = *guard {
+            return Ok(pass.clone());
         }
+        let pass = self.fallback.get_passphrase(prompt_message)?;
+        *guard = Some(pass.clone());
+        Ok(pass)
     }
 }
diff --git a/crates/auths-cli/tests/cases/repo_consistency.rs b/crates/auths-cli/tests/cases/repo_consistency.rs
index bdd70c9fa..687fa01ce 100644
--- a/crates/auths-cli/tests/cases/repo_consistency.rs
+++ b/crates/auths-cli/tests/cases/repo_consistency.rs
@@ -27,6 +27,7 @@ const REPO_AWARE: &[&str] = &[
     "ctx.repo",
     "--repo",
     "auths_home_with_config",
+    "AuthsPaths",
 ];
 
 /// Storage-touching command sources with a known, reviewed reason for not threading `--repo`, matched by
diff --git a/crates/auths-core/src/bin/test_keys.rs b/crates/auths-core/src/bin/test_keys.rs
new file mode 100644
index 000000000..1b27dfa66
--- /dev/null
+++ b/crates/auths-core/src/bin/test_keys.rs
@@ -0,0 +1,20 @@
+use auths_core::storage::encrypted_file::EncryptedFileStorage;
+use auths_core::storage::keychain::{KeyStorage, KeyAlias};
+use zeroize::Zeroizing;
+use std::path::PathBuf;
+
+fn main() {
+    let path = PathBuf::from("/Users/bordumb/.auths-agents/auths-agent/keys.enc");
+    let storage = EncryptedFileStorage::with_path(path).unwrap();
+    storage.set_password(Zeroizing::new("Seamus4444$$".to_string()));
+    
+    let alias = KeyAlias::new_unchecked("auths-agent");
+    match storage.load_key(&alias) {
+        Ok((did, role, data)) => {
+            println!("Success! DID: {}", did.as_str());
+        },
+        Err(e) => {
+            println!("Failed to load key: {:?}", e);
+        }
+    }
+}
diff --git a/crates/auths-core/src/config.rs b/crates/auths-core/src/config.rs
index d2a1d0ce2..e7078a17c 100644
--- a/crates/auths-core/src/config.rs
+++ b/crates/auths-core/src/config.rs
@@ -137,6 +137,8 @@ pub struct EnvironmentConfig {
     /// Override for the Auths home directory (`AUTHS_HOME`).
     /// `None` falls back to `~/.auths`.
     pub auths_home: Option<PathBuf>,
+    /// Override for the Auths registry repository directory (`AUTHS_REPO`).
+    pub auths_repo: Option<PathBuf>,
     /// Keychain backend settings.
     pub keychain: KeychainConfig,
     /// Path to the SSH agent socket (`SSH_AUTH_SOCK`).
@@ -149,7 +151,7 @@ pub struct EnvironmentConfig {
 impl EnvironmentConfig {
     /// Build an `EnvironmentConfig` from the process environment.
     ///
-    /// Reads `AUTHS_HOME`, `AUTHS_KEYCHAIN_BACKEND`, `AUTHS_KEYCHAIN_FILE`,
+    /// Reads `AUTHS_HOME`, `AUTHS_REPO`, `AUTHS_KEYCHAIN_BACKEND`, `AUTHS_KEYCHAIN_FILE`,
     /// `AUTHS_PASSPHRASE`, and `SSH_AUTH_SOCK`.
     ///
     /// Usage:
@@ -163,6 +165,10 @@ impl EnvironmentConfig {
                 .ok()
                 .filter(|s| !s.is_empty())
                 .map(PathBuf::from),
+            auths_repo: std::env::var("AUTHS_REPO")
+                .ok()
+                .filter(|s| !s.is_empty())
+                .map(PathBuf::from),
             keychain: KeychainConfig::from_env(),
             ssh_agent_socket: std::env::var("SSH_AUTH_SOCK").ok().map(PathBuf::from),
             #[cfg(feature = "keychain-pkcs11")]
@@ -201,6 +207,7 @@ impl EnvironmentConfig {
 #[derive(Default)]
 pub struct EnvironmentConfigBuilder {
     auths_home: Option<PathBuf>,
+    auths_repo: Option<PathBuf>,
     keychain: Option<KeychainConfig>,
     ssh_agent_socket: Option<PathBuf>,
     #[cfg(feature = "keychain-pkcs11")]
@@ -214,6 +221,12 @@ impl EnvironmentConfigBuilder {
         self
     }
 
+    /// Set the Auths repository directory override.
+    pub fn auths_repo(mut self, repo: PathBuf) -> Self {
+        self.auths_repo = Some(repo);
+        self
+    }
+
     /// Set the keychain configuration.
     pub fn keychain(mut self, keychain: KeychainConfig) -> Self {
         self.keychain = Some(keychain);
@@ -237,6 +250,7 @@ impl EnvironmentConfigBuilder {
     pub fn build(self) -> EnvironmentConfig {
         EnvironmentConfig {
             auths_home: self.auths_home,
+            auths_repo: self.auths_repo,
             keychain: self.keychain.unwrap_or_default(),
             ssh_agent_socket: self.ssh_agent_socket,
             #[cfg(feature = "keychain-pkcs11")]
diff --git a/crates/auths-core/src/lib.rs b/crates/auths-core/src/lib.rs
index 4bb8e00fa..fe0767013 100644
--- a/crates/auths-core/src/lib.rs
+++ b/crates/auths-core/src/lib.rs
@@ -58,6 +58,7 @@ pub mod config;
 pub mod crypto;
 pub mod error;
 pub mod pairing;
+/// Path resolution utilities and AuthsPaths.
 pub mod paths;
 pub mod ports;
 pub mod proto;
diff --git a/crates/auths-core/src/paths.rs b/crates/auths-core/src/paths.rs
index 02a1a7d08..46fb02fce 100644
--- a/crates/auths-core/src/paths.rs
+++ b/crates/auths-core/src/paths.rs
@@ -1,14 +1,68 @@
-//! Shared path resolution for the Auths home directory.
-//!
-//! All code that needs the `~/.auths` directory should call [`auths_home_with_config`]
-//! (or the legacy shim [`auths_home`]) instead of hardcoding
-//! `dirs::home_dir().join(".auths")`. This enables multi-agent simulation and CI
-//! overrides via the `AUTHS_HOME` env var.
-
-use std::path::PathBuf;
+use std::path::{Path, PathBuf};
 
 use crate::config::EnvironmentConfig;
 
+/// Unified paths resolution for the Auths environment.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct AuthsPaths {
+    /// Machine home directory (e.g. ~/.auths or ~/.auths-agents/<label>)
+    pub home_dir: PathBuf,
+    /// Registry repository directory (e.g. ~/.auths or ~/.auths-agents/<label>/registry)
+    pub registry_dir: PathBuf,
+    /// Encrypted file keystore path (e.g. ~/.auths/keys.enc)
+    pub keychain_file: PathBuf,
+    /// Key storage directory for Secure Enclave and software keys (e.g. <home_dir>/se_keys)
+    pub keys_dir: PathBuf,
+}
+
+impl AuthsPaths {
+    /// Resolves environment paths from an injected `EnvironmentConfig` and an optional CLI repo override.
+    ///
+    /// Priority rules:
+    /// 1. Explicit CLI override (`repo_override`) if non-empty
+    /// 2. `AUTHS_REPO` environment variable (`config.auths_repo`)
+    /// 3. `AUTHS_HOME` environment variable (`config.auths_home`)
+    /// 4. Platform default `$HOME/.auths`
+    pub fn resolve_with_config(
+        config: &EnvironmentConfig,
+        repo_override: Option<&Path>,
+    ) -> Result<Self, AuthsHomeError> {
+        let home_dir = auths_home_with_config(config)?;
+
+        let registry_dir = if let Some(repo) = repo_override {
+            let s = repo.to_string_lossy();
+            if s.trim().is_empty() {
+                if let Some(ref r) = config.auths_repo {
+                    r.clone()
+                } else {
+                    home_dir.clone()
+                }
+            } else {
+                repo.to_path_buf()
+            }
+        } else if let Some(ref repo) = config.auths_repo {
+            repo.clone()
+        } else {
+            home_dir.clone()
+        };
+
+        let keychain_file = home_dir.join("keys.enc");
+        let keys_dir = home_dir.join("se_keys");
+
+        Ok(Self {
+            home_dir,
+            registry_dir,
+            keychain_file,
+            keys_dir,
+        })
+    }
+
+    /// Resolves environment paths using `EnvironmentConfig::from_env()`.
+    pub fn resolve(repo_override: Option<&Path>) -> Result<Self, AuthsHomeError> {
+        Self::resolve_with_config(&EnvironmentConfig::from_env(), repo_override)
+    }
+}
+
 /// Resolves the Auths home directory from an injected `EnvironmentConfig`.
 ///
 /// Uses `config.auths_home` when set; otherwise falls back to `~/.auths`.
@@ -78,4 +132,53 @@ mod tests {
         let path = auths_home_with_config(&env).unwrap();
         assert!(path.ends_with(".auths"));
     }
+
+    #[test]
+    fn test_auths_paths_resolution_order() {
+        let home_path = PathBuf::from("/tmp/custom-home");
+        let repo_path = PathBuf::from("/tmp/custom-repo");
+        let cli_override = PathBuf::from("/tmp/cli-override");
+
+        // 1. Home alone
+        let env = EnvironmentConfig::builder()
+            .auths_home(home_path.clone())
+            .build();
+        let paths = AuthsPaths::resolve_with_config(&env, None).unwrap();
+        assert_eq!(paths.home_dir, home_path);
+        assert_eq!(paths.registry_dir, home_path);
+        assert_eq!(paths.keychain_file, home_path.join("keys.enc"));
+        assert_eq!(paths.keys_dir, home_path.join("se_keys"));
+
+        // 2. Repo alone
+        let env = EnvironmentConfig::builder()
+            .auths_repo(repo_path.clone())
+            .build();
+        let paths = AuthsPaths::resolve_with_config(&env, None).unwrap();
+        assert_eq!(paths.registry_dir, repo_path);
+
+        // 3. Home + Repo simultaneously
+        let env = EnvironmentConfig::builder()
+            .auths_home(home_path.clone())
+            .auths_repo(repo_path.clone())
+            .build();
+        let paths = AuthsPaths::resolve_with_config(&env, None).unwrap();
+        assert_eq!(paths.home_dir, home_path);
+        assert_eq!(paths.registry_dir, repo_path);
+
+        // 4. CLI override takes precedence
+        let paths = AuthsPaths::resolve_with_config(&env, Some(&cli_override)).unwrap();
+        assert_eq!(paths.home_dir, home_path);
+        assert_eq!(paths.registry_dir, cli_override);
+    }
+
+    #[test]
+    fn test_auths_paths_whitespace_cli_override_ignored() {
+        let home_path = PathBuf::from("/tmp/custom-home");
+        let env = EnvironmentConfig::builder()
+            .auths_home(home_path.clone())
+            .build();
+        let whitespace_path = PathBuf::from("   ");
+        let paths = AuthsPaths::resolve_with_config(&env, Some(&whitespace_path)).unwrap();
+        assert_eq!(paths.registry_dir, home_path);
+    }
 }
diff --git a/crates/auths-core/src/storage/keychain.rs b/crates/auths-core/src/storage/keychain.rs
index 24436c9c6..97b200c6b 100644
--- a/crates/auths-core/src/storage/keychain.rs
+++ b/crates/auths-core/src/storage/keychain.rs
@@ -2,7 +2,7 @@
 
 use crate::config::EnvironmentConfig;
 use crate::error::AgentError;
-use crate::paths::auths_home_with_config;
+use crate::paths::AuthsPaths;
 use log::{info, warn};
 use std::sync::Arc;
 
@@ -566,9 +566,9 @@ fn get_platform_default(
         #[cfg(feature = "keychain-secure-enclave")]
         {
             if super::secure_enclave::is_available()
-                && let Ok(home) = auths_home_with_config(config)
+                && let Ok(paths) = AuthsPaths::resolve_with_config(config, None)
             {
-                match super::secure_enclave::SecureEnclaveKeyStorage::new(&home) {
+                match super::secure_enclave::SecureEnclaveKeyStorage::new(&paths.home_dir) {
                     Ok(storage) => {
                         log::info!("Using Secure Enclave (Touch ID signing)");
                         return Ok(Box::new(storage));
@@ -671,12 +671,12 @@ fn get_backend_by_name(
         #[cfg(all(target_os = "macos", feature = "keychain-secure-enclave"))]
         "secure-enclave" => {
             info!("Using Secure Enclave backend (AUTHS_KEYCHAIN_BACKEND=secure-enclave)");
-            let home =
-                auths_home_with_config(config).map_err(|e| AgentError::BackendInitFailed {
+            let paths =
+                AuthsPaths::resolve_with_config(config, None).map_err(|e| AgentError::BackendInitFailed {
                     backend: "secure-enclave",
-                    error: format!("failed to resolve auths home: {e}"),
+                    error: format!("failed to resolve auths paths: {e}"),
                 })?;
-            let storage = super::secure_enclave::SecureEnclaveKeyStorage::new(&home)?;
+            let storage = super::secure_enclave::SecureEnclaveKeyStorage::new(&paths.home_dir)?;
             Ok(Box::new(storage))
         }
         _ => {
@@ -692,7 +692,7 @@ fn get_backend_by_name(
 /// Construct an `EncryptedFileStorage` from the provided config.
 ///
 /// Uses `config.keychain.file_path` when set; otherwise resolves the default
-/// path from `config.auths_home` (or `~/.auths/keys.enc`).
+/// path from `AuthsPaths::resolve_with_config`.
 /// Sets the password from `config.keychain.passphrase` when present.
 fn new_encrypted_file_storage(
     config: &EnvironmentConfig,
@@ -700,9 +700,9 @@ fn new_encrypted_file_storage(
     let storage = if let Some(ref path) = config.keychain.file_path {
         EncryptedFileStorage::with_path(path.clone())?
     } else {
-        let home =
-            auths_home_with_config(config).map_err(|e| AgentError::StorageError(e.to_string()))?;
-        EncryptedFileStorage::new(&home)?
+        let paths = AuthsPaths::resolve_with_config(config, None)
+            .map_err(|e: crate::paths::AuthsHomeError| AgentError::StorageError(e.to_string()))?;
+        EncryptedFileStorage::with_path(paths.keychain_file)?
     };
 
     if let Some(ref passphrase) = config.keychain.passphrase {
@@ -796,6 +796,22 @@ impl KeyStorage for Arc<dyn KeyStorage + Send + Sync> {
     fn is_hardware_backend(&self) -> bool {
         self.as_ref().is_hardware_backend()
     }
+    fn is_hardware_key(&self, alias: &KeyAlias) -> bool {
+        self.as_ref().is_hardware_key(alias)
+    }
+    fn rebind_identity(
+        &self,
+        alias: &KeyAlias,
+        identity_did: &IdentityDID,
+    ) -> Result<(), AgentError> {
+        self.as_ref().rebind_identity(alias, identity_did)
+    }
+    fn export_public_key(&self, alias: &KeyAlias) -> Result<Vec<u8>, AgentError> {
+        self.as_ref().export_public_key(alias)
+    }
+    fn sign_raw(&self, alias: &KeyAlias, message: &[u8]) -> Result<Vec<u8>, AgentError> {
+        self.as_ref().sign_raw(alias, message)
+    }
 }
 
 impl KeyStorage for Box<dyn KeyStorage + Send + Sync> {
@@ -841,6 +857,22 @@ impl KeyStorage for Box<dyn KeyStorage + Send + Sync> {
     fn is_hardware_backend(&self) -> bool {
         self.as_ref().is_hardware_backend()
     }
+    fn is_hardware_key(&self, alias: &KeyAlias) -> bool {
+        self.as_ref().is_hardware_key(alias)
+    }
+    fn rebind_identity(
+        &self,
+        alias: &KeyAlias,
+        identity_did: &IdentityDID,
+    ) -> Result<(), AgentError> {
+        self.as_ref().rebind_identity(alias, identity_did)
+    }
+    fn export_public_key(&self, alias: &KeyAlias) -> Result<Vec<u8>, AgentError> {
+        self.as_ref().export_public_key(alias)
+    }
+    fn sign_raw(&self, alias: &KeyAlias, message: &[u8]) -> Result<Vec<u8>, AgentError> {
+        self.as_ref().sign_raw(alias, message)
+    }
 }
 
 #[cfg(test)]
diff --git a/crates/auths-core/src/storage/secure_enclave.rs b/crates/auths-core/src/storage/secure_enclave.rs
index 3df98ad70..b8daea051 100644
--- a/crates/auths-core/src/storage/secure_enclave.rs
+++ b/crates/auths-core/src/storage/secure_enclave.rs
@@ -154,8 +154,11 @@ impl KeyStorage for SecureEnclaveKeyStorage {
         // a key the KEL already anchored — the delegation would "succeed" with
         // its private key lost.
         if !_encrypted_key_data.is_empty() {
-            // Ensure no leftover hardware handle file collides with this software key
+            // Ensure no leftover hardware handle file or cached handle collides with this software key
             let _ = fs::remove_file(self.handle_path(alias));
+            if let Ok(mut cache) = self.handle_cache.lock() {
+                cache.remove(alias.as_str());
+            }
             let path = self.swkey_path(alias);
             fs::write(&path, _encrypted_key_data).map_err(|e| {
                 AgentError::IO(std::io::Error::other(format!(
@@ -225,18 +228,23 @@ impl KeyStorage for SecureEnclaveKeyStorage {
     }
 
     fn load_key(&self, alias: &KeyAlias) -> Result<(IdentityDID, KeyRole, Vec<u8>), AgentError> {
-        // A software item (delegated/imported key) loads its encrypted blob; a
-        // hardware key loads its opaque handle. Handle wins if both exist.
-        let handle = if self.handle_path(alias).exists() {
-            self.load_handle(alias)?
-        } else {
+        // A software key (swkey_path) loads its passphrase-encrypted blob; a
+        // hardware key (handle_path) loads its opaque handle.
+        let handle = if self.swkey_path(alias).exists() {
             let sw = self.swkey_path(alias);
             fs::read(&sw).map_err(|e| {
                 AgentError::StorageError(format!(
-                    "SE key handle not found for '{}': {e}",
+                    "SE software key file read failed for '{}': {e}",
                     alias.as_str()
                 ))
             })?
+        } else if self.handle_path(alias).exists() {
+            self.load_handle(alias)?
+        } else {
+            return Err(AgentError::StorageError(format!(
+                "SE key not found for '{}'",
+                alias.as_str()
+            )));
         };
 
         // Read metadata. A key whose identity binding is missing must not load under a
@@ -347,15 +355,35 @@ impl KeyStorage for SecureEnclaveKeyStorage {
     }
 
     fn is_hardware_key(&self, alias: &KeyAlias) -> bool {
-        self.handle_path(alias).exists()
+        self.handle_path(alias).exists() && !self.swkey_path(alias).exists()
     }
 
     fn export_public_key(&self, alias: &KeyAlias) -> Result<Vec<u8>, AgentError> {
+        if !self.is_hardware_key(alias) {
+            let (_, _role, encrypted) = self.load_key(alias)?;
+            // Software key: for export_public_key without passphrase prompt,
+            // attempt decrypting with empty passphrase if stored unencrypted or
+            // load PKCS8 seed info.
+            use crate::crypto::signer::load_seed_and_pubkey;
+            if let Ok((_, pubkey, _)) = load_seed_and_pubkey(&encrypted) {
+                return Ok(pubkey);
+            }
+            return Err(AgentError::StorageError(format!(
+                "software key '{}' requires passphrase to derive public key",
+                alias.as_str()
+            )));
+        }
         let handle = self.load_handle(alias)?;
         public_key_from_handle(&handle)
     }
 
     fn sign_raw(&self, alias: &KeyAlias, message: &[u8]) -> Result<Vec<u8>, AgentError> {
+        if !self.is_hardware_key(alias) {
+            return Err(AgentError::StorageError(format!(
+                "software key '{}' requires passphrase provider for sign_with_alias",
+                alias.as_str()
+            )));
+        }
         let handle = self.load_handle(alias)?;
         sign_with_handle(&handle, message)
     }
@@ -452,3 +480,44 @@ pub fn sign_with_handle(handle: &[u8], message: &[u8]) -> Result<Vec<u8>, AgentE
     sig_buf.truncate(sig_len);
     Ok(sig_buf)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tempfile::TempDir;
+
+    #[test]
+    fn test_software_key_precedence_over_stale_hardware_handle() {
+        let temp = TempDir::new().unwrap();
+        let keys_dir = temp.path().join("se_keys");
+        fs::create_dir_all(&keys_dir).unwrap();
+
+        let storage = SecureEnclaveKeyStorage {
+            keys_dir: keys_dir.clone(),
+            handle_cache: Mutex::new(HashMap::new()),
+        };
+
+        let alias = KeyAlias::new_unchecked("main-device");
+        let did = IdentityDID::try_from("did:keri:test-did").unwrap();
+
+        // Write a stale .se handle file
+        fs::write(storage.handle_path(&alias), b"stale-se-handle").unwrap();
+
+        // Store a software key with non-empty encrypted data
+        let sw_data = b"encrypted-software-key-material";
+        storage
+            .store_key(&alias, &did, KeyRole::Primary, sw_data)
+            .unwrap();
+
+        // 1. is_hardware_key must be FALSE when .swkey exists
+        assert!(!storage.is_hardware_key(&alias));
+
+        // 2. load_key must return the software key material, not the stale handle
+        let (loaded_did, _role, loaded_data) = storage.load_key(&alias).unwrap();
+        assert_eq!(loaded_did, did);
+        assert_eq!(loaded_data, sw_data);
+
+        // 3. handle_path file must have been deleted by store_key
+        assert!(!storage.handle_path(&alias).exists());
+    }
+}
diff --git a/crates/auths-id/src/storage/layout.rs b/crates/auths-id/src/storage/layout.rs
index f4fffe06d..f709198d9 100644
--- a/crates/auths-id/src/storage/layout.rs
+++ b/crates/auths-id/src/storage/layout.rs
@@ -336,19 +336,17 @@ use crate::storage::registry::shard::sanitize_did;
 /// `~/.auths` work correctly (the shell does not expand tildes when they
 /// arrive via clap default values or programmatic callers).
 #[cfg(feature = "git-storage")]
-#[allow(clippy::disallowed_methods)] // INVARIANT: designated home-dir resolution for repo path
 pub fn resolve_repo_path(repo_arg: Option<PathBuf>) -> Result<PathBuf, StorageError> {
-    match repo_arg {
-        Some(pathbuf) if !pathbuf.as_os_str().is_empty() => {
-            auths_utils::path::expand_tilde(&pathbuf)
-                .map_err(|e| StorageError::NotFound(e.to_string()))
+    let expanded = repo_arg.and_then(|p| {
+        if p.as_os_str().is_empty() {
+            None
+        } else {
+            auths_utils::path::expand_tilde(&p).ok()
         }
-        _ => {
-            let home = dirs::home_dir()
-                .ok_or_else(|| StorageError::NotFound("Could not find HOME directory".into()))?;
-            Ok(home.join(TOOL_PATH))
-        }
-    }
+    });
+    auths_core::paths::AuthsPaths::resolve(expanded.as_deref())
+        .map(|p| p.registry_dir)
+        .map_err(|e| StorageError::NotFound(e.to_string()))
 }
 
 /// Creates a Git namespace prefix string for a given DID.
diff --git a/crates/auths-sdk/src/domains/agents/delegation.rs b/crates/auths-sdk/src/domains/agents/delegation.rs
index d34c90b38..a5849f297 100644
--- a/crates/auths-sdk/src/domains/agents/delegation.rs
+++ b/crates/auths-sdk/src/domains/agents/delegation.rs
@@ -108,9 +108,15 @@ pub fn add_scoped(
             .map_err(|e| AgentError::IdentityNotFound {
                 did: format!("identity load failed: {e}"),
             })?;
-    let root_prefix = parse_did_keri(managed.controller_did.as_str()).map_err(|e| {
+    let (parent_did, _, _) = ctx
+        .key_storage
+        .load_key(root_alias)
+        .map_err(|e| AgentError::IdentityNotFound {
+            did: format!("parent key alias '{}' load failed: {e}", root_alias.as_str()),
+        })?;
+    let root_prefix = parse_did_keri(parent_did.as_str()).map_err(|e| {
         AgentError::IdentityNotFound {
-            did: format!("invalid root did:keri: {e}"),
+            did: format!("invalid parent did:keri: {e}"),
         }
     })?;
     let (_pk, root_curve) = extract_public_key_bytes(
diff --git a/crates/auths-sdk/src/paths.rs b/crates/auths-sdk/src/paths.rs
index 9a27c125f..e15822683 100644
--- a/crates/auths-sdk/src/paths.rs
+++ b/crates/auths-sdk/src/paths.rs
@@ -2,28 +2,13 @@
 
 use std::path::PathBuf;
 
-use auths_core::paths::AuthsHomeError;
-
-pub use auths_core::paths::{auths_home, auths_home_with_config};
+pub use auths_core::paths::{auths_home, auths_home_with_config, AuthsHomeError, AuthsPaths};
 
 /// Resolve the registry (local storage) directory for a command, honoring an explicit `--repo` override.
 ///
-/// When `override_path` is `Some` (the user passed `--repo <dir>`), that directory is used verbatim, so
-/// the command's identity store and existing-identity check are scoped to it rather than silently
-/// falling back to the default `~/.auths`. When `None`, the default home is used.
-///
-/// Args:
-/// * `override_path`: the `--repo` override, if the user supplied one.
-///
-/// Usage:
-/// ```ignore
-/// let registry_path = resolve_registry_path(ctx.repo_path.clone())?;
-/// ```
+/// Delegates to `AuthsPaths::resolve(override_path.as_deref())`.
 pub fn resolve_registry_path(override_path: Option<PathBuf>) -> Result<PathBuf, AuthsHomeError> {
-    match override_path {
-        Some(p) => Ok(p),
-        None => auths_home(),
-    }
+    AuthsPaths::resolve(override_path.as_deref()).map(|p| p.registry_dir)
 }
 
 #[cfg(test)]
diff --git a/crates/auths-sdk/src/workflows/agent_provision.rs b/crates/auths-sdk/src/workflows/agent_provision.rs
index 243988980..43be87113 100644
--- a/crates/auths-sdk/src/workflows/agent_provision.rs
+++ b/crates/auths-sdk/src/workflows/agent_provision.rs
@@ -1,5 +1,5 @@
 #![allow(clippy::disallowed_types)]
-use std::fs::{self, Permissions};
+use std::fs;
 use std::os::unix::fs::PermissionsExt;
 use std::path::{Path, PathBuf};
 use std::process::Command;
@@ -105,7 +105,7 @@ pub fn provision_agent_machine(
 
     // Ensure destination directory exists with 0700 permissions
     fs::create_dir_all(&params.destination_dir)?;
-    fs::set_permissions(&params.destination_dir, Permissions::from_mode(0o700))?;
+    fs::set_permissions(&params.destination_dir, fs::Permissions::from_mode(0o700))?;
 
     // 2. Materialize agent machine registry in destination_dir/registry
     let registry_dir = params.destination_dir.join("registry");
@@ -115,7 +115,7 @@ pub fn provision_agent_machine(
     let keychain_path = params.destination_dir.join("keys.enc");
     let passphrase_path = params.destination_dir.join("passphrase.txt");
     fs::write(&passphrase_path, passphrase)?;
-    fs::set_permissions(&passphrase_path, Permissions::from_mode(0o600))?;
+    fs::set_permissions(&passphrase_path, fs::Permissions::from_mode(0o600))?;
 
     // Copy keys from main keychain to agent file-backend keys.enc
     let export_res = export_agent_keys_to_file_backend(ctx, &agent_alias, passphrase, &keychain_path);
@@ -140,7 +140,7 @@ export AUTHS_REPO="{repo}"
 export AUTHS_KEYCHAIN_BACKEND="file"
 export AUTHS_KEYCHAIN_FILE="{keychain}"
 export AUTHS_PASSPHRASE_FILE="{passphrase_file}"
-export AUTHS_PASSPHRASE="{passphrase}"
+export AUTHS_PASSPHRASE='{passphrase}'
 export AUTHS_SIGNING_KEY="auths:{label}"
 
 # Direct Git Native Signing Overrides (No file modifications to .git/config)
@@ -157,7 +157,7 @@ export GIT_CONFIG_KEY_2="user.signingkey"      export GIT_CONFIG_VALUE_2="auths:
         label = params.label
     );
     fs::write(&env_file_path, &env_script_content)?;
-    fs::set_permissions(&env_file_path, Permissions::from_mode(0o600))?;
+    fs::set_permissions(&env_file_path, fs::Permissions::from_mode(0o600))?;
 
     // 6. Generate executable wrapper helper bin/auths-agent
     let bin_dir = params.destination_dir.join("bin");
@@ -174,7 +174,7 @@ exec auths "$@"
         env_sh = env_file_path.display()
     );
     fs::write(&wrapper_path, &wrapper_content)?;
-    fs::set_permissions(&wrapper_path, Permissions::from_mode(0o755))?;
+    fs::set_permissions(&wrapper_path, fs::Permissions::from_mode(0o755))?;
 
     let expires_dt = expires_at.and_then(|ts| DateTime::from_timestamp(ts, 0));
 
diff --git a/crates/auths-sdk/tests/cases/agents.rs b/crates/auths-sdk/tests/cases/agents.rs
index 21d6cdb62..1f7f8ad7a 100644
--- a/crates/auths-sdk/tests/cases/agents.rs
+++ b/crates/auths-sdk/tests/cases/agents.rs
@@ -413,3 +413,43 @@ fn scoped_agent_with_empty_scope_is_allowed() {
     .expect("an empty scope is a valid (capability-less) delegation");
     assert!(agent.agent_did.starts_with("did:keri:"));
 }
+
+#[test]
+fn test_provision_agent_machine_under_delegated_device_key() {
+    let tmp = tempfile::TempDir::new().unwrap();
+    let reg_dir = tmp.path().join("registry");
+    let (root_alias, _keychain) = setup_test_identity(&reg_dir);
+
+    let ctx = build_test_context_with_provider(
+        &reg_dir,
+        Arc::new(_keychain),
+        Some(Arc::new(PrefilledPassphraseProvider::new(PASS)) as Arc<dyn PassphraseProvider + Send + Sync>),
+    );
+
+    let device_alias = KeyAlias::new_unchecked(format!("{}-device", root_alias.as_str()));
+    let dest_dir = tmp.path().join("agent-dest");
+
+    let params = auths_sdk::workflows::agent_provision::AgentProvisionParams {
+        label: "agent-machine-test".to_string(),
+        scopes: vec![],
+        expires_in_secs: None,
+        destination_dir: dest_dir.clone(),
+        profile: auths_sdk::workflows::agent_provision::AgentProfile::Assistant,
+    };
+
+    let now = chrono::Utc::now();
+    let res = auths_sdk::workflows::agent_provision::provision_agent_machine(
+        &ctx,
+        &device_alias,
+        &params,
+        PASS,
+        now,
+        &reg_dir,
+    )
+    .expect("provision_agent_machine under device key must succeed");
+
+    assert!(res.agent_did.starts_with("did:keri:"));
+    assert_eq!(res.label, "agent-machine-test");
+    assert!(dest_dir.join("keys.enc").exists());
+    assert!(dest_dir.join("env.sh").exists());
+}

From 74419747736d0143a5f9e21e276eada74f0c02ad Mon Sep 17 00:00:00 2001
From: bordumb <bordumbb@gmail.com>
Date: Thu, 23 Jul 2026 16:57:11 +0100
Subject: [PATCH 12/37] fix(core): forward is_hardware_key, rebind_identity,
 export_public_key, sign_raw in Arc and Box KeyStorage impls

Auths-Scope: sign_commit
Auths-Id: did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b
Auths-Device: did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6
Auths-Anchor-Seq: 1
---
 .auths/roots | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.auths/roots b/.auths/roots
index a8fc00e65..ad19d4e07 100644
--- a/.auths/roots
+++ b/.auths/roots
@@ -90,3 +90,6 @@ did:keri:ENuElbIUDJCnrvV5AVUYpaKh7qiS1FHP0D-UDbODfD3G
 did:keri:EGpSv1HWP1N23rS2LLII_dW1DivWLlqaEbCDHOCVCLK1
 did:keri:EB7KV8EgoWFm4_Mvaw3MieLoH5qI7OGLt4br6IMhqFjy
 did:keri:EPY4c6eTkMBYNpblT2WDSi4ZaYiX2Vp_INs9mC2Qt4la
+did:keri:EHU-kftF7oO_thZxY5nUwTG3yJXk9no1IPs3tOEzAQyf
+did:keri:EF6HpRXXJL56EYIm60vXbQ8jIHCwxYC1NF_2QN2mDAp_
+did:keri:EEtk6uK4eTSSMsHmoNNd7QWegwi8tADX9zCXz7Kqx7cu

From a3e28359b84c4f6c2544faa3d62717ae522a245a Mon Sep 17 00:00:00 2001
From: bordumb <bordumbb@gmail.com>
Date: Thu, 23 Jul 2026 17:01:53 +0100
Subject: [PATCH 13/37] test(core): add unit test for Arc and Box KeyStorage
 trait method forwarding

Auths-Scope: sign_commit
Auths-Id: did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b
Auths-Device: did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6
Auths-Anchor-Seq: 1
---
 claims/claim-cbe93daa3a36463c.json            |  2 +-
 crates/auths-cli/src/commands/sign.rs         | 10 +++-
 crates/auths-core/src/signing.rs              |  7 ++-
 crates/auths-core/src/storage/keychain.rs     | 55 +++++++++++++++++++
 .../auths-core/src/storage/secure_enclave.rs  |  3 +-
 .../src/domains/agents/delegation.rs          | 11 ++--
 .../src/workflows/agent_provision.rs          | 10 +++-
 7 files changed, 83 insertions(+), 15 deletions(-)

diff --git a/claims/claim-cbe93daa3a36463c.json b/claims/claim-cbe93daa3a36463c.json
index 091429bb8..ad8c80de5 100644
--- a/claims/claim-cbe93daa3a36463c.json
+++ b/claims/claim-cbe93daa3a36463c.json
@@ -25,4 +25,4 @@
   "railHint": "claim-only",
   "issued_by": "did:key:zDnaeSrJVhp4D1zdH8Yec1W4LuHpCBartmkNaUathniKQKWSu",
   "signature": "D9lkJLs9R1RH/6QGRBQ7qlfA9At5GZ/BJ/GjYUpVXtAMjomrTDFaW95h8pVWfQppHl0PY9xt/Ku43Q6I3PwH2A=="
-}
\ No newline at end of file
+}
diff --git a/crates/auths-cli/src/commands/sign.rs b/crates/auths-cli/src/commands/sign.rs
index 8fbeeeeda..052e3aa99 100644
--- a/crates/auths-cli/src/commands/sign.rs
+++ b/crates/auths-cli/src/commands/sign.rs
@@ -265,7 +265,12 @@ fn short_sha(sha: &str) -> &str {
 /// * `range` - A git ref or range (e.g., "HEAD", "main..HEAD").
 /// * `signer` - The resolved local signing identity (root + device DIDs).
 /// * `scope` - Capabilities this commit claims (emitted as an `Auths-Scope` trailer).
-fn sign_commit_range(range: &str, signer: &LocalSigner, scope: &[String], autostash: bool) -> Result<()> {
+fn sign_commit_range(
+    range: &str,
+    signer: &LocalSigner,
+    scope: &[String],
+    autostash: bool,
+) -> Result<()> {
     ensure_repo_root_pin(signer);
     validate_scope(scope)?;
 
@@ -274,7 +279,8 @@ fn sign_commit_range(range: &str, signer: &LocalSigner, scope: &[String], autost
         && let Ok(out) = crate::subprocess::git_command(&["status", "--porcelain"]).output()
         && !out.stdout.is_empty()
     {
-        let _ = crate::subprocess::git_command(&["stash", "push", "-m", "auths-autostash"]).output();
+        let _ =
+            crate::subprocess::git_command(&["stash", "push", "-m", "auths-autostash"]).output();
         stashed = true;
     }
 
diff --git a/crates/auths-core/src/signing.rs b/crates/auths-core/src/signing.rs
index 553ab58f2..cf511872b 100644
--- a/crates/auths-core/src/signing.rs
+++ b/crates/auths-core/src/signing.rs
@@ -275,7 +275,12 @@ impl<S: KeyStorage + Send + Sync + 'static> SecureSigner for StorageSigner<S> {
         passphrase_provider: &dyn PassphraseProvider,
         message: &[u8],
     ) -> Result<Vec<u8>, AgentError> {
-        let (sig, _pubkey, _curve) = crate::storage::keychain::sign_with_key(&self.storage, alias, passphrase_provider, message)?;
+        let (sig, _pubkey, _curve) = crate::storage::keychain::sign_with_key(
+            &self.storage,
+            alias,
+            passphrase_provider,
+            message,
+        )?;
         Ok(sig)
     }
 
diff --git a/crates/auths-core/src/storage/keychain.rs b/crates/auths-core/src/storage/keychain.rs
index 97b200c6b..a9ccb4c8c 100644
--- a/crates/auths-core/src/storage/keychain.rs
+++ b/crates/auths-core/src/storage/keychain.rs
@@ -796,6 +796,7 @@ impl KeyStorage for Arc<dyn KeyStorage + Send + Sync> {
     fn is_hardware_backend(&self) -> bool {
         self.as_ref().is_hardware_backend()
     }
+    // Forward to inner storage so backends like SecureEnclave can distinguish software vs hardware keys
     fn is_hardware_key(&self, alias: &KeyAlias) -> bool {
         self.as_ref().is_hardware_key(alias)
     }
@@ -857,6 +858,7 @@ impl KeyStorage for Box<dyn KeyStorage + Send + Sync> {
     fn is_hardware_backend(&self) -> bool {
         self.as_ref().is_hardware_backend()
     }
+    // Forward to inner storage so backends like SecureEnclave can distinguish software vs hardware keys
     fn is_hardware_key(&self, alias: &KeyAlias) -> bool {
         self.as_ref().is_hardware_key(alias)
     }
@@ -1064,4 +1066,57 @@ mod tests {
         assert_eq!(agents.len(), 1);
         assert_eq!(agents[0].as_str(), "deploy-agent");
     }
+
+    struct MockHardwareKeyStorage;
+    impl KeyStorage for MockHardwareKeyStorage {
+        fn store_key(
+            &self,
+            _: &KeyAlias,
+            _: &IdentityDID,
+            _: KeyRole,
+            _: &[u8],
+        ) -> Result<(), AgentError> {
+            Ok(())
+        }
+        fn load_key(&self, _: &KeyAlias) -> Result<(IdentityDID, KeyRole, Vec<u8>), AgentError> {
+            Err(AgentError::StorageError("not found".into()))
+        }
+        fn delete_key(&self, _: &KeyAlias) -> Result<(), AgentError> {
+            Ok(())
+        }
+        fn list_aliases(&self) -> Result<Vec<KeyAlias>, AgentError> {
+            Ok(vec![])
+        }
+        fn list_aliases_for_identity(&self, _: &IdentityDID) -> Result<Vec<KeyAlias>, AgentError> {
+            Ok(vec![])
+        }
+        fn get_identity_for_alias(&self, _: &KeyAlias) -> Result<IdentityDID, AgentError> {
+            Err(AgentError::StorageError("not found".into()))
+        }
+        fn backend_name(&self) -> &'static str {
+            "MockHardware"
+        }
+        fn is_hardware_backend(&self) -> bool {
+            true
+        }
+        fn is_hardware_key(&self, alias: &KeyAlias) -> bool {
+            // Returns false for software key aliases to simulate software/hardware key differentiation
+            alias.as_str() != "software-key"
+        }
+    }
+
+    #[test]
+    fn test_arc_and_box_forward_is_hardware_key() {
+        let mock = MockHardwareKeyStorage;
+        let hw_alias = KeyAlias::new_unchecked("hardware-key");
+        let sw_alias = KeyAlias::new_unchecked("software-key");
+
+        let arc_storage: Arc<dyn KeyStorage + Send + Sync> = Arc::new(mock);
+        assert!(arc_storage.is_hardware_key(&hw_alias));
+        assert!(!arc_storage.is_hardware_key(&sw_alias));
+
+        let box_storage: Box<dyn KeyStorage + Send + Sync> = Box::new(MockHardwareKeyStorage);
+        assert!(box_storage.is_hardware_key(&hw_alias));
+        assert!(!box_storage.is_hardware_key(&sw_alias));
+    }
 }
diff --git a/crates/auths-core/src/storage/secure_enclave.rs b/crates/auths-core/src/storage/secure_enclave.rs
index b8daea051..579329231 100644
--- a/crates/auths-core/src/storage/secure_enclave.rs
+++ b/crates/auths-core/src/storage/secure_enclave.rs
@@ -416,7 +416,8 @@ impl SecureSigner for SecureEnclaveKeyStorage {
         passphrase_provider: &dyn PassphraseProvider,
         message: &[u8],
     ) -> Result<Vec<u8>, AgentError> {
-        let (sig, _pubkey, _curve) = super::keychain::sign_with_key(self, alias, passphrase_provider, message)?;
+        let (sig, _pubkey, _curve) =
+            super::keychain::sign_with_key(self, alias, passphrase_provider, message)?;
         Ok(sig)
     }
 
diff --git a/crates/auths-sdk/src/domains/agents/delegation.rs b/crates/auths-sdk/src/domains/agents/delegation.rs
index a5849f297..09302d7db 100644
--- a/crates/auths-sdk/src/domains/agents/delegation.rs
+++ b/crates/auths-sdk/src/domains/agents/delegation.rs
@@ -23,9 +23,9 @@ use auths_keri::{AgentScope, Capability};
 use auths_verifier::core::SignerType;
 use auths_verifier::types::CanonicalDid;
 
-use crate::signing::PassphraseProvider;
 use crate::context::AuthsContext;
 use crate::domains::agents::error::AgentError;
+use crate::signing::PassphraseProvider;
 
 /// Result of adding a delegated agent.
 #[derive(Debug, Clone)]
@@ -370,12 +370,9 @@ pub fn record_delegation_attestation_with_provider(
     agent_did: &IdentityDID,
     expires_at: Option<i64>,
 ) -> Result<(), AgentError> {
-    let (agent_pk, agent_pk_curve) = extract_public_key_bytes(
-        ctx.key_storage.as_ref(),
-        agent_alias,
-        passphrase_provider,
-    )
-    .map_err(AgentError::CryptoError)?;
+    let (agent_pk, agent_pk_curve) =
+        extract_public_key_bytes(ctx.key_storage.as_ref(), agent_alias, passphrase_provider)
+            .map_err(AgentError::CryptoError)?;
     let now = ctx.clock.now();
     let meta = AttestationMetadata {
         timestamp: Some(now),
diff --git a/crates/auths-sdk/src/workflows/agent_provision.rs b/crates/auths-sdk/src/workflows/agent_provision.rs
index 43be87113..80dc9e64d 100644
--- a/crates/auths-sdk/src/workflows/agent_provision.rs
+++ b/crates/auths-sdk/src/workflows/agent_provision.rs
@@ -4,11 +4,11 @@ use std::os::unix::fs::PermissionsExt;
 use std::path::{Path, PathBuf};
 use std::process::Command;
 
+use crate::context::AuthsContext;
 use anyhow::{Context, Result, anyhow};
 use auths_core::storage::keychain::KeyAlias;
 use auths_crypto::CurveType;
 use auths_keri::Capability;
-use crate::context::AuthsContext;
 use chrono::{DateTime, Utc};
 use serde::{Deserialize, Serialize};
 
@@ -28,7 +28,10 @@ impl std::str::FromStr for AgentProfile {
         match s.to_lowercase().as_str() {
             "ci" => Ok(AgentProfile::Ci),
             "assistant" => Ok(AgentProfile::Assistant),
-            _ => Err(anyhow!("Invalid agent profile '{}': expected 'ci' or 'assistant'", s)),
+            _ => Err(anyhow!(
+                "Invalid agent profile '{}': expected 'ci' or 'assistant'",
+                s
+            )),
         }
     }
 }
@@ -118,7 +121,8 @@ pub fn provision_agent_machine(
     fs::set_permissions(&passphrase_path, fs::Permissions::from_mode(0o600))?;
 
     // Copy keys from main keychain to agent file-backend keys.enc
-    let export_res = export_agent_keys_to_file_backend(ctx, &agent_alias, passphrase, &keychain_path);
+    let export_res =
+        export_agent_keys_to_file_backend(ctx, &agent_alias, passphrase, &keychain_path);
 
     // Clean up temporary staging keys from root key storage so root storage stays clean
     let next_alias = KeyAlias::new_unchecked(format!("{}--next-0", agent_alias.as_str()));

From 18b1d2854e503f1440c748e5b63f02583b8b9c49 Mon Sep 17 00:00:00 2001
From: bordumb <bordumbb@gmail.com>
Date: Thu, 23 Jul 2026 18:16:26 +0100
Subject: [PATCH 14/37] fix(sdk): replace cp -R with pure Rust copy_dir_clean
 to filter sockets

Auths-Scope: sign_commit
Auths-Id: did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b
Auths-Device: did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6
Auths-Anchor-Seq: 1
---
 .auths/roots                                  |  3 ++
 .../src/workflows/agent_provision.rs          | 36 ++++++++++++++-----
 packages/auths-python/Cargo.lock              |  1 +
 3 files changed, 31 insertions(+), 9 deletions(-)

diff --git a/.auths/roots b/.auths/roots
index ad19d4e07..0cc7c5bc8 100644
--- a/.auths/roots
+++ b/.auths/roots
@@ -93,3 +93,6 @@ did:keri:EPY4c6eTkMBYNpblT2WDSi4ZaYiX2Vp_INs9mC2Qt4la
 did:keri:EHU-kftF7oO_thZxY5nUwTG3yJXk9no1IPs3tOEzAQyf
 did:keri:EF6HpRXXJL56EYIm60vXbQ8jIHCwxYC1NF_2QN2mDAp_
 did:keri:EEtk6uK4eTSSMsHmoNNd7QWegwi8tADX9zCXz7Kqx7cu
+did:keri:EAHC2YuN3eobxRJMlp0CE4OexNc98xGVE2w4-D9kH3s6
+did:keri:EN5Tl5fsEeh_8TrjHKD0zgH6tEIxPMTfHr59syYo_WiC
+did:keri:EF8gz7nH5YYFZbiOjuyMYgAXTyf2kiTe9ObN41tmuhxd
diff --git a/crates/auths-sdk/src/workflows/agent_provision.rs b/crates/auths-sdk/src/workflows/agent_provision.rs
index 80dc9e64d..c316258f9 100644
--- a/crates/auths-sdk/src/workflows/agent_provision.rs
+++ b/crates/auths-sdk/src/workflows/agent_provision.rs
@@ -207,17 +207,9 @@ pub fn materialize_agent_machine_registry(
         fs::remove_dir_all(agent_registry)?;
     }
 
-    let status = Command::new("cp")
-        .arg("-R")
-        .arg(root_repo)
-        .arg(agent_registry)
-        .status()
+    copy_dir_clean(root_repo, agent_registry)
         .context("failed to copy registry repository")?;
 
-    if !status.success() {
-        anyhow::bail!("cp -R failed when materializing agent machine registry");
-    }
-
     let git_dir = agent_registry.join(".git");
     if git_dir.exists() {
         let gd = git_dir.to_string_lossy().to_string();
@@ -254,6 +246,32 @@ pub fn materialize_agent_machine_registry(
     Ok(())
 }
 
+/// Recursively copies a directory tree, skipping Unix domain sockets, FIFOs, and special IPC handles.
+fn copy_dir_clean(src: &Path, dst: &Path) -> Result<()> {
+    fs::create_dir_all(dst).with_context(|| format!("failed to create directory {}", dst.display()))?;
+    for entry_res in fs::read_dir(src).with_context(|| format!("failed to read directory {}", src.display()))? {
+        let entry = entry_res?;
+        let file_type = entry.file_type()?;
+
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::FileTypeExt;
+            if file_type.is_socket() || file_type.is_fifo() {
+                continue;
+            }
+        }
+
+        let dst_path = dst.join(entry.file_name());
+        if file_type.is_dir() {
+            copy_dir_clean(&entry.path(), &dst_path)?;
+        } else if file_type.is_file() || file_type.is_symlink() {
+            fs::copy(entry.path(), &dst_path)
+                .with_context(|| format!("failed to copy file {}", entry.path().display()))?;
+        }
+    }
+    Ok(())
+}
+
 fn export_agent_keys_to_file_backend(
     ctx: &AuthsContext,
     agent_alias: &KeyAlias,
diff --git a/packages/auths-python/Cargo.lock b/packages/auths-python/Cargo.lock
index cb6b941f9..ce0e965ba 100644
--- a/packages/auths-python/Cargo.lock
+++ b/packages/auths-python/Cargo.lock
@@ -484,6 +484,7 @@ dependencies = [
 name = "auths-sdk"
 version = "0.1.16"
 dependencies = [
+ "anyhow",
  "async-trait",
  "auths-anchor",
  "auths-core",

From b9f30b1803ca2316bc17d8ef64efddd90b7759e6 Mon Sep 17 00:00:00 2001
From: bordumb <bordumbb@gmail.com>
Date: Thu, 23 Jul 2026 18:24:35 +0100
Subject: [PATCH 15/37] fix(e2e): isolate test_agent_provisioning working
 directory to tmp_path and clean .auths/roots

Auths-Scope: sign_commit
Auths-Id: did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b
Auths-Device: did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6
Auths-Anchor-Seq: 1
---
 .auths/roots                         | 73 ----------------------------
 tests/e2e/test_agent_provisioning.py |  9 +++-
 2 files changed, 8 insertions(+), 74 deletions(-)

diff --git a/.auths/roots b/.auths/roots
index 0cc7c5bc8..26cc6d3d4 100644
--- a/.auths/roots
+++ b/.auths/roots
@@ -23,76 +23,3 @@ did:keri:EPsk0PCEQpa3ALIG1Oyiuxg8UfLbgma4QV16I-O6TnOc
 did:keri:EAZG0HqAzbydr1iAbnEPUhVC_IuB6vZXYBJagVXS2k9a
 did:keri:EKh1onK1bubyaWxHIWzr_yeOAtBm36ZGn0AXDYsBhrsq
 did:keri:EPmp6Nav8Z-_prJg0EShHnB396yJJtXmBr6hG647PxwJ
-did:keri:EE5atQLEkKyy1GnkFY1xYdVM8qwRLNzOSVdVzosLbiIv
-did:keri:EExNah2mq91GJdODsZXPJ9w9QWdeewmXdxfro_Bg7be-
-did:keri:EOXtlYDnHMmI_hQlPu0V5prWC4xE05QwvOTeTYYrB5X4
-did:keri:EJTqvxp1bDvOF96co7cqdgC98ydppt_6bUDbVshg7Z1k
-did:keri:EGe5II_9JpsGJzmwNTRDKuDC4owoe7PIpkwWUNXR_9Lu
-did:keri:EEKYb-wilgjXY95DYQaaxeCpVETNsjU9VCgYoCnYs0p1
-did:keri:EGGPusyETlYzKsQA92qzCSLfUz2leOnV7zNDSCEqgZdR
-did:keri:EFnoV44-J0ywYJeVRMyC74ceVVnHu7BjvN5km5wiR8yS
-did:keri:EHQBqXFfzbftCTDzALeNVqRckBxx46_yk8BV6b378Noe
-did:keri:EPahOppzqRKLiscwDyZ8IpsqBfQgdr1uBFznKBuPmxQx
-did:keri:ECIKOYuc1H2Y4ecmmrKmluxXqzZp5BD612cH_7OQ5Teq
-did:keri:ENwwu0osm6SiWct18FUST9MNvN7appkG1_AyD2J7552u
-did:keri:EDRFqbywXlZ59qGFHnl4B9y9HwIFcm4nn1rrfonM-fvh
-did:keri:EEbozruIICYaKs1IoLLinfA8N2Bwfd8GcUdKAWmzY5rD
-did:keri:EG98ah4_D4-wXbI9Ft4ZozcItkvfzimsVnIZvBwhcdRK
-did:keri:ENuHgcpsPerQZWSQpXFjQvUiigaDpugBg5nIhapwtV3z
-did:keri:EBLnKq9BHLTcV8hEDxC_Te2GNJtqiuwlsX4q2IQvLeg_
-did:keri:EANpaVmKBvSSmnstoZs5WqhHAbdRCYN_FRm1PVRi7wY7
-did:keri:EDO92vr-PU1HNhZIDvz2tEwzd0xDbzPN3kWPzbTATdsb
-did:keri:EKwff-SOXzEQi8sIaovIjLWhyUGo3ZSFxzD7vL-SjApj
-did:keri:ENNCiXa2kgw9A5CtyBtC2IJe0MGFLkg4P-Gx94Jao828
-did:keri:EARstBIdgmQ5pqv_d9q0tp8kBv8c28EOr2QDbBy1sIkr
-did:keri:EKGD7mJpPQBVxTk_4Vhjp03TldarLE05N3lbbSNGiaT2
-did:keri:EKI5mPuKaI0XrjvfBZNsqqbWqu7KsAzeFrvDXqhqkDFR
-did:keri:EB-tLZ-egZ3njzuiAiyk0s8BRgApJOlA4blsOQrGyBAQ
-did:keri:EG9IvTUjq-duwdU8GieIS2Ok-rjN-XsjjOOTr8PJJgBm
-did:keri:EKLHtTSixyVelolAzqDsd2vGW91B_OiLIagWHq2qPszD
-did:keri:EI5FKVNhgtr03vhdGIlmB4tCkUftsekKCLSO1MA27Vg0
-did:keri:EEMNJX1Q2ispjPP3JX5V52OeHeHcraSneeL0OgUl1DHi
-did:keri:EIZcLBvnz6M1eeVracxLANLEBm-VUPAqXHs8q9quxCXh
-did:keri:EMvTUg93H5MiOtR707DULExzLmqyZfajUiZfZQ49hW42
-did:keri:EKBem7qpHuT2xv6oHPh39x9l2YKRAQAB3FLcE73Dg3Dz
-did:keri:EMwol0DhyRMxRiuS126ubkBBRRiwozQYqUxJCxkBcMc1
-did:keri:EKeDN2J3g6wA8mMM0-GLovrd2gc1kZmzScToj90M8t6i
-did:keri:EC3GVxNtU8xW07h2y50wddhUICEQmiMMpUyfWbCCLE3y
-did:keri:ECDfCfwHlyVg_3iXIi4bZW4AlOiQG3VrFQbQ85LM0h_W
-did:keri:EASYEp5X9etjJSTN64E2ODpEZrM1ei8gNkQiudE10Wh9
-did:keri:ENX4hMLPT_idVRWpAs_URw-eLyDL5YrPfrEyLdosyju_
-did:keri:EOT7Yz9SiYiAFkYwv58MWQIhTCwe7Q6efENqj24S8kQI
-did:keri:EF4PMaOZQMOsi2DgkLtMdYGK-lZkk0IFQZ6BAqi1ofZ2
-did:keri:EA5zTD3zYXJD8lFN74Zg6yR3ZIYV8G41m_Y9edO2x2jU
-did:keri:EBmrwhOcA-vwS0gqvphIbdiUWE3kuqjUzglfhQqJqIgP
-did:keri:EOaOG0s_2K11dDyru_bgrhvKJIpr2gPYuwlCSOTW-83d
-did:keri:ENnP7oy-s6_gxu0MphMRiEN9s31GIwcRkFlejDGQVUYY
-did:keri:EJVbhiX-rdXvtMAlmCkbWzB0zKyEeuvTCJMLKADyvMHk
-did:keri:EL1-mnZ7asIrfG0WiPJJAhk0XqBkFZ9YqPRfFbjfAfkW
-did:keri:ELb6KgZzM742NJEgS3e6b20iQ82Fe2FZ9Krj4SDZORWv
-did:keri:ELafDKRkYC1qaeXnPUUud6X8hPXUB7K66_DQHpOU5WU9
-did:keri:EPs_ZPfa5WvIEFOnBDY0Xz5SL6hMw04IH1_zYswIxZvn
-did:keri:EJc_d4j3KpN5eVoS6Y1GsGelC1lQWi-h8Hzq0Cc6uKT1
-did:keri:EIZ7WA2Cr4q0Zfo_0zEoGIbCQEUQyLzaT-TPZw9GYrm4
-did:keri:EGnmlkwufXpZlsMAwvMkQ7ToG4Nn-c54U6e0Wqjzls6T
-did:keri:EHAUHQbA230P-qIbTYqLtHUbHlu19YbSwnMxGeTb_r7Z
-did:keri:EIwmSKXiy_GHWbIMdo1tfdJ-m4BLy6CXhp092BRLt_gS
-did:keri:EHqnlQGs4KafK2mbJQva2qGjVL1Dh7eOI1zBh-Y0U3Ez
-did:keri:EFfUQu2DaVL9sk24FHvnqcMVrh6MRdZc0J44ZXfglFgJ
-did:keri:EA4HimjDao06wfs1z9lGBmOzfZeeEkGtSlQcXRBwSdpd
-did:keri:EHit5IlX6QKBw0o5pVDPceY1xexnuzCKvJNKa7l5bdLi
-did:keri:ECwcEkpmVrenOg5fmgUMlCXwNzgGzwq7BxvVr-9esyCE
-did:keri:EJFm7RVnrEPOJaUpTChHxwK1gQwQ6yOHsdcsTLEutmfe
-did:keri:EJVsMmUtMzggZed2EmSoJLcn6EUHbLtYXjBeZ3NhIqoY
-did:keri:EBc_lGm9VVHXwjSEjKHWnFIbALIcVAISYLv5mbGhHFdS
-did:keri:EPbcMhv2TMdqZl6FnbYTpAffGhxJy9o2M-9I_jxXGBDC
-did:keri:ENuElbIUDJCnrvV5AVUYpaKh7qiS1FHP0D-UDbODfD3G
-did:keri:EGpSv1HWP1N23rS2LLII_dW1DivWLlqaEbCDHOCVCLK1
-did:keri:EB7KV8EgoWFm4_Mvaw3MieLoH5qI7OGLt4br6IMhqFjy
-did:keri:EPY4c6eTkMBYNpblT2WDSi4ZaYiX2Vp_INs9mC2Qt4la
-did:keri:EHU-kftF7oO_thZxY5nUwTG3yJXk9no1IPs3tOEzAQyf
-did:keri:EF6HpRXXJL56EYIm60vXbQ8jIHCwxYC1NF_2QN2mDAp_
-did:keri:EEtk6uK4eTSSMsHmoNNd7QWegwi8tADX9zCXz7Kqx7cu
-did:keri:EAHC2YuN3eobxRJMlp0CE4OexNc98xGVE2w4-D9kH3s6
-did:keri:EN5Tl5fsEeh_8TrjHKD0zgH6tEIxPMTfHr59syYo_WiC
-did:keri:EF8gz7nH5YYFZbiOjuyMYgAXTyf2kiTe9ObN41tmuhxd
diff --git a/tests/e2e/test_agent_provisioning.py b/tests/e2e/test_agent_provisioning.py
index e0b45e9c6..aed9e110b 100644
--- a/tests/e2e/test_agent_provisioning.py
+++ b/tests/e2e/test_agent_provisioning.py
@@ -15,6 +15,7 @@ def test_agent_provision_manual_flags(auths_bin, isolated_env, tmp_path):
     init_res = run_auths(
         auths_bin,
         ["init", "--profile", "developer", "--non-interactive"],
+        cwd=tmp_path,
         env=isolated_env,
     )
     assert init_res.returncode == 0, f"Init failed: {init_res.stderr}"
@@ -40,6 +41,7 @@ def test_agent_provision_manual_flags(auths_bin, isolated_env, tmp_path):
             "--passphrase-file",
             str(passphrase_file),
         ],
+        cwd=tmp_path,
         env=isolated_env,
     )
     assert prov_res.returncode == 0, f"Provisioning failed: {prov_res.stderr}\n{prov_res.stdout}"
@@ -52,7 +54,7 @@ def test_agent_provision_manual_flags(auths_bin, isolated_env, tmp_path):
     assert (out_dir / "bin" / "auths-agent").exists()
 
     # 4. Verify agent list output
-    list_res = run_auths(auths_bin, ["agent", "list"], env=isolated_env)
+    list_res = run_auths(auths_bin, ["agent", "list"], cwd=tmp_path, env=isolated_env)
     assert list_res.returncode == 0
     assert "agent-builder" in list_res.stdout or "did:keri:" in list_res.stdout
 
@@ -66,6 +68,7 @@ def test_agent_provision_custom_backend(auths_bin, isolated_env, tmp_path):
     init_res = run_auths(
         auths_bin,
         ["init", "--profile", "developer", "--non-interactive"],
+        cwd=tmp_path,
         env=env,
     )
     assert init_res.returncode == 0, f"Init failed: {init_res.stderr}"
@@ -90,6 +93,7 @@ def test_agent_provision_custom_backend(auths_bin, isolated_env, tmp_path):
             "--passphrase-file",
             str(passphrase_file),
         ],
+        cwd=tmp_path,
         env=env,
     )
     assert prov_res.returncode == 0, f"Provisioning failed: {prov_res.stderr}\n{prov_res.stdout}"
@@ -101,6 +105,7 @@ def test_agent_provision_recursive_subagent(auths_bin, isolated_env, tmp_path):
     init_res = run_auths(
         auths_bin,
         ["init", "--profile", "developer", "--non-interactive"],
+        cwd=tmp_path,
         env=isolated_env,
     )
     assert init_res.returncode == 0
@@ -126,6 +131,7 @@ def test_agent_provision_recursive_subagent(auths_bin, isolated_env, tmp_path):
             "--passphrase-file",
             str(passphrase_file),
         ],
+        cwd=tmp_path,
         env=isolated_env,
     )
     assert prov_res.returncode == 0
@@ -157,6 +163,7 @@ def test_agent_provision_recursive_subagent(auths_bin, isolated_env, tmp_path):
             "--passphrase-file",
             str(sub_pass_file),
         ],
+        cwd=tmp_path,
         capture_output=True,
         text=True,
         env=sub_env,

From f13a33df56366ec798eda966a2da62b0bb7b1784 Mon Sep 17 00:00:00 2001
From: bordumb <bordumbb@gmail.com>
Date: Thu, 23 Jul 2026 18:27:36 +0100
Subject: [PATCH 16/37] test(cli): add comprehensive unit tests for
 handle_provision_cmd

Auths-Scope: sign_commit
Auths-Id: did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b
Auths-Device: did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6
Auths-Anchor-Seq: 1
---
 crates/auths-cli/src/commands/agent/mod.rs | 103 +++++++++++++++++++++
 1 file changed, 103 insertions(+)

diff --git a/crates/auths-cli/src/commands/agent/mod.rs b/crates/auths-cli/src/commands/agent/mod.rs
index 1c2a47f3e..8d0f54a58 100644
--- a/crates/auths-cli/src/commands/agent/mod.rs
+++ b/crates/auths-cli/src/commands/agent/mod.rs
@@ -1048,4 +1048,107 @@ mod tests {
         assert_eq!(parse_timeout("2h").unwrap(), Duration::from_secs(7200));
         assert_eq!(parse_timeout("30").unwrap(), Duration::from_secs(1800));
     }
+
+    #[test]
+    fn test_handle_provision_cmd_invalid_profile() {
+        let temp_dir = tempfile::tempdir().unwrap();
+        let repo_path = temp_dir.path().join("repo");
+        std::fs::create_dir_all(&repo_path).unwrap();
+
+        let res = handle_provision_cmd(
+            Some("test-agent".to_string()),
+            Some("main".to_string()),
+            vec![],
+            None,
+            Some(temp_dir.path().join("agent-out")),
+            Some("invalid-profile-name".to_string()),
+            None,
+            Some(repo_path),
+        );
+
+        assert!(res.is_err());
+        let err_msg = res.unwrap_err().to_string();
+        assert!(err_msg.contains("invalid") || err_msg.contains("profile") || err_msg.contains("Unknown"));
+    }
+
+    #[test]
+    fn test_handle_provision_cmd_missing_passphrase_file() {
+        let temp_dir = tempfile::tempdir().unwrap();
+        let repo_path = temp_dir.path().join("repo");
+        std::fs::create_dir_all(&repo_path).unwrap();
+
+        let missing_pass_file = temp_dir.path().join("nonexistent_passphrase.txt");
+
+        let res = handle_provision_cmd(
+            Some("test-agent".to_string()),
+            Some("main".to_string()),
+            vec![],
+            None,
+            Some(temp_dir.path().join("agent-out")),
+            Some("assistant".to_string()),
+            Some(missing_pass_file),
+            Some(repo_path),
+        );
+
+        assert!(res.is_err());
+        let err_msg = res.unwrap_err().to_string();
+        assert!(err_msg.contains("Failed to read passphrase file"));
+    }
+
+    #[test]
+    fn test_handle_provision_cmd_missing_parent_key() {
+        let temp_dir = tempfile::tempdir().unwrap();
+        let repo_path = temp_dir.path().join("repo");
+        std::fs::create_dir_all(&repo_path).unwrap();
+
+        let pass_file = temp_dir.path().join("pass.txt");
+        std::fs::write(&pass_file, "TestPassphrase123!").unwrap();
+
+        let res = handle_provision_cmd(
+            Some("test-agent".to_string()),
+            Some("nonexistent_key_alias".to_string()),
+            vec![],
+            None,
+            Some(temp_dir.path().join("agent-out")),
+            Some("assistant".to_string()),
+            Some(pass_file),
+            Some(repo_path),
+        );
+
+        assert!(res.is_err());
+    }
+
+    #[test]
+    fn test_handle_provision_cmd_capabilities_parsing_and_error_handling() {
+        let temp_dir = tempfile::tempdir().unwrap();
+        let repo_path = temp_dir.path().join("repo");
+        let auths_home = temp_dir.path().join(".auths");
+        std::fs::create_dir_all(&repo_path).unwrap();
+        std::fs::create_dir_all(&auths_home).unwrap();
+
+        unsafe {
+            std::env::set_var("AUTHS_HOME", &auths_home);
+            std::env::set_var("AUTHS_KEYCHAIN_BACKEND", "file");
+            std::env::set_var("AUTHS_KEYCHAIN_FILE", auths_home.join("keys.enc"));
+            std::env::set_var("AUTHS_PASSPHRASE", "RootTestPassphrase!123");
+        }
+
+        let cap: auths_keri::Capability = "sign_commit".parse().unwrap();
+        let pass_file = temp_dir.path().join("agent_pass.txt");
+        std::fs::write(&pass_file, "AgentPassphrase123!").unwrap();
+        let out_dir = temp_dir.path().join("agent-out");
+
+        let res = handle_provision_cmd(
+            Some("test-agent".to_string()),
+            Some("main".to_string()),
+            vec![cap],
+            Some(86400),
+            Some(out_dir),
+            Some("assistant".to_string()),
+            Some(pass_file),
+            Some(auths_home),
+        );
+
+        assert!(res.is_err());
+    }
 }

From d2e13a8be9280e0cbe05ac43dbf3c8e4600ec61f Mon Sep 17 00:00:00 2001
From: bordumb <bordumbb@gmail.com>
Date: Thu, 23 Jul 2026 20:09:00 +0100
Subject: [PATCH 17/37] fix(cli,sdk): resolve AUTHS_REPO and AUTHS_SIGNING_KEY
 for agent commit signing and verification

Auths-Scope: sign_commit
Auths-Id: did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b
Auths-Device: did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6
Auths-Anchor-Seq: 1
---
 crates/auths-cli/src/commands/sign.rs         |  2 +-
 .../auths-cli/src/commands/verify_commit.rs   | 41 ++++++++++++-------
 crates/auths-cli/src/errors/registry.rs       |  2 +-
 .../auths-sdk/src/domains/identity/local.rs   | 39 ++++++++++++++++++
 .../src/workflows/agent_provision.rs          | 19 +++++----
 .../auths-sdk/src/workflows/commit_hooks.rs   |  2 +-
 docs/errors/AUTHS-E4203.md                    |  2 +-
 7 files changed, 81 insertions(+), 26 deletions(-)

diff --git a/crates/auths-cli/src/commands/sign.rs b/crates/auths-cli/src/commands/sign.rs
index 052e3aa99..c9c296a08 100644
--- a/crates/auths-cli/src/commands/sign.rs
+++ b/crates/auths-cli/src/commands/sign.rs
@@ -142,7 +142,7 @@ fn execute_git_rebase(base: &str, trailers: &[String]) -> Result<()> {
     // Auths-* trailer replaces it in place rather than appending a second copy, so
     // a re-signed commit (the recovery rewrite) keeps exactly one trailer per token.
     let exec_cmd = format!(
-        "git -c trailer.ifexists=replace commit --amend --no-edit --no-verify{trailer_flags}"
+        "git -c trailer.ifexists=replace commit --amend -C HEAD --no-verify{trailer_flags}"
     );
     let output = crate::subprocess::git_command(&["rebase", "--exec", &exec_cmd, base])
         .output()
diff --git a/crates/auths-cli/src/commands/verify_commit.rs b/crates/auths-cli/src/commands/verify_commit.rs
index 0d53e601d..1fbe35e56 100644
--- a/crates/auths-cli/src/commands/verify_commit.rs
+++ b/crates/auths-cli/src/commands/verify_commit.rs
@@ -436,19 +436,29 @@ async fn resolve_signer_kel(
     bundle_kels: &[BundleKel],
     did: &str,
 ) -> Result<Vec<Event>, String> {
-    // Stateless first: a bundle that carries the signer's KEL (the root's or a
-    // delegated device's) satisfies resolution without any identity store (CI
-    // runners). Prefix binding is still enforced, so a tampered bundle cannot
-    // smuggle a foreign KEL.
-    if let Some(bundle) = bundle_kels.iter().find(|b| b.did == did) {
-        let prefix = auths_sdk::keri::parse_did_keri(did).map_err(|e| e.to_string())?;
-        auths_sdk::keri::verify_prefix_binding(&prefix, &bundle.events)
-            .map_err(|e| e.to_string())?;
-        return Ok(bundle.events.clone());
+    let local_res = auths_sdk::keri::KelResolverChain::local(registry).resolve_kel(did);
+    let bundle_opt = bundle_kels.iter().find(|b| b.did == did);
+
+    match (local_res, bundle_opt) {
+        (Ok(local_events), Some(bundle)) => {
+            let prefix = auths_sdk::keri::parse_did_keri(did).map_err(|e| e.to_string())?;
+            auths_sdk::keri::verify_prefix_binding(&prefix, &bundle.events)
+                .map_err(|e| e.to_string())?;
+            if local_events.len() >= bundle.events.len() {
+                Ok(local_events)
+            } else {
+                Ok(bundle.events.clone())
+            }
+        }
+        (Ok(local_events), None) => Ok(local_events),
+        (Err(_), Some(bundle)) => {
+            let prefix = auths_sdk::keri::parse_did_keri(did).map_err(|e| e.to_string())?;
+            auths_sdk::keri::verify_prefix_binding(&prefix, &bundle.events)
+                .map_err(|e| e.to_string())?;
+            Ok(bundle.events.clone())
+        }
+        (Err(e), None) => Err(e.to_string()),
     }
-    auths_sdk::keri::KelResolverChain::local(registry)
-        .resolve_kel(did)
-        .map_err(|e| e.to_string())
 }
 
 /// Verify a single commit against the replayed KEL.
@@ -712,9 +722,10 @@ pub(crate) async fn commit_trusted_via_bundle(
             .map(|(did, events)| BundleKel { did, events }),
     );
 
-    let auths_home = auths_sdk::paths::auths_home().map_err(|e| e.to_string())?;
+    let repo_path =
+        auths_sdk::storage_layout::resolve_repo_path(None).map_err(|e| e.to_string())?;
     let registry =
-        GitRegistryBackend::from_config_unchecked(RegistryConfig::single_tenant(&auths_home));
+        GitRegistryBackend::from_config_unchecked(RegistryConfig::single_tenant(&repo_path));
     let device_kel = resolve_signer_kel(&registry, &bundle_kels, &device_did)
         .await
         .map_err(|e| format!("device KEL for {device_did} could not be resolved: {e}"))?;
@@ -727,7 +738,7 @@ pub(crate) async fn commit_trusted_via_bundle(
         .map_err(|e| format!("root KEL for {root_did} could not be resolved: {e}"))?;
 
     let provider = auths_crypto::RingCryptoProvider;
-    let receipt_lookup = GitWitnessReceiptLookup::new(&auths_home);
+    let receipt_lookup = GitWitnessReceiptLookup::new(&repo_path);
     let witnessed = verify_commit_against_kel_witnessed_scoped(
         raw_commit.as_bytes(),
         &device_kel,
diff --git a/crates/auths-cli/src/errors/registry.rs b/crates/auths-cli/src/errors/registry.rs
index 2d76a3567..a5029eab2 100644
--- a/crates/auths-cli/src/errors/registry.rs
+++ b/crates/auths-cli/src/errors/registry.rs
@@ -224,7 +224,7 @@ pub fn explain(code: &str) -> Option<&'static str> {
         // --- auths-id (InitError) ---
         "AUTHS-E4201" => Some("# AUTHS-E4201\n\n**Crate:** `auths-id`\n\n**Type:** `InitError::Git`\n\n## Message\n\n_(transparent — see inner error)_\n\n## Suggestion\n\nCheck that the Git repository is accessible\n"),
         "AUTHS-E4202" => Some("# AUTHS-E4202\n\n**Crate:** `auths-id`\n\n**Type:** `InitError::Keri`\n\n## Message\n\nKERI operation failed: {0}\n\n## Suggestion\n\nKERI event processing failed; check identity state\n"),
-        "AUTHS-E4203" => Some("# AUTHS-E4203\n\n**Crate:** `auths-id`\n\n**Type:** `InitError::Key`\n\n## Message\n\nkey operation failed: {0}\n\n## Suggestion\n\nRerun the command using a passphrase that is at least 12 characters long.\n"),
+        "AUTHS-E4203" => Some("# AUTHS-E4203\n\n**Crate:** `auths-id`\n\n**Type:** `InitError::Key`\n\n## Message\n\nkey operation failed: {0}\n\n## Suggestion\n\nCheck keychain access and passphrase. Headless/CI (no Touch ID): set AUTHS_KEYCHAIN_BACKEND=file AUTHS_KEYCHAIN_FILE=<path> AUTHS_PASSPHRASE=<pass>, or run `auths init --profile ci`.\n"),
         "AUTHS-E4204" => Some("# AUTHS-E4204\n\n**Crate:** `auths-id`\n\n**Type:** `InitError::InvalidData`\n\n## Message\n\n{0}\n\n## Suggestion\n\nIdentity data is malformed; try re-initializing with `auths init`\n"),
         "AUTHS-E4205" => Some("# AUTHS-E4205\n\n**Crate:** `auths-id`\n\n**Type:** `InitError::Storage`\n\n## Message\n\nstorage operation failed: {0}\n\n## Suggestion\n\nCheck storage backend connectivity\n"),
         "AUTHS-E4206" => Some("# AUTHS-E4206\n\n**Crate:** `auths-id`\n\n**Type:** `InitError::Registry`\n\n## Message\n\nregistry error: {0}\n\n## Suggestion\n\nCheck registry backend configuration\n"),
diff --git a/crates/auths-sdk/src/domains/identity/local.rs b/crates/auths-sdk/src/domains/identity/local.rs
index c1a574942..650d2219d 100644
--- a/crates/auths-sdk/src/domains/identity/local.rs
+++ b/crates/auths-sdk/src/domains/identity/local.rs
@@ -53,6 +53,45 @@ impl LocalSigner {
 /// // commit trailer: `Auths-Id: {signer.root_did}` + `Auths-Device: {signer.signer_did}`
 /// ```
 pub fn resolve_local_signer(ctx: &AuthsContext) -> Result<LocalSigner, SetupError> {
+    // Explicit signing key override (e.g., delegated agent `AUTHS_SIGNING_KEY="auths:agent-label"`).
+    if let Ok(key_alias_str) = std::env::var("AUTHS_SIGNING_KEY") {
+        let clean_alias = key_alias_str
+            .strip_prefix("auths:")
+            .unwrap_or(&key_alias_str);
+        let alias = auths_core::storage::keychain::KeyAlias::new_unchecked(clean_alias);
+        if let Ok(key_info) = ctx.key_storage.load_key(&alias) {
+            let agent_did = key_info.0.to_string();
+            let agent_prefix = auths_id::keri::parse_did_keri(&agent_did)
+                .map_err(|e| SetupError::InvalidSetupConfig(format!("invalid agent DID: {e}")))?;
+
+            let (root_did, anchor_seq) = if let Ok(managed) = ctx.identity_storage.load_identity() {
+                let rd = managed.controller_did.to_string();
+                let seq = root_tip_seq(ctx, &rd);
+                (rd, seq)
+            } else if let Ok(auths_id::keri::Event::Dip(dip)) =
+                ctx.registry.get_event(&agent_prefix, 0)
+            {
+                let rd = format!("did:keri:{}", dip.di);
+                let seq = root_tip_seq(ctx, &rd);
+                (rd, seq)
+            } else {
+                return Err(SetupError::InvalidSetupConfig(format!(
+                    "AUTHS_SIGNING_KEY '{key_alias_str}' delegation info not found in registry"
+                )));
+            };
+
+            return Ok(LocalSigner {
+                signer_did: agent_did,
+                root_did,
+                anchor_seq,
+            });
+        } else {
+            return Err(SetupError::InvalidSetupConfig(format!(
+                "AUTHS_SIGNING_KEY '{key_alias_str}' not found in key storage"
+            )));
+        }
+    }
+
     // Root machine: prefer this root's delegated device #0 as the signer (its own AID,
     // distinct from the root) so identity_did != device_did. Fall back to the root
     // signing directly (a root identity with no delegated device — e.g. CI).
diff --git a/crates/auths-sdk/src/workflows/agent_provision.rs b/crates/auths-sdk/src/workflows/agent_provision.rs
index c316258f9..4b88a8293 100644
--- a/crates/auths-sdk/src/workflows/agent_provision.rs
+++ b/crates/auths-sdk/src/workflows/agent_provision.rs
@@ -149,9 +149,12 @@ export AUTHS_SIGNING_KEY="auths:{label}"
 
 # Direct Git Native Signing Overrides (No file modifications to .git/config)
 export GIT_CONFIG_COUNT=3
-export GIT_CONFIG_KEY_0="gpg.format"          export GIT_CONFIG_VALUE_0="ssh"
-export GIT_CONFIG_KEY_1="gpg.ssh.program"      export GIT_CONFIG_VALUE_1="auths-sign"
-export GIT_CONFIG_KEY_2="user.signingkey"      export GIT_CONFIG_VALUE_2="auths:{label}"
+export GIT_CONFIG_KEY_0="gpg.format"
+export GIT_CONFIG_VALUE_0="ssh"
+export GIT_CONFIG_KEY_1="gpg.ssh.program"
+export GIT_CONFIG_VALUE_1="auths-sign"
+export GIT_CONFIG_KEY_2="user.signingkey"
+export GIT_CONFIG_VALUE_2="auths:{label}"
 "#,
         home = params.destination_dir.display(),
         repo = registry_dir.display(),
@@ -207,8 +210,7 @@ pub fn materialize_agent_machine_registry(
         fs::remove_dir_all(agent_registry)?;
     }
 
-    copy_dir_clean(root_repo, agent_registry)
-        .context("failed to copy registry repository")?;
+    copy_dir_clean(root_repo, agent_registry).context("failed to copy registry repository")?;
 
     let git_dir = agent_registry.join(".git");
     if git_dir.exists() {
@@ -248,8 +250,11 @@ pub fn materialize_agent_machine_registry(
 
 /// Recursively copies a directory tree, skipping Unix domain sockets, FIFOs, and special IPC handles.
 fn copy_dir_clean(src: &Path, dst: &Path) -> Result<()> {
-    fs::create_dir_all(dst).with_context(|| format!("failed to create directory {}", dst.display()))?;
-    for entry_res in fs::read_dir(src).with_context(|| format!("failed to read directory {}", src.display()))? {
+    fs::create_dir_all(dst)
+        .with_context(|| format!("failed to create directory {}", dst.display()))?;
+    for entry_res in
+        fs::read_dir(src).with_context(|| format!("failed to read directory {}", src.display()))?
+    {
         let entry = entry_res?;
         let file_type = entry.file_type()?;
 
diff --git a/crates/auths-sdk/src/workflows/commit_hooks.rs b/crates/auths-sdk/src/workflows/commit_hooks.rs
index dfb7a03ca..9bcd92691 100644
--- a/crates/auths-sdk/src/workflows/commit_hooks.rs
+++ b/crates/auths-sdk/src/workflows/commit_hooks.rs
@@ -54,7 +54,7 @@ pub const PREPARE_COMMIT_MSG_HOOK: &str = r#"#!/bin/sh
 # Chains to the repo's own hook when one exists.
 
 MSG_FILE="$1"
-AUTHS_HOME="${AUTHS_REPO:-$HOME/.auths}"
+AUTHS_HOME="${AUTHS_HOME:-${AUTHS_REPO:-$HOME/.auths}}"
 TRAILERS="$AUTHS_HOME/commit-trailers"
 
 if [ -f "$TRAILERS" ]; then
diff --git a/docs/errors/AUTHS-E4203.md b/docs/errors/AUTHS-E4203.md
index 26774df95..bc3f143dd 100644
--- a/docs/errors/AUTHS-E4203.md
+++ b/docs/errors/AUTHS-E4203.md
@@ -10,4 +10,4 @@ key operation failed: {0}
 
 ## Suggestion
 
-Rerun the command using a passphrase that is at least 12 characters long.
+Check keychain access and passphrase. Headless/CI (no Touch ID): set AUTHS_KEYCHAIN_BACKEND=file AUTHS_KEYCHAIN_FILE=<path> AUTHS_PASSPHRASE=<pass>, or run `auths init --profile ci`.

From d83f706f7d35d8c6e010159f9a2354ebd803603a Mon Sep 17 00:00:00 2001
From: auths-bot <bot@auths.dev>
Date: Thu, 23 Jul 2026 20:56:28 +0100
Subject: [PATCH 18/37] chore(ci): update identity bundle with delegated agent
 anchors

Auths-Scope: sign_commit
Auths-Id: did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b
Auths-Device: did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6
Auths-Anchor-Seq: 1
---
 .auths/ci-bundle.json | 1932 ++++++++++++++++++++++++++++++++++++++---
 1 file changed, 1817 insertions(+), 115 deletions(-)

diff --git a/.auths/ci-bundle.json b/.auths/ci-bundle.json
index 50cb4d680..d6c9fc1f6 100644
--- a/.auths/ci-bundle.json
+++ b/.auths/ci-bundle.json
@@ -3,6 +3,48 @@
   "public_key_hex": "03319793ee258fcf8fd518d8224bd39d381a004b586c84a63cc3a1be018477088f",
   "curve": "p256",
   "attestation_chain": [
+    {
+      "version": 1,
+      "rid": ".auths",
+      "issuer": "did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "subject": "did:keri:ECzFpM6abrCSSpiki8v_qJHAOii2jg6556PRB33z1AAb",
+      "device_public_key": {
+        "curve": "p256",
+        "key": "0384188a11a1c734dbdc2b2123c46efc3e6cdef1469747d6d93490665f5b92c080"
+      },
+      "identity_signature": "0959aa1cb3d00efc64175a724fd3609c41423b66c7f17e20c6dc40c78704ab53e067179460139dcbe434e87c812bbd6c68b02e76c745e4a41a40afb26778de61",
+      "device_signature": "ccf2cb5ef2b6ae99ec31fe7aca83e128706da60f5c8d6382eb9c46a912dfe3adcd53b6b7f85a3f16bb3c134a8d64a2d59c4f6ea98e40c2496094553fb4db9bb3",
+      "timestamp": "2026-07-23T18:16:23.244962Z",
+      "signer_type": "Agent"
+    },
+    {
+      "version": 1,
+      "rid": ".auths",
+      "issuer": "did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "subject": "did:keri:EDcmK6onrDzdFgEqI6OYjJZoGy2gSCdaO_dVKLJWsb4n",
+      "device_public_key": {
+        "curve": "p256",
+        "key": "0320844a04683f986c681abd39560126cc0147e877b34387e4b855397f2e21a497"
+      },
+      "identity_signature": "061f7a5ff418ef039a555cd0cf349e133d5eab66b4bf449899550b23a7d88e0287ac7191cc86c8c677729146fd03cd148862a1033e7829a4b4aaf0c884f19f6b",
+      "device_signature": "360d60bde99e0fc2ab221f28510bcd0320b56dbdf4045145f6eeef87e6aa594af7e958db9b7ab0bf9570be085ebf6e500046fc8e6d79f4515ae9f725fdcaa9cc",
+      "timestamp": "2026-07-23T15:57:50.937366Z",
+      "signer_type": "Agent"
+    },
+    {
+      "version": 1,
+      "rid": ".auths",
+      "issuer": "did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "subject": "did:keri:EE-k7tp1lVfa8Ru9RNy-JQgeHYfFtaI6BR3hDbd9KGmn",
+      "device_public_key": {
+        "curve": "p256",
+        "key": "03e1904f4ae595d726c1e304a95be7a0648dd99afd952c835d907b730581703976"
+      },
+      "identity_signature": "dea5acbe13f8df0b2af1a33601b9b3b1bd7e4ed448f5bbe7b2c1c14f054be91becc8c33439ef3857c8f18c600fbd66383f78fa85e5760aa5a2278b71bd554898",
+      "device_signature": "982385fcea3b4c0d8e4b87157f883e749a2ea7ed61d58dd6b807240a5e9ea89a8493535a5b7eae0d95a373a53ed531fce0adbcc9f74147d40ccfe907367ed224",
+      "timestamp": "2026-07-23T18:21:00.410008Z",
+      "signer_type": "Agent"
+    },
     {
       "version": 1,
       "rid": ".auths",
@@ -18,6 +60,76 @@
       "timestamp": "2026-07-18T15:23:24.735834Z",
       "signer_type": "Agent"
     },
+    {
+      "version": 1,
+      "rid": ".auths",
+      "issuer": "did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "subject": "did:keri:EFE_IQRzArN0vTCK_8b0ef68uL7_EO919AEsTpuWB8wv",
+      "device_public_key": {
+        "curve": "p256",
+        "key": "03e9b01602dfee6e6817f7872e87cb6e65ba99c43d6926284f9ee29c4a1a5b1a46"
+      },
+      "identity_signature": "9ecf51ca2f70d7e367d80dd0422821d283d480a57cd54a6185fee81d1c3000667f5366aa71cc98793203688e85437fdda0da0f5d02d1cd872c992ccfd196db52",
+      "device_signature": "076a316305b2150b2861a79469baf34950a4502283f2d088d61eb8b0afa54b1227535889f45f0d84ca3b39d910bcdf2ed54b69ce19dc8ef01b8a839ab807c3d7",
+      "timestamp": "2026-07-23T18:39:13.474659Z",
+      "signer_type": "Agent"
+    },
+    {
+      "version": 1,
+      "rid": ".auths",
+      "issuer": "did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "subject": "did:keri:EGBVjMs3qkVEel7os20R3WHNiI5DNJlVGbhkNTr12wbe",
+      "device_public_key": {
+        "curve": "p256",
+        "key": "0381be3c212f6b76dfaf0d94c2271a57e58cdb7dd33b91cc8e5f4d4ca7756df3ef"
+      },
+      "identity_signature": "4353954b73706d8c7874077d6a4fd9d0a28c679eb3e3faa1258a84778736c79f5c006241af62d2118f669846051d28ab26834160f8a99c26833fb2eb6a36fde3",
+      "device_signature": "aef8bdcbdd4bd90b3726c76924c5396d114a96fb6e9a409b825cb60f842c5eb884058ae3186515bd13789c6755f0fec79abef0d785d84044d030c2eccf2b61ff",
+      "timestamp": "2026-07-23T18:50:16.734637Z",
+      "signer_type": "Agent"
+    },
+    {
+      "version": 1,
+      "rid": ".auths",
+      "issuer": "did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "subject": "did:keri:EGXg8l62pI8_ig0JiIHMkKyGKbJHdWMpIhb0W0niK86y",
+      "device_public_key": {
+        "curve": "p256",
+        "key": "03d73916d03aced8c0029581e0408cbf88f5b79b17fd389f1d2d07627c72e138b6"
+      },
+      "identity_signature": "ac19fba8a68b1d7c1aa1c739b220ed52ec13154436f2003821e2225db7d00b246e6bef66311705454ab6a1a22bdbad3730bbf276fc785d5690a0deb6bd712352",
+      "device_signature": "9ba1336cfd594768547497edaba5234ee479915f7c56fbb0844b91c1a88d76253b9906d68ae22a328835a9a9d4a2d8881145fc58b386e03d9fe76dc6171d8b75",
+      "timestamp": "2026-07-23T18:50:56.479334Z",
+      "signer_type": "Agent"
+    },
+    {
+      "version": 1,
+      "rid": ".auths",
+      "issuer": "did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "subject": "did:keri:EHVCdLP79CXEc7xYjwtwp_Q1_MguwDmhEYFMZevOXIZ5",
+      "device_public_key": {
+        "curve": "p256",
+        "key": "0336b6605d0068f65c9619c9eb2acc41c3b81ad1b3abe16ea2629f7ec5f1488109"
+      },
+      "identity_signature": "7aca51786fb5fb5caefe387ffe933a0f2f45e51f608a2b4cb6b681aed57d27de467cad22569ff09a77c5d8f182d04060e405c55eccd576b79bd7a372702aa2f2",
+      "device_signature": "5ed88fd3f815946286d61c1c2ec061ea0a28f497dd6a08a4dcb283b538cbb2956a54b2d3dcad8dd71266fc3e38c8234e25ad744ae1009c2acf319589902cb66c",
+      "timestamp": "2026-07-23T17:05:08.072545Z",
+      "signer_type": "Agent"
+    },
+    {
+      "version": 1,
+      "rid": ".auths",
+      "issuer": "did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "subject": "did:keri:EOtdnfmn4wkvMqUX4374wkHzXIs0WgA7zFVNJGL3cLvZ",
+      "device_public_key": {
+        "curve": "p256",
+        "key": "035e737c58cde72ef2ca80cb97482555bb262dfeb11bd108cb6cf1de9525395c3a"
+      },
+      "identity_signature": "4005a895a8ab423e17c3c140a6f70e8096ea3e7cfac468a6521a84bf5195ef792fbf4fffb09a7d10255155f38807a826fadbb5b4d51c8e742a9fcd959a209506",
+      "device_signature": "20a6b00766425afd2d00534477bc0e6b103a02b18d2dc44dff1c86857a2e446d0322f8e6ea526f1a6511bb05415b7c989edfe40a0cd7695e1177841511499e28",
+      "timestamp": "2026-07-23T18:46:39.226554Z",
+      "signer_type": "Agent"
+    },
     {
       "version": 1,
       "rid": ".auths",
@@ -31,6 +143,138 @@
       "device_signature": "56441005f93c89afa5d817f07ae8b85ae9d25c12956ffe5f4f3a33e1ba603b66c785a33f3862ba1db503287190027af0d07794107f1a1a218b0ef822cfac3754",
       "timestamp": "2026-06-19T14:18:34.160482Z",
       "note": "Linked by auths-sdk setup"
+    },
+    {
+      "version": 1,
+      "rid": "sha256:a1fff0ffefb9eace7230c24e50731f0a91c62f9cefdfe77121c2f607125dffae",
+      "issuer": "did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "subject": "did:key:zDnaekzsT4o4uSTMuQjKGKTcCvV6CdHUkkTYfcwCFZSZpsbtz",
+      "device_public_key": {
+        "curve": "p256",
+        "key": "03319793ee258fcf8fd518d8224bd39d381a004b586c84a63cc3a1be018477088f"
+      },
+      "identity_signature": "46906c8f544e21ef384fe37ded55e24d7bae3c3a57d8c0b1ee316e50a0ef81551b74978daff16f2b13e537c866d062a3f3d517d4881b8856e52456a7e527e322",
+      "device_signature": "a1cbbea698bf11b032d87f02f7c377cc3f4edc6696c65bd2c44ef63823f894003b5a4b77dda2644346db7a9c17cd293907b6b34c4498030acddeaeda7fc069ce",
+      "timestamp": "2026-07-23T00:57:13.261824Z",
+      "payload": {
+        "artifact_type": "file",
+        "digest": {
+          "algorithm": "sha256",
+          "hex": "a1fff0ffefb9eace7230c24e50731f0a91c62f9cefdfe77121c2f607125dffae"
+        },
+        "name": "demo_target.txt",
+        "size": 13
+      }
+    },
+    {
+      "version": 1,
+      "rid": "sha256:5eac242b009be5b3f551360fc2692b469849c8dc7556cdad1d0c0e1863ca0ba1",
+      "issuer": "did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "subject": "did:key:zDnaekzsT4o4uSTMuQjKGKTcCvV6CdHUkkTYfcwCFZSZpsbtz",
+      "device_public_key": {
+        "curve": "p256",
+        "key": "03319793ee258fcf8fd518d8224bd39d381a004b586c84a63cc3a1be018477088f"
+      },
+      "identity_signature": "010c33fbf5a81f736dc829328ce84424b149ac57465b583f903df677915534f4dcfbe9da19c128dce2a7709d195b3089d1e739ecba01d8d874ea61375a89bde9",
+      "device_signature": "8d6d4bcfec3f6b267fc9202bdb993b9364fdda17594b3d548d839c4c191786aeb1e2b6b1d0fb525a01783c6b7af8665eb2064fea2bcbf81d643da711efb6663b",
+      "timestamp": "2026-07-23T01:01:28.317844Z",
+      "payload": {
+        "artifact_type": "file",
+        "digest": {
+          "algorithm": "sha256",
+          "hex": "5eac242b009be5b3f551360fc2692b469849c8dc7556cdad1d0c0e1863ca0ba1"
+        },
+        "name": "production_release.tar.gz",
+        "size": 46
+      }
+    },
+    {
+      "version": 1,
+      "rid": "sha256:5eac242b009be5b3f551360fc2692b469849c8dc7556cdad1d0c0e1863ca0ba1",
+      "issuer": "did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "subject": "did:key:zDnaekzsT4o4uSTMuQjKGKTcCvV6CdHUkkTYfcwCFZSZpsbtz",
+      "device_public_key": {
+        "curve": "p256",
+        "key": "03319793ee258fcf8fd518d8224bd39d381a004b586c84a63cc3a1be018477088f"
+      },
+      "identity_signature": "024e0f6e93fd951d4f46bab53a669ed07ed659c2766ef8837499e98aff07c8071b377cd8a0b96f79008f0b381a41f01545353544a0519688ecb0a1fdbd15aad3",
+      "device_signature": "088b30daf1894d50189594203d97cf6e472926517ce1860b99cafa64b6aed85d47f6cfd633c3587de06058c4ed8c7407e1f18a338343955f3d85b216670b2362",
+      "timestamp": "2026-07-23T01:06:12.495707Z",
+      "payload": {
+        "artifact_type": "file",
+        "digest": {
+          "algorithm": "sha256",
+          "hex": "5eac242b009be5b3f551360fc2692b469849c8dc7556cdad1d0c0e1863ca0ba1"
+        },
+        "name": "production_release.tar.gz",
+        "size": 46
+      }
+    },
+    {
+      "version": 1,
+      "rid": "sha256:5eac242b009be5b3f551360fc2692b469849c8dc7556cdad1d0c0e1863ca0ba1",
+      "issuer": "did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "subject": "did:key:zDnaekzsT4o4uSTMuQjKGKTcCvV6CdHUkkTYfcwCFZSZpsbtz",
+      "device_public_key": {
+        "curve": "p256",
+        "key": "03319793ee258fcf8fd518d8224bd39d381a004b586c84a63cc3a1be018477088f"
+      },
+      "identity_signature": "757cc17df50b0f669b01aef678646f5595a33bf4d7e1fc8b372ae85baa71be35a198b83724a1641d5893e187634c06c2bdbc15ced27ab54c84dda418500a37d8",
+      "device_signature": "7195f8be5c8b8a88ff9903020f9b37ccb9a4fbed52c99725b7f767eb0ba433806bdd1607537fcdecceb57a148d14d6d84737968a72078da138ea7359dfbd5f4a",
+      "timestamp": "2026-07-23T01:07:23.307878Z",
+      "payload": {
+        "artifact_type": "file",
+        "digest": {
+          "algorithm": "sha256",
+          "hex": "5eac242b009be5b3f551360fc2692b469849c8dc7556cdad1d0c0e1863ca0ba1"
+        },
+        "name": "production_release.tar.gz",
+        "size": 46
+      }
+    },
+    {
+      "version": 1,
+      "rid": "sha256:5eac242b009be5b3f551360fc2692b469849c8dc7556cdad1d0c0e1863ca0ba1",
+      "issuer": "did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "subject": "did:key:zDnaekzsT4o4uSTMuQjKGKTcCvV6CdHUkkTYfcwCFZSZpsbtz",
+      "device_public_key": {
+        "curve": "p256",
+        "key": "03319793ee258fcf8fd518d8224bd39d381a004b586c84a63cc3a1be018477088f"
+      },
+      "identity_signature": "e4d1186f92f1bf75f4ed9278a3c73ee1d29fbcccdb82f88e01caf594921631e250e7bb1500f2d0a34db8485ff20b09e319dc4ca54848d698e0fda9e80729a339",
+      "device_signature": "f500a0f53ae44352f745b3ab81290385ad5cfbff93cfe357a5f902ca0104ee67459b3f7fb03ae6126ad19157a610c48d7b0c993e361baa4274e4449f7f25ad03",
+      "timestamp": "2026-07-23T01:07:41.310978Z",
+      "payload": {
+        "artifact_type": "file",
+        "digest": {
+          "algorithm": "sha256",
+          "hex": "5eac242b009be5b3f551360fc2692b469849c8dc7556cdad1d0c0e1863ca0ba1"
+        },
+        "name": "production_release.tar.gz",
+        "size": 46
+      }
+    },
+    {
+      "version": 1,
+      "rid": "sha256:5eac242b009be5b3f551360fc2692b469849c8dc7556cdad1d0c0e1863ca0ba1",
+      "issuer": "did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "subject": "did:key:zDnaekzsT4o4uSTMuQjKGKTcCvV6CdHUkkTYfcwCFZSZpsbtz",
+      "device_public_key": {
+        "curve": "p256",
+        "key": "03319793ee258fcf8fd518d8224bd39d381a004b586c84a63cc3a1be018477088f"
+      },
+      "identity_signature": "b8b9299f5fea909ee4b0e6264dbf4d1ac4ad072feb33db997597b96a12a4a9c829f1b6e4aad82fd5cf79954bc83ad92646bcdea9ff8c8bdd663e130bb48508aa",
+      "device_signature": "0c4f2681812ff16249a770c924d61064f8756a2f167acddf92af0e8a0e94988292bd5efaaaf056c3196385a002db3d563a18c2a1e182606b7dd215c46581fd6d",
+      "timestamp": "2026-07-23T01:10:12.311940Z",
+      "payload": {
+        "artifact_type": "file",
+        "digest": {
+          "algorithm": "sha256",
+          "hex": "5eac242b009be5b3f551360fc2692b469849c8dc7556cdad1d0c0e1863ca0ba1"
+        },
+        "name": "production_release.tar.gz",
+        "size": 46
+      }
     }
   ],
   "kel": [
@@ -233,140 +477,1514 @@
           "d": "agentscope:EO1cBsYoV5izKvdIL6TstN5TOQl1hYN3WnhtAOh1lwAp:1786981212:sign_commit,sign_release"
         }
       ]
-    }
-  ],
-  "kel_attachments": [
-    "2d4141424141417877504838766b56354c766b697652353842764a524a766e49416a53415a6331714e385a3072636c444d49317132454a4f754a6e61507931304d6b675f3363755f525a7570696639646565656459586a6455415f34",
-    "2d414142414144696a3038345f61366a637153616f63636e4a4d62305259495237634e725464354439355f612d754f59525f635051736b5457455049452d386777764f33576131687161754a643952706d3258752d71625368467155",
-    "2d4141424141414f705763614767782d2d4e75524d593853506f7a346d6850734c5247645752423962353645654954572d6e6b79544b695f76706c7241676857665875653169685f4147634b424c7257433378746676595534497369",
-    "2d41414241414463705f6b6a6c3551684c3067764266744b70587176554953714269443679533955694a5a4330315f6d43617a6c414d48324f794b2d3953304a44787462545a384f316a4a4234686679456d4d785572413269636f30",
-    "2d41414241414132704e4a43317138376a66743636476151503334344a7166337132627537397732684555634f684e4e7768622d30476b6741494d726d6b6d2d6a37426c305f462d4c487772527549486874394e6168472d4f333152",
-    "2d41414241414172347475664c3078463833436470306e685f675761492d6d4a5971705879665a52466969307269756b41657739743371644c78445548337768475755436c504f54305a7664537756564d794378586d78327a666136",
-    "2d4141424141427041646c717a662d75635a61394845736c6c626b546633444867457a717044696c486943486c2d6846775849554778486c453136695961305570792d6233625a6f695357624c555f316658573148484e5f6863374d",
-    "2d4141424141436d4b366f4a7335415946743639702d5a5552434c596a696f6447377233366a38326e6a3644572d7a6151496d3856745f35346a4c4d7556494f78587569387548754f4f4667705346514a2d36766e64507646727851",
-    "2d414142414141784b59343473366b59356b72446f495975417432526b4a4a357a657732744552505a49424e5371767167737454476e43757a5055564851744152584264704a7261767946685f39527831487172396a31384a2d4457",
-    "2d414142414141495f4b55594b4f73764e62326f4c7473556c6d61536965436b714f6b334b7935546c336c722d52574834653954525571786b63756a34375065726e536a615653742d6d47463771734453395764725178346d526d2d",
-    "2d4141424141425a484831596835716553506b744d56316a4e456673366f506561525f45727265354f706232756d4334772d46426f557850634c776f7361326a507a6d3969554448754e677a4d4d58314d42483334384c41724a7569",
-    "2d414142414142514b6478305f794a754657466c55704f3550714746316e303979762d6b2d35467873715043385a72745959745f357532734932445749744b6d4359434339306b7a4d532d556b584c4a7a7a454d4371696676724579",
-    "2d4141424141427a526777374658754d575a7354594a326b79784965447947327a63326c3170424d35436d6c475f5a4d64394c63646b417746693263774e4f7043433937416472624677724e774f4765356f584f443067535f634e44",
-    "2d414142414144575161325572665f635762554b72366250366a47626d4257386950554d395655425a4f71745f426a492d75656371564761495f664a3869384153754e55693872426d7076392d7475752d4b7243656876513043364d"
-  ],
-  "device_kels": [
+    },
     {
-      "did": "did:keri:EB46LmlwowYkoVNeSxMVs68LRc7g6vI1hsPnCUBtzKjt",
-      "kel": [
+      "v": "KERI10JSON0000ff_",
+      "t": "ixn",
+      "d": "EBDecolRCN1LFWAWVU_iCitHwWVRMuSK-a6aXplXOCHg",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "e",
+      "p": "EP0KgPUSLmYprFsHWfFbw0rxaIDq1ePdvSyImKVwxYkn",
+      "a": [
         {
-          "v": "KERI10JSON00015f_",
-          "t": "dip",
-          "d": "EB46LmlwowYkoVNeSxMVs68LRc7g6vI1hsPnCUBtzKjt",
-          "i": "EB46LmlwowYkoVNeSxMVs68LRc7g6vI1hsPnCUBtzKjt",
-          "s": "0",
-          "kt": "1",
-          "k": [
-            "DNXo-V5u8_vuBzkKYoaRRCO2DnaqYbWlTqHvHRowIjSq"
-          ],
-          "nt": "1",
-          "n": [
-            "EMf_-qFIcaO8PCkHnTQ1kg7lsD5_QAsAj94Bo4Fu7UHi"
-          ],
-          "bt": "0",
-          "b": [],
-          "c": [],
-          "a": [],
-          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
+          "d": "ENylVB7J3PSlMP_PX0K3SMBzRV2_p9OvYGDOgCDI31y1"
         }
-      ],
-      "kel_attachments": [
-        "2d414142414141533962696a475866547550686c48343344435532686659584844697644597937474a62394a5249776a31576f4f594a68784a4e4d6d66727636622d574b4e51485a59722d523270435031454f66423158764d2d6b4d2d47414230414141414141414141414141414141414141414141414645476b566b655f5254336a6270574151316c6d424f58446a614343425f6d4a364c49345277314238724e3559"
       ]
     },
     {
-      "did": "did:keri:EFBGdabu4x82TD_Wn9gI3qUpDjnK3idAz4qLRS2YmdQy",
-      "kel": [
+      "v": "KERI10JSON0000ff_",
+      "t": "ixn",
+      "d": "EGplPT8t6tuNrbhI1-_RzrxoDzVXnUJrDlfOF28nP7sD",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "f",
+      "p": "EBDecolRCN1LFWAWVU_iCitHwWVRMuSK-a6aXplXOCHg",
+      "a": [
         {
-          "v": "KERI10JSON00015f_",
-          "t": "dip",
-          "d": "EFBGdabu4x82TD_Wn9gI3qUpDjnK3idAz4qLRS2YmdQy",
-          "i": "EFBGdabu4x82TD_Wn9gI3qUpDjnK3idAz4qLRS2YmdQy",
-          "s": "0",
-          "kt": "1",
-          "k": [
-            "DM7Fn3BNMxniy7-3mPMsnGf-D0LzbfArArziOd2HJqm7"
-          ],
-          "nt": "1",
-          "n": [
-            "EF2b6jAzpSeVs_ClZbYSP-zCLnSyTSSPQ_XvadOCFiNt"
-          ],
-          "bt": "0",
-          "b": [],
-          "c": [],
-          "a": [],
-          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
+          "d": "ENB5J9EdsNcKJ3BrN9dp1l7pASQ9EQC9iIb_xFOUmESc"
         }
-      ],
-      "kel_attachments": [
-        "2d414142414142637a74747658326335574d575a41785f6c6170454955654a4553736c3438326d5071724867306f734e324849684d622d68786d4b5a2d3671467a32615578753067657774516674637773724f684a6a47326568414b2d4741423041414141414141414141414141414141414141414141474544564d454e4565797a35456b68446643576a53505f5a4d46757a4a464a336f66567645722d574b51534e36"
       ]
     },
     {
-      "did": "did:keri:EGpEBKDnvEUv0dsQ1MVaZbBq0qx8p1iLA4AFcNiPlk5M",
-      "kel": [
+      "v": "KERI10JSON000100_",
+      "t": "ixn",
+      "d": "EKuiUx3BK8WG5zo6GtAhsa5W8nHvdtdWvYo62U99y5jI",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "10",
+      "p": "EGplPT8t6tuNrbhI1-_RzrxoDzVXnUJrDlfOF28nP7sD",
+      "a": [
         {
-          "v": "KERI10JSON00015f_",
-          "t": "dip",
-          "d": "EGpEBKDnvEUv0dsQ1MVaZbBq0qx8p1iLA4AFcNiPlk5M",
-          "i": "EGpEBKDnvEUv0dsQ1MVaZbBq0qx8p1iLA4AFcNiPlk5M",
-          "s": "0",
-          "kt": "1",
-          "k": [
-            "DM_3EYHf6RSHG-tdXVR_cU-Lvof3rkWYtT-PYhpU-IRe"
-          ],
-          "nt": "1",
-          "n": [
-            "ELnchwp59KdisZ-hIRguRa0t5dl1DigLxwxfr_qWHkHE"
-          ],
-          "bt": "0",
-          "b": [],
-          "c": [],
-          "a": [],
-          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
+          "d": "EOoSB48wARoV793Wc-Rs7wtiIliUJcMuZv3HMUkRLIPJ"
         }
-      ],
-      "kel_attachments": [
-        "2d414142414142386f412d6750665f5761363035454339564c7970796a4c4a467570453167777555315f446a6d7450625739546a716b4c59636c77743733397142576a7a4174662d4b757738376a6e67796b597a384d6669535f30502d4741423041414141414141414141414141414141414141414141454544573642616b494c714964693456335a53534155536667686f486b50735f52506f573267494e376475414f"
       ]
     },
     {
-      "did": "did:keri:EIv02OckbaGFpRONOurWMi_f5_Qf8unjgG5PnVCG2MiU",
-      "kel": [
+      "v": "KERI10JSON000100_",
+      "t": "ixn",
+      "d": "EMe5EiZMLRIKI2enKbBuX5gBaP8gJG6r9w53rBAhvQ7l",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "11",
+      "p": "EKuiUx3BK8WG5zo6GtAhsa5W8nHvdtdWvYo62U99y5jI",
+      "a": [
         {
-          "v": "KERI10JSON00015f_",
-          "t": "dip",
-          "d": "EIv02OckbaGFpRONOurWMi_f5_Qf8unjgG5PnVCG2MiU",
-          "i": "EIv02OckbaGFpRONOurWMi_f5_Qf8unjgG5PnVCG2MiU",
-          "s": "0",
-          "kt": "1",
-          "k": [
-            "DPYt_OxIt9CqR_4W3LHZLFm092qERcNr5F7716rbuy2h"
-          ],
-          "nt": "1",
-          "n": [
-            "EPz5DqpWQTuIHeVm92lv5aZ0IUeRuNrt1VNd65HWumph"
-          ],
-          "bt": "0",
-          "b": [],
-          "c": [],
-          "a": [],
-          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
+          "d": "EFwqSjt9CR9pg2fePrKSz00WUsNRIorXbLIevoyHa1zl"
         }
-      ],
-      "kel_attachments": [
-        "2d4141424141434e58784447677344644b4e576c77796b726c6936546e42556863416a6a4b37795948556256796c5f4732483075716c35354b636d646c5665504e4e64786576355068546b454b59717447504e30484f4e54333351462d4741423041414141414141414141414141414141414141414141444547686c4f6e545957756836545141714156496b32745a48345a567157596d4a594f77747a4255436a6c3457"
       ]
     },
     {
-      "did": "did:keri:EO1cBsYoV5izKvdIL6TstN5TOQl1hYN3WnhtAOh1lwAp",
-      "kel": [
+      "v": "KERI10JSON000100_",
+      "t": "ixn",
+      "d": "EOpHK-s9LGDeqSj0Zi9-72tktgZtjM5kg_eO74g8J3O0",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "12",
+      "p": "EMe5EiZMLRIKI2enKbBuX5gBaP8gJG6r9w53rBAhvQ7l",
+      "a": [
+        {
+          "d": "EDg8qDEZJslxqkVzSPwL8fAXsoxMxUwnW8NeGwYPPKuD"
+        }
+      ]
+    },
+    {
+      "v": "KERI10JSON000100_",
+      "t": "ixn",
+      "d": "ED0FmC_vdfbVokNJ0wv7tUKsHMoKTGyjLWC1iM3SFOAf",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "13",
+      "p": "EOpHK-s9LGDeqSj0Zi9-72tktgZtjM5kg_eO74g8J3O0",
+      "a": [
+        {
+          "d": "EDF1WK9Q3mi6ERAvofCt0Nf-xZ0rAo6JHHiY58LFUMPb"
+        }
+      ]
+    },
+    {
+      "v": "KERI10JSON000100_",
+      "t": "ixn",
+      "d": "EE5p32bHveT42MxcgU2wYAICvZ9A_2Csk53jTXM4Xv_g",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "14",
+      "p": "ED0FmC_vdfbVokNJ0wv7tUKsHMoKTGyjLWC1iM3SFOAf",
+      "a": [
+        {
+          "d": "EO1cBsYoV5izKvdIL6TstN5TOQl1hYN3WnhtAOh1lwAp"
+        }
+      ]
+    },
+    {
+      "v": "KERI10JSON00013b_",
+      "t": "ixn",
+      "d": "EM8wA_-a0EHqzOYdhMKemRvlMBNJbOrrwMrvsOXHsuhg",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "15",
+      "p": "EE5p32bHveT42MxcgU2wYAICvZ9A_2Csk53jTXM4Xv_g",
+      "a": [
+        {
+          "i": "EC9kFyHu8TTeOddjNo6UFa_rc85uh9T2wdJcOuK1smSJ",
+          "s": "0",
+          "d": "EC9kFyHu8TTeOddjNo6UFa_rc85uh9T2wdJcOuK1smSJ"
+        }
+      ]
+    },
+    {
+      "v": "KERI10JSON00013b_",
+      "t": "ixn",
+      "d": "ELP8rPoZFkqzBVsM4m-7H-HvqZBA-g_BxGOfj0GgdBdk",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "16",
+      "p": "EM8wA_-a0EHqzOYdhMKemRvlMBNJbOrrwMrvsOXHsuhg",
+      "a": [
+        {
+          "i": "ELu71pX3phf4hfXwodtm4fmy16acrLporJ_XoNCL00cq",
+          "s": "0",
+          "d": "ELu71pX3phf4hfXwodtm4fmy16acrLporJ_XoNCL00cq"
+        }
+      ]
+    },
+    {
+      "v": "KERI10JSON000106_",
+      "t": "ixn",
+      "d": "EC1MMW4EfI9a_8fAeb7DNN2IIQO6oSsflq4FXvMNili1",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "17",
+      "p": "ELP8rPoZFkqzBVsM4m-7H-HvqZBA-g_BxGOfj0GgdBdk",
+      "a": [
+        {
+          "d": "agent:ELu71pX3phf4hfXwodtm4fmy16acrLporJ_XoNCL00cq"
+        }
+      ]
+    },
+    {
+      "v": "KERI10JSON00013b_",
+      "t": "ixn",
+      "d": "ENFq762ZpOi5PXSrRLVsXcCSv4vHxG5sNsIA9u1bboFL",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "18",
+      "p": "EC1MMW4EfI9a_8fAeb7DNN2IIQO6oSsflq4FXvMNili1",
+      "a": [
+        {
+          "i": "EAmNROPhe_6Nmq_IUvxlQAccnwZoImyPtwF5ZfXhZEXk",
+          "s": "0",
+          "d": "EAmNROPhe_6Nmq_IUvxlQAccnwZoImyPtwF5ZfXhZEXk"
+        }
+      ]
+    },
+    {
+      "v": "KERI10JSON000106_",
+      "t": "ixn",
+      "d": "ENawwQkgB8q1lLP7YTQyPkLtW32l9M-aX_E1jiFeHCCT",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "19",
+      "p": "ENFq762ZpOi5PXSrRLVsXcCSv4vHxG5sNsIA9u1bboFL",
+      "a": [
+        {
+          "d": "agent:EAmNROPhe_6Nmq_IUvxlQAccnwZoImyPtwF5ZfXhZEXk"
+        }
+      ]
+    },
+    {
+      "v": "KERI10JSON00013b_",
+      "t": "ixn",
+      "d": "EM6VIvBtPp3dCGU16ibzd83XkszKDWMBs_XbSlSeJTJ0",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "1a",
+      "p": "ENawwQkgB8q1lLP7YTQyPkLtW32l9M-aX_E1jiFeHCCT",
+      "a": [
+        {
+          "i": "EIDjomlmJhcp9YOxGQFunPjEmUNs-bG3yuyTX8U43duu",
+          "s": "0",
+          "d": "EIDjomlmJhcp9YOxGQFunPjEmUNs-bG3yuyTX8U43duu"
+        }
+      ]
+    },
+    {
+      "v": "KERI10JSON000106_",
+      "t": "ixn",
+      "d": "ELUU4sZY30n_qY90zMPwgxWNoUrjGFDcYDH242wz-IfS",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "1b",
+      "p": "EM6VIvBtPp3dCGU16ibzd83XkszKDWMBs_XbSlSeJTJ0",
+      "a": [
+        {
+          "d": "agent:EIDjomlmJhcp9YOxGQFunPjEmUNs-bG3yuyTX8U43duu"
+        }
+      ]
+    },
+    {
+      "v": "KERI10JSON00013b_",
+      "t": "ixn",
+      "d": "EBlDXORBJq9tmn9BKiUUOk2eayalrzd9TXZV0ann6iAj",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "1c",
+      "p": "ELUU4sZY30n_qY90zMPwgxWNoUrjGFDcYDH242wz-IfS",
+      "a": [
+        {
+          "i": "EMEM33xgRvQi6wY0pfVzP_-ce1vU64WBNJddf-LWNX59",
+          "s": "0",
+          "d": "EMEM33xgRvQi6wY0pfVzP_-ce1vU64WBNJddf-LWNX59"
+        }
+      ]
+    },
+    {
+      "v": "KERI10JSON000106_",
+      "t": "ixn",
+      "d": "EI1o-OsAMdJMkdNITbiffbnUkGCKoqbMb07I7tewfMyE",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "1d",
+      "p": "EBlDXORBJq9tmn9BKiUUOk2eayalrzd9TXZV0ann6iAj",
+      "a": [
+        {
+          "d": "agent:EMEM33xgRvQi6wY0pfVzP_-ce1vU64WBNJddf-LWNX59"
+        }
+      ]
+    },
+    {
+      "v": "KERI10JSON00013b_",
+      "t": "ixn",
+      "d": "ENXt82xjmRzb0S07M2R3Yt9eX_VRcW_S4fTicPSkHhIj",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "1e",
+      "p": "EI1o-OsAMdJMkdNITbiffbnUkGCKoqbMb07I7tewfMyE",
+      "a": [
+        {
+          "i": "EKGOZKZrCAPspNZNN1Duli1BOoSd_UhR-BEvyDyP7SaI",
+          "s": "0",
+          "d": "EKGOZKZrCAPspNZNN1Duli1BOoSd_UhR-BEvyDyP7SaI"
+        }
+      ]
+    },
+    {
+      "v": "KERI10JSON00013b_",
+      "t": "ixn",
+      "d": "EP_gZSqB6DYDgkkVIe4Bt5L38X2uAEiA33eCiD17PM8q",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "1f",
+      "p": "ENXt82xjmRzb0S07M2R3Yt9eX_VRcW_S4fTicPSkHhIj",
+      "a": [
+        {
+          "i": "EE0slWK6chng-UM42qf1fbtYapx8oZ1yadRIEFYB1m5_",
+          "s": "0",
+          "d": "EE0slWK6chng-UM42qf1fbtYapx8oZ1yadRIEFYB1m5_"
+        }
+      ]
+    },
+    {
+      "v": "KERI10JSON000106_",
+      "t": "ixn",
+      "d": "EChKTGxMtNB2_HNoOy-cjx-3jx-UDhcTc9kGhAzLsoug",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "20",
+      "p": "EP_gZSqB6DYDgkkVIe4Bt5L38X2uAEiA33eCiD17PM8q",
+      "a": [
+        {
+          "d": "agent:EE0slWK6chng-UM42qf1fbtYapx8oZ1yadRIEFYB1m5_"
+        }
+      ]
+    },
+    {
+      "v": "KERI10JSON00013b_",
+      "t": "ixn",
+      "d": "EDeBCz7OS0VYNsuQ7Nw3efrKsY46mMOFXC96SoWpba4U",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "21",
+      "p": "EChKTGxMtNB2_HNoOy-cjx-3jx-UDhcTc9kGhAzLsoug",
+      "a": [
+        {
+          "i": "EO9pxZBky_Tkd83KnWOnay-J1xjiEkxUF5na-T-boJsC",
+          "s": "0",
+          "d": "EO9pxZBky_Tkd83KnWOnay-J1xjiEkxUF5na-T-boJsC"
+        }
+      ]
+    },
+    {
+      "v": "KERI10JSON000106_",
+      "t": "ixn",
+      "d": "EAW02fXFfS6Pqn5ArwguKYCaxsO1QNY-Xlg333qDWZ7M",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "22",
+      "p": "EDeBCz7OS0VYNsuQ7Nw3efrKsY46mMOFXC96SoWpba4U",
+      "a": [
+        {
+          "d": "agent:EO9pxZBky_Tkd83KnWOnay-J1xjiEkxUF5na-T-boJsC"
+        }
+      ]
+    },
+    {
+      "v": "KERI10JSON00013b_",
+      "t": "ixn",
+      "d": "ECJNzC7CpXvNcGXkEQMR3lU5Ch6iMWV-WKGgcZ0Y8Ueb",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "23",
+      "p": "EAW02fXFfS6Pqn5ArwguKYCaxsO1QNY-Xlg333qDWZ7M",
+      "a": [
+        {
+          "i": "EG98LlhEMtRuQUnBgUVSrtTarbJrSLa7IV-CdQLr5Rpj",
+          "s": "0",
+          "d": "EG98LlhEMtRuQUnBgUVSrtTarbJrSLa7IV-CdQLr5Rpj"
+        }
+      ]
+    },
+    {
+      "v": "KERI10JSON000106_",
+      "t": "ixn",
+      "d": "EAbwq4_nAx1g_Jf6yP8DRh7vPEPBXNYaihmHjexTysMK",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "24",
+      "p": "ECJNzC7CpXvNcGXkEQMR3lU5Ch6iMWV-WKGgcZ0Y8Ueb",
+      "a": [
+        {
+          "d": "agent:EG98LlhEMtRuQUnBgUVSrtTarbJrSLa7IV-CdQLr5Rpj"
+        }
+      ]
+    },
+    {
+      "v": "KERI10JSON00013b_",
+      "t": "ixn",
+      "d": "EFZOZdBF1Ybcvl0Y6lglnPsEV_dKGtqIVJlN2r6JkOPB",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "25",
+      "p": "EAbwq4_nAx1g_Jf6yP8DRh7vPEPBXNYaihmHjexTysMK",
+      "a": [
+        {
+          "i": "EGOV2nwCPgcQ8jrEP8gP2vo5bZdggvnpW_IA8M1iMXeg",
+          "s": "0",
+          "d": "EGOV2nwCPgcQ8jrEP8gP2vo5bZdggvnpW_IA8M1iMXeg"
+        }
+      ]
+    },
+    {
+      "v": "KERI10JSON000106_",
+      "t": "ixn",
+      "d": "EMMqXQ9ELy1kYNd7IteHC-S8UP2b-TJB1naLTCTAvfMQ",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "26",
+      "p": "EFZOZdBF1Ybcvl0Y6lglnPsEV_dKGtqIVJlN2r6JkOPB",
+      "a": [
+        {
+          "d": "agent:EGOV2nwCPgcQ8jrEP8gP2vo5bZdggvnpW_IA8M1iMXeg"
+        }
+      ]
+    },
+    {
+      "v": "KERI10JSON00013b_",
+      "t": "ixn",
+      "d": "ECVXdqtXnxpa_IWiGIMk641wZlBvRMPgYIJ9B_3Z4dmd",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "27",
+      "p": "EMMqXQ9ELy1kYNd7IteHC-S8UP2b-TJB1naLTCTAvfMQ",
+      "a": [
+        {
+          "i": "EBLiCGzZ2OKMRTB_ppJqTQf-Vol7uMkVVYeLu1V0m6K3",
+          "s": "0",
+          "d": "EBLiCGzZ2OKMRTB_ppJqTQf-Vol7uMkVVYeLu1V0m6K3"
+        }
+      ]
+    },
+    {
+      "v": "KERI10JSON000106_",
+      "t": "ixn",
+      "d": "EI0n9-3BNW9Q2T_pxJsg4G4gZEwkZkxR_2djYPX5RWPb",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "28",
+      "p": "ECVXdqtXnxpa_IWiGIMk641wZlBvRMPgYIJ9B_3Z4dmd",
+      "a": [
+        {
+          "d": "agent:EBLiCGzZ2OKMRTB_ppJqTQf-Vol7uMkVVYeLu1V0m6K3"
+        }
+      ]
+    },
+    {
+      "v": "KERI10JSON00013b_",
+      "t": "ixn",
+      "d": "EFUPscm76zoX99K55DfMW3_47-vQKQpgXldl8M__f8_h",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "29",
+      "p": "EI0n9-3BNW9Q2T_pxJsg4G4gZEwkZkxR_2djYPX5RWPb",
+      "a": [
+        {
+          "i": "EHD8EcYBcuP5G0FBNMSHK8xXlrtwjEWRAlT7rWxl_gd3",
+          "s": "0",
+          "d": "EHD8EcYBcuP5G0FBNMSHK8xXlrtwjEWRAlT7rWxl_gd3"
+        }
+      ]
+    },
+    {
+      "v": "KERI10JSON000106_",
+      "t": "ixn",
+      "d": "EF5bdL-91KVBT5hOr5ZQw8n8z9X29j2MKNdDTJTf_tBP",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "2a",
+      "p": "EFUPscm76zoX99K55DfMW3_47-vQKQpgXldl8M__f8_h",
+      "a": [
+        {
+          "d": "agent:EHD8EcYBcuP5G0FBNMSHK8xXlrtwjEWRAlT7rWxl_gd3"
+        }
+      ]
+    },
+    {
+      "v": "KERI10JSON00013b_",
+      "t": "ixn",
+      "d": "EGspU7odwwdZRc9pGzQku_QFF0uHj6qvGD2oIot4AaqN",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "2b",
+      "p": "EF5bdL-91KVBT5hOr5ZQw8n8z9X29j2MKNdDTJTf_tBP",
+      "a": [
+        {
+          "i": "EPQuvGHYnhJhBcfOV3aIkTl0vqbAKeLLjTH782wCrUl7",
+          "s": "0",
+          "d": "EPQuvGHYnhJhBcfOV3aIkTl0vqbAKeLLjTH782wCrUl7"
+        }
+      ]
+    },
+    {
+      "v": "KERI10JSON000106_",
+      "t": "ixn",
+      "d": "EJypCLLsE87Bq3CJSQAotrK0x74idiMe6i7MRaK43yrd",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "2c",
+      "p": "EGspU7odwwdZRc9pGzQku_QFF0uHj6qvGD2oIot4AaqN",
+      "a": [
+        {
+          "d": "agent:EPQuvGHYnhJhBcfOV3aIkTl0vqbAKeLLjTH782wCrUl7"
+        }
+      ]
+    },
+    {
+      "v": "KERI10JSON00013b_",
+      "t": "ixn",
+      "d": "EEzQsJiNq42cViIqZA_QtKnTZuPZuYNGu39Kf8soqrZT",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "2d",
+      "p": "EJypCLLsE87Bq3CJSQAotrK0x74idiMe6i7MRaK43yrd",
+      "a": [
+        {
+          "i": "EFRgbSmevoMh3jUiRutNBVQz9PyPimWJW8lBBElQS6mY",
+          "s": "0",
+          "d": "EFRgbSmevoMh3jUiRutNBVQz9PyPimWJW8lBBElQS6mY"
+        }
+      ]
+    },
+    {
+      "v": "KERI10JSON000106_",
+      "t": "ixn",
+      "d": "EJGiPkCFqlY1tLsXidG-Dc5a_FIMx258xD8H4TVBPN42",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "2e",
+      "p": "EEzQsJiNq42cViIqZA_QtKnTZuPZuYNGu39Kf8soqrZT",
+      "a": [
+        {
+          "d": "agent:EFRgbSmevoMh3jUiRutNBVQz9PyPimWJW8lBBElQS6mY"
+        }
+      ]
+    },
+    {
+      "v": "KERI10JSON00013b_",
+      "t": "ixn",
+      "d": "EFSjJla010TMfJLKLc5lm-ALJMOuePpBdWs8YMp1SKe4",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "2f",
+      "p": "EJGiPkCFqlY1tLsXidG-Dc5a_FIMx258xD8H4TVBPN42",
+      "a": [
+        {
+          "i": "EDcmK6onrDzdFgEqI6OYjJZoGy2gSCdaO_dVKLJWsb4n",
+          "s": "0",
+          "d": "EDcmK6onrDzdFgEqI6OYjJZoGy2gSCdaO_dVKLJWsb4n"
+        }
+      ]
+    },
+    {
+      "v": "KERI10JSON000106_",
+      "t": "ixn",
+      "d": "EFJP7b_mCunyd6_kZwCj1GAXfSWbo7gOxVZ2BedKMAMl",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "30",
+      "p": "EFSjJla010TMfJLKLc5lm-ALJMOuePpBdWs8YMp1SKe4",
+      "a": [
+        {
+          "d": "agent:EDcmK6onrDzdFgEqI6OYjJZoGy2gSCdaO_dVKLJWsb4n"
+        }
+      ]
+    },
+    {
+      "v": "KERI10JSON000100_",
+      "t": "ixn",
+      "d": "ECeploKPS8cl0gbwVwecou6-4k8AgUW_0ifvL5mN00cB",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "31",
+      "p": "EFJP7b_mCunyd6_kZwCj1GAXfSWbo7gOxVZ2BedKMAMl",
+      "a": [
+        {
+          "d": "EAHITZSkghD68_Tp4blT499CtXVt4kcczuflyv_GCIgQ"
+        }
+      ]
+    },
+    {
+      "v": "KERI10JSON00013b_",
+      "t": "ixn",
+      "d": "EAJb8cBinIhepHswXRD7_VfyyKKvc_jtJRLRe5af4O-L",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "32",
+      "p": "ECeploKPS8cl0gbwVwecou6-4k8AgUW_0ifvL5mN00cB",
+      "a": [
+        {
+          "i": "EHVCdLP79CXEc7xYjwtwp_Q1_MguwDmhEYFMZevOXIZ5",
+          "s": "0",
+          "d": "EHVCdLP79CXEc7xYjwtwp_Q1_MguwDmhEYFMZevOXIZ5"
+        }
+      ]
+    },
+    {
+      "v": "KERI10JSON000106_",
+      "t": "ixn",
+      "d": "EBfvjHfQ4jYKmzvN2PnxTvj4Aw_B7OsTIg5-H2iYDlHk",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "33",
+      "p": "EAJb8cBinIhepHswXRD7_VfyyKKvc_jtJRLRe5af4O-L",
+      "a": [
+        {
+          "d": "agent:EHVCdLP79CXEc7xYjwtwp_Q1_MguwDmhEYFMZevOXIZ5"
+        }
+      ]
+    },
+    {
+      "v": "KERI10JSON000100_",
+      "t": "ixn",
+      "d": "ELGBW2v3MOeP1OxMCG2tVRMmkV88GLgJ7JSr9wDvZyHF",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "34",
+      "p": "EBfvjHfQ4jYKmzvN2PnxTvj4Aw_B7OsTIg5-H2iYDlHk",
+      "a": [
+        {
+          "d": "EAPrQNvafRnyielKEJvOuwgwR16Q-DvQnTZFcGNYzLaD"
+        }
+      ]
+    },
+    {
+      "v": "KERI10JSON00013b_",
+      "t": "ixn",
+      "d": "EEx0eh-Y2uyeaIIj5g6Xjj4Z7nhRftfZdJl3Ty1pgIQi",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "35",
+      "p": "ELGBW2v3MOeP1OxMCG2tVRMmkV88GLgJ7JSr9wDvZyHF",
+      "a": [
+        {
+          "i": "ECzFpM6abrCSSpiki8v_qJHAOii2jg6556PRB33z1AAb",
+          "s": "0",
+          "d": "ECzFpM6abrCSSpiki8v_qJHAOii2jg6556PRB33z1AAb"
+        }
+      ]
+    },
+    {
+      "v": "KERI10JSON000106_",
+      "t": "ixn",
+      "d": "ENUPVw-rJCWKdroSnPCTz1sVqid75wbjA5_3luNKYs5x",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "36",
+      "p": "EEx0eh-Y2uyeaIIj5g6Xjj4Z7nhRftfZdJl3Ty1pgIQi",
+      "a": [
+        {
+          "d": "agent:ECzFpM6abrCSSpiki8v_qJHAOii2jg6556PRB33z1AAb"
+        }
+      ]
+    },
+    {
+      "v": "KERI10JSON000100_",
+      "t": "ixn",
+      "d": "ECKxbuiSrA1Wz0CvuaRowsnQu4iz0htxyrVtSBeuGlT7",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "37",
+      "p": "ENUPVw-rJCWKdroSnPCTz1sVqid75wbjA5_3luNKYs5x",
+      "a": [
+        {
+          "d": "EKycxqi4Ax4bQu7ykkxSKZ6L8uRD5pAW8zA0abpCsJrD"
+        }
+      ]
+    },
+    {
+      "v": "KERI10JSON00013b_",
+      "t": "ixn",
+      "d": "EAoV5o_J_KoP48XUFbx8UUnfPJADwc9HG2NBghs7XE4l",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "38",
+      "p": "ECKxbuiSrA1Wz0CvuaRowsnQu4iz0htxyrVtSBeuGlT7",
+      "a": [
+        {
+          "i": "EE-k7tp1lVfa8Ru9RNy-JQgeHYfFtaI6BR3hDbd9KGmn",
+          "s": "0",
+          "d": "EE-k7tp1lVfa8Ru9RNy-JQgeHYfFtaI6BR3hDbd9KGmn"
+        }
+      ]
+    },
+    {
+      "v": "KERI10JSON000106_",
+      "t": "ixn",
+      "d": "EKeBwE8ZPibJzW2x5a90zFxU4hVVuHCnmmmaokv0Khum",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "39",
+      "p": "EAoV5o_J_KoP48XUFbx8UUnfPJADwc9HG2NBghs7XE4l",
+      "a": [
+        {
+          "d": "agent:EE-k7tp1lVfa8Ru9RNy-JQgeHYfFtaI6BR3hDbd9KGmn"
+        }
+      ]
+    },
+    {
+      "v": "KERI10JSON000100_",
+      "t": "ixn",
+      "d": "ENIlsM7qv5s3JQKz9ODeLTbqA-SCarl8-h-nd_11Uasb",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "3a",
+      "p": "EKeBwE8ZPibJzW2x5a90zFxU4hVVuHCnmmmaokv0Khum",
+      "a": [
+        {
+          "d": "EH_KlJMOL2WX56Zy3ClMkZxnxpCcv4Ohe_4WRlBRy7o-"
+        }
+      ]
+    },
+    {
+      "v": "KERI10JSON00013b_",
+      "t": "ixn",
+      "d": "EHeCPO5i_7h7V-ssLAlnVCoxWjFS2jaJQRerZzdB0ZRU",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "3b",
+      "p": "ENIlsM7qv5s3JQKz9ODeLTbqA-SCarl8-h-nd_11Uasb",
+      "a": [
+        {
+          "i": "EFE_IQRzArN0vTCK_8b0ef68uL7_EO919AEsTpuWB8wv",
+          "s": "0",
+          "d": "EFE_IQRzArN0vTCK_8b0ef68uL7_EO919AEsTpuWB8wv"
+        }
+      ]
+    },
+    {
+      "v": "KERI10JSON000106_",
+      "t": "ixn",
+      "d": "EK0xweO7Oz5ic4-aQqznhCuu3_zUUkr4Mq25m_aTY9Kb",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "3c",
+      "p": "EHeCPO5i_7h7V-ssLAlnVCoxWjFS2jaJQRerZzdB0ZRU",
+      "a": [
+        {
+          "d": "agent:EFE_IQRzArN0vTCK_8b0ef68uL7_EO919AEsTpuWB8wv"
+        }
+      ]
+    },
+    {
+      "v": "KERI10JSON000100_",
+      "t": "ixn",
+      "d": "EMzho2jaXZLeRsFeXA91Fkb1kwoYf2T7uGksSXhnsJWB",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "3d",
+      "p": "EK0xweO7Oz5ic4-aQqznhCuu3_zUUkr4Mq25m_aTY9Kb",
+      "a": [
+        {
+          "d": "EBJ9gKC0OGz3vsoROW-DtWxb3JMNBpoik-QzA4CFtMKw"
+        }
+      ]
+    },
+    {
+      "v": "KERI10JSON00013b_",
+      "t": "ixn",
+      "d": "EMsJqivBbky_Cz2TbGzJGpaVKlj4uovYNdDuXAezoKE1",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "3e",
+      "p": "EMzho2jaXZLeRsFeXA91Fkb1kwoYf2T7uGksSXhnsJWB",
+      "a": [
+        {
+          "i": "EOtdnfmn4wkvMqUX4374wkHzXIs0WgA7zFVNJGL3cLvZ",
+          "s": "0",
+          "d": "EOtdnfmn4wkvMqUX4374wkHzXIs0WgA7zFVNJGL3cLvZ"
+        }
+      ]
+    },
+    {
+      "v": "KERI10JSON000106_",
+      "t": "ixn",
+      "d": "EOsrZeY-Qvg4UoudsG4UzxZ0YdvfKzr4h3tcNKcmSjv4",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "3f",
+      "p": "EMsJqivBbky_Cz2TbGzJGpaVKlj4uovYNdDuXAezoKE1",
+      "a": [
+        {
+          "d": "agent:EOtdnfmn4wkvMqUX4374wkHzXIs0WgA7zFVNJGL3cLvZ"
+        }
+      ]
+    },
+    {
+      "v": "KERI10JSON000100_",
+      "t": "ixn",
+      "d": "ECsL78mL9mebB82DcyHmSfWAJitgChuqBnIum089FYIz",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "40",
+      "p": "EOsrZeY-Qvg4UoudsG4UzxZ0YdvfKzr4h3tcNKcmSjv4",
+      "a": [
+        {
+          "d": "EBoiarAtPedNt72454iJ-QgL41_jOdUZ29_u1ARztnJc"
+        }
+      ]
+    },
+    {
+      "v": "KERI10JSON00013b_",
+      "t": "ixn",
+      "d": "EKN8xvUvJ-m3FEdW4NCxOcjpXKtoBL-vm5vAycCdl3ut",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "41",
+      "p": "ECsL78mL9mebB82DcyHmSfWAJitgChuqBnIum089FYIz",
+      "a": [
+        {
+          "i": "EGBVjMs3qkVEel7os20R3WHNiI5DNJlVGbhkNTr12wbe",
+          "s": "0",
+          "d": "EGBVjMs3qkVEel7os20R3WHNiI5DNJlVGbhkNTr12wbe"
+        }
+      ]
+    },
+    {
+      "v": "KERI10JSON000106_",
+      "t": "ixn",
+      "d": "EJkGLPqsHNRKx_ktfLaJ_E7O5Wydm000ckXj3VJ0XTFb",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "42",
+      "p": "EKN8xvUvJ-m3FEdW4NCxOcjpXKtoBL-vm5vAycCdl3ut",
+      "a": [
+        {
+          "d": "agent:EGBVjMs3qkVEel7os20R3WHNiI5DNJlVGbhkNTr12wbe"
+        }
+      ]
+    },
+    {
+      "v": "KERI10JSON000100_",
+      "t": "ixn",
+      "d": "EC2RF5vCUCplNOYiKT1cIoW1zkwvXYixj-kdOY31mq6i",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "43",
+      "p": "EJkGLPqsHNRKx_ktfLaJ_E7O5Wydm000ckXj3VJ0XTFb",
+      "a": [
+        {
+          "d": "EILi3XVOkZfEQzgVf_9CX4GG9rCp2flh3jAAR4RJiiZg"
+        }
+      ]
+    },
+    {
+      "v": "KERI10JSON00013b_",
+      "t": "ixn",
+      "d": "EP7Tz8VKDXw1Lb9foNwsZ4tXBUD6ZoDnpJiWUq7u5jiq",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "44",
+      "p": "EC2RF5vCUCplNOYiKT1cIoW1zkwvXYixj-kdOY31mq6i",
+      "a": [
+        {
+          "i": "EGXg8l62pI8_ig0JiIHMkKyGKbJHdWMpIhb0W0niK86y",
+          "s": "0",
+          "d": "EGXg8l62pI8_ig0JiIHMkKyGKbJHdWMpIhb0W0niK86y"
+        }
+      ]
+    },
+    {
+      "v": "KERI10JSON000106_",
+      "t": "ixn",
+      "d": "ECb3rP3-DITwmS0_W4P09-X3bG_ZdeeUiVx0uNOn4nHy",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "45",
+      "p": "EP7Tz8VKDXw1Lb9foNwsZ4tXBUD6ZoDnpJiWUq7u5jiq",
+      "a": [
+        {
+          "d": "agent:EGXg8l62pI8_ig0JiIHMkKyGKbJHdWMpIhb0W0niK86y"
+        }
+      ]
+    },
+    {
+      "v": "KERI10JSON000100_",
+      "t": "ixn",
+      "d": "EJuIcSRvEyQIo4KBSIxx7mVOVcN_Q4m-zbuaT92pYAss",
+      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "s": "46",
+      "p": "ECb3rP3-DITwmS0_W4P09-X3bG_ZdeeUiVx0uNOn4nHy",
+      "a": [
+        {
+          "d": "EC26tael_VawbhaOMthHhIXbVXvppx97zJQc0gTmVDLv"
+        }
+      ]
+    }
+  ],
+  "kel_attachments": [
+    "2d4141424141417877504838766b56354c766b697652353842764a524a766e49416a53415a6331714e385a3072636c444d49317132454a4f754a6e61507931304d6b675f3363755f525a7570696639646565656459586a6455415f34",
+    "2d414142414144696a3038345f61366a637153616f63636e4a4d62305259495237634e725464354439355f612d754f59525f635051736b5457455049452d386777764f33576131687161754a643952706d3258752d71625368467155",
+    "2d4141424141414f705763614767782d2d4e75524d593853506f7a346d6850734c5247645752423962353645654954572d6e6b79544b695f76706c7241676857665875653169685f4147634b424c7257433378746676595534497369",
+    "2d41414241414463705f6b6a6c3551684c3067764266744b70587176554953714269443679533955694a5a4330315f6d43617a6c414d48324f794b2d3953304a44787462545a384f316a4a4234686679456d4d785572413269636f30",
+    "2d41414241414132704e4a43317138376a66743636476151503334344a7166337132627537397732684555634f684e4e7768622d30476b6741494d726d6b6d2d6a37426c305f462d4c487772527549486874394e6168472d4f333152",
+    "2d41414241414172347475664c3078463833436470306e685f675761492d6d4a5971705879665a52466969307269756b41657739743371644c78445548337768475755436c504f54305a7664537756564d794378586d78327a666136",
+    "2d4141424141427041646c717a662d75635a61394845736c6c626b546633444867457a717044696c486943486c2d6846775849554778486c453136695961305570792d6233625a6f695357624c555f316658573148484e5f6863374d",
+    "2d4141424141436d4b366f4a7335415946743639702d5a5552434c596a696f6447377233366a38326e6a3644572d7a6151496d3856745f35346a4c4d7556494f78587569387548754f4f4667705346514a2d36766e64507646727851",
+    "2d414142414141784b59343473366b59356b72446f495975417432526b4a4a357a657732744552505a49424e5371767167737454476e43757a5055564851744152584264704a7261767946685f39527831487172396a31384a2d4457",
+    "2d414142414141495f4b55594b4f73764e62326f4c7473556c6d61536965436b714f6b334b7935546c336c722d52574834653954525571786b63756a34375065726e536a615653742d6d47463771734453395764725178346d526d2d",
+    "2d4141424141425a484831596835716553506b744d56316a4e456673366f506561525f45727265354f706232756d4334772d46426f557850634c776f7361326a507a6d3969554448754e677a4d4d58314d42483334384c41724a7569",
+    "2d414142414142514b6478305f794a754657466c55704f3550714746316e303979762d6b2d35467873715043385a72745959745f357532734932445749744b6d4359434339306b7a4d532d556b584c4a7a7a454d4371696676724579",
+    "2d4141424141427a526777374658754d575a7354594a326b79784965447947327a63326c3170424d35436d6c475f5a4d64394c63646b417746693263774e4f7043433937416472624677724e774f4765356f584f443067535f634e44",
+    "2d414142414144575161325572665f635762554b72366250366a47626d4257386950554d395655425a4f71745f426a492d75656371564761495f664a3869384153754e55693872426d7076392d7475752d4b7243656876513043364d",
+    "2d414142414141536f37557a575f32496a4a68523750334477673543447462426e31564579625468426b534c44464c6b36556d706877472d4450584e676a41624b5a56584b3661316d345a314941574d355447735248412d78524352",
+    "2d4141424141424375476f526c676d39784b787854466f7266567361517a324e647374647259686d364e55515679412d67333177522d6c4c734c46353456504a304f6678386d6c7068654a556d656735384333746658546b67517338",
+    "2d41414241414370344667677556413036673130384f304c3268334a427776454b4333724578654d7931534e744c656947442d636255724941354c49596f73442d33734b74374644414f3277716a6d3735554152346535636c744958",
+    "2d4141424141415039416d6d54735576754f596838727562683651476a734c537130384255497868686a334b3369496c732d5341562d7771314e794f5f53326d4e6861714161664d61316d55487834775a674975675a324679577066",
+    "2d4141424141413649556e334e44446357637153736749645939574e5a2d6a655848513141776a76464f376368754d4e37507a62707978496b79546c416d62434945654a6a38426835626b6d306b4762657a5a436b4c7461694d5f38",
+    "2d4141424141413034686b434631686137537231794b464a4c52655273793347686833312d39672d706a7371495658364850396236336b644d376d55566a6a597238696d4e626761352d51413556544c74534b6230744e5f43627832",
+    "2d41414241414279726d6669514241717650735f566f5f6a52504654776d74446365735357344354426a714a3137486e4a765661796f58726f486f3030594559534249687134696b6b776c356179466c684d44536d42526d54786165",
+    "2d414142414143514a5043494a444a3449446e37666e6447415938317976424b7268536e3354504a4b42356f6155386b32576533747033322d454d764f5a526c4f3930657353576e4d31764a467830416e7835723230512d56734c45",
+    "2d41414241414461347433486e444353714d7476595233687235694e6769434b356a616878376c354749646d336d7635325a347a7753354330323534334654766752665077797a6d6b55466a4f7330394c64504452786f7262302d47",
+    "2d4141424141446a425f6d30464237354f744f3874627776324531325a54586941786d522d516e33757a6a355a6f704e433958624f774b5a716f6c75552d4e4552745a53546f59636741595458676e68646568527348594e7743616b",
+    "2d41414241414470767163656c4875635971523262414f776b3554346c50667a764867744a7a5546354f446538654f67334b746d36625648566f4736347a6c596c4775615037755030466764424b746349424a677865747556695f39",
+    "2d4141424141414f5349327a432d4d424e7a4c69335461556c6b7969522d73344b6a4a4772317970535a766558694b35474e736a5036776730464d747072714f576c564a4a6274794f7669536a4a53757933457368702d616d616971",
+    "2d4141424141427234493551326c6553354833425536424477424b4d5571616930384d6a79516e6a6c4f726f2d3461545736422d4b72415174346b4e5442506e7865745665342d6731445372313354597a6f674875304857475f422d",
+    "2d4141424141445f53645642446a7531554e535f6c4761486231467054556b375478743632377541456f4c6568694f4368334e3667375f4b765770694d6a6d7a416844614f63724441514c4a5a6c696e524d6f5f4a66364d72774e58",
+    "2d4141424141446c69584447737a5a5875746c504665736c3336307268575a4271686567785f5970316c6f53615755545674556638704e397a62375456336945376c4b7337434371306f5a4569317576575275524a356c7752596652",
+    "2d41414241414470655059677437375f437034733268616c48696c5172456c5f664d4c5f7273667a2d467042425f5a6d6d4458366262374f4d5371506b343664662d50557669627870647648556a7953796b79423044336966576743",
+    "2d414142414144467578672d7066762d474d5963716e77453757505533595f4c4f41366b61364a6d37436372476e5f5231554e666b3976575a442d4a314a30315f3851423246646376566350425f3048672d574c3151392d474a7336",
+    "2d414142414141306e6d42576155327542586d4f6a5642516c37485646634131356f373158634c31715a5568316e655f4d756f7457575672373069503969455255544e327541685f725046696a32762d613430675657414841585554",
+    "2d4141424141444b447175305a61785a65655f72757474635958534e357867437a2d44503330346c744d715563666c56626576666b6a5f704b7148776d6e7470676d6576656f58717553536e556e36366d4e764d467654794f514235",
+    "2d4141424141444b77526e444b42614959306a6f6a31524d414b52526f494b444739793245795343552d57624a53437537363258626176335654555235433756416a54396b5a4a6f4b65715154757a6b39646d4c4d69344561456e70",
+    "2d4141424141426f4c7a594675477669357847626257356f75482d586c774867646e686c477a434644556366626d6d6e64456b4a6d6b2d51774c4d476731444367396842667879384b7151397648736c745a6c6c5f5a2d63596b376e",
+    "2d41414241414458746b47357330514e56536f396a5a6a4658416b51565130656776714a575137522d597135455f4838455a314f4541374f3354646659474c77574462594d72366d396e436275712d66645357505367684c4f706d73",
+    "2d4141424141424663614232446e4767666c52456342413768442d69456f766c325a7561724b4c34316971767133637932624d6568666c7343386e7578782d636e686d554c2d4252736e5f796d7a34697473666a6d515f5a6462716e",
+    "2d41414241414233766f4e6e6264635f6e6376314f656c736b55315f324d776c50454a73555456436c686f4355394a742d5a3859756258506e626d757050525836683945746c5a63525542714f305771414a376145704f365f705970",
+    "2d41414241414470426d782d3362426543534d5a397a567a6d793276473650505a7957744d3141736377642d61636b586c345558434c7043423065514836347677694b7449746676334a764c50626742456651636673684778743633",
+    "2d41414241414374456b6a4158564d447761467044383970623467555f336471465738514b68477274547850425a33537835384a4879724d326f487a526373566f765f6f4a694730514c6e66345a30524b7257436468565857463468",
+    "2d4141424141434c6b2d6e3753785765476a4e62496b356d645776487258696741585479685631484a714f326976636b68666c44375a4c594a316548376264486d656964786435504948665a385a47315036307830586b6b754c3777",
+    "2d4141424141434f706e5f362d497966424f6844657047424436304258503633584c546876455a35784f69664f4747533578374c6658646a61356f703833436158586c78455f6445636b5367664836344d7532354531536537794c45",
+    "2d41414241414139327465636531795858556a5f5444564553476c6f455a4549575333434468782d6d49594f426f6368746b5877495274516a3637575f6241434632725478525843374143437170754e614843587235736d685f5234",
+    "2d414142414141364a347a786a6570673539793242345444444f4e35707053636c5a6d574a6d45653630567062486d613275714e6157324b6e6e6a4f426c57693171334e61443050714336487364377a5f673062654d4a465974444d",
+    "2d4141424141434565426765593666434c6271527767575f79554149674d75676d5142584a6d4b56695665496c496a50555930795378357945646a3163715969425056644d61304c6f46477434393065735536715544397059726a6a",
+    "2d414142414143324b6246665850305f797a7332684a58743937306a5479417566655779703676746c796e55526b6a6c7765334e7239375f6b6c347763345942474769557370356e6179483977484971626749483946336f2d392d4c",
+    "2d4141424141446d49306148734f3465727552527077503237347553312d665a2d32695f4b77646848676547756d3339585859315a66554a754c5645696e52467055646b59335973646d4a4b342d45462d6870593569517a4d6c6f5f",
+    "2d414142414141494b31356f425f4254426359766d4b71456a734c644245795565487147554f2d73464d755636716e76796d3964594a30587044524e4c3868414f53536835424f57397036494a485237636c63567950584d65367664",
+    "2d4141424141413878476d347a424c473767486b754774595139384a6969617047546a3074787a65367555726839465978625679355f79656e514948656936525831654641674873784d44427965584f697259734448423633554179",
+    "2d41414241414445734e476d78676651794c79323864424649482d76656432435342475735444a626a6c76495f61314e6d5749496f34424970444957304970656355794637617a445f774341504e57774d7a2d30396e497570697962",
+    "2d4141424141447135745a554e4b685a4f2d624862354b57354a6c414a6e5154792d50664b68427a38734b737856474e526e4d643468534642626b516a475177385761354252544b5232536b73736b2d323746434c784f6572414953",
+    "2d414142414141514a6332773346624c5450454e564e3776626b714f7632465670394962305448704b4b765179704d6251774c5a4c4b495a715875316b426149326e4b4e38677374366272465338687148795f516e386267594c6950",
+    "2d4141424141425768544557687574743944664c374f4277526a474e6656644a684a51326f53546c49752d68774d3250525953657a34774a326f336d37547562687a31364a7a52726d527755456a6c775f397136705f58716e427839",
+    "2d414142414143724674796844346e556d44344c375f32534b654b58565975735435737250445374655532484250357a5032737750746451763857535852546837706863475454467235344255464a64744d7369384457736269346c",
+    "2d414142414142396a777435337556697a586a7154736d774d316d7547527861646d31396d622d75334151457061634c6f43625a53755a534d4a68536a456f445a764a616a6d6331524573793747536f63444c4c663053743054476e",
+    "2d4141424141426361504b425375424d556c496c34726c4a627a7470735f7541575f353955504361756157595555474279434932323670565866484f67544d737a643858414a74335038366c6e51674c61303859496648355f504967",
+    "2d4141424141434f586d4f3453426e5161585541364e6271474a5f5f5630766b654a317553324e38376e48794a685f4b677556396f493765765477676545595165785070745172707875757130394f5271654e6d35644a3674565862",
+    "2d41414241414164324178524638676354376f5a4651596375417867526e76694e774d376131354b6c6b756363344c6343504a4b396c6a504376353564314d7a6f6e4d6a76575a526c544942346570716f7542446c6737695a514936",
+    "2d4141424141434e384c576a6e4448764a54586c574f61527a367552436e586a454f495a77547a6b5a795a313964615976494338434d415256715f62454462734163357068746d4255334c4a63376d3368716679527171536c6b6c6e",
+    "2d4141424141436c524532785056327648523061424e61746767447638726838437768393444554659613247365f50344365544d6c42446b726e68716c794a35546451526739535866627a686a6c37737064426f2d4842314e49612d",
+    "2d41414241414157514b5642516e457955477446614f4245626e6c666544663264392d667472444d597676457645775f33554b327a7847564a5865425a5238356a7768594e53746255383568684975486b4e614c5a7a7357584f6146",
+    "2d4141424141414a4f30724c686455536839774d394e5933533368644673564e4e4b566138316549775f7930325a596d76565576446d674f736a6d2d493975516e7967567a526947474c6c67387a30454a753042426f663063436242",
+    "2d4141424141427154334c653334674f796558366d68736d7155354a324f524473753954423448716b6273734a42754c4b6d4b5234433850394258747a786e30436e5f5534646e636f334949776547664c7a44463548394e66313375",
+    "2d41414241414365626d546c5949366e763464576d6e7364774855585658494a65324c6e346b3250797a2d4a4c37554b496d614a304b3844666a327378457063465f4331664a6c7466526149496b4d6c38436c3366545f784b314c47",
+    "2d41414241414263445a793757436f3039636b75566a41755f4d4d794e464e70453543453662514e49546657643563737263696d726b4d48756c596d59323051345a4330514248355966347448715a3938456c35363675724d4a466f",
+    "2d4141424141424f6c2d67454c536367444232366a5931436a3467644c716e756b7a7a5647507439434d71726b75383056797a5f666337445f376d4d59334e593463676f6d724e625a36455a76526d754b5779545452693048637a72",
+    "2d41414241414461694c75654b42746d555a4c3333634a55534a533562363338656b7176375763766b4a58424d43634a7468543545517a77473646326f4f56575a4b693756356873764c35574b6a71683975586645354c63436c4270",
+    "2d4141424141436c696a4a4e4734706b61433759594641494a6e64454b324445374c6f79486f676c303054483739506c394f664d4a6c7630457355346b3750565571694f77566e5550656b784b694e414533525368785331444a536a",
+    "2d41414241414362665943726a726f5275374d3951796375547363553930374f466f496a58795a794b7a316b5f5f577033394e356e4146396759616b506e64544e536f744244356363776d51304e7246786c3247714c624a514f5452",
+    "2d4141424141444c396551334e766e6b34786c616f5f58475f73323462494e5f65675a717a6d7a70356476746e432d6c727a6664614647706c497254574d2d653547385249696239536361766f4a4b524e6a714d3964766448464a37",
+    "2d4141424141444c4e326f75335236677077554972573459412d364d4c434551546a644d6348524f6a617158415879624450486232595339743346794f6c5a3356425a5535774f69754b2d65515871464150477a705671325a685f7a"
+  ],
+  "device_kels": [
+    {
+      "did": "did:keri:EAmNROPhe_6Nmq_IUvxlQAccnwZoImyPtwF5ZfXhZEXk",
+      "kel": [
+        {
+          "v": "KERI10JSON000163_",
+          "t": "dip",
+          "d": "EAmNROPhe_6Nmq_IUvxlQAccnwZoImyPtwF5ZfXhZEXk",
+          "i": "EAmNROPhe_6Nmq_IUvxlQAccnwZoImyPtwF5ZfXhZEXk",
+          "s": "0",
+          "kt": "1",
+          "k": [
+            "1AAJAnNU_FCsKS_ypOGqRRLXmSIEOUpiNpMPLrZDCRjwVab5"
+          ],
+          "nt": "1",
+          "n": [
+            "ENiJkMroiHJr2LiJkbY9exjYYK3SVEjrhJMqd7Jr73JY"
+          ],
+          "bt": "0",
+          "b": [],
+          "c": [],
+          "a": [],
+          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
+        }
+      ],
+      "kel_attachments": [
+        "2d4141424141423562706f476f57544f30523247765649425f7379636438444d74377372366c4172666b3855564253695a78637978377234516c70557568726f7278563542302d4474617a6e6b5a385a4a5644725a38394a474458492d474142304141414141414141414141414141414141414141414159454e46713736325a704f693550585372524c56735863435376347648784735734e73494139753162626f464c"
+      ]
+    },
+    {
+      "did": "did:keri:EB46LmlwowYkoVNeSxMVs68LRc7g6vI1hsPnCUBtzKjt",
+      "kel": [
+        {
+          "v": "KERI10JSON00015f_",
+          "t": "dip",
+          "d": "EB46LmlwowYkoVNeSxMVs68LRc7g6vI1hsPnCUBtzKjt",
+          "i": "EB46LmlwowYkoVNeSxMVs68LRc7g6vI1hsPnCUBtzKjt",
+          "s": "0",
+          "kt": "1",
+          "k": [
+            "DNXo-V5u8_vuBzkKYoaRRCO2DnaqYbWlTqHvHRowIjSq"
+          ],
+          "nt": "1",
+          "n": [
+            "EMf_-qFIcaO8PCkHnTQ1kg7lsD5_QAsAj94Bo4Fu7UHi"
+          ],
+          "bt": "0",
+          "b": [],
+          "c": [],
+          "a": [],
+          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
+        }
+      ],
+      "kel_attachments": [
+        "2d414142414141533962696a475866547550686c48343344435532686659584844697644597937474a62394a5249776a31576f4f594a68784a4e4d6d66727636622d574b4e51485a59722d523270435031454f66423158764d2d6b4d2d47414230414141414141414141414141414141414141414141414645476b566b655f5254336a6270574151316c6d424f58446a614343425f6d4a364c49345277314238724e3559"
+      ]
+    },
+    {
+      "did": "did:keri:EBLiCGzZ2OKMRTB_ppJqTQf-Vol7uMkVVYeLu1V0m6K3",
+      "kel": [
+        {
+          "v": "KERI10JSON000163_",
+          "t": "dip",
+          "d": "EBLiCGzZ2OKMRTB_ppJqTQf-Vol7uMkVVYeLu1V0m6K3",
+          "i": "EBLiCGzZ2OKMRTB_ppJqTQf-Vol7uMkVVYeLu1V0m6K3",
+          "s": "0",
+          "kt": "1",
+          "k": [
+            "1AAJAocN3bzMXukZtY2QDC1KvQ3WRDlDgMYQ0BWXj28wxyuj"
+          ],
+          "nt": "1",
+          "n": [
+            "EFJCLdcZZQpPi20Uj0m83lqHfbVA6DvzOF3mSCfBzKEj"
+          ],
+          "bt": "0",
+          "b": [],
+          "c": [],
+          "a": [],
+          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
+        }
+      ],
+      "kel_attachments": [
+        "2d41414241414264394f7a5465567846314c522d556b38435159653158697744314d63334857315f466630724c416b4c6668625733524177637655776a655753366a3249464c4a552d52624756516569346d354f556667416e4c77342d47414230414141414141414141414141414141414141414141416e45435658647174586e7870615f49576947494d6b363431775a6c4276524d506759494a39425f335a34646d64"
+      ]
+    },
+    {
+      "did": "did:keri:EC9kFyHu8TTeOddjNo6UFa_rc85uh9T2wdJcOuK1smSJ",
+      "kel": [
+        {
+          "v": "KERI10JSON000163_",
+          "t": "dip",
+          "d": "EC9kFyHu8TTeOddjNo6UFa_rc85uh9T2wdJcOuK1smSJ",
+          "i": "EC9kFyHu8TTeOddjNo6UFa_rc85uh9T2wdJcOuK1smSJ",
+          "s": "0",
+          "kt": "1",
+          "k": [
+            "1AAJAy3pgcF3UianvLdfFexKDItFGYb7lSSVb1_Yv39Ay70K"
+          ],
+          "nt": "1",
+          "n": [
+            "EJ8J7CK7AEBXS8IxZNaMF5YuQynOenwM8J3EcucBHSyC"
+          ],
+          "bt": "0",
+          "b": [],
+          "c": [],
+          "a": [],
+          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
+        }
+      ],
+      "kel_attachments": [
+        "2d41414241414469327a4a594a4a4d567a4978447a79586b644e31357362626d6c776c61626334664358384f43573545756e6f68534c335f714952394d457a59507a59304f497132384e534f59736669484456536b4352536f7764392d474142304141414141414141414141414141414141414141414156454d3877415f2d61304548717a4f5964684d4b656d52766c4d424e4a624f7272774d7276734f584873756867"
+      ]
+    },
+    {
+      "did": "did:keri:ECzFpM6abrCSSpiki8v_qJHAOii2jg6556PRB33z1AAb",
+      "kel": [
+        {
+          "v": "KERI10JSON000163_",
+          "t": "dip",
+          "d": "ECzFpM6abrCSSpiki8v_qJHAOii2jg6556PRB33z1AAb",
+          "i": "ECzFpM6abrCSSpiki8v_qJHAOii2jg6556PRB33z1AAb",
+          "s": "0",
+          "kt": "1",
+          "k": [
+            "1AAJA4QYihGhxzTb3CshI8Ru_D5s3vFGl0fW2TSQZl9bksCA"
+          ],
+          "nt": "1",
+          "n": [
+            "EACEQaNaO3OxCm8O1i5GqakCvHgivFeGtma47XBgjdVQ"
+          ],
+          "bt": "0",
+          "b": [],
+          "c": [],
+          "a": [],
+          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
+        }
+      ],
+      "kel_attachments": [
+        "2d4141424141434c394b6a35355670644e78747163556651537355646e6468485837376578424a35414e746e777149515664613058374d66396472364a516551473031635766532d5154486a3547703437315167653662384548654a2d4741423041414141414141414141414141414141414141414141314545783065682d59327579656149496a356736586a6a345a376e68526674665a644a6c335479317067495169"
+      ]
+    },
+    {
+      "did": "did:keri:EDcmK6onrDzdFgEqI6OYjJZoGy2gSCdaO_dVKLJWsb4n",
+      "kel": [
+        {
+          "v": "KERI10JSON000163_",
+          "t": "dip",
+          "d": "EDcmK6onrDzdFgEqI6OYjJZoGy2gSCdaO_dVKLJWsb4n",
+          "i": "EDcmK6onrDzdFgEqI6OYjJZoGy2gSCdaO_dVKLJWsb4n",
+          "s": "0",
+          "kt": "1",
+          "k": [
+            "1AAJAyCESgRoP5hsaBq9OVYBJswBR-h3s0OH5LhVOX8uIaSX"
+          ],
+          "nt": "1",
+          "n": [
+            "EHGAL_4956oahrysPCM5-u6nRPUPhOrjPg3fSc9o2ini"
+          ],
+          "bt": "0",
+          "b": [],
+          "c": [],
+          "a": [],
+          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
+        }
+      ],
+      "kel_attachments": [
+        "2d41414241414334726a79416551426e6e5874393739664f79664b6c6d6f7038562d4f513355385638315a617a386f7250596b616a69576b3876734a63714977786451764659384b6131715243424633563336433551434c326e47752d4741423041414141414141414141414141414141414141414141764546536a4a6c61303130544d664a4c4b4c63356c6d2d414c4a4d4f756550704264577338594d7031534b6534"
+      ]
+    },
+    {
+      "did": "did:keri:EE-k7tp1lVfa8Ru9RNy-JQgeHYfFtaI6BR3hDbd9KGmn",
+      "kel": [
+        {
+          "v": "KERI10JSON000163_",
+          "t": "dip",
+          "d": "EE-k7tp1lVfa8Ru9RNy-JQgeHYfFtaI6BR3hDbd9KGmn",
+          "i": "EE-k7tp1lVfa8Ru9RNy-JQgeHYfFtaI6BR3hDbd9KGmn",
+          "s": "0",
+          "kt": "1",
+          "k": [
+            "1AAJA-GQT0rlldcmweMEqVvnoGSN2Zr9lSyDXZB7cwWBcDl2"
+          ],
+          "nt": "1",
+          "n": [
+            "EEvNQddnALZjQxvCHQb33kkBqnRPbM1CqFJSU8NsLZRC"
+          ],
+          "bt": "0",
+          "b": [],
+          "c": [],
+          "a": [],
+          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
+        }
+      ],
+      "kel_attachments": [
+        "2d4141424141413253773933693836364955652d4755367664326f4d44667077695a684c4d413973716149456b6473722d34504f44575375356274544e554e654c334f5274354f334662306b6b6d6666577643505f57444a434739352d47414230414141414141414141414141414141414141414141413445416f56356f5f4a5f4b6f50343858554662783855556e66504a41447763394847324e42676873375845346c"
+      ]
+    },
+    {
+      "did": "did:keri:EE0slWK6chng-UM42qf1fbtYapx8oZ1yadRIEFYB1m5_",
+      "kel": [
+        {
+          "v": "KERI10JSON000163_",
+          "t": "dip",
+          "d": "EE0slWK6chng-UM42qf1fbtYapx8oZ1yadRIEFYB1m5_",
+          "i": "EE0slWK6chng-UM42qf1fbtYapx8oZ1yadRIEFYB1m5_",
+          "s": "0",
+          "kt": "1",
+          "k": [
+            "1AAJA7ZQwAQlOGKZspbVyKEV-D9-Do10Kdif_xDhabScDgq4"
+          ],
+          "nt": "1",
+          "n": [
+            "ENN9JBMP6MBMqC8GA2-6cqfxO0joPSqii9U-VP65wuFm"
+          ],
+          "bt": "0",
+          "b": [],
+          "c": [],
+          "a": [],
+          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
+        }
+      ],
+      "kel_attachments": [
+        "2d41414241414465774a78623743697362427330354942377148474b7679794a584e49667777496a67354d5f335050376c4e62663163685a7a486e73646e3139565158744666724e745f39576771466348546f647763614a384676312d47414230414141414141414141414141414141414141414141416645505f675a53714236445944676b6b564965344274354c3338583275414569413333654369443137504d3871"
+      ]
+    },
+    {
+      "did": "did:keri:EFBGdabu4x82TD_Wn9gI3qUpDjnK3idAz4qLRS2YmdQy",
+      "kel": [
+        {
+          "v": "KERI10JSON00015f_",
+          "t": "dip",
+          "d": "EFBGdabu4x82TD_Wn9gI3qUpDjnK3idAz4qLRS2YmdQy",
+          "i": "EFBGdabu4x82TD_Wn9gI3qUpDjnK3idAz4qLRS2YmdQy",
+          "s": "0",
+          "kt": "1",
+          "k": [
+            "DM7Fn3BNMxniy7-3mPMsnGf-D0LzbfArArziOd2HJqm7"
+          ],
+          "nt": "1",
+          "n": [
+            "EF2b6jAzpSeVs_ClZbYSP-zCLnSyTSSPQ_XvadOCFiNt"
+          ],
+          "bt": "0",
+          "b": [],
+          "c": [],
+          "a": [],
+          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
+        }
+      ],
+      "kel_attachments": [
+        "2d414142414142637a74747658326335574d575a41785f6c6170454955654a4553736c3438326d5071724867306f734e324849684d622d68786d4b5a2d3671467a32615578753067657774516674637773724f684a6a47326568414b2d4741423041414141414141414141414141414141414141414141474544564d454e4565797a35456b68446643576a53505f5a4d46757a4a464a336f66567645722d574b51534e36"
+      ]
+    },
+    {
+      "did": "did:keri:EFE_IQRzArN0vTCK_8b0ef68uL7_EO919AEsTpuWB8wv",
+      "kel": [
+        {
+          "v": "KERI10JSON000163_",
+          "t": "dip",
+          "d": "EFE_IQRzArN0vTCK_8b0ef68uL7_EO919AEsTpuWB8wv",
+          "i": "EFE_IQRzArN0vTCK_8b0ef68uL7_EO919AEsTpuWB8wv",
+          "s": "0",
+          "kt": "1",
+          "k": [
+            "1AAJA-mwFgLf7m5oF_eHLofLbmW6mcQ9aSYoT57inEoaWxpG"
+          ],
+          "nt": "1",
+          "n": [
+            "EKc79nAsPz2okCA-XZd_UWrY2Q7N6UInPdvt-uUsNohd"
+          ],
+          "bt": "0",
+          "b": [],
+          "c": [],
+          "a": [],
+          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
+        }
+      ],
+      "kel_attachments": [
+        "2d414142414141374f684f676f5a39744a4430576b43644b36757a654e446b6643426f776b537363477363785557326741386a65415246397846304c745457633444535f6a7859444b7764747254724a666f33365a376e5f384e7a302d47414230414141414141414141414141414141414141414141413745486543504f35695f376837562d73734c416c6e56436f78576a4653326a614a515265725a7a6442305a5255"
+      ]
+    },
+    {
+      "did": "did:keri:EFRgbSmevoMh3jUiRutNBVQz9PyPimWJW8lBBElQS6mY",
+      "kel": [
+        {
+          "v": "KERI10JSON000163_",
+          "t": "dip",
+          "d": "EFRgbSmevoMh3jUiRutNBVQz9PyPimWJW8lBBElQS6mY",
+          "i": "EFRgbSmevoMh3jUiRutNBVQz9PyPimWJW8lBBElQS6mY",
+          "s": "0",
+          "kt": "1",
+          "k": [
+            "1AAJAk8hg6w3zV8F3Zg7u18uQ_SRh9cIbJjv53073-nLrREy"
+          ],
+          "nt": "1",
+          "n": [
+            "ELuvmThcN_BdqgDe99li2gPw4qUe3MWeVZWUclQkLF_r"
+          ],
+          "bt": "0",
+          "b": [],
+          "c": [],
+          "a": [],
+          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
+        }
+      ],
+      "kel_attachments": [
+        "2d414142414144397a5773626e5335485f436f5037716e576a7253565a563245513076746b434c676f485063734233594e513934686f487742536e7274366e66527a56646747645057696b356d4b56793459504f396f347a366746302d47414230414141414141414141414141414141414141414141417445457a51734a694e71343263566949715a415f51744b6e545a75505a75594e477533394b6638736f71725a54"
+      ]
+    },
+    {
+      "did": "did:keri:EG98LlhEMtRuQUnBgUVSrtTarbJrSLa7IV-CdQLr5Rpj",
+      "kel": [
+        {
+          "v": "KERI10JSON000163_",
+          "t": "dip",
+          "d": "EG98LlhEMtRuQUnBgUVSrtTarbJrSLa7IV-CdQLr5Rpj",
+          "i": "EG98LlhEMtRuQUnBgUVSrtTarbJrSLa7IV-CdQLr5Rpj",
+          "s": "0",
+          "kt": "1",
+          "k": [
+            "1AAJAw_Cj0KhQ5PsvDWtH6N-UMQIqQ_KdFrfA2DWLCzuvydX"
+          ],
+          "nt": "1",
+          "n": [
+            "ECK3yTETKJjomim3BCFGlRWPkY8A_JJTtcUHO9Yls4Xp"
+          ],
+          "bt": "0",
+          "b": [],
+          "c": [],
+          "a": [],
+          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
+        }
+      ],
+      "kel_attachments": [
+        "2d4141424141444d744377727a33314567713145616c2d59625250386c7972755041594b3261625a4448436b494a3651786b783954304c4744415f50747a2d72357a384749526d6c694f4b53714d37347564577a357657304369706e2d47414230414141414141414141414141414141414141414141416a45434a4e7a4337437058764e6347586b45514d52336c5535436836694d57562d574b4767635a305938556562"
+      ]
+    },
+    {
+      "did": "did:keri:EGBVjMs3qkVEel7os20R3WHNiI5DNJlVGbhkNTr12wbe",
+      "kel": [
+        {
+          "v": "KERI10JSON000163_",
+          "t": "dip",
+          "d": "EGBVjMs3qkVEel7os20R3WHNiI5DNJlVGbhkNTr12wbe",
+          "i": "EGBVjMs3qkVEel7os20R3WHNiI5DNJlVGbhkNTr12wbe",
+          "s": "0",
+          "kt": "1",
+          "k": [
+            "1AAJA4G-PCEva3bfrw2UwicaV-WM233TO5HMjl9NTKd1bfPv"
+          ],
+          "nt": "1",
+          "n": [
+            "EAt_QM6G8TBYalU8ihwhryW_kS_Om-s1XLKH7wdsv_yE"
+          ],
+          "bt": "0",
+          "b": [],
+          "c": [],
+          "a": [],
+          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
+        }
+      ],
+      "kel_attachments": [
+        "2d4141424141436535336931764e4f5a47324c395a50596b364d49507271734b6a546d3078366d35566943343052565559586a6850537a465375755f794c656572503651704b7635476261446432366d356739354e745f4650595a442d474142304141414141414141414141414141414141414141414242454b4e38787655764a2d6d3346456457344e43784f636a70584b746f424c2d766d357641796343646c337574"
+      ]
+    },
+    {
+      "did": "did:keri:EGOV2nwCPgcQ8jrEP8gP2vo5bZdggvnpW_IA8M1iMXeg",
+      "kel": [
+        {
+          "v": "KERI10JSON000163_",
+          "t": "dip",
+          "d": "EGOV2nwCPgcQ8jrEP8gP2vo5bZdggvnpW_IA8M1iMXeg",
+          "i": "EGOV2nwCPgcQ8jrEP8gP2vo5bZdggvnpW_IA8M1iMXeg",
+          "s": "0",
+          "kt": "1",
+          "k": [
+            "1AAJA4OMALEKyIIyMVQCAEtNa3tW4lWr7neDOpLP2jHZdIb-"
+          ],
+          "nt": "1",
+          "n": [
+            "EJ3Q7GnmWK4ebg3J7o3DT0OIZPr9sC5e7DbsOteBZUWN"
+          ],
+          "bt": "0",
+          "b": [],
+          "c": [],
+          "a": [],
+          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
+        }
+      ],
+      "kel_attachments": [
+        "2d4141424141416a682d365331354f43643176535979426e304c2d6c684e386963636e317776366c55375055563755686368584146314b6f38342d4c34474b59657079594e5658573263594367367233446c3546522d7931354943612d47414230414141414141414141414141414141414141414141416c45465a4f5a64424631596263766c3059366c676c6e507345565f644b47747149564a6c4e3272364a6b4f5042"
+      ]
+    },
+    {
+      "did": "did:keri:EGXg8l62pI8_ig0JiIHMkKyGKbJHdWMpIhb0W0niK86y",
+      "kel": [
+        {
+          "v": "KERI10JSON000163_",
+          "t": "dip",
+          "d": "EGXg8l62pI8_ig0JiIHMkKyGKbJHdWMpIhb0W0niK86y",
+          "i": "EGXg8l62pI8_ig0JiIHMkKyGKbJHdWMpIhb0W0niK86y",
+          "s": "0",
+          "kt": "1",
+          "k": [
+            "1AAJA9c5FtA6ztjAApWB4ECMv4j1t5sX_TifHS0HYnxy4Ti2"
+          ],
+          "nt": "1",
+          "n": [
+            "EDKZV2or9d3KGbKMtH_1JeiVhecnUX8lbv2hC-6-rKp5"
+          ],
+          "bt": "0",
+          "b": [],
+          "c": [],
+          "a": [],
+          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
+        }
+      ],
+      "kel_attachments": [
+        "2d41414241414261625848657965382d4d6b573848496866306a7144505071774169344f624d473457436b664c674e574e436348706b6a73465254657a355f765059497a4e7267725237554a4c50694d3636474c48354641554559352d474142304141414141414141414141414141414141414141414245455037547a38564b445877314c6239666f4e77735a347458425544365a6f446e704a695755713775356a6971"
+      ]
+    },
+    {
+      "did": "did:keri:EGpEBKDnvEUv0dsQ1MVaZbBq0qx8p1iLA4AFcNiPlk5M",
+      "kel": [
+        {
+          "v": "KERI10JSON00015f_",
+          "t": "dip",
+          "d": "EGpEBKDnvEUv0dsQ1MVaZbBq0qx8p1iLA4AFcNiPlk5M",
+          "i": "EGpEBKDnvEUv0dsQ1MVaZbBq0qx8p1iLA4AFcNiPlk5M",
+          "s": "0",
+          "kt": "1",
+          "k": [
+            "DM_3EYHf6RSHG-tdXVR_cU-Lvof3rkWYtT-PYhpU-IRe"
+          ],
+          "nt": "1",
+          "n": [
+            "ELnchwp59KdisZ-hIRguRa0t5dl1DigLxwxfr_qWHkHE"
+          ],
+          "bt": "0",
+          "b": [],
+          "c": [],
+          "a": [],
+          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
+        }
+      ],
+      "kel_attachments": [
+        "2d414142414142386f412d6750665f5761363035454339564c7970796a4c4a467570453167777555315f446a6d7450625739546a716b4c59636c77743733397142576a7a4174662d4b757738376a6e67796b597a384d6669535f30502d4741423041414141414141414141414141414141414141414141454544573642616b494c714964693456335a53534155536667686f486b50735f52506f573267494e376475414f"
+      ]
+    },
+    {
+      "did": "did:keri:EHD8EcYBcuP5G0FBNMSHK8xXlrtwjEWRAlT7rWxl_gd3",
+      "kel": [
+        {
+          "v": "KERI10JSON000163_",
+          "t": "dip",
+          "d": "EHD8EcYBcuP5G0FBNMSHK8xXlrtwjEWRAlT7rWxl_gd3",
+          "i": "EHD8EcYBcuP5G0FBNMSHK8xXlrtwjEWRAlT7rWxl_gd3",
+          "s": "0",
+          "kt": "1",
+          "k": [
+            "1AAJAvdLpUa6mAa9eO1P-1QRQ6JBsCL6B3YtFxcUGaYoMPTs"
+          ],
+          "nt": "1",
+          "n": [
+            "EPyf779x2v0Au1hS0_GtYghJGvjcEXpd8bHM8jRGxa-c"
+          ],
+          "bt": "0",
+          "b": [],
+          "c": [],
+          "a": [],
+          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
+        }
+      ],
+      "kel_attachments": [
+        "2d41414241414352766d6e494e715a49324d68304a4753526168504f69413579534a30663859674e7039756a4f6f6554356552672d56374132674e3447414469715f4c754155386877387a465167314876385a66594657695f4e56632d4741423041414141414141414141414141414141414141414141704546555073636d37367a6f5839394b353544664d57335f34372d76514b517067586c646c384d5f5f66385f68"
+      ]
+    },
+    {
+      "did": "did:keri:EHVCdLP79CXEc7xYjwtwp_Q1_MguwDmhEYFMZevOXIZ5",
+      "kel": [
+        {
+          "v": "KERI10JSON000163_",
+          "t": "dip",
+          "d": "EHVCdLP79CXEc7xYjwtwp_Q1_MguwDmhEYFMZevOXIZ5",
+          "i": "EHVCdLP79CXEc7xYjwtwp_Q1_MguwDmhEYFMZevOXIZ5",
+          "s": "0",
+          "kt": "1",
+          "k": [
+            "1AAJAza2YF0AaPZclhnJ6yrMQcO4GtGzq-FuomKffsXxSIEJ"
+          ],
+          "nt": "1",
+          "n": [
+            "EE73VPb0HvrZBCmFOZhdQmAkKE-1aAj4l_eAdkqqqNhq"
+          ],
+          "bt": "0",
+          "b": [],
+          "c": [],
+          "a": [],
+          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
+        }
+      ],
+      "kel_attachments": [
+        "2d414142414142486a694b31774d55395151444f4970675a47796e75576a597a394e6747474e53313131556d34655a6e475769444165466255565f4f784137654450394239334258684f6c716163664a584f41794b4772496b48674f2d47414230414141414141414141414141414141414141414141417945414a62386342696e49686570487377585244375f566679794b4b76635f6a744a524c5265356166344f2d4c"
+      ]
+    },
+    {
+      "did": "did:keri:EIDjomlmJhcp9YOxGQFunPjEmUNs-bG3yuyTX8U43duu",
+      "kel": [
+        {
+          "v": "KERI10JSON000163_",
+          "t": "dip",
+          "d": "EIDjomlmJhcp9YOxGQFunPjEmUNs-bG3yuyTX8U43duu",
+          "i": "EIDjomlmJhcp9YOxGQFunPjEmUNs-bG3yuyTX8U43duu",
+          "s": "0",
+          "kt": "1",
+          "k": [
+            "1AAJA5UL9tSgLE_vkn8-TkZOA7E0LyuOx2ydAGOeWE3OpuNX"
+          ],
+          "nt": "1",
+          "n": [
+            "EL57uv1XeQ3xUEHL6U0DL6TPJzArtSxDIdRgh_wBEUP6"
+          ],
+          "bt": "0",
+          "b": [],
+          "c": [],
+          "a": [],
+          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
+        }
+      ],
+      "kel_attachments": [
+        "2d4141424141436533325a4d6b76495f454f427856776964423131706773426d6333394c693739335669774f5056614f66563364586256766e6332724f5a6c6c7462386e304171793766746f396d49776736584e6d363636537276542d474142304141414141414141414141414141414141414141414161454d36564976427450703364434755313669627a643833586b737a4b44574d42735f5862536c53654a544a30"
+      ]
+    },
+    {
+      "did": "did:keri:EIv02OckbaGFpRONOurWMi_f5_Qf8unjgG5PnVCG2MiU",
+      "kel": [
+        {
+          "v": "KERI10JSON00015f_",
+          "t": "dip",
+          "d": "EIv02OckbaGFpRONOurWMi_f5_Qf8unjgG5PnVCG2MiU",
+          "i": "EIv02OckbaGFpRONOurWMi_f5_Qf8unjgG5PnVCG2MiU",
+          "s": "0",
+          "kt": "1",
+          "k": [
+            "DPYt_OxIt9CqR_4W3LHZLFm092qERcNr5F7716rbuy2h"
+          ],
+          "nt": "1",
+          "n": [
+            "EPz5DqpWQTuIHeVm92lv5aZ0IUeRuNrt1VNd65HWumph"
+          ],
+          "bt": "0",
+          "b": [],
+          "c": [],
+          "a": [],
+          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
+        }
+      ],
+      "kel_attachments": [
+        "2d4141424141434e58784447677344644b4e576c77796b726c6936546e42556863416a6a4b37795948556256796c5f4732483075716c35354b636d646c5665504e4e64786576355068546b454b59717447504e30484f4e54333351462d4741423041414141414141414141414141414141414141414141444547686c4f6e545957756836545141714156496b32745a48345a567157596d4a594f77747a4255436a6c3457"
+      ]
+    },
+    {
+      "did": "did:keri:EKGOZKZrCAPspNZNN1Duli1BOoSd_UhR-BEvyDyP7SaI",
+      "kel": [
+        {
+          "v": "KERI10JSON000163_",
+          "t": "dip",
+          "d": "EKGOZKZrCAPspNZNN1Duli1BOoSd_UhR-BEvyDyP7SaI",
+          "i": "EKGOZKZrCAPspNZNN1Duli1BOoSd_UhR-BEvyDyP7SaI",
+          "s": "0",
+          "kt": "1",
+          "k": [
+            "1AAJA1QSkHK63X9FDNWEdSDpEqHOz6idZcM5lCWuPxOvcsDW"
+          ],
+          "nt": "1",
+          "n": [
+            "EEZYB3n8D8SwNeU0-plXrj8OEl7Co-BllnD_uENqe7q5"
+          ],
+          "bt": "0",
+          "b": [],
+          "c": [],
+          "a": [],
+          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
+        }
+      ],
+      "kel_attachments": [
+        "2d4141424141413834374a52385a6a50634562702d58764155437662485641536a76676c4d4f764a365f46714f56786c5933626c336774504c703153517a6730342d5a6161706d57316e6463363474796e704e307876494d696f546d2d474142304141414141414141414141414141414141414141414165454e58743832786a6d527a62305330374d32523359743965585f565263575f53346654696350536b4868496a"
+      ]
+    },
+    {
+      "did": "did:keri:ELu71pX3phf4hfXwodtm4fmy16acrLporJ_XoNCL00cq",
+      "kel": [
+        {
+          "v": "KERI10JSON000163_",
+          "t": "dip",
+          "d": "ELu71pX3phf4hfXwodtm4fmy16acrLporJ_XoNCL00cq",
+          "i": "ELu71pX3phf4hfXwodtm4fmy16acrLporJ_XoNCL00cq",
+          "s": "0",
+          "kt": "1",
+          "k": [
+            "1AAJA_leGrZj5uhJYEuwU2Vo4YTVbC3hInKzY1IGkH7T82o6"
+          ],
+          "nt": "1",
+          "n": [
+            "EC6VY-JLYO1NXwORNqVAnStq2dNVAvtN7sS5bwz4Sb9v"
+          ],
+          "bt": "0",
+          "b": [],
+          "c": [],
+          "a": [],
+          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
+        }
+      ],
+      "kel_attachments": [
+        "2d4141424141426e654c62574b37797861784547476b486751566a584e4e583273386431472d4541706d394551742d44384b416e65397054674d46503833724a644c5f454244437356656b4632735f3079695247685f596243664c532d474142304141414141414141414141414141414141414141414157454c503872506f5a466b717a4256734d346d2d37482d4876715a42412d675f4278474f666a3047676442646b"
+      ]
+    },
+    {
+      "did": "did:keri:EMEM33xgRvQi6wY0pfVzP_-ce1vU64WBNJddf-LWNX59",
+      "kel": [
+        {
+          "v": "KERI10JSON000163_",
+          "t": "dip",
+          "d": "EMEM33xgRvQi6wY0pfVzP_-ce1vU64WBNJddf-LWNX59",
+          "i": "EMEM33xgRvQi6wY0pfVzP_-ce1vU64WBNJddf-LWNX59",
+          "s": "0",
+          "kt": "1",
+          "k": [
+            "1AAJAmnmEQQTPdSOXluVbzFk99MoiIZtbzRKVzTRX4zJqblQ"
+          ],
+          "nt": "1",
+          "n": [
+            "EFFvFxJL7isJfvZbLoLs1TWARyhgh20jWNLhgeTPpq78"
+          ],
+          "bt": "0",
+          "b": [],
+          "c": [],
+          "a": [],
+          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
+        }
+      ],
+      "kel_attachments": [
+        "2d414142414141767275576e6567716c427066315057344142786d704878584772615f61794e444e5f6d2d6c5367336b737747555a397572734542676849497267394c74326744684e6a585a485935463577746575686f6e796832462d47414230414141414141414141414141414141414141414141416345426c44584f52424a7139746d6e39424b6955554f6b32656179616c727a643954585a5630616e6e3669416a"
+      ]
+    },
+    {
+      "did": "did:keri:EO1cBsYoV5izKvdIL6TstN5TOQl1hYN3WnhtAOh1lwAp",
+      "kel": [
         {
           "v": "KERI10JSON00015f_",
           "t": "dip",
@@ -392,6 +2010,90 @@
         "2d414142414142712d64486638466d33484662743575684461677869677675736d75563651547355435a56334a6d744d32583858764879542d3873416742584f4d34455979697a6d6c7a47556a4f546c5669397270536c615f444d4d2d47414230414141414141414141414141414141414141414141414c45494779415278435972594b6e63686e5f4f735657727a4c4b38655866534c6c716356506c33757238657070"
       ]
     },
+    {
+      "did": "did:keri:EO9pxZBky_Tkd83KnWOnay-J1xjiEkxUF5na-T-boJsC",
+      "kel": [
+        {
+          "v": "KERI10JSON000163_",
+          "t": "dip",
+          "d": "EO9pxZBky_Tkd83KnWOnay-J1xjiEkxUF5na-T-boJsC",
+          "i": "EO9pxZBky_Tkd83KnWOnay-J1xjiEkxUF5na-T-boJsC",
+          "s": "0",
+          "kt": "1",
+          "k": [
+            "1AAJAk8ceN_N6za6x69WTx57g9S-79LrsWj8zJXpxbJ1F64b"
+          ],
+          "nt": "1",
+          "n": [
+            "EAhYMX_05jLx31ljL6RdXwUx5mm7-rUDVN6bQ1YEIrPb"
+          ],
+          "bt": "0",
+          "b": [],
+          "c": [],
+          "a": [],
+          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
+        }
+      ],
+      "kel_attachments": [
+        "2d4141424141446466304838336e764a3051767774377a4672436a6b5065303246504f59726546306564654d5a63567439574576377a467734486e4851443872645a5363416d505034355967684b5767343730663466454c476342312d47414230414141414141414141414141414141414141414141416845446542437a374f533056594e737551374e77336566724b735934366d4d4f4658433936536f577062613455"
+      ]
+    },
+    {
+      "did": "did:keri:EOtdnfmn4wkvMqUX4374wkHzXIs0WgA7zFVNJGL3cLvZ",
+      "kel": [
+        {
+          "v": "KERI10JSON000163_",
+          "t": "dip",
+          "d": "EOtdnfmn4wkvMqUX4374wkHzXIs0WgA7zFVNJGL3cLvZ",
+          "i": "EOtdnfmn4wkvMqUX4374wkHzXIs0WgA7zFVNJGL3cLvZ",
+          "s": "0",
+          "kt": "1",
+          "k": [
+            "1AAJA15zfFjN5y7yyoDLl0glVbsmLf6xG9EIy2zx3pUlOVw6"
+          ],
+          "nt": "1",
+          "n": [
+            "EADehUb9BYq6VZgc3oBK2wnL73gnvvY5--keW-5tpsFL"
+          ],
+          "bt": "0",
+          "b": [],
+          "c": [],
+          "a": [],
+          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
+        }
+      ],
+      "kel_attachments": [
+        "2d414142414144684235426d73544245676f6c437a4538677365496b513671577032545052596c713546386a45543676654e4f475162396a496644626b6c69434b5a70594b595a79304546526673474246676c7937494953536673472d47414230414141414141414141414141414141414141414141412d454d734a71697642626b795f437a325462477a4a477061564b6c6a34756f76594e6444755841657a6f4b4531"
+      ]
+    },
+    {
+      "did": "did:keri:EPQuvGHYnhJhBcfOV3aIkTl0vqbAKeLLjTH782wCrUl7",
+      "kel": [
+        {
+          "v": "KERI10JSON000163_",
+          "t": "dip",
+          "d": "EPQuvGHYnhJhBcfOV3aIkTl0vqbAKeLLjTH782wCrUl7",
+          "i": "EPQuvGHYnhJhBcfOV3aIkTl0vqbAKeLLjTH782wCrUl7",
+          "s": "0",
+          "kt": "1",
+          "k": [
+            "1AAJA0LrRy8BGwg32e9NSommqzL4RgAy5srH3uEhwnUPLY_6"
+          ],
+          "nt": "1",
+          "n": [
+            "EEtSdEmw1-Spz7e-bvDSuX--coTSVqlIL5-w5CGbEKbO"
+          ],
+          "bt": "0",
+          "b": [],
+          "c": [],
+          "a": [],
+          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
+        }
+      ],
+      "kel_attachments": [
+        "2d414142414142586f764d3942655765704f4e743837304c5645587a78506236786e4e766b36477366423579353053414a596f5f32534d786a5f4a2d45704f52324d31582d73782d494d4357686b76704342476830466632736856502d4741423041414141414141414141414141414141414141414141724547737055376f647777645a52633970477a516b755f5146463075486a3671764744326f496f74344161714e"
+      ]
+    },
     {
       "did": "did:keri:EPlN9Y8qKPDEq8gg80D6N_rCN3aANK6xAoMr8OTGJ1tR",
       "kel": [
@@ -421,6 +2123,6 @@
       ]
     }
   ],
-  "bundle_timestamp": "2026-07-18T15:55:57.244316Z",
+  "bundle_timestamp": "2026-07-23T19:55:56.286887Z",
   "max_valid_for_secs": 31536000
-}
+}
\ No newline at end of file

From 0653650a05fc5e08f4bf0c0ab31e485f7a708ddd Mon Sep 17 00:00:00 2001
From: bordumb <bordumbb@gmail.com>
Date: Thu, 23 Jul 2026 22:56:36 +0100
Subject: [PATCH 19/37] style: apply cargo fmt to crates

Auths-Id: did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b
Auths-Device: did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6
Auths-Anchor-Seq: 1
---
 .auths/ci-bundle.json                         |   2 +-
 crates/auths-cli/src/commands/agent/mod.rs    | 284 +++++++++++-------
 crates/auths-cli/src/core/provider.rs         |  34 ++-
 crates/auths-core/src/bin/test_keys.rs        |  20 --
 crates/auths-core/src/storage/keychain.rs     |   7 +-
 .../src/domains/agents/delegation.rs          |  22 +-
 crates/auths-sdk/src/paths.rs                 |   2 +-
 crates/auths-sdk/tests/cases/agents.rs        |   3 +-
 packages/auths-node/src/helpers.rs            |   1 +
 packages/auths-python/src/identity.rs         |   1 +
 packages/auths-python/src/identity_sign.rs    |   1 +
 11 files changed, 216 insertions(+), 161 deletions(-)
 delete mode 100644 crates/auths-core/src/bin/test_keys.rs

diff --git a/.auths/ci-bundle.json b/.auths/ci-bundle.json
index d6c9fc1f6..ef9ad02d3 100644
--- a/.auths/ci-bundle.json
+++ b/.auths/ci-bundle.json
@@ -2125,4 +2125,4 @@
   ],
   "bundle_timestamp": "2026-07-23T19:55:56.286887Z",
   "max_valid_for_secs": 31536000
-}
\ No newline at end of file
+}
diff --git a/crates/auths-cli/src/commands/agent/mod.rs b/crates/auths-cli/src/commands/agent/mod.rs
index 8d0f54a58..8fc1ca080 100644
--- a/crates/auths-cli/src/commands/agent/mod.rs
+++ b/crates/auths-cli/src/commands/agent/mod.rs
@@ -152,7 +152,11 @@ pub enum AgentSubcommand {
         agent_did: String,
 
         /// Delegator signing key alias
-        #[arg(long, default_value = "main", help = "Your root identity's signing key name")]
+        #[arg(
+            long,
+            default_value = "main",
+            help = "Your root identity's signing key name"
+        )]
         key: String,
     },
 }
@@ -285,7 +289,16 @@ pub fn handle_agent(cmd: AgentCommand, repo: Option<PathBuf>) -> Result<()> {
             out,
             profile,
             passphrase_file,
-        } => handle_provision_cmd(label, key, scope, expires_in, out, profile, passphrase_file, repo),
+        } => handle_provision_cmd(
+            label,
+            key,
+            scope,
+            expires_in,
+            out,
+            profile,
+            passphrase_file,
+            repo,
+        ),
         AgentSubcommand::List { include_revoked } => handle_list_cmd(include_revoked, repo),
         AgentSubcommand::Update {
             agent,
@@ -792,132 +805,152 @@ fn handle_provision_cmd(
     passphrase_file: Option<PathBuf>,
     repo: Option<PathBuf>,
 ) -> Result<()> {
-    use std::path::Path;
-    use auths_core::paths::auths_home;
+    use crate::core::provider::CliPassphraseProvider;
     use auths_sdk::keychain::KeyAlias;
+    use auths_sdk::paths::auths_home;
     use auths_sdk::storage_layout::resolve_repo_path;
-    use crate::core::provider::CliPassphraseProvider;
+    use std::path::Path;
 
     let repo_path = resolve_repo_path(repo)?;
     let env_config = auths_sdk::core_config::EnvironmentConfig::from_env();
     let is_interactive = console::user_attended() && !is_json_mode();
 
-    let (label_str, key_str, profile_str, destination_dir) = if is_interactive && (label.is_none() || key.is_none() || profile.is_none()) {
-        use dialoguer::{Input, Select};
-
-        let label_input = if let Some(l) = label {
-            l
-        } else {
-            Input::new()
-                .with_prompt("Type a name for your agent")
-                .interact_text()?
-        };
+    let (label_str, key_str, profile_str, destination_dir) =
+        if is_interactive && (label.is_none() || key.is_none() || profile.is_none()) {
+            use dialoguer::{Input, Select};
 
-        let key_input = if let Some(k) = key {
-            k
-        } else {
-            // Auto-detect active local signing key (defaults to main-device, omitting root hardware AID main)
-            let temp_provider = std::sync::Arc::new(CliPassphraseProvider::new());
-            let temp_ctx = crate::factories::storage::build_auths_context(&repo_path, &env_config, Some(temp_provider))?;
-            let aliases = temp_ctx.key_storage.list_aliases().unwrap_or_default();
-            if aliases.iter().any(|k| k.as_str() == "main-device") {
-                "main-device".to_string()
-            } else if let Some(first_device) = aliases.iter().find(|k| k.as_str().ends_with("-device")) {
-                first_device.as_str().to_string()
+            let label_input = if let Some(l) = label {
+                l
             } else {
-                aliases
-                    .into_iter()
-                    .map(|k| k.as_str().to_string())
-                    .find(|k| !k.ends_with("--next-0") && k != "main")
-                    .unwrap_or_else(|| "main-device".to_string())
-            }
-        };
+                Input::new()
+                    .with_prompt("Type a name for your agent")
+                    .interact_text()?
+            };
 
-        let profile_input = if let Some(p) = profile {
-            p
-        } else {
-            let profiles = vec![
-                "assistant (Interactive AI assistant profile)",
-                "ci (Headless CI runner profile)",
-            ];
-            let selection = Select::new()
-                .with_prompt("Select agent profile preset")
-                .items(&profiles)
-                .default(0)
-                .interact()?;
-            if selection == 0 {
-                "assistant".to_string()
+            let key_input = if let Some(k) = key {
+                k
             } else {
-                "ci".to_string()
-            }
+                // Auto-detect active local signing key (defaults to main-device, omitting root hardware AID main)
+                let temp_provider = std::sync::Arc::new(CliPassphraseProvider::new());
+                let temp_ctx = crate::factories::storage::build_auths_context(
+                    &repo_path,
+                    &env_config,
+                    Some(temp_provider),
+                )?;
+                let aliases = temp_ctx.key_storage.list_aliases().unwrap_or_default();
+                if aliases.iter().any(|k| k.as_str() == "main-device") {
+                    "main-device".to_string()
+                } else if let Some(first_device) =
+                    aliases.iter().find(|k| k.as_str().ends_with("-device"))
+                {
+                    first_device.as_str().to_string()
+                } else {
+                    aliases
+                        .into_iter()
+                        .map(|k| k.as_str().to_string())
+                        .find(|k| !k.ends_with("--next-0") && k != "main")
+                        .unwrap_or_else(|| "main-device".to_string())
+                }
+            };
+
+            let profile_input = if let Some(p) = profile {
+                p
+            } else {
+                let profiles = vec![
+                    "assistant (Interactive AI assistant profile)",
+                    "ci (Headless CI runner profile)",
+                ];
+                let selection = Select::new()
+                    .with_prompt("Select agent profile preset")
+                    .items(&profiles)
+                    .default(0)
+                    .interact()?;
+                if selection == 0 {
+                    "assistant".to_string()
+                } else {
+                    "ci".to_string()
+                }
+            };
+
+            let out_input = out.unwrap_or_else(|| {
+                auths_home()
+                    .unwrap_or_else(|_| PathBuf::from("~/.auths"))
+                    .parent()
+                    .unwrap_or_else(|| Path::new("."))
+                    .join(".auths-agents")
+                    .join(&label_input)
+            });
+
+            (label_input, key_input, profile_input, out_input)
+        } else {
+            let label_val = label.unwrap_or_else(|| "agent-builder".to_string());
+            let key_val = key.unwrap_or_else(|| "main-device".to_string());
+            let profile_val = profile.unwrap_or_else(|| "assistant".to_string());
+            let out_val = out.unwrap_or_else(|| {
+                auths_home()
+                    .unwrap_or_else(|_| PathBuf::from("~/.auths"))
+                    .parent()
+                    .unwrap_or_else(|| Path::new("."))
+                    .join(".auths-agents")
+                    .join(&label_val)
+            });
+            (label_val, key_val, profile_val, out_val)
         };
 
-        let out_input = out.unwrap_or_else(|| {
-            auths_home()
-                .unwrap_or_else(|_| PathBuf::from("~/.auths"))
-                .parent()
-                .unwrap_or_else(|| Path::new("."))
-                .join(".auths-agents")
-                .join(&label_input)
-        });
-
-        (label_input, key_input, profile_input, out_input)
-    } else {
-        let label_val = label.unwrap_or_else(|| "agent-builder".to_string());
-        let key_val = key.unwrap_or_else(|| "main-device".to_string());
-        let profile_val = profile.unwrap_or_else(|| "assistant".to_string());
-        let out_val = out.unwrap_or_else(|| {
-            auths_home()
-                .unwrap_or_else(|_| PathBuf::from("~/.auths"))
-                .parent()
-                .unwrap_or_else(|| Path::new("."))
-                .join(".auths-agents")
-                .join(&label_val)
-        });
-        (label_val, key_val, profile_val, out_val)
-    };
-
     let parent_alias = KeyAlias::new_unchecked(&key_str);
-    let agent_profile = profile_str.parse::<auths_sdk::workflows::agent_provision::AgentProfile>()?;
-
-    let (passphrase, passphrase_provider): (String, std::sync::Arc<dyn auths_sdk::signing::PassphraseProvider>) =
-        if let Some(p_file) = &passphrase_file {
-            let pass = std::fs::read_to_string(p_file)
-                .with_context(|| format!("Failed to read passphrase file {}", p_file.display()))?
-                .trim()
-                .to_string();
-            let provider = std::sync::Arc::new(crate::core::provider::AgentProvisionPassphraseProvider::with_parent(
+    let agent_profile =
+        profile_str.parse::<auths_sdk::workflows::agent_provision::AgentProfile>()?;
+
+    let (passphrase, passphrase_provider): (
+        String,
+        std::sync::Arc<dyn auths_sdk::signing::PassphraseProvider>,
+    ) = if let Some(p_file) = &passphrase_file {
+        let pass = std::fs::read_to_string(p_file)
+            .with_context(|| format!("Failed to read passphrase file {}", p_file.display()))?
+            .trim()
+            .to_string();
+        let provider = std::sync::Arc::new(
+            crate::core::provider::AgentProvisionPassphraseProvider::with_parent(
                 label_str.clone(),
                 zeroize::Zeroizing::new(pass.clone()),
                 key_str.clone(),
                 None,
-            ));
-            (pass, provider)
-        } else if is_interactive {
-            eprintln!("[1/2] Create passphrase for NEW agent key '{label_str}':");
-            let pass = rpassword::prompt_password("Enter passphrase: ")
-                .context("Failed to read passphrase from terminal")?;
-            let provider = std::sync::Arc::new(crate::core::provider::AgentProvisionPassphraseProvider::with_parent(
+            ),
+        );
+        (pass, provider)
+    } else if is_interactive {
+        eprintln!("[1/2] Create passphrase for NEW agent key '{label_str}':");
+        let pass = rpassword::prompt_password("Enter passphrase: ")
+            .context("Failed to read passphrase from terminal")?;
+        let provider = std::sync::Arc::new(
+            crate::core::provider::AgentProvisionPassphraseProvider::with_parent(
                 label_str.clone(),
                 zeroize::Zeroizing::new(pass.clone()),
                 key_str.clone(),
                 None,
-            ));
-            (pass, provider)
-        } else {
-            use rand::Rng;
-            let mut rng = rand::rng();
-            let pass: String = (0..32)
-                .map(|_| rng.sample(rand::distr::Alphanumeric) as char)
-                .collect();
-            let provider = std::sync::Arc::new(crate::core::provider::AgentProvisionPassphraseProvider::new(
+            ),
+        );
+        (pass, provider)
+    } else {
+        use rand::Rng;
+        let mut rng = rand::rng();
+        let pass: String = (0..32)
+            .map(|_| rng.sample(rand::distr::Alphanumeric) as char)
+            .collect();
+        let provider = std::sync::Arc::new(
+            crate::core::provider::AgentProvisionPassphraseProvider::new(
                 label_str.clone(),
                 zeroize::Zeroizing::new(pass.clone()),
-            ));
-            (pass, provider)
-        };
+            ),
+        );
+        (pass, provider)
+    };
 
-    let ctx = crate::factories::storage::build_auths_context(&repo_path, &env_config, Some(passphrase_provider))?;
+    let ctx = crate::factories::storage::build_auths_context(
+        &repo_path,
+        &env_config,
+        Some(passphrase_provider),
+    )?;
 
     let params = auths_sdk::workflows::agent_provision::AgentProvisionParams {
         label: label_str.clone(),
@@ -929,7 +962,14 @@ fn handle_provision_cmd(
 
     #[allow(clippy::disallowed_methods)]
     let now = chrono::Utc::now();
-    let res = auths_sdk::workflows::agent_provision::provision_agent_machine(&ctx, &parent_alias, &params, &passphrase, now, &repo_path)?;
+    let res = auths_sdk::workflows::agent_provision::provision_agent_machine(
+        &ctx,
+        &parent_alias,
+        &params,
+        &passphrase,
+        now,
+        &repo_path,
+    )?;
 
     if is_json_mode() {
         JsonResponse::success(
@@ -952,19 +992,26 @@ fn handle_provision_cmd(
         println!("  Wrapper Helper:  {}", res.wrapper_path.display());
         println!();
         println!("Your agent is provisioned!");
-        println!("You can find its details at {}", res.destination_dir.display());
+        println!(
+            "You can find its details at {}",
+            res.destination_dir.display()
+        );
     }
 
     Ok(())
 }
 
 fn handle_list_cmd(include_revoked: bool, repo: Option<PathBuf>) -> Result<()> {
-    use auths_sdk::storage_layout::resolve_repo_path;
     use crate::core::provider::CliPassphraseProvider;
+    use auths_sdk::storage_layout::resolve_repo_path;
     let repo_path = resolve_repo_path(repo)?;
     let env_config = auths_sdk::core_config::EnvironmentConfig::from_env();
     let passphrase_provider = std::sync::Arc::new(CliPassphraseProvider::new());
-    let ctx = crate::factories::storage::build_auths_context(&repo_path, &env_config, Some(passphrase_provider))?;
+    let ctx = crate::factories::storage::build_auths_context(
+        &repo_path,
+        &env_config,
+        Some(passphrase_provider),
+    )?;
 
     let mut agents = auths_sdk::domains::agents::list(&ctx)?;
     if !include_revoked {
@@ -983,25 +1030,34 @@ fn handle_list_cmd(include_revoked: bool, repo: Option<PathBuf>) -> Result<()> {
     Ok(())
 }
 
-fn handle_update_cmd(agent: String, _label: Option<String>, _extend_expiration: Option<i64>) -> Result<()> {
+fn handle_update_cmd(
+    agent: String,
+    _label: Option<String>,
+    _extend_expiration: Option<i64>,
+) -> Result<()> {
     println!("✔ Updated agent metadata for '{}'", agent);
     Ok(())
 }
 
 fn handle_revoke_cmd(agent_did: String, key: String, repo: Option<PathBuf>) -> Result<()> {
+    use crate::core::provider::CliPassphraseProvider;
     use auths_sdk::keychain::KeyAlias;
     use auths_sdk::storage_layout::resolve_repo_path;
-    use crate::core::provider::CliPassphraseProvider;
     let repo_path = resolve_repo_path(repo)?;
     let env_config = auths_sdk::core_config::EnvironmentConfig::from_env();
     let passphrase_provider = std::sync::Arc::new(CliPassphraseProvider::new());
-    let ctx = crate::factories::storage::build_auths_context(&repo_path, &env_config, Some(passphrase_provider))?;
+    let ctx = crate::factories::storage::build_auths_context(
+        &repo_path,
+        &env_config,
+        Some(passphrase_provider),
+    )?;
     let root_alias = KeyAlias::new_unchecked(key);
 
     auths_sdk::domains::agents::revoke(&ctx, &root_alias, &agent_did)?;
 
     if is_json_mode() {
-        JsonResponse::success("agent revoke", &serde_json::json!({ "revoked": agent_did })).print()?;
+        JsonResponse::success("agent revoke", &serde_json::json!({ "revoked": agent_did }))
+            .print()?;
     } else {
         println!("✔ Revoked agent identity {}", agent_did);
     }
@@ -1068,7 +1124,11 @@ mod tests {
 
         assert!(res.is_err());
         let err_msg = res.unwrap_err().to_string();
-        assert!(err_msg.contains("invalid") || err_msg.contains("profile") || err_msg.contains("Unknown"));
+        assert!(
+            err_msg.contains("invalid")
+                || err_msg.contains("profile")
+                || err_msg.contains("Unknown")
+        );
     }
 
     #[test]
diff --git a/crates/auths-cli/src/core/provider.rs b/crates/auths-cli/src/core/provider.rs
index f578b0a24..4201e795d 100644
--- a/crates/auths-cli/src/core/provider.rs
+++ b/crates/auths-cli/src/core/provider.rs
@@ -30,7 +30,9 @@ impl PassphraseProvider for CliPassphraseProvider {
                 .split('\'')
                 .next()
                 .unwrap_or("parent");
-            format!("[2/2] Enter EXISTING passphrase for parent key '{key_name}' (created during `auths init`):")
+            format!(
+                "[2/2] Enter EXISTING passphrase for parent key '{key_name}' (created during `auths init`):"
+            )
         } else {
             prompt_message.to_string()
         };
@@ -123,21 +125,27 @@ impl PassphraseProvider for AgentProvisionPassphraseProvider {
             return Ok(self.agent_passphrase.clone());
         }
 
-        if let Some(ref parent) = self.parent_alias {
-            if prompt_message.contains(parent.as_str())
-                || (parent.ends_with("-device") && prompt_message.contains(parent.trim_end_matches("-device")))
-            {
-                let mut guard = self.parent_passphrase.lock().unwrap_or_else(|e| e.into_inner());
-                if let Some(ref pass) = *guard {
-                    return Ok(pass.clone());
-                }
-                let pass = self.fallback.get_passphrase(prompt_message)?;
-                *guard = Some(pass.clone());
-                return Ok(pass);
+        if let Some(ref parent) = self.parent_alias
+            && (prompt_message.contains(parent.as_str())
+                || (parent.ends_with("-device")
+                    && prompt_message.contains(parent.trim_end_matches("-device"))))
+        {
+            let mut guard = self
+                .parent_passphrase
+                .lock()
+                .unwrap_or_else(|e| e.into_inner());
+            if let Some(ref pass) = *guard {
+                return Ok(pass.clone());
             }
+            let pass = self.fallback.get_passphrase(prompt_message)?;
+            *guard = Some(pass.clone());
+            return Ok(pass);
         }
 
-        let mut guard = self.parent_passphrase.lock().unwrap_or_else(|e| e.into_inner());
+        let mut guard = self
+            .parent_passphrase
+            .lock()
+            .unwrap_or_else(|e| e.into_inner());
         if let Some(ref pass) = *guard {
             return Ok(pass.clone());
         }
diff --git a/crates/auths-core/src/bin/test_keys.rs b/crates/auths-core/src/bin/test_keys.rs
deleted file mode 100644
index 1b27dfa66..000000000
--- a/crates/auths-core/src/bin/test_keys.rs
+++ /dev/null
@@ -1,20 +0,0 @@
-use auths_core::storage::encrypted_file::EncryptedFileStorage;
-use auths_core::storage::keychain::{KeyStorage, KeyAlias};
-use zeroize::Zeroizing;
-use std::path::PathBuf;
-
-fn main() {
-    let path = PathBuf::from("/Users/bordumb/.auths-agents/auths-agent/keys.enc");
-    let storage = EncryptedFileStorage::with_path(path).unwrap();
-    storage.set_password(Zeroizing::new("Seamus4444$$".to_string()));
-    
-    let alias = KeyAlias::new_unchecked("auths-agent");
-    match storage.load_key(&alias) {
-        Ok((did, role, data)) => {
-            println!("Success! DID: {}", did.as_str());
-        },
-        Err(e) => {
-            println!("Failed to load key: {:?}", e);
-        }
-    }
-}
diff --git a/crates/auths-core/src/storage/keychain.rs b/crates/auths-core/src/storage/keychain.rs
index a9ccb4c8c..eb61167af 100644
--- a/crates/auths-core/src/storage/keychain.rs
+++ b/crates/auths-core/src/storage/keychain.rs
@@ -671,11 +671,12 @@ fn get_backend_by_name(
         #[cfg(all(target_os = "macos", feature = "keychain-secure-enclave"))]
         "secure-enclave" => {
             info!("Using Secure Enclave backend (AUTHS_KEYCHAIN_BACKEND=secure-enclave)");
-            let paths =
-                AuthsPaths::resolve_with_config(config, None).map_err(|e| AgentError::BackendInitFailed {
+            let paths = AuthsPaths::resolve_with_config(config, None).map_err(|e| {
+                AgentError::BackendInitFailed {
                     backend: "secure-enclave",
                     error: format!("failed to resolve auths paths: {e}"),
-                })?;
+                }
+            })?;
             let storage = super::secure_enclave::SecureEnclaveKeyStorage::new(&paths.home_dir)?;
             Ok(Box::new(storage))
         }
diff --git a/crates/auths-sdk/src/domains/agents/delegation.rs b/crates/auths-sdk/src/domains/agents/delegation.rs
index 09302d7db..3563a6c19 100644
--- a/crates/auths-sdk/src/domains/agents/delegation.rs
+++ b/crates/auths-sdk/src/domains/agents/delegation.rs
@@ -108,17 +108,19 @@ pub fn add_scoped(
             .map_err(|e| AgentError::IdentityNotFound {
                 did: format!("identity load failed: {e}"),
             })?;
-    let (parent_did, _, _) = ctx
-        .key_storage
-        .load_key(root_alias)
-        .map_err(|e| AgentError::IdentityNotFound {
-            did: format!("parent key alias '{}' load failed: {e}", root_alias.as_str()),
-        })?;
-    let root_prefix = parse_did_keri(parent_did.as_str()).map_err(|e| {
-        AgentError::IdentityNotFound {
+    let (parent_did, _, _) =
+        ctx.key_storage
+            .load_key(root_alias)
+            .map_err(|e| AgentError::IdentityNotFound {
+                did: format!(
+                    "parent key alias '{}' load failed: {e}",
+                    root_alias.as_str()
+                ),
+            })?;
+    let root_prefix =
+        parse_did_keri(parent_did.as_str()).map_err(|e| AgentError::IdentityNotFound {
             did: format!("invalid parent did:keri: {e}"),
-        }
-    })?;
+        })?;
     let (_pk, root_curve) = extract_public_key_bytes(
         ctx.key_storage.as_ref(),
         root_alias,
diff --git a/crates/auths-sdk/src/paths.rs b/crates/auths-sdk/src/paths.rs
index e15822683..b7890bb60 100644
--- a/crates/auths-sdk/src/paths.rs
+++ b/crates/auths-sdk/src/paths.rs
@@ -2,7 +2,7 @@
 
 use std::path::PathBuf;
 
-pub use auths_core::paths::{auths_home, auths_home_with_config, AuthsHomeError, AuthsPaths};
+pub use auths_core::paths::{AuthsHomeError, AuthsPaths, auths_home, auths_home_with_config};
 
 /// Resolve the registry (local storage) directory for a command, honoring an explicit `--repo` override.
 ///
diff --git a/crates/auths-sdk/tests/cases/agents.rs b/crates/auths-sdk/tests/cases/agents.rs
index 1f7f8ad7a..7b79f219f 100644
--- a/crates/auths-sdk/tests/cases/agents.rs
+++ b/crates/auths-sdk/tests/cases/agents.rs
@@ -423,7 +423,8 @@ fn test_provision_agent_machine_under_delegated_device_key() {
     let ctx = build_test_context_with_provider(
         &reg_dir,
         Arc::new(_keychain),
-        Some(Arc::new(PrefilledPassphraseProvider::new(PASS)) as Arc<dyn PassphraseProvider + Send + Sync>),
+        Some(Arc::new(PrefilledPassphraseProvider::new(PASS))
+            as Arc<dyn PassphraseProvider + Send + Sync>),
     );
 
     let device_alias = KeyAlias::new_unchecked(format!("{}-device", root_alias.as_str()));
diff --git a/packages/auths-node/src/helpers.rs b/packages/auths-node/src/helpers.rs
index 1e6d6b858..82768b651 100644
--- a/packages/auths-node/src/helpers.rs
+++ b/packages/auths-node/src/helpers.rs
@@ -30,6 +30,7 @@ pub fn make_env_config(passphrase: &str, repo_path: &str) -> EnvironmentConfig {
     keychain.passphrase = Some(passphrase.to_string());
     EnvironmentConfig {
         auths_home: Some(repo_path.into()),
+        auths_repo: None,
         keychain,
         ssh_agent_socket: None,
     }
diff --git a/packages/auths-python/src/identity.rs b/packages/auths-python/src/identity.rs
index 8cec09cd7..482c7157d 100644
--- a/packages/auths-python/src/identity.rs
+++ b/packages/auths-python/src/identity.rs
@@ -46,6 +46,7 @@ pub(crate) fn validate_capabilities(capabilities: &[String]) -> PyResult<()> {
 pub(crate) fn make_keychain_config(passphrase: &str, repo_path: &str) -> EnvironmentConfig {
     EnvironmentConfig {
         auths_home: Some(repo_path.into()),
+        auths_repo: None,
         keychain: KeychainConfig {
             backend: Some("file".to_string()),
             file_path: None,
diff --git a/packages/auths-python/src/identity_sign.rs b/packages/auths-python/src/identity_sign.rs
index 9f8032963..29d66d156 100644
--- a/packages/auths-python/src/identity_sign.rs
+++ b/packages/auths-python/src/identity_sign.rs
@@ -23,6 +23,7 @@ fn make_signer(
     keychain_config.passphrase = Some(passphrase_str.clone());
     let env_config = EnvironmentConfig {
         auths_home: repo_path.map(Into::into),
+        auths_repo: None,
         keychain: keychain_config,
         ssh_agent_socket: None,
     };

From 3a97cf974fe863fe009a2bca6bdcd876ee952c0e Mon Sep 17 00:00:00 2001
From: bordumb <bordumbb@gmail.com>
Date: Thu, 23 Jul 2026 23:27:08 +0100
Subject: [PATCH 20/37] fix: update ci-bundle

Auths-Id: did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b
Auths-Device: did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6
Auths-Anchor-Seq: 1
---
 .auths/ci-bundle.json | 2167 ++---------------------------------------
 1 file changed, 88 insertions(+), 2079 deletions(-)

diff --git a/.auths/ci-bundle.json b/.auths/ci-bundle.json
index ef9ad02d3..ebca61092 100644
--- a/.auths/ci-bundle.json
+++ b/.auths/ci-bundle.json
@@ -1,2128 +1,137 @@
 {
-  "identity_did": "did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-  "public_key_hex": "03319793ee258fcf8fd518d8224bd39d381a004b586c84a63cc3a1be018477088f",
+  "identity_did": "did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b",
+  "public_key_hex": "023d45d337ebc9e39b790a22b458605781cd58a1786295e4bfef3b496a24d62d4c",
   "curve": "p256",
   "attestation_chain": [
     {
       "version": 1,
       "rid": ".auths",
-      "issuer": "did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "subject": "did:keri:ECzFpM6abrCSSpiki8v_qJHAOii2jg6556PRB33z1AAb",
+      "issuer": "did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b",
+      "subject": "did:keri:EJDqDJ7WkayddxOv4aP1c9ny3tyjWjSgguX2gCiVsKdf",
       "device_public_key": {
         "curve": "p256",
-        "key": "0384188a11a1c734dbdc2b2123c46efc3e6cdef1469747d6d93490665f5b92c080"
+        "key": "02a0f2201768ccf5a9679a0757eefe12b2995a9250954ff59b19967e3fed07a81e"
       },
-      "identity_signature": "0959aa1cb3d00efc64175a724fd3609c41423b66c7f17e20c6dc40c78704ab53e067179460139dcbe434e87c812bbd6c68b02e76c745e4a41a40afb26778de61",
-      "device_signature": "ccf2cb5ef2b6ae99ec31fe7aca83e128706da60f5c8d6382eb9c46a912dfe3adcd53b6b7f85a3f16bb3c134a8d64a2d59c4f6ea98e40c2496094553fb4db9bb3",
-      "timestamp": "2026-07-23T18:16:23.244962Z",
+      "identity_signature": "db08d9e56557665e943907d4abe700393f59d2a3ecd0684cc48995e25dd36b6520dc2ca8eda1f5bfd9a4699884255e7d91d5ed8724b94575215ce9e0b59873d7",
+      "device_signature": "8c2fdc72fa7d422984cd9562af27ab44168c1169c91d7fbf664015e1616f636456a4855cb90a1b03ea2c517d2ac4bca251cab02ca24ab477d7a13ff01285a78e",
+      "timestamp": "2026-07-23T21:32:15.358487Z",
       "signer_type": "Agent"
-    },
-    {
-      "version": 1,
-      "rid": ".auths",
-      "issuer": "did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "subject": "did:keri:EDcmK6onrDzdFgEqI6OYjJZoGy2gSCdaO_dVKLJWsb4n",
-      "device_public_key": {
-        "curve": "p256",
-        "key": "0320844a04683f986c681abd39560126cc0147e877b34387e4b855397f2e21a497"
-      },
-      "identity_signature": "061f7a5ff418ef039a555cd0cf349e133d5eab66b4bf449899550b23a7d88e0287ac7191cc86c8c677729146fd03cd148862a1033e7829a4b4aaf0c884f19f6b",
-      "device_signature": "360d60bde99e0fc2ab221f28510bcd0320b56dbdf4045145f6eeef87e6aa594af7e958db9b7ab0bf9570be085ebf6e500046fc8e6d79f4515ae9f725fdcaa9cc",
-      "timestamp": "2026-07-23T15:57:50.937366Z",
-      "signer_type": "Agent"
-    },
-    {
-      "version": 1,
-      "rid": ".auths",
-      "issuer": "did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "subject": "did:keri:EE-k7tp1lVfa8Ru9RNy-JQgeHYfFtaI6BR3hDbd9KGmn",
-      "device_public_key": {
-        "curve": "p256",
-        "key": "03e1904f4ae595d726c1e304a95be7a0648dd99afd952c835d907b730581703976"
-      },
-      "identity_signature": "dea5acbe13f8df0b2af1a33601b9b3b1bd7e4ed448f5bbe7b2c1c14f054be91becc8c33439ef3857c8f18c600fbd66383f78fa85e5760aa5a2278b71bd554898",
-      "device_signature": "982385fcea3b4c0d8e4b87157f883e749a2ea7ed61d58dd6b807240a5e9ea89a8493535a5b7eae0d95a373a53ed531fce0adbcc9f74147d40ccfe907367ed224",
-      "timestamp": "2026-07-23T18:21:00.410008Z",
-      "signer_type": "Agent"
-    },
-    {
-      "version": 1,
-      "rid": ".auths",
-      "issuer": "did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "subject": "did:keri:EFBGdabu4x82TD_Wn9gI3qUpDjnK3idAz4qLRS2YmdQy",
-      "device_public_key": {
-        "curve": "p256",
-        "key": "02f0b52b1829bb0a848dcfc7eec67d21bc032fdad711815c222363f7b9ff932800"
-      },
-      "identity_signature": "ba82e88fd4da085bfb20122b3069ae7fce97e2618e32891e8f4f4e72a402d684e2a0a7f8cec16d1ed8e38a61291a547b2fbeabdaa799b1912624d107b7f59f8b",
-      "device_signature": "c9a04a5135642bb87804d24c27b2d50b51bd8aea22b99cfb5453e4db264dd24857404c44fead4ae13247e60ad83602bf407b31949f20c1977eee02acc4470547",
-      "expires_at": "2026-08-17T15:23:20Z",
-      "timestamp": "2026-07-18T15:23:24.735834Z",
-      "signer_type": "Agent"
-    },
-    {
-      "version": 1,
-      "rid": ".auths",
-      "issuer": "did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "subject": "did:keri:EFE_IQRzArN0vTCK_8b0ef68uL7_EO919AEsTpuWB8wv",
-      "device_public_key": {
-        "curve": "p256",
-        "key": "03e9b01602dfee6e6817f7872e87cb6e65ba99c43d6926284f9ee29c4a1a5b1a46"
-      },
-      "identity_signature": "9ecf51ca2f70d7e367d80dd0422821d283d480a57cd54a6185fee81d1c3000667f5366aa71cc98793203688e85437fdda0da0f5d02d1cd872c992ccfd196db52",
-      "device_signature": "076a316305b2150b2861a79469baf34950a4502283f2d088d61eb8b0afa54b1227535889f45f0d84ca3b39d910bcdf2ed54b69ce19dc8ef01b8a839ab807c3d7",
-      "timestamp": "2026-07-23T18:39:13.474659Z",
-      "signer_type": "Agent"
-    },
-    {
-      "version": 1,
-      "rid": ".auths",
-      "issuer": "did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "subject": "did:keri:EGBVjMs3qkVEel7os20R3WHNiI5DNJlVGbhkNTr12wbe",
-      "device_public_key": {
-        "curve": "p256",
-        "key": "0381be3c212f6b76dfaf0d94c2271a57e58cdb7dd33b91cc8e5f4d4ca7756df3ef"
-      },
-      "identity_signature": "4353954b73706d8c7874077d6a4fd9d0a28c679eb3e3faa1258a84778736c79f5c006241af62d2118f669846051d28ab26834160f8a99c26833fb2eb6a36fde3",
-      "device_signature": "aef8bdcbdd4bd90b3726c76924c5396d114a96fb6e9a409b825cb60f842c5eb884058ae3186515bd13789c6755f0fec79abef0d785d84044d030c2eccf2b61ff",
-      "timestamp": "2026-07-23T18:50:16.734637Z",
-      "signer_type": "Agent"
-    },
-    {
-      "version": 1,
-      "rid": ".auths",
-      "issuer": "did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "subject": "did:keri:EGXg8l62pI8_ig0JiIHMkKyGKbJHdWMpIhb0W0niK86y",
-      "device_public_key": {
-        "curve": "p256",
-        "key": "03d73916d03aced8c0029581e0408cbf88f5b79b17fd389f1d2d07627c72e138b6"
-      },
-      "identity_signature": "ac19fba8a68b1d7c1aa1c739b220ed52ec13154436f2003821e2225db7d00b246e6bef66311705454ab6a1a22bdbad3730bbf276fc785d5690a0deb6bd712352",
-      "device_signature": "9ba1336cfd594768547497edaba5234ee479915f7c56fbb0844b91c1a88d76253b9906d68ae22a328835a9a9d4a2d8881145fc58b386e03d9fe76dc6171d8b75",
-      "timestamp": "2026-07-23T18:50:56.479334Z",
-      "signer_type": "Agent"
-    },
-    {
-      "version": 1,
-      "rid": ".auths",
-      "issuer": "did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "subject": "did:keri:EHVCdLP79CXEc7xYjwtwp_Q1_MguwDmhEYFMZevOXIZ5",
-      "device_public_key": {
-        "curve": "p256",
-        "key": "0336b6605d0068f65c9619c9eb2acc41c3b81ad1b3abe16ea2629f7ec5f1488109"
-      },
-      "identity_signature": "7aca51786fb5fb5caefe387ffe933a0f2f45e51f608a2b4cb6b681aed57d27de467cad22569ff09a77c5d8f182d04060e405c55eccd576b79bd7a372702aa2f2",
-      "device_signature": "5ed88fd3f815946286d61c1c2ec061ea0a28f497dd6a08a4dcb283b538cbb2956a54b2d3dcad8dd71266fc3e38c8234e25ad744ae1009c2acf319589902cb66c",
-      "timestamp": "2026-07-23T17:05:08.072545Z",
-      "signer_type": "Agent"
-    },
-    {
-      "version": 1,
-      "rid": ".auths",
-      "issuer": "did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "subject": "did:keri:EOtdnfmn4wkvMqUX4374wkHzXIs0WgA7zFVNJGL3cLvZ",
-      "device_public_key": {
-        "curve": "p256",
-        "key": "035e737c58cde72ef2ca80cb97482555bb262dfeb11bd108cb6cf1de9525395c3a"
-      },
-      "identity_signature": "4005a895a8ab423e17c3c140a6f70e8096ea3e7cfac468a6521a84bf5195ef792fbf4fffb09a7d10255155f38807a826fadbb5b4d51c8e742a9fcd959a209506",
-      "device_signature": "20a6b00766425afd2d00534477bc0e6b103a02b18d2dc44dff1c86857a2e446d0322f8e6ea526f1a6511bb05415b7c989edfe40a0cd7695e1177841511499e28",
-      "timestamp": "2026-07-23T18:46:39.226554Z",
-      "signer_type": "Agent"
-    },
-    {
-      "version": 1,
-      "rid": ".auths",
-      "issuer": "did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "subject": "did:key:zDnaekzsT4o4uSTMuQjKGKTcCvV6CdHUkkTYfcwCFZSZpsbtz",
-      "device_public_key": {
-        "curve": "p256",
-        "key": "03319793ee258fcf8fd518d8224bd39d381a004b586c84a63cc3a1be018477088f"
-      },
-      "identity_signature": "d32b80901ccd3f68f013144783768245a53ae144f1ba134731893b3385fa15adbffc4b2d05c7c104e4a9002f9364daade9710c10b20b37c302cc2341dd464c06",
-      "device_signature": "56441005f93c89afa5d817f07ae8b85ae9d25c12956ffe5f4f3a33e1ba603b66c785a33f3862ba1db503287190027af0d07794107f1a1a218b0ef822cfac3754",
-      "timestamp": "2026-06-19T14:18:34.160482Z",
-      "note": "Linked by auths-sdk setup"
-    },
-    {
-      "version": 1,
-      "rid": "sha256:a1fff0ffefb9eace7230c24e50731f0a91c62f9cefdfe77121c2f607125dffae",
-      "issuer": "did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "subject": "did:key:zDnaekzsT4o4uSTMuQjKGKTcCvV6CdHUkkTYfcwCFZSZpsbtz",
-      "device_public_key": {
-        "curve": "p256",
-        "key": "03319793ee258fcf8fd518d8224bd39d381a004b586c84a63cc3a1be018477088f"
-      },
-      "identity_signature": "46906c8f544e21ef384fe37ded55e24d7bae3c3a57d8c0b1ee316e50a0ef81551b74978daff16f2b13e537c866d062a3f3d517d4881b8856e52456a7e527e322",
-      "device_signature": "a1cbbea698bf11b032d87f02f7c377cc3f4edc6696c65bd2c44ef63823f894003b5a4b77dda2644346db7a9c17cd293907b6b34c4498030acddeaeda7fc069ce",
-      "timestamp": "2026-07-23T00:57:13.261824Z",
-      "payload": {
-        "artifact_type": "file",
-        "digest": {
-          "algorithm": "sha256",
-          "hex": "a1fff0ffefb9eace7230c24e50731f0a91c62f9cefdfe77121c2f607125dffae"
-        },
-        "name": "demo_target.txt",
-        "size": 13
-      }
-    },
-    {
-      "version": 1,
-      "rid": "sha256:5eac242b009be5b3f551360fc2692b469849c8dc7556cdad1d0c0e1863ca0ba1",
-      "issuer": "did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "subject": "did:key:zDnaekzsT4o4uSTMuQjKGKTcCvV6CdHUkkTYfcwCFZSZpsbtz",
-      "device_public_key": {
-        "curve": "p256",
-        "key": "03319793ee258fcf8fd518d8224bd39d381a004b586c84a63cc3a1be018477088f"
-      },
-      "identity_signature": "010c33fbf5a81f736dc829328ce84424b149ac57465b583f903df677915534f4dcfbe9da19c128dce2a7709d195b3089d1e739ecba01d8d874ea61375a89bde9",
-      "device_signature": "8d6d4bcfec3f6b267fc9202bdb993b9364fdda17594b3d548d839c4c191786aeb1e2b6b1d0fb525a01783c6b7af8665eb2064fea2bcbf81d643da711efb6663b",
-      "timestamp": "2026-07-23T01:01:28.317844Z",
-      "payload": {
-        "artifact_type": "file",
-        "digest": {
-          "algorithm": "sha256",
-          "hex": "5eac242b009be5b3f551360fc2692b469849c8dc7556cdad1d0c0e1863ca0ba1"
-        },
-        "name": "production_release.tar.gz",
-        "size": 46
-      }
-    },
-    {
-      "version": 1,
-      "rid": "sha256:5eac242b009be5b3f551360fc2692b469849c8dc7556cdad1d0c0e1863ca0ba1",
-      "issuer": "did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "subject": "did:key:zDnaekzsT4o4uSTMuQjKGKTcCvV6CdHUkkTYfcwCFZSZpsbtz",
-      "device_public_key": {
-        "curve": "p256",
-        "key": "03319793ee258fcf8fd518d8224bd39d381a004b586c84a63cc3a1be018477088f"
-      },
-      "identity_signature": "024e0f6e93fd951d4f46bab53a669ed07ed659c2766ef8837499e98aff07c8071b377cd8a0b96f79008f0b381a41f01545353544a0519688ecb0a1fdbd15aad3",
-      "device_signature": "088b30daf1894d50189594203d97cf6e472926517ce1860b99cafa64b6aed85d47f6cfd633c3587de06058c4ed8c7407e1f18a338343955f3d85b216670b2362",
-      "timestamp": "2026-07-23T01:06:12.495707Z",
-      "payload": {
-        "artifact_type": "file",
-        "digest": {
-          "algorithm": "sha256",
-          "hex": "5eac242b009be5b3f551360fc2692b469849c8dc7556cdad1d0c0e1863ca0ba1"
-        },
-        "name": "production_release.tar.gz",
-        "size": 46
-      }
-    },
-    {
-      "version": 1,
-      "rid": "sha256:5eac242b009be5b3f551360fc2692b469849c8dc7556cdad1d0c0e1863ca0ba1",
-      "issuer": "did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "subject": "did:key:zDnaekzsT4o4uSTMuQjKGKTcCvV6CdHUkkTYfcwCFZSZpsbtz",
-      "device_public_key": {
-        "curve": "p256",
-        "key": "03319793ee258fcf8fd518d8224bd39d381a004b586c84a63cc3a1be018477088f"
-      },
-      "identity_signature": "757cc17df50b0f669b01aef678646f5595a33bf4d7e1fc8b372ae85baa71be35a198b83724a1641d5893e187634c06c2bdbc15ced27ab54c84dda418500a37d8",
-      "device_signature": "7195f8be5c8b8a88ff9903020f9b37ccb9a4fbed52c99725b7f767eb0ba433806bdd1607537fcdecceb57a148d14d6d84737968a72078da138ea7359dfbd5f4a",
-      "timestamp": "2026-07-23T01:07:23.307878Z",
-      "payload": {
-        "artifact_type": "file",
-        "digest": {
-          "algorithm": "sha256",
-          "hex": "5eac242b009be5b3f551360fc2692b469849c8dc7556cdad1d0c0e1863ca0ba1"
-        },
-        "name": "production_release.tar.gz",
-        "size": 46
-      }
-    },
-    {
-      "version": 1,
-      "rid": "sha256:5eac242b009be5b3f551360fc2692b469849c8dc7556cdad1d0c0e1863ca0ba1",
-      "issuer": "did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "subject": "did:key:zDnaekzsT4o4uSTMuQjKGKTcCvV6CdHUkkTYfcwCFZSZpsbtz",
-      "device_public_key": {
-        "curve": "p256",
-        "key": "03319793ee258fcf8fd518d8224bd39d381a004b586c84a63cc3a1be018477088f"
-      },
-      "identity_signature": "e4d1186f92f1bf75f4ed9278a3c73ee1d29fbcccdb82f88e01caf594921631e250e7bb1500f2d0a34db8485ff20b09e319dc4ca54848d698e0fda9e80729a339",
-      "device_signature": "f500a0f53ae44352f745b3ab81290385ad5cfbff93cfe357a5f902ca0104ee67459b3f7fb03ae6126ad19157a610c48d7b0c993e361baa4274e4449f7f25ad03",
-      "timestamp": "2026-07-23T01:07:41.310978Z",
-      "payload": {
-        "artifact_type": "file",
-        "digest": {
-          "algorithm": "sha256",
-          "hex": "5eac242b009be5b3f551360fc2692b469849c8dc7556cdad1d0c0e1863ca0ba1"
-        },
-        "name": "production_release.tar.gz",
-        "size": 46
-      }
-    },
-    {
-      "version": 1,
-      "rid": "sha256:5eac242b009be5b3f551360fc2692b469849c8dc7556cdad1d0c0e1863ca0ba1",
-      "issuer": "did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "subject": "did:key:zDnaekzsT4o4uSTMuQjKGKTcCvV6CdHUkkTYfcwCFZSZpsbtz",
-      "device_public_key": {
-        "curve": "p256",
-        "key": "03319793ee258fcf8fd518d8224bd39d381a004b586c84a63cc3a1be018477088f"
-      },
-      "identity_signature": "b8b9299f5fea909ee4b0e6264dbf4d1ac4ad072feb33db997597b96a12a4a9c829f1b6e4aad82fd5cf79954bc83ad92646bcdea9ff8c8bdd663e130bb48508aa",
-      "device_signature": "0c4f2681812ff16249a770c924d61064f8756a2f167acddf92af0e8a0e94988292bd5efaaaf056c3196385a002db3d563a18c2a1e182606b7dd215c46581fd6d",
-      "timestamp": "2026-07-23T01:10:12.311940Z",
-      "payload": {
-        "artifact_type": "file",
-        "digest": {
-          "algorithm": "sha256",
-          "hex": "5eac242b009be5b3f551360fc2692b469849c8dc7556cdad1d0c0e1863ca0ba1"
-        },
-        "name": "production_release.tar.gz",
-        "size": 46
-      }
     }
   ],
   "kel": [
     {
       "v": "KERI10JSON00012f_",
       "t": "icp",
-      "d": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
+      "d": "EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b",
+      "i": "EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b",
       "s": "0",
       "kt": "1",
       "k": [
-        "1AAJAzGXk-4lj8-P1RjYIkvTnTgaAEtYbISmPMOhvgGEdwiP"
+        "1AAJAj1F0zfryeObeQoitFhgV4HNWKF4YpXkv-87SWok1i1M"
       ],
       "nt": "1",
       "n": [
-        "EGPZRt46kODI9PChbjPRnNxPurBLfRNJxNlqutsBUNFH"
+        "EA0RchGx-W5-lfcDIDiCjhLEDj4S5BeanHSrJwoPUrDJ"
       ],
       "bt": "0",
       "b": [],
       "c": [],
       "a": []
     },
-    {
-      "v": "KERI10JSON0000ff_",
-      "t": "ixn",
-      "d": "EEEA2-C23Lc2BAOhUqcFY38G2AtjCNHwH56ivk9Mst8l",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "1",
-      "p": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "a": [
-        {
-          "d": "EPbW1zoEt_Gxw2QJBtiuS0TGzdaQwkHe1fdKnjZ-WaO9"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON00013a_",
-      "t": "ixn",
-      "d": "EEfSEmwF2xMyUATv5yDcKdFaieSnIA-tEBr4-R2wxAjv",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "2",
-      "p": "EEEA2-C23Lc2BAOhUqcFY38G2AtjCNHwH56ivk9Mst8l",
-      "a": [
-        {
-          "i": "EPlN9Y8qKPDEq8gg80D6N_rCN3aANK6xAoMr8OTGJ1tR",
-          "s": "0",
-          "d": "EPlN9Y8qKPDEq8gg80D6N_rCN3aANK6xAoMr8OTGJ1tR"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON00013a_",
-      "t": "ixn",
-      "d": "EGhlOnTYWuh6TQAqAVIk2tZH4ZVqWYmJYOwtzBUCjl4W",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "3",
-      "p": "EEfSEmwF2xMyUATv5yDcKdFaieSnIA-tEBr4-R2wxAjv",
-      "a": [
-        {
-          "i": "EIv02OckbaGFpRONOurWMi_f5_Qf8unjgG5PnVCG2MiU",
-          "s": "0",
-          "d": "EIv02OckbaGFpRONOurWMi_f5_Qf8unjgG5PnVCG2MiU"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON00013a_",
-      "t": "ixn",
-      "d": "EDW6BakILqIdi4V3ZSSAUSfghoHkPs_RPoW2gIN7duAO",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "4",
-      "p": "EGhlOnTYWuh6TQAqAVIk2tZH4ZVqWYmJYOwtzBUCjl4W",
-      "a": [
-        {
-          "i": "EGpEBKDnvEUv0dsQ1MVaZbBq0qx8p1iLA4AFcNiPlk5M",
-          "s": "0",
-          "d": "EGpEBKDnvEUv0dsQ1MVaZbBq0qx8p1iLA4AFcNiPlk5M"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON00013a_",
-      "t": "ixn",
-      "d": "EGkVke_RT3jbpWAQ1lmBOXDjaCCB_mJ6LI4Rw1B8rN5Y",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "5",
-      "p": "EDW6BakILqIdi4V3ZSSAUSfghoHkPs_RPoW2gIN7duAO",
-      "a": [
-        {
-          "i": "EB46LmlwowYkoVNeSxMVs68LRc7g6vI1hsPnCUBtzKjt",
-          "s": "0",
-          "d": "EB46LmlwowYkoVNeSxMVs68LRc7g6vI1hsPnCUBtzKjt"
-        }
-      ]
-    },
     {
       "v": "KERI10JSON00013a_",
       "t": "ixn",
-      "d": "EDVMENEeyz5EkhDfCWjSP_ZMFuzJFJ3ofVvEr-WKQSN6",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "6",
-      "p": "EGkVke_RT3jbpWAQ1lmBOXDjaCCB_mJ6LI4Rw1B8rN5Y",
+      "d": "EA7GcuFgAMkTpUURA5SNSoeg9Y0v9aGqBrqgF0u0EVuU",
+      "i": "EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b",
+      "s": "1",
+      "p": "EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b",
       "a": [
         {
-          "i": "EFBGdabu4x82TD_Wn9gI3qUpDjnK3idAz4qLRS2YmdQy",
+          "i": "EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6",
           "s": "0",
-          "d": "EFBGdabu4x82TD_Wn9gI3qUpDjnK3idAz4qLRS2YmdQy"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON000105_",
-      "t": "ixn",
-      "d": "EFXvPGjPvzLIKwWrAuvfH0akAfQf7060evdDYy9ezpgW",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "7",
-      "p": "EDVMENEeyz5EkhDfCWjSP_ZMFuzJFJ3ofVvEr-WKQSN6",
-      "a": [
-        {
-          "d": "agent:EFBGdabu4x82TD_Wn9gI3qUpDjnK3idAz4qLRS2YmdQy"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON00012e_",
-      "t": "ixn",
-      "d": "EMdZyZkadYolw2Wm87OYkUqrLcmUIDVrjE57hYdr1aS9",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "8",
-      "p": "EFXvPGjPvzLIKwWrAuvfH0akAfQf7060evdDYy9ezpgW",
-      "a": [
-        {
-          "d": "agentscope:EFBGdabu4x82TD_Wn9gI3qUpDjnK3idAz4qLRS2YmdQy:1786980200:sign_commit,sign_release"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON0000ff_",
-      "t": "ixn",
-      "d": "EHoKJCGZk960cpfR3GCV8La5wEB_7UUEQKVIsM54-u7r",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "9",
-      "p": "EMdZyZkadYolw2Wm87OYkUqrLcmUIDVrjE57hYdr1aS9",
-      "a": [
-        {
-          "d": "EF-P7CX_EyjZ85cbInn0B74kMMs8YjcbUwVj3USilFKY"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON0000ff_",
-      "t": "ixn",
-      "d": "EO0uFfkch9BKjPNzOB5vLZiO4GvytVAuBMY2HAjQahAK",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "a",
-      "p": "EHoKJCGZk960cpfR3GCV8La5wEB_7UUEQKVIsM54-u7r",
-      "a": [
-        {
-          "d": "EFBGdabu4x82TD_Wn9gI3qUpDjnK3idAz4qLRS2YmdQy"
+          "d": "EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6"
         }
       ]
-    },
+    }
+  ],
+  "kel_attachments": [
+    "2d4141424141425037505a4f515870356c4153365f7075744b5635546f5147344d336b2d65534936574c64727a595856432d3333744a4a70544562766959454b656c787865744a2d323164317174746b414739745f384b7372504277",
+    "2d414142414142367832385263744153785067334f5f6c537479564a564f4c6833623778424678684b553949663977334a4248794e4c44554c596b56396e437057416555457656796d5266497163787141566e696f446f7247574d35"
+  ],
+  "device_kels": [
     {
-      "v": "KERI10JSON00013a_",
-      "t": "ixn",
-      "d": "EIGyARxCYrYKnchn_OsVWrzLK8eXfSLlqcVPl3ur8epp",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "b",
-      "p": "EO0uFfkch9BKjPNzOB5vLZiO4GvytVAuBMY2HAjQahAK",
-      "a": [
+      "did": "did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6",
+      "kel": [
         {
-          "i": "EO1cBsYoV5izKvdIL6TstN5TOQl1hYN3WnhtAOh1lwAp",
+          "v": "KERI10JSON000163_",
+          "t": "dip",
+          "d": "EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6",
+          "i": "EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6",
           "s": "0",
-          "d": "EO1cBsYoV5izKvdIL6TstN5TOQl1hYN3WnhtAOh1lwAp"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON000105_",
-      "t": "ixn",
-      "d": "EKvB1FemDJ0kEwiqhmTQljb5_clKGiQ9qjb5MilfuU2Q",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "c",
-      "p": "EIGyARxCYrYKnchn_OsVWrzLK8eXfSLlqcVPl3ur8epp",
-      "a": [
-        {
-          "d": "agent:EO1cBsYoV5izKvdIL6TstN5TOQl1hYN3WnhtAOh1lwAp"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON00012e_",
-      "t": "ixn",
-      "d": "EP0KgPUSLmYprFsHWfFbw0rxaIDq1ePdvSyImKVwxYkn",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "d",
-      "p": "EKvB1FemDJ0kEwiqhmTQljb5_clKGiQ9qjb5MilfuU2Q",
-      "a": [
-        {
-          "d": "agentscope:EO1cBsYoV5izKvdIL6TstN5TOQl1hYN3WnhtAOh1lwAp:1786981212:sign_commit,sign_release"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON0000ff_",
-      "t": "ixn",
-      "d": "EBDecolRCN1LFWAWVU_iCitHwWVRMuSK-a6aXplXOCHg",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "e",
-      "p": "EP0KgPUSLmYprFsHWfFbw0rxaIDq1ePdvSyImKVwxYkn",
-      "a": [
-        {
-          "d": "ENylVB7J3PSlMP_PX0K3SMBzRV2_p9OvYGDOgCDI31y1"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON0000ff_",
-      "t": "ixn",
-      "d": "EGplPT8t6tuNrbhI1-_RzrxoDzVXnUJrDlfOF28nP7sD",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "f",
-      "p": "EBDecolRCN1LFWAWVU_iCitHwWVRMuSK-a6aXplXOCHg",
-      "a": [
+          "kt": "1",
+          "k": [
+            "1AAJA2ttXyx31_wfXFLDdeYnjfaFU2PmT3aSjIacdsCoO6c3"
+          ],
+          "nt": "1",
+          "n": [
+            "EMg-xEysO1vCYcJCKG791YN4FPJrDOn2jkhb5jFRzG8y"
+          ],
+          "bt": "0",
+          "b": [],
+          "c": [],
+          "a": [],
+          "di": "EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b"
+        },
         {
-          "d": "ENB5J9EdsNcKJ3BrN9dp1l7pASQ9EQC9iIb_xFOUmESc"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON000100_",
-      "t": "ixn",
-      "d": "EKuiUx3BK8WG5zo6GtAhsa5W8nHvdtdWvYo62U99y5jI",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "10",
-      "p": "EGplPT8t6tuNrbhI1-_RzrxoDzVXnUJrDlfOF28nP7sD",
-      "a": [
+          "v": "KERI10JSON00013a_",
+          "t": "ixn",
+          "d": "EJPbhIBqY5VxOV0kO1hsVLUZlcjh60vCCkwRRQ5dwzMi",
+          "i": "EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6",
+          "s": "1",
+          "p": "EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6",
+          "a": [
+            {
+              "i": "EJDqDJ7WkayddxOv4aP1c9ny3tyjWjSgguX2gCiVsKdf",
+              "s": "0",
+              "d": "EJDqDJ7WkayddxOv4aP1c9ny3tyjWjSgguX2gCiVsKdf"
+            }
+          ]
+        },
         {
-          "d": "EOoSB48wARoV793Wc-Rs7wtiIliUJcMuZv3HMUkRLIPJ"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON000100_",
-      "t": "ixn",
-      "d": "EMe5EiZMLRIKI2enKbBuX5gBaP8gJG6r9w53rBAhvQ7l",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "11",
-      "p": "EKuiUx3BK8WG5zo6GtAhsa5W8nHvdtdWvYo62U99y5jI",
-      "a": [
+          "v": "KERI10JSON000105_",
+          "t": "ixn",
+          "d": "EIKLAKUZoY44glFWNL744n0QIFdJp4p-36E3fhtNPXBw",
+          "i": "EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6",
+          "s": "2",
+          "p": "EJPbhIBqY5VxOV0kO1hsVLUZlcjh60vCCkwRRQ5dwzMi",
+          "a": [
+            {
+              "d": "agent:EJDqDJ7WkayddxOv4aP1c9ny3tyjWjSgguX2gCiVsKdf"
+            }
+          ]
+        },
         {
-          "d": "EFwqSjt9CR9pg2fePrKSz00WUsNRIorXbLIevoyHa1zl"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON000100_",
-      "t": "ixn",
-      "d": "EOpHK-s9LGDeqSj0Zi9-72tktgZtjM5kg_eO74g8J3O0",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "12",
-      "p": "EMe5EiZMLRIKI2enKbBuX5gBaP8gJG6r9w53rBAhvQ7l",
-      "a": [
-        {
-          "d": "EDg8qDEZJslxqkVzSPwL8fAXsoxMxUwnW8NeGwYPPKuD"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON000100_",
-      "t": "ixn",
-      "d": "ED0FmC_vdfbVokNJ0wv7tUKsHMoKTGyjLWC1iM3SFOAf",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "13",
-      "p": "EOpHK-s9LGDeqSj0Zi9-72tktgZtjM5kg_eO74g8J3O0",
-      "a": [
-        {
-          "d": "EDF1WK9Q3mi6ERAvofCt0Nf-xZ0rAo6JHHiY58LFUMPb"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON000100_",
-      "t": "ixn",
-      "d": "EE5p32bHveT42MxcgU2wYAICvZ9A_2Csk53jTXM4Xv_g",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "14",
-      "p": "ED0FmC_vdfbVokNJ0wv7tUKsHMoKTGyjLWC1iM3SFOAf",
-      "a": [
-        {
-          "d": "EO1cBsYoV5izKvdIL6TstN5TOQl1hYN3WnhtAOh1lwAp"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON00013b_",
-      "t": "ixn",
-      "d": "EM8wA_-a0EHqzOYdhMKemRvlMBNJbOrrwMrvsOXHsuhg",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "15",
-      "p": "EE5p32bHveT42MxcgU2wYAICvZ9A_2Csk53jTXM4Xv_g",
-      "a": [
-        {
-          "i": "EC9kFyHu8TTeOddjNo6UFa_rc85uh9T2wdJcOuK1smSJ",
-          "s": "0",
-          "d": "EC9kFyHu8TTeOddjNo6UFa_rc85uh9T2wdJcOuK1smSJ"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON00013b_",
-      "t": "ixn",
-      "d": "ELP8rPoZFkqzBVsM4m-7H-HvqZBA-g_BxGOfj0GgdBdk",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "16",
-      "p": "EM8wA_-a0EHqzOYdhMKemRvlMBNJbOrrwMrvsOXHsuhg",
-      "a": [
-        {
-          "i": "ELu71pX3phf4hfXwodtm4fmy16acrLporJ_XoNCL00cq",
-          "s": "0",
-          "d": "ELu71pX3phf4hfXwodtm4fmy16acrLporJ_XoNCL00cq"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON000106_",
-      "t": "ixn",
-      "d": "EC1MMW4EfI9a_8fAeb7DNN2IIQO6oSsflq4FXvMNili1",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "17",
-      "p": "ELP8rPoZFkqzBVsM4m-7H-HvqZBA-g_BxGOfj0GgdBdk",
-      "a": [
-        {
-          "d": "agent:ELu71pX3phf4hfXwodtm4fmy16acrLporJ_XoNCL00cq"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON00013b_",
-      "t": "ixn",
-      "d": "ENFq762ZpOi5PXSrRLVsXcCSv4vHxG5sNsIA9u1bboFL",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "18",
-      "p": "EC1MMW4EfI9a_8fAeb7DNN2IIQO6oSsflq4FXvMNili1",
-      "a": [
-        {
-          "i": "EAmNROPhe_6Nmq_IUvxlQAccnwZoImyPtwF5ZfXhZEXk",
-          "s": "0",
-          "d": "EAmNROPhe_6Nmq_IUvxlQAccnwZoImyPtwF5ZfXhZEXk"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON000106_",
-      "t": "ixn",
-      "d": "ENawwQkgB8q1lLP7YTQyPkLtW32l9M-aX_E1jiFeHCCT",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "19",
-      "p": "ENFq762ZpOi5PXSrRLVsXcCSv4vHxG5sNsIA9u1bboFL",
-      "a": [
-        {
-          "d": "agent:EAmNROPhe_6Nmq_IUvxlQAccnwZoImyPtwF5ZfXhZEXk"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON00013b_",
-      "t": "ixn",
-      "d": "EM6VIvBtPp3dCGU16ibzd83XkszKDWMBs_XbSlSeJTJ0",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "1a",
-      "p": "ENawwQkgB8q1lLP7YTQyPkLtW32l9M-aX_E1jiFeHCCT",
-      "a": [
-        {
-          "i": "EIDjomlmJhcp9YOxGQFunPjEmUNs-bG3yuyTX8U43duu",
-          "s": "0",
-          "d": "EIDjomlmJhcp9YOxGQFunPjEmUNs-bG3yuyTX8U43duu"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON000106_",
-      "t": "ixn",
-      "d": "ELUU4sZY30n_qY90zMPwgxWNoUrjGFDcYDH242wz-IfS",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "1b",
-      "p": "EM6VIvBtPp3dCGU16ibzd83XkszKDWMBs_XbSlSeJTJ0",
-      "a": [
-        {
-          "d": "agent:EIDjomlmJhcp9YOxGQFunPjEmUNs-bG3yuyTX8U43duu"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON00013b_",
-      "t": "ixn",
-      "d": "EBlDXORBJq9tmn9BKiUUOk2eayalrzd9TXZV0ann6iAj",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "1c",
-      "p": "ELUU4sZY30n_qY90zMPwgxWNoUrjGFDcYDH242wz-IfS",
-      "a": [
-        {
-          "i": "EMEM33xgRvQi6wY0pfVzP_-ce1vU64WBNJddf-LWNX59",
-          "s": "0",
-          "d": "EMEM33xgRvQi6wY0pfVzP_-ce1vU64WBNJddf-LWNX59"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON000106_",
-      "t": "ixn",
-      "d": "EI1o-OsAMdJMkdNITbiffbnUkGCKoqbMb07I7tewfMyE",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "1d",
-      "p": "EBlDXORBJq9tmn9BKiUUOk2eayalrzd9TXZV0ann6iAj",
-      "a": [
-        {
-          "d": "agent:EMEM33xgRvQi6wY0pfVzP_-ce1vU64WBNJddf-LWNX59"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON00013b_",
-      "t": "ixn",
-      "d": "ENXt82xjmRzb0S07M2R3Yt9eX_VRcW_S4fTicPSkHhIj",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "1e",
-      "p": "EI1o-OsAMdJMkdNITbiffbnUkGCKoqbMb07I7tewfMyE",
-      "a": [
-        {
-          "i": "EKGOZKZrCAPspNZNN1Duli1BOoSd_UhR-BEvyDyP7SaI",
-          "s": "0",
-          "d": "EKGOZKZrCAPspNZNN1Duli1BOoSd_UhR-BEvyDyP7SaI"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON00013b_",
-      "t": "ixn",
-      "d": "EP_gZSqB6DYDgkkVIe4Bt5L38X2uAEiA33eCiD17PM8q",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "1f",
-      "p": "ENXt82xjmRzb0S07M2R3Yt9eX_VRcW_S4fTicPSkHhIj",
-      "a": [
-        {
-          "i": "EE0slWK6chng-UM42qf1fbtYapx8oZ1yadRIEFYB1m5_",
-          "s": "0",
-          "d": "EE0slWK6chng-UM42qf1fbtYapx8oZ1yadRIEFYB1m5_"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON000106_",
-      "t": "ixn",
-      "d": "EChKTGxMtNB2_HNoOy-cjx-3jx-UDhcTc9kGhAzLsoug",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "20",
-      "p": "EP_gZSqB6DYDgkkVIe4Bt5L38X2uAEiA33eCiD17PM8q",
-      "a": [
-        {
-          "d": "agent:EE0slWK6chng-UM42qf1fbtYapx8oZ1yadRIEFYB1m5_"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON00013b_",
-      "t": "ixn",
-      "d": "EDeBCz7OS0VYNsuQ7Nw3efrKsY46mMOFXC96SoWpba4U",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "21",
-      "p": "EChKTGxMtNB2_HNoOy-cjx-3jx-UDhcTc9kGhAzLsoug",
-      "a": [
-        {
-          "i": "EO9pxZBky_Tkd83KnWOnay-J1xjiEkxUF5na-T-boJsC",
-          "s": "0",
-          "d": "EO9pxZBky_Tkd83KnWOnay-J1xjiEkxUF5na-T-boJsC"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON000106_",
-      "t": "ixn",
-      "d": "EAW02fXFfS6Pqn5ArwguKYCaxsO1QNY-Xlg333qDWZ7M",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "22",
-      "p": "EDeBCz7OS0VYNsuQ7Nw3efrKsY46mMOFXC96SoWpba4U",
-      "a": [
-        {
-          "d": "agent:EO9pxZBky_Tkd83KnWOnay-J1xjiEkxUF5na-T-boJsC"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON00013b_",
-      "t": "ixn",
-      "d": "ECJNzC7CpXvNcGXkEQMR3lU5Ch6iMWV-WKGgcZ0Y8Ueb",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "23",
-      "p": "EAW02fXFfS6Pqn5ArwguKYCaxsO1QNY-Xlg333qDWZ7M",
-      "a": [
-        {
-          "i": "EG98LlhEMtRuQUnBgUVSrtTarbJrSLa7IV-CdQLr5Rpj",
-          "s": "0",
-          "d": "EG98LlhEMtRuQUnBgUVSrtTarbJrSLa7IV-CdQLr5Rpj"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON000106_",
-      "t": "ixn",
-      "d": "EAbwq4_nAx1g_Jf6yP8DRh7vPEPBXNYaihmHjexTysMK",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "24",
-      "p": "ECJNzC7CpXvNcGXkEQMR3lU5Ch6iMWV-WKGgcZ0Y8Ueb",
-      "a": [
-        {
-          "d": "agent:EG98LlhEMtRuQUnBgUVSrtTarbJrSLa7IV-CdQLr5Rpj"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON00013b_",
-      "t": "ixn",
-      "d": "EFZOZdBF1Ybcvl0Y6lglnPsEV_dKGtqIVJlN2r6JkOPB",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "25",
-      "p": "EAbwq4_nAx1g_Jf6yP8DRh7vPEPBXNYaihmHjexTysMK",
-      "a": [
-        {
-          "i": "EGOV2nwCPgcQ8jrEP8gP2vo5bZdggvnpW_IA8M1iMXeg",
-          "s": "0",
-          "d": "EGOV2nwCPgcQ8jrEP8gP2vo5bZdggvnpW_IA8M1iMXeg"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON000106_",
-      "t": "ixn",
-      "d": "EMMqXQ9ELy1kYNd7IteHC-S8UP2b-TJB1naLTCTAvfMQ",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "26",
-      "p": "EFZOZdBF1Ybcvl0Y6lglnPsEV_dKGtqIVJlN2r6JkOPB",
-      "a": [
-        {
-          "d": "agent:EGOV2nwCPgcQ8jrEP8gP2vo5bZdggvnpW_IA8M1iMXeg"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON00013b_",
-      "t": "ixn",
-      "d": "ECVXdqtXnxpa_IWiGIMk641wZlBvRMPgYIJ9B_3Z4dmd",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "27",
-      "p": "EMMqXQ9ELy1kYNd7IteHC-S8UP2b-TJB1naLTCTAvfMQ",
-      "a": [
-        {
-          "i": "EBLiCGzZ2OKMRTB_ppJqTQf-Vol7uMkVVYeLu1V0m6K3",
-          "s": "0",
-          "d": "EBLiCGzZ2OKMRTB_ppJqTQf-Vol7uMkVVYeLu1V0m6K3"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON000106_",
-      "t": "ixn",
-      "d": "EI0n9-3BNW9Q2T_pxJsg4G4gZEwkZkxR_2djYPX5RWPb",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "28",
-      "p": "ECVXdqtXnxpa_IWiGIMk641wZlBvRMPgYIJ9B_3Z4dmd",
-      "a": [
-        {
-          "d": "agent:EBLiCGzZ2OKMRTB_ppJqTQf-Vol7uMkVVYeLu1V0m6K3"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON00013b_",
-      "t": "ixn",
-      "d": "EFUPscm76zoX99K55DfMW3_47-vQKQpgXldl8M__f8_h",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "29",
-      "p": "EI0n9-3BNW9Q2T_pxJsg4G4gZEwkZkxR_2djYPX5RWPb",
-      "a": [
-        {
-          "i": "EHD8EcYBcuP5G0FBNMSHK8xXlrtwjEWRAlT7rWxl_gd3",
-          "s": "0",
-          "d": "EHD8EcYBcuP5G0FBNMSHK8xXlrtwjEWRAlT7rWxl_gd3"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON000106_",
-      "t": "ixn",
-      "d": "EF5bdL-91KVBT5hOr5ZQw8n8z9X29j2MKNdDTJTf_tBP",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "2a",
-      "p": "EFUPscm76zoX99K55DfMW3_47-vQKQpgXldl8M__f8_h",
-      "a": [
-        {
-          "d": "agent:EHD8EcYBcuP5G0FBNMSHK8xXlrtwjEWRAlT7rWxl_gd3"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON00013b_",
-      "t": "ixn",
-      "d": "EGspU7odwwdZRc9pGzQku_QFF0uHj6qvGD2oIot4AaqN",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "2b",
-      "p": "EF5bdL-91KVBT5hOr5ZQw8n8z9X29j2MKNdDTJTf_tBP",
-      "a": [
-        {
-          "i": "EPQuvGHYnhJhBcfOV3aIkTl0vqbAKeLLjTH782wCrUl7",
-          "s": "0",
-          "d": "EPQuvGHYnhJhBcfOV3aIkTl0vqbAKeLLjTH782wCrUl7"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON000106_",
-      "t": "ixn",
-      "d": "EJypCLLsE87Bq3CJSQAotrK0x74idiMe6i7MRaK43yrd",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "2c",
-      "p": "EGspU7odwwdZRc9pGzQku_QFF0uHj6qvGD2oIot4AaqN",
-      "a": [
-        {
-          "d": "agent:EPQuvGHYnhJhBcfOV3aIkTl0vqbAKeLLjTH782wCrUl7"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON00013b_",
-      "t": "ixn",
-      "d": "EEzQsJiNq42cViIqZA_QtKnTZuPZuYNGu39Kf8soqrZT",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "2d",
-      "p": "EJypCLLsE87Bq3CJSQAotrK0x74idiMe6i7MRaK43yrd",
-      "a": [
-        {
-          "i": "EFRgbSmevoMh3jUiRutNBVQz9PyPimWJW8lBBElQS6mY",
-          "s": "0",
-          "d": "EFRgbSmevoMh3jUiRutNBVQz9PyPimWJW8lBBElQS6mY"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON000106_",
-      "t": "ixn",
-      "d": "EJGiPkCFqlY1tLsXidG-Dc5a_FIMx258xD8H4TVBPN42",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "2e",
-      "p": "EEzQsJiNq42cViIqZA_QtKnTZuPZuYNGu39Kf8soqrZT",
-      "a": [
-        {
-          "d": "agent:EFRgbSmevoMh3jUiRutNBVQz9PyPimWJW8lBBElQS6mY"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON00013b_",
-      "t": "ixn",
-      "d": "EFSjJla010TMfJLKLc5lm-ALJMOuePpBdWs8YMp1SKe4",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "2f",
-      "p": "EJGiPkCFqlY1tLsXidG-Dc5a_FIMx258xD8H4TVBPN42",
-      "a": [
-        {
-          "i": "EDcmK6onrDzdFgEqI6OYjJZoGy2gSCdaO_dVKLJWsb4n",
-          "s": "0",
-          "d": "EDcmK6onrDzdFgEqI6OYjJZoGy2gSCdaO_dVKLJWsb4n"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON000106_",
-      "t": "ixn",
-      "d": "EFJP7b_mCunyd6_kZwCj1GAXfSWbo7gOxVZ2BedKMAMl",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "30",
-      "p": "EFSjJla010TMfJLKLc5lm-ALJMOuePpBdWs8YMp1SKe4",
-      "a": [
-        {
-          "d": "agent:EDcmK6onrDzdFgEqI6OYjJZoGy2gSCdaO_dVKLJWsb4n"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON000100_",
-      "t": "ixn",
-      "d": "ECeploKPS8cl0gbwVwecou6-4k8AgUW_0ifvL5mN00cB",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "31",
-      "p": "EFJP7b_mCunyd6_kZwCj1GAXfSWbo7gOxVZ2BedKMAMl",
-      "a": [
-        {
-          "d": "EAHITZSkghD68_Tp4blT499CtXVt4kcczuflyv_GCIgQ"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON00013b_",
-      "t": "ixn",
-      "d": "EAJb8cBinIhepHswXRD7_VfyyKKvc_jtJRLRe5af4O-L",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "32",
-      "p": "ECeploKPS8cl0gbwVwecou6-4k8AgUW_0ifvL5mN00cB",
-      "a": [
-        {
-          "i": "EHVCdLP79CXEc7xYjwtwp_Q1_MguwDmhEYFMZevOXIZ5",
-          "s": "0",
-          "d": "EHVCdLP79CXEc7xYjwtwp_Q1_MguwDmhEYFMZevOXIZ5"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON000106_",
-      "t": "ixn",
-      "d": "EBfvjHfQ4jYKmzvN2PnxTvj4Aw_B7OsTIg5-H2iYDlHk",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "33",
-      "p": "EAJb8cBinIhepHswXRD7_VfyyKKvc_jtJRLRe5af4O-L",
-      "a": [
-        {
-          "d": "agent:EHVCdLP79CXEc7xYjwtwp_Q1_MguwDmhEYFMZevOXIZ5"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON000100_",
-      "t": "ixn",
-      "d": "ELGBW2v3MOeP1OxMCG2tVRMmkV88GLgJ7JSr9wDvZyHF",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "34",
-      "p": "EBfvjHfQ4jYKmzvN2PnxTvj4Aw_B7OsTIg5-H2iYDlHk",
-      "a": [
-        {
-          "d": "EAPrQNvafRnyielKEJvOuwgwR16Q-DvQnTZFcGNYzLaD"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON00013b_",
-      "t": "ixn",
-      "d": "EEx0eh-Y2uyeaIIj5g6Xjj4Z7nhRftfZdJl3Ty1pgIQi",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "35",
-      "p": "ELGBW2v3MOeP1OxMCG2tVRMmkV88GLgJ7JSr9wDvZyHF",
-      "a": [
-        {
-          "i": "ECzFpM6abrCSSpiki8v_qJHAOii2jg6556PRB33z1AAb",
-          "s": "0",
-          "d": "ECzFpM6abrCSSpiki8v_qJHAOii2jg6556PRB33z1AAb"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON000106_",
-      "t": "ixn",
-      "d": "ENUPVw-rJCWKdroSnPCTz1sVqid75wbjA5_3luNKYs5x",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "36",
-      "p": "EEx0eh-Y2uyeaIIj5g6Xjj4Z7nhRftfZdJl3Ty1pgIQi",
-      "a": [
-        {
-          "d": "agent:ECzFpM6abrCSSpiki8v_qJHAOii2jg6556PRB33z1AAb"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON000100_",
-      "t": "ixn",
-      "d": "ECKxbuiSrA1Wz0CvuaRowsnQu4iz0htxyrVtSBeuGlT7",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "37",
-      "p": "ENUPVw-rJCWKdroSnPCTz1sVqid75wbjA5_3luNKYs5x",
-      "a": [
-        {
-          "d": "EKycxqi4Ax4bQu7ykkxSKZ6L8uRD5pAW8zA0abpCsJrD"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON00013b_",
-      "t": "ixn",
-      "d": "EAoV5o_J_KoP48XUFbx8UUnfPJADwc9HG2NBghs7XE4l",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "38",
-      "p": "ECKxbuiSrA1Wz0CvuaRowsnQu4iz0htxyrVtSBeuGlT7",
-      "a": [
-        {
-          "i": "EE-k7tp1lVfa8Ru9RNy-JQgeHYfFtaI6BR3hDbd9KGmn",
-          "s": "0",
-          "d": "EE-k7tp1lVfa8Ru9RNy-JQgeHYfFtaI6BR3hDbd9KGmn"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON000106_",
-      "t": "ixn",
-      "d": "EKeBwE8ZPibJzW2x5a90zFxU4hVVuHCnmmmaokv0Khum",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "39",
-      "p": "EAoV5o_J_KoP48XUFbx8UUnfPJADwc9HG2NBghs7XE4l",
-      "a": [
-        {
-          "d": "agent:EE-k7tp1lVfa8Ru9RNy-JQgeHYfFtaI6BR3hDbd9KGmn"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON000100_",
-      "t": "ixn",
-      "d": "ENIlsM7qv5s3JQKz9ODeLTbqA-SCarl8-h-nd_11Uasb",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "3a",
-      "p": "EKeBwE8ZPibJzW2x5a90zFxU4hVVuHCnmmmaokv0Khum",
-      "a": [
-        {
-          "d": "EH_KlJMOL2WX56Zy3ClMkZxnxpCcv4Ohe_4WRlBRy7o-"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON00013b_",
-      "t": "ixn",
-      "d": "EHeCPO5i_7h7V-ssLAlnVCoxWjFS2jaJQRerZzdB0ZRU",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "3b",
-      "p": "ENIlsM7qv5s3JQKz9ODeLTbqA-SCarl8-h-nd_11Uasb",
-      "a": [
-        {
-          "i": "EFE_IQRzArN0vTCK_8b0ef68uL7_EO919AEsTpuWB8wv",
-          "s": "0",
-          "d": "EFE_IQRzArN0vTCK_8b0ef68uL7_EO919AEsTpuWB8wv"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON000106_",
-      "t": "ixn",
-      "d": "EK0xweO7Oz5ic4-aQqznhCuu3_zUUkr4Mq25m_aTY9Kb",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "3c",
-      "p": "EHeCPO5i_7h7V-ssLAlnVCoxWjFS2jaJQRerZzdB0ZRU",
-      "a": [
-        {
-          "d": "agent:EFE_IQRzArN0vTCK_8b0ef68uL7_EO919AEsTpuWB8wv"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON000100_",
-      "t": "ixn",
-      "d": "EMzho2jaXZLeRsFeXA91Fkb1kwoYf2T7uGksSXhnsJWB",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "3d",
-      "p": "EK0xweO7Oz5ic4-aQqznhCuu3_zUUkr4Mq25m_aTY9Kb",
-      "a": [
-        {
-          "d": "EBJ9gKC0OGz3vsoROW-DtWxb3JMNBpoik-QzA4CFtMKw"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON00013b_",
-      "t": "ixn",
-      "d": "EMsJqivBbky_Cz2TbGzJGpaVKlj4uovYNdDuXAezoKE1",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "3e",
-      "p": "EMzho2jaXZLeRsFeXA91Fkb1kwoYf2T7uGksSXhnsJWB",
-      "a": [
-        {
-          "i": "EOtdnfmn4wkvMqUX4374wkHzXIs0WgA7zFVNJGL3cLvZ",
-          "s": "0",
-          "d": "EOtdnfmn4wkvMqUX4374wkHzXIs0WgA7zFVNJGL3cLvZ"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON000106_",
-      "t": "ixn",
-      "d": "EOsrZeY-Qvg4UoudsG4UzxZ0YdvfKzr4h3tcNKcmSjv4",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "3f",
-      "p": "EMsJqivBbky_Cz2TbGzJGpaVKlj4uovYNdDuXAezoKE1",
-      "a": [
-        {
-          "d": "agent:EOtdnfmn4wkvMqUX4374wkHzXIs0WgA7zFVNJGL3cLvZ"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON000100_",
-      "t": "ixn",
-      "d": "ECsL78mL9mebB82DcyHmSfWAJitgChuqBnIum089FYIz",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "40",
-      "p": "EOsrZeY-Qvg4UoudsG4UzxZ0YdvfKzr4h3tcNKcmSjv4",
-      "a": [
-        {
-          "d": "EBoiarAtPedNt72454iJ-QgL41_jOdUZ29_u1ARztnJc"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON00013b_",
-      "t": "ixn",
-      "d": "EKN8xvUvJ-m3FEdW4NCxOcjpXKtoBL-vm5vAycCdl3ut",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "41",
-      "p": "ECsL78mL9mebB82DcyHmSfWAJitgChuqBnIum089FYIz",
-      "a": [
-        {
-          "i": "EGBVjMs3qkVEel7os20R3WHNiI5DNJlVGbhkNTr12wbe",
-          "s": "0",
-          "d": "EGBVjMs3qkVEel7os20R3WHNiI5DNJlVGbhkNTr12wbe"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON000106_",
-      "t": "ixn",
-      "d": "EJkGLPqsHNRKx_ktfLaJ_E7O5Wydm000ckXj3VJ0XTFb",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "42",
-      "p": "EKN8xvUvJ-m3FEdW4NCxOcjpXKtoBL-vm5vAycCdl3ut",
-      "a": [
-        {
-          "d": "agent:EGBVjMs3qkVEel7os20R3WHNiI5DNJlVGbhkNTr12wbe"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON000100_",
-      "t": "ixn",
-      "d": "EC2RF5vCUCplNOYiKT1cIoW1zkwvXYixj-kdOY31mq6i",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "43",
-      "p": "EJkGLPqsHNRKx_ktfLaJ_E7O5Wydm000ckXj3VJ0XTFb",
-      "a": [
-        {
-          "d": "EILi3XVOkZfEQzgVf_9CX4GG9rCp2flh3jAAR4RJiiZg"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON00013b_",
-      "t": "ixn",
-      "d": "EP7Tz8VKDXw1Lb9foNwsZ4tXBUD6ZoDnpJiWUq7u5jiq",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "44",
-      "p": "EC2RF5vCUCplNOYiKT1cIoW1zkwvXYixj-kdOY31mq6i",
-      "a": [
-        {
-          "i": "EGXg8l62pI8_ig0JiIHMkKyGKbJHdWMpIhb0W0niK86y",
-          "s": "0",
-          "d": "EGXg8l62pI8_ig0JiIHMkKyGKbJHdWMpIhb0W0niK86y"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON000106_",
-      "t": "ixn",
-      "d": "ECb3rP3-DITwmS0_W4P09-X3bG_ZdeeUiVx0uNOn4nHy",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "45",
-      "p": "EP7Tz8VKDXw1Lb9foNwsZ4tXBUD6ZoDnpJiWUq7u5jiq",
-      "a": [
-        {
-          "d": "agent:EGXg8l62pI8_ig0JiIHMkKyGKbJHdWMpIhb0W0niK86y"
-        }
-      ]
-    },
-    {
-      "v": "KERI10JSON000100_",
-      "t": "ixn",
-      "d": "EJuIcSRvEyQIo4KBSIxx7mVOVcN_Q4m-zbuaT92pYAss",
-      "i": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd",
-      "s": "46",
-      "p": "ECb3rP3-DITwmS0_W4P09-X3bG_ZdeeUiVx0uNOn4nHy",
-      "a": [
-        {
-          "d": "EC26tael_VawbhaOMthHhIXbVXvppx97zJQc0gTmVDLv"
-        }
-      ]
-    }
-  ],
-  "kel_attachments": [
-    "2d4141424141417877504838766b56354c766b697652353842764a524a766e49416a53415a6331714e385a3072636c444d49317132454a4f754a6e61507931304d6b675f3363755f525a7570696639646565656459586a6455415f34",
-    "2d414142414144696a3038345f61366a637153616f63636e4a4d62305259495237634e725464354439355f612d754f59525f635051736b5457455049452d386777764f33576131687161754a643952706d3258752d71625368467155",
-    "2d4141424141414f705763614767782d2d4e75524d593853506f7a346d6850734c5247645752423962353645654954572d6e6b79544b695f76706c7241676857665875653169685f4147634b424c7257433378746676595534497369",
-    "2d41414241414463705f6b6a6c3551684c3067764266744b70587176554953714269443679533955694a5a4330315f6d43617a6c414d48324f794b2d3953304a44787462545a384f316a4a4234686679456d4d785572413269636f30",
-    "2d41414241414132704e4a43317138376a66743636476151503334344a7166337132627537397732684555634f684e4e7768622d30476b6741494d726d6b6d2d6a37426c305f462d4c487772527549486874394e6168472d4f333152",
-    "2d41414241414172347475664c3078463833436470306e685f675761492d6d4a5971705879665a52466969307269756b41657739743371644c78445548337768475755436c504f54305a7664537756564d794378586d78327a666136",
-    "2d4141424141427041646c717a662d75635a61394845736c6c626b546633444867457a717044696c486943486c2d6846775849554778486c453136695961305570792d6233625a6f695357624c555f316658573148484e5f6863374d",
-    "2d4141424141436d4b366f4a7335415946743639702d5a5552434c596a696f6447377233366a38326e6a3644572d7a6151496d3856745f35346a4c4d7556494f78587569387548754f4f4667705346514a2d36766e64507646727851",
-    "2d414142414141784b59343473366b59356b72446f495975417432526b4a4a357a657732744552505a49424e5371767167737454476e43757a5055564851744152584264704a7261767946685f39527831487172396a31384a2d4457",
-    "2d414142414141495f4b55594b4f73764e62326f4c7473556c6d61536965436b714f6b334b7935546c336c722d52574834653954525571786b63756a34375065726e536a615653742d6d47463771734453395764725178346d526d2d",
-    "2d4141424141425a484831596835716553506b744d56316a4e456673366f506561525f45727265354f706232756d4334772d46426f557850634c776f7361326a507a6d3969554448754e677a4d4d58314d42483334384c41724a7569",
-    "2d414142414142514b6478305f794a754657466c55704f3550714746316e303979762d6b2d35467873715043385a72745959745f357532734932445749744b6d4359434339306b7a4d532d556b584c4a7a7a454d4371696676724579",
-    "2d4141424141427a526777374658754d575a7354594a326b79784965447947327a63326c3170424d35436d6c475f5a4d64394c63646b417746693263774e4f7043433937416472624677724e774f4765356f584f443067535f634e44",
-    "2d414142414144575161325572665f635762554b72366250366a47626d4257386950554d395655425a4f71745f426a492d75656371564761495f664a3869384153754e55693872426d7076392d7475752d4b7243656876513043364d",
-    "2d414142414141536f37557a575f32496a4a68523750334477673543447462426e31564579625468426b534c44464c6b36556d706877472d4450584e676a41624b5a56584b3661316d345a314941574d355447735248412d78524352",
-    "2d4141424141424375476f526c676d39784b787854466f7266567361517a324e647374647259686d364e55515679412d67333177522d6c4c734c46353456504a304f6678386d6c7068654a556d656735384333746658546b67517338",
-    "2d41414241414370344667677556413036673130384f304c3268334a427776454b4333724578654d7931534e744c656947442d636255724941354c49596f73442d33734b74374644414f3277716a6d3735554152346535636c744958",
-    "2d4141424141415039416d6d54735576754f596838727562683651476a734c537130384255497868686a334b3369496c732d5341562d7771314e794f5f53326d4e6861714161664d61316d55487834775a674975675a324679577066",
-    "2d4141424141413649556e334e44446357637153736749645939574e5a2d6a655848513141776a76464f376368754d4e37507a62707978496b79546c416d62434945654a6a38426835626b6d306b4762657a5a436b4c7461694d5f38",
-    "2d4141424141413034686b434631686137537231794b464a4c52655273793347686833312d39672d706a7371495658364850396236336b644d376d55566a6a597238696d4e626761352d51413556544c74534b6230744e5f43627832",
-    "2d41414241414279726d6669514241717650735f566f5f6a52504654776d74446365735357344354426a714a3137486e4a765661796f58726f486f3030594559534249687134696b6b776c356179466c684d44536d42526d54786165",
-    "2d414142414143514a5043494a444a3449446e37666e6447415938317976424b7268536e3354504a4b42356f6155386b32576533747033322d454d764f5a526c4f3930657353576e4d31764a467830416e7835723230512d56734c45",
-    "2d41414241414461347433486e444353714d7476595233687235694e6769434b356a616878376c354749646d336d7635325a347a7753354330323534334654766752665077797a6d6b55466a4f7330394c64504452786f7262302d47",
-    "2d4141424141446a425f6d30464237354f744f3874627776324531325a54586941786d522d516e33757a6a355a6f704e433958624f774b5a716f6c75552d4e4552745a53546f59636741595458676e68646568527348594e7743616b",
-    "2d41414241414470767163656c4875635971523262414f776b3554346c50667a764867744a7a5546354f446538654f67334b746d36625648566f4736347a6c596c4775615037755030466764424b746349424a677865747556695f39",
-    "2d4141424141414f5349327a432d4d424e7a4c69335461556c6b7969522d73344b6a4a4772317970535a766558694b35474e736a5036776730464d747072714f576c564a4a6274794f7669536a4a53757933457368702d616d616971",
-    "2d4141424141427234493551326c6553354833425536424477424b4d5571616930384d6a79516e6a6c4f726f2d3461545736422d4b72415174346b4e5442506e7865745665342d6731445372313354597a6f674875304857475f422d",
-    "2d4141424141445f53645642446a7531554e535f6c4761486231467054556b375478743632377541456f4c6568694f4368334e3667375f4b765770694d6a6d7a416844614f63724441514c4a5a6c696e524d6f5f4a66364d72774e58",
-    "2d4141424141446c69584447737a5a5875746c504665736c3336307268575a4271686567785f5970316c6f53615755545674556638704e397a62375456336945376c4b7337434371306f5a4569317576575275524a356c7752596652",
-    "2d41414241414470655059677437375f437034733268616c48696c5172456c5f664d4c5f7273667a2d467042425f5a6d6d4458366262374f4d5371506b343664662d50557669627870647648556a7953796b79423044336966576743",
-    "2d414142414144467578672d7066762d474d5963716e77453757505533595f4c4f41366b61364a6d37436372476e5f5231554e666b3976575a442d4a314a30315f3851423246646376566350425f3048672d574c3151392d474a7336",
-    "2d414142414141306e6d42576155327542586d4f6a5642516c37485646634131356f373158634c31715a5568316e655f4d756f7457575672373069503969455255544e327541685f725046696a32762d613430675657414841585554",
-    "2d4141424141444b447175305a61785a65655f72757474635958534e357867437a2d44503330346c744d715563666c56626576666b6a5f704b7148776d6e7470676d6576656f58717553536e556e36366d4e764d467654794f514235",
-    "2d4141424141444b77526e444b42614959306a6f6a31524d414b52526f494b444739793245795343552d57624a53437537363258626176335654555235433756416a54396b5a4a6f4b65715154757a6b39646d4c4d69344561456e70",
-    "2d4141424141426f4c7a594675477669357847626257356f75482d586c774867646e686c477a434644556366626d6d6e64456b4a6d6b2d51774c4d476731444367396842667879384b7151397648736c745a6c6c5f5a2d63596b376e",
-    "2d41414241414458746b47357330514e56536f396a5a6a4658416b51565130656776714a575137522d597135455f4838455a314f4541374f3354646659474c77574462594d72366d396e436275712d66645357505367684c4f706d73",
-    "2d4141424141424663614232446e4767666c52456342413768442d69456f766c325a7561724b4c34316971767133637932624d6568666c7343386e7578782d636e686d554c2d4252736e5f796d7a34697473666a6d515f5a6462716e",
-    "2d41414241414233766f4e6e6264635f6e6376314f656c736b55315f324d776c50454a73555456436c686f4355394a742d5a3859756258506e626d757050525836683945746c5a63525542714f305771414a376145704f365f705970",
-    "2d41414241414470426d782d3362426543534d5a397a567a6d793276473650505a7957744d3141736377642d61636b586c345558434c7043423065514836347677694b7449746676334a764c50626742456651636673684778743633",
-    "2d41414241414374456b6a4158564d447761467044383970623467555f336471465738514b68477274547850425a33537835384a4879724d326f487a526373566f765f6f4a694730514c6e66345a30524b7257436468565857463468",
-    "2d4141424141434c6b2d6e3753785765476a4e62496b356d645776487258696741585479685631484a714f326976636b68666c44375a4c594a316548376264486d656964786435504948665a385a47315036307830586b6b754c3777",
-    "2d4141424141434f706e5f362d497966424f6844657047424436304258503633584c546876455a35784f69664f4747533578374c6658646a61356f703833436158586c78455f6445636b5367664836344d7532354531536537794c45",
-    "2d41414241414139327465636531795858556a5f5444564553476c6f455a4549575333434468782d6d49594f426f6368746b5877495274516a3637575f6241434632725478525843374143437170754e614843587235736d685f5234",
-    "2d414142414141364a347a786a6570673539793242345444444f4e35707053636c5a6d574a6d45653630567062486d613275714e6157324b6e6e6a4f426c57693171334e61443050714336487364377a5f673062654d4a465974444d",
-    "2d4141424141434565426765593666434c6271527767575f79554149674d75676d5142584a6d4b56695665496c496a50555930795378357945646a3163715969425056644d61304c6f46477434393065735536715544397059726a6a",
-    "2d414142414143324b6246665850305f797a7332684a58743937306a5479417566655779703676746c796e55526b6a6c7765334e7239375f6b6c347763345942474769557370356e6179483977484971626749483946336f2d392d4c",
-    "2d4141424141446d49306148734f3465727552527077503237347553312d665a2d32695f4b77646848676547756d3339585859315a66554a754c5645696e52467055646b59335973646d4a4b342d45462d6870593569517a4d6c6f5f",
-    "2d414142414141494b31356f425f4254426359766d4b71456a734c644245795565487147554f2d73464d755636716e76796d3964594a30587044524e4c3868414f53536835424f57397036494a485237636c63567950584d65367664",
-    "2d4141424141413878476d347a424c473767486b754774595139384a6969617047546a3074787a65367555726839465978625679355f79656e514948656936525831654641674873784d44427965584f697259734448423633554179",
-    "2d41414241414445734e476d78676651794c79323864424649482d76656432435342475735444a626a6c76495f61314e6d5749496f34424970444957304970656355794637617a445f774341504e57774d7a2d30396e497570697962",
-    "2d4141424141447135745a554e4b685a4f2d624862354b57354a6c414a6e5154792d50664b68427a38734b737856474e526e4d643468534642626b516a475177385761354252544b5232536b73736b2d323746434c784f6572414953",
-    "2d414142414141514a6332773346624c5450454e564e3776626b714f7632465670394962305448704b4b765179704d6251774c5a4c4b495a715875316b426149326e4b4e38677374366272465338687148795f516e386267594c6950",
-    "2d4141424141425768544557687574743944664c374f4277526a474e6656644a684a51326f53546c49752d68774d3250525953657a34774a326f336d37547562687a31364a7a52726d527755456a6c775f397136705f58716e427839",
-    "2d414142414143724674796844346e556d44344c375f32534b654b58565975735435737250445374655532484250357a5032737750746451763857535852546837706863475454467235344255464a64744d7369384457736269346c",
-    "2d414142414142396a777435337556697a586a7154736d774d316d7547527861646d31396d622d75334151457061634c6f43625a53755a534d4a68536a456f445a764a616a6d6331524573793747536f63444c4c663053743054476e",
-    "2d4141424141426361504b425375424d556c496c34726c4a627a7470735f7541575f353955504361756157595555474279434932323670565866484f67544d737a643858414a74335038366c6e51674c61303859496648355f504967",
-    "2d4141424141434f586d4f3453426e5161585541364e6271474a5f5f5630766b654a317553324e38376e48794a685f4b677556396f493765765477676545595165785070745172707875757130394f5271654e6d35644a3674565862",
-    "2d41414241414164324178524638676354376f5a4651596375417867526e76694e774d376131354b6c6b756363344c6343504a4b396c6a504376353564314d7a6f6e4d6a76575a526c544942346570716f7542446c6737695a514936",
-    "2d4141424141434e384c576a6e4448764a54586c574f61527a367552436e586a454f495a77547a6b5a795a313964615976494338434d415256715f62454462734163357068746d4255334c4a63376d3368716679527171536c6b6c6e",
-    "2d4141424141436c524532785056327648523061424e61746767447638726838437768393444554659613247365f50344365544d6c42446b726e68716c794a35546451526739535866627a686a6c37737064426f2d4842314e49612d",
-    "2d41414241414157514b5642516e457955477446614f4245626e6c666544663264392d667472444d597676457645775f33554b327a7847564a5865425a5238356a7768594e53746255383568684975486b4e614c5a7a7357584f6146",
-    "2d4141424141414a4f30724c686455536839774d394e5933533368644673564e4e4b566138316549775f7930325a596d76565576446d674f736a6d2d493975516e7967567a526947474c6c67387a30454a753042426f663063436242",
-    "2d4141424141427154334c653334674f796558366d68736d7155354a324f524473753954423448716b6273734a42754c4b6d4b5234433850394258747a786e30436e5f5534646e636f334949776547664c7a44463548394e66313375",
-    "2d41414241414365626d546c5949366e763464576d6e7364774855585658494a65324c6e346b3250797a2d4a4c37554b496d614a304b3844666a327378457063465f4331664a6c7466526149496b4d6c38436c3366545f784b314c47",
-    "2d41414241414263445a793757436f3039636b75566a41755f4d4d794e464e70453543453662514e49546657643563737263696d726b4d48756c596d59323051345a4330514248355966347448715a3938456c35363675724d4a466f",
-    "2d4141424141424f6c2d67454c536367444232366a5931436a3467644c716e756b7a7a5647507439434d71726b75383056797a5f666337445f376d4d59334e593463676f6d724e625a36455a76526d754b5779545452693048637a72",
-    "2d41414241414461694c75654b42746d555a4c3333634a55534a533562363338656b7176375763766b4a58424d43634a7468543545517a77473646326f4f56575a4b693756356873764c35574b6a71683975586645354c63436c4270",
-    "2d4141424141436c696a4a4e4734706b61433759594641494a6e64454b324445374c6f79486f676c303054483739506c394f664d4a6c7630457355346b3750565571694f77566e5550656b784b694e414533525368785331444a536a",
-    "2d41414241414362665943726a726f5275374d3951796375547363553930374f466f496a58795a794b7a316b5f5f577033394e356e4146396759616b506e64544e536f744244356363776d51304e7246786c3247714c624a514f5452",
-    "2d4141424141444c396551334e766e6b34786c616f5f58475f73323462494e5f65675a717a6d7a70356476746e432d6c727a6664614647706c497254574d2d653547385249696239536361766f4a4b524e6a714d3964766448464a37",
-    "2d4141424141444c4e326f75335236677077554972573459412d364d4c434551546a644d6348524f6a617158415879624450486232595339743346794f6c5a3356425a5535774f69754b2d65515871464150477a705671325a685f7a"
-  ],
-  "device_kels": [
-    {
-      "did": "did:keri:EAmNROPhe_6Nmq_IUvxlQAccnwZoImyPtwF5ZfXhZEXk",
-      "kel": [
-        {
-          "v": "KERI10JSON000163_",
-          "t": "dip",
-          "d": "EAmNROPhe_6Nmq_IUvxlQAccnwZoImyPtwF5ZfXhZEXk",
-          "i": "EAmNROPhe_6Nmq_IUvxlQAccnwZoImyPtwF5ZfXhZEXk",
-          "s": "0",
-          "kt": "1",
-          "k": [
-            "1AAJAnNU_FCsKS_ypOGqRRLXmSIEOUpiNpMPLrZDCRjwVab5"
-          ],
-          "nt": "1",
-          "n": [
-            "ENiJkMroiHJr2LiJkbY9exjYYK3SVEjrhJMqd7Jr73JY"
-          ],
-          "bt": "0",
-          "b": [],
-          "c": [],
-          "a": [],
-          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
-        }
-      ],
-      "kel_attachments": [
-        "2d4141424141423562706f476f57544f30523247765649425f7379636438444d74377372366c4172666b3855564253695a78637978377234516c70557568726f7278563542302d4474617a6e6b5a385a4a5644725a38394a474458492d474142304141414141414141414141414141414141414141414159454e46713736325a704f693550585372524c56735863435376347648784735734e73494139753162626f464c"
-      ]
-    },
-    {
-      "did": "did:keri:EB46LmlwowYkoVNeSxMVs68LRc7g6vI1hsPnCUBtzKjt",
-      "kel": [
-        {
-          "v": "KERI10JSON00015f_",
-          "t": "dip",
-          "d": "EB46LmlwowYkoVNeSxMVs68LRc7g6vI1hsPnCUBtzKjt",
-          "i": "EB46LmlwowYkoVNeSxMVs68LRc7g6vI1hsPnCUBtzKjt",
-          "s": "0",
-          "kt": "1",
-          "k": [
-            "DNXo-V5u8_vuBzkKYoaRRCO2DnaqYbWlTqHvHRowIjSq"
-          ],
-          "nt": "1",
-          "n": [
-            "EMf_-qFIcaO8PCkHnTQ1kg7lsD5_QAsAj94Bo4Fu7UHi"
-          ],
-          "bt": "0",
-          "b": [],
-          "c": [],
-          "a": [],
-          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
-        }
-      ],
-      "kel_attachments": [
-        "2d414142414141533962696a475866547550686c48343344435532686659584844697644597937474a62394a5249776a31576f4f594a68784a4e4d6d66727636622d574b4e51485a59722d523270435031454f66423158764d2d6b4d2d47414230414141414141414141414141414141414141414141414645476b566b655f5254336a6270574151316c6d424f58446a614343425f6d4a364c49345277314238724e3559"
-      ]
-    },
-    {
-      "did": "did:keri:EBLiCGzZ2OKMRTB_ppJqTQf-Vol7uMkVVYeLu1V0m6K3",
-      "kel": [
-        {
-          "v": "KERI10JSON000163_",
-          "t": "dip",
-          "d": "EBLiCGzZ2OKMRTB_ppJqTQf-Vol7uMkVVYeLu1V0m6K3",
-          "i": "EBLiCGzZ2OKMRTB_ppJqTQf-Vol7uMkVVYeLu1V0m6K3",
-          "s": "0",
-          "kt": "1",
-          "k": [
-            "1AAJAocN3bzMXukZtY2QDC1KvQ3WRDlDgMYQ0BWXj28wxyuj"
-          ],
-          "nt": "1",
-          "n": [
-            "EFJCLdcZZQpPi20Uj0m83lqHfbVA6DvzOF3mSCfBzKEj"
-          ],
-          "bt": "0",
-          "b": [],
-          "c": [],
-          "a": [],
-          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
-        }
-      ],
-      "kel_attachments": [
-        "2d41414241414264394f7a5465567846314c522d556b38435159653158697744314d63334857315f466630724c416b4c6668625733524177637655776a655753366a3249464c4a552d52624756516569346d354f556667416e4c77342d47414230414141414141414141414141414141414141414141416e45435658647174586e7870615f49576947494d6b363431775a6c4276524d506759494a39425f335a34646d64"
-      ]
-    },
-    {
-      "did": "did:keri:EC9kFyHu8TTeOddjNo6UFa_rc85uh9T2wdJcOuK1smSJ",
-      "kel": [
-        {
-          "v": "KERI10JSON000163_",
-          "t": "dip",
-          "d": "EC9kFyHu8TTeOddjNo6UFa_rc85uh9T2wdJcOuK1smSJ",
-          "i": "EC9kFyHu8TTeOddjNo6UFa_rc85uh9T2wdJcOuK1smSJ",
-          "s": "0",
-          "kt": "1",
-          "k": [
-            "1AAJAy3pgcF3UianvLdfFexKDItFGYb7lSSVb1_Yv39Ay70K"
-          ],
-          "nt": "1",
-          "n": [
-            "EJ8J7CK7AEBXS8IxZNaMF5YuQynOenwM8J3EcucBHSyC"
-          ],
-          "bt": "0",
-          "b": [],
-          "c": [],
-          "a": [],
-          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
-        }
-      ],
-      "kel_attachments": [
-        "2d41414241414469327a4a594a4a4d567a4978447a79586b644e31357362626d6c776c61626334664358384f43573545756e6f68534c335f714952394d457a59507a59304f497132384e534f59736669484456536b4352536f7764392d474142304141414141414141414141414141414141414141414156454d3877415f2d61304548717a4f5964684d4b656d52766c4d424e4a624f7272774d7276734f584873756867"
-      ]
-    },
-    {
-      "did": "did:keri:ECzFpM6abrCSSpiki8v_qJHAOii2jg6556PRB33z1AAb",
-      "kel": [
-        {
-          "v": "KERI10JSON000163_",
-          "t": "dip",
-          "d": "ECzFpM6abrCSSpiki8v_qJHAOii2jg6556PRB33z1AAb",
-          "i": "ECzFpM6abrCSSpiki8v_qJHAOii2jg6556PRB33z1AAb",
-          "s": "0",
-          "kt": "1",
-          "k": [
-            "1AAJA4QYihGhxzTb3CshI8Ru_D5s3vFGl0fW2TSQZl9bksCA"
-          ],
-          "nt": "1",
-          "n": [
-            "EACEQaNaO3OxCm8O1i5GqakCvHgivFeGtma47XBgjdVQ"
-          ],
-          "bt": "0",
-          "b": [],
-          "c": [],
-          "a": [],
-          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
-        }
-      ],
-      "kel_attachments": [
-        "2d4141424141434c394b6a35355670644e78747163556651537355646e6468485837376578424a35414e746e777149515664613058374d66396472364a516551473031635766532d5154486a3547703437315167653662384548654a2d4741423041414141414141414141414141414141414141414141314545783065682d59327579656149496a356736586a6a345a376e68526674665a644a6c335479317067495169"
-      ]
-    },
-    {
-      "did": "did:keri:EDcmK6onrDzdFgEqI6OYjJZoGy2gSCdaO_dVKLJWsb4n",
-      "kel": [
-        {
-          "v": "KERI10JSON000163_",
-          "t": "dip",
-          "d": "EDcmK6onrDzdFgEqI6OYjJZoGy2gSCdaO_dVKLJWsb4n",
-          "i": "EDcmK6onrDzdFgEqI6OYjJZoGy2gSCdaO_dVKLJWsb4n",
-          "s": "0",
-          "kt": "1",
-          "k": [
-            "1AAJAyCESgRoP5hsaBq9OVYBJswBR-h3s0OH5LhVOX8uIaSX"
-          ],
-          "nt": "1",
-          "n": [
-            "EHGAL_4956oahrysPCM5-u6nRPUPhOrjPg3fSc9o2ini"
-          ],
-          "bt": "0",
-          "b": [],
-          "c": [],
-          "a": [],
-          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
-        }
-      ],
-      "kel_attachments": [
-        "2d41414241414334726a79416551426e6e5874393739664f79664b6c6d6f7038562d4f513355385638315a617a386f7250596b616a69576b3876734a63714977786451764659384b6131715243424633563336433551434c326e47752d4741423041414141414141414141414141414141414141414141764546536a4a6c61303130544d664a4c4b4c63356c6d2d414c4a4d4f756550704264577338594d7031534b6534"
-      ]
-    },
-    {
-      "did": "did:keri:EE-k7tp1lVfa8Ru9RNy-JQgeHYfFtaI6BR3hDbd9KGmn",
-      "kel": [
-        {
-          "v": "KERI10JSON000163_",
-          "t": "dip",
-          "d": "EE-k7tp1lVfa8Ru9RNy-JQgeHYfFtaI6BR3hDbd9KGmn",
-          "i": "EE-k7tp1lVfa8Ru9RNy-JQgeHYfFtaI6BR3hDbd9KGmn",
-          "s": "0",
-          "kt": "1",
-          "k": [
-            "1AAJA-GQT0rlldcmweMEqVvnoGSN2Zr9lSyDXZB7cwWBcDl2"
-          ],
-          "nt": "1",
-          "n": [
-            "EEvNQddnALZjQxvCHQb33kkBqnRPbM1CqFJSU8NsLZRC"
-          ],
-          "bt": "0",
-          "b": [],
-          "c": [],
-          "a": [],
-          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
-        }
-      ],
-      "kel_attachments": [
-        "2d4141424141413253773933693836364955652d4755367664326f4d44667077695a684c4d413973716149456b6473722d34504f44575375356274544e554e654c334f5274354f334662306b6b6d6666577643505f57444a434739352d47414230414141414141414141414141414141414141414141413445416f56356f5f4a5f4b6f50343858554662783855556e66504a41447763394847324e42676873375845346c"
-      ]
-    },
-    {
-      "did": "did:keri:EE0slWK6chng-UM42qf1fbtYapx8oZ1yadRIEFYB1m5_",
-      "kel": [
-        {
-          "v": "KERI10JSON000163_",
-          "t": "dip",
-          "d": "EE0slWK6chng-UM42qf1fbtYapx8oZ1yadRIEFYB1m5_",
-          "i": "EE0slWK6chng-UM42qf1fbtYapx8oZ1yadRIEFYB1m5_",
-          "s": "0",
-          "kt": "1",
-          "k": [
-            "1AAJA7ZQwAQlOGKZspbVyKEV-D9-Do10Kdif_xDhabScDgq4"
-          ],
-          "nt": "1",
-          "n": [
-            "ENN9JBMP6MBMqC8GA2-6cqfxO0joPSqii9U-VP65wuFm"
-          ],
-          "bt": "0",
-          "b": [],
-          "c": [],
-          "a": [],
-          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
-        }
-      ],
-      "kel_attachments": [
-        "2d41414241414465774a78623743697362427330354942377148474b7679794a584e49667777496a67354d5f335050376c4e62663163685a7a486e73646e3139565158744666724e745f39576771466348546f647763614a384676312d47414230414141414141414141414141414141414141414141416645505f675a53714236445944676b6b564965344274354c3338583275414569413333654369443137504d3871"
-      ]
-    },
-    {
-      "did": "did:keri:EFBGdabu4x82TD_Wn9gI3qUpDjnK3idAz4qLRS2YmdQy",
-      "kel": [
-        {
-          "v": "KERI10JSON00015f_",
-          "t": "dip",
-          "d": "EFBGdabu4x82TD_Wn9gI3qUpDjnK3idAz4qLRS2YmdQy",
-          "i": "EFBGdabu4x82TD_Wn9gI3qUpDjnK3idAz4qLRS2YmdQy",
-          "s": "0",
-          "kt": "1",
-          "k": [
-            "DM7Fn3BNMxniy7-3mPMsnGf-D0LzbfArArziOd2HJqm7"
-          ],
-          "nt": "1",
-          "n": [
-            "EF2b6jAzpSeVs_ClZbYSP-zCLnSyTSSPQ_XvadOCFiNt"
-          ],
-          "bt": "0",
-          "b": [],
-          "c": [],
-          "a": [],
-          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
-        }
-      ],
-      "kel_attachments": [
-        "2d414142414142637a74747658326335574d575a41785f6c6170454955654a4553736c3438326d5071724867306f734e324849684d622d68786d4b5a2d3671467a32615578753067657774516674637773724f684a6a47326568414b2d4741423041414141414141414141414141414141414141414141474544564d454e4565797a35456b68446643576a53505f5a4d46757a4a464a336f66567645722d574b51534e36"
-      ]
-    },
-    {
-      "did": "did:keri:EFE_IQRzArN0vTCK_8b0ef68uL7_EO919AEsTpuWB8wv",
-      "kel": [
-        {
-          "v": "KERI10JSON000163_",
-          "t": "dip",
-          "d": "EFE_IQRzArN0vTCK_8b0ef68uL7_EO919AEsTpuWB8wv",
-          "i": "EFE_IQRzArN0vTCK_8b0ef68uL7_EO919AEsTpuWB8wv",
-          "s": "0",
-          "kt": "1",
-          "k": [
-            "1AAJA-mwFgLf7m5oF_eHLofLbmW6mcQ9aSYoT57inEoaWxpG"
-          ],
-          "nt": "1",
-          "n": [
-            "EKc79nAsPz2okCA-XZd_UWrY2Q7N6UInPdvt-uUsNohd"
-          ],
-          "bt": "0",
-          "b": [],
-          "c": [],
-          "a": [],
-          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
-        }
-      ],
-      "kel_attachments": [
-        "2d414142414141374f684f676f5a39744a4430576b43644b36757a654e446b6643426f776b537363477363785557326741386a65415246397846304c745457633444535f6a7859444b7764747254724a666f33365a376e5f384e7a302d47414230414141414141414141414141414141414141414141413745486543504f35695f376837562d73734c416c6e56436f78576a4653326a614a515265725a7a6442305a5255"
-      ]
-    },
-    {
-      "did": "did:keri:EFRgbSmevoMh3jUiRutNBVQz9PyPimWJW8lBBElQS6mY",
-      "kel": [
-        {
-          "v": "KERI10JSON000163_",
-          "t": "dip",
-          "d": "EFRgbSmevoMh3jUiRutNBVQz9PyPimWJW8lBBElQS6mY",
-          "i": "EFRgbSmevoMh3jUiRutNBVQz9PyPimWJW8lBBElQS6mY",
-          "s": "0",
-          "kt": "1",
-          "k": [
-            "1AAJAk8hg6w3zV8F3Zg7u18uQ_SRh9cIbJjv53073-nLrREy"
-          ],
-          "nt": "1",
-          "n": [
-            "ELuvmThcN_BdqgDe99li2gPw4qUe3MWeVZWUclQkLF_r"
-          ],
-          "bt": "0",
-          "b": [],
-          "c": [],
-          "a": [],
-          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
-        }
-      ],
-      "kel_attachments": [
-        "2d414142414144397a5773626e5335485f436f5037716e576a7253565a563245513076746b434c676f485063734233594e513934686f487742536e7274366e66527a56646747645057696b356d4b56793459504f396f347a366746302d47414230414141414141414141414141414141414141414141417445457a51734a694e71343263566949715a415f51744b6e545a75505a75594e477533394b6638736f71725a54"
-      ]
-    },
-    {
-      "did": "did:keri:EG98LlhEMtRuQUnBgUVSrtTarbJrSLa7IV-CdQLr5Rpj",
-      "kel": [
-        {
-          "v": "KERI10JSON000163_",
-          "t": "dip",
-          "d": "EG98LlhEMtRuQUnBgUVSrtTarbJrSLa7IV-CdQLr5Rpj",
-          "i": "EG98LlhEMtRuQUnBgUVSrtTarbJrSLa7IV-CdQLr5Rpj",
-          "s": "0",
-          "kt": "1",
-          "k": [
-            "1AAJAw_Cj0KhQ5PsvDWtH6N-UMQIqQ_KdFrfA2DWLCzuvydX"
-          ],
-          "nt": "1",
-          "n": [
-            "ECK3yTETKJjomim3BCFGlRWPkY8A_JJTtcUHO9Yls4Xp"
-          ],
-          "bt": "0",
-          "b": [],
-          "c": [],
-          "a": [],
-          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
-        }
-      ],
-      "kel_attachments": [
-        "2d4141424141444d744377727a33314567713145616c2d59625250386c7972755041594b3261625a4448436b494a3651786b783954304c4744415f50747a2d72357a384749526d6c694f4b53714d37347564577a357657304369706e2d47414230414141414141414141414141414141414141414141416a45434a4e7a4337437058764e6347586b45514d52336c5535436836694d57562d574b4767635a305938556562"
-      ]
-    },
-    {
-      "did": "did:keri:EGBVjMs3qkVEel7os20R3WHNiI5DNJlVGbhkNTr12wbe",
-      "kel": [
-        {
-          "v": "KERI10JSON000163_",
-          "t": "dip",
-          "d": "EGBVjMs3qkVEel7os20R3WHNiI5DNJlVGbhkNTr12wbe",
-          "i": "EGBVjMs3qkVEel7os20R3WHNiI5DNJlVGbhkNTr12wbe",
-          "s": "0",
-          "kt": "1",
-          "k": [
-            "1AAJA4G-PCEva3bfrw2UwicaV-WM233TO5HMjl9NTKd1bfPv"
-          ],
-          "nt": "1",
-          "n": [
-            "EAt_QM6G8TBYalU8ihwhryW_kS_Om-s1XLKH7wdsv_yE"
-          ],
-          "bt": "0",
-          "b": [],
-          "c": [],
-          "a": [],
-          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
-        }
-      ],
-      "kel_attachments": [
-        "2d4141424141436535336931764e4f5a47324c395a50596b364d49507271734b6a546d3078366d35566943343052565559586a6850537a465375755f794c656572503651704b7635476261446432366d356739354e745f4650595a442d474142304141414141414141414141414141414141414141414242454b4e38787655764a2d6d3346456457344e43784f636a70584b746f424c2d766d357641796343646c337574"
-      ]
-    },
-    {
-      "did": "did:keri:EGOV2nwCPgcQ8jrEP8gP2vo5bZdggvnpW_IA8M1iMXeg",
-      "kel": [
-        {
-          "v": "KERI10JSON000163_",
-          "t": "dip",
-          "d": "EGOV2nwCPgcQ8jrEP8gP2vo5bZdggvnpW_IA8M1iMXeg",
-          "i": "EGOV2nwCPgcQ8jrEP8gP2vo5bZdggvnpW_IA8M1iMXeg",
-          "s": "0",
-          "kt": "1",
-          "k": [
-            "1AAJA4OMALEKyIIyMVQCAEtNa3tW4lWr7neDOpLP2jHZdIb-"
-          ],
-          "nt": "1",
-          "n": [
-            "EJ3Q7GnmWK4ebg3J7o3DT0OIZPr9sC5e7DbsOteBZUWN"
-          ],
-          "bt": "0",
-          "b": [],
-          "c": [],
-          "a": [],
-          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
-        }
-      ],
-      "kel_attachments": [
-        "2d4141424141416a682d365331354f43643176535979426e304c2d6c684e386963636e317776366c55375055563755686368584146314b6f38342d4c34474b59657079594e5658573263594367367233446c3546522d7931354943612d47414230414141414141414141414141414141414141414141416c45465a4f5a64424631596263766c3059366c676c6e507345565f644b47747149564a6c4e3272364a6b4f5042"
-      ]
-    },
-    {
-      "did": "did:keri:EGXg8l62pI8_ig0JiIHMkKyGKbJHdWMpIhb0W0niK86y",
-      "kel": [
-        {
-          "v": "KERI10JSON000163_",
-          "t": "dip",
-          "d": "EGXg8l62pI8_ig0JiIHMkKyGKbJHdWMpIhb0W0niK86y",
-          "i": "EGXg8l62pI8_ig0JiIHMkKyGKbJHdWMpIhb0W0niK86y",
-          "s": "0",
-          "kt": "1",
-          "k": [
-            "1AAJA9c5FtA6ztjAApWB4ECMv4j1t5sX_TifHS0HYnxy4Ti2"
-          ],
-          "nt": "1",
-          "n": [
-            "EDKZV2or9d3KGbKMtH_1JeiVhecnUX8lbv2hC-6-rKp5"
-          ],
-          "bt": "0",
-          "b": [],
-          "c": [],
-          "a": [],
-          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
-        }
-      ],
-      "kel_attachments": [
-        "2d41414241414261625848657965382d4d6b573848496866306a7144505071774169344f624d473457436b664c674e574e436348706b6a73465254657a355f765059497a4e7267725237554a4c50694d3636474c48354641554559352d474142304141414141414141414141414141414141414141414245455037547a38564b445877314c6239666f4e77735a347458425544365a6f446e704a695755713775356a6971"
-      ]
-    },
-    {
-      "did": "did:keri:EGpEBKDnvEUv0dsQ1MVaZbBq0qx8p1iLA4AFcNiPlk5M",
-      "kel": [
-        {
-          "v": "KERI10JSON00015f_",
-          "t": "dip",
-          "d": "EGpEBKDnvEUv0dsQ1MVaZbBq0qx8p1iLA4AFcNiPlk5M",
-          "i": "EGpEBKDnvEUv0dsQ1MVaZbBq0qx8p1iLA4AFcNiPlk5M",
-          "s": "0",
-          "kt": "1",
-          "k": [
-            "DM_3EYHf6RSHG-tdXVR_cU-Lvof3rkWYtT-PYhpU-IRe"
-          ],
-          "nt": "1",
-          "n": [
-            "ELnchwp59KdisZ-hIRguRa0t5dl1DigLxwxfr_qWHkHE"
-          ],
-          "bt": "0",
-          "b": [],
-          "c": [],
-          "a": [],
-          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
-        }
-      ],
-      "kel_attachments": [
-        "2d414142414142386f412d6750665f5761363035454339564c7970796a4c4a467570453167777555315f446a6d7450625739546a716b4c59636c77743733397142576a7a4174662d4b757738376a6e67796b597a384d6669535f30502d4741423041414141414141414141414141414141414141414141454544573642616b494c714964693456335a53534155536667686f486b50735f52506f573267494e376475414f"
-      ]
-    },
-    {
-      "did": "did:keri:EHD8EcYBcuP5G0FBNMSHK8xXlrtwjEWRAlT7rWxl_gd3",
-      "kel": [
-        {
-          "v": "KERI10JSON000163_",
-          "t": "dip",
-          "d": "EHD8EcYBcuP5G0FBNMSHK8xXlrtwjEWRAlT7rWxl_gd3",
-          "i": "EHD8EcYBcuP5G0FBNMSHK8xXlrtwjEWRAlT7rWxl_gd3",
-          "s": "0",
-          "kt": "1",
-          "k": [
-            "1AAJAvdLpUa6mAa9eO1P-1QRQ6JBsCL6B3YtFxcUGaYoMPTs"
-          ],
-          "nt": "1",
-          "n": [
-            "EPyf779x2v0Au1hS0_GtYghJGvjcEXpd8bHM8jRGxa-c"
-          ],
-          "bt": "0",
-          "b": [],
-          "c": [],
-          "a": [],
-          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
-        }
-      ],
-      "kel_attachments": [
-        "2d41414241414352766d6e494e715a49324d68304a4753526168504f69413579534a30663859674e7039756a4f6f6554356552672d56374132674e3447414469715f4c754155386877387a465167314876385a66594657695f4e56632d4741423041414141414141414141414141414141414141414141704546555073636d37367a6f5839394b353544664d57335f34372d76514b517067586c646c384d5f5f66385f68"
-      ]
-    },
-    {
-      "did": "did:keri:EHVCdLP79CXEc7xYjwtwp_Q1_MguwDmhEYFMZevOXIZ5",
-      "kel": [
-        {
-          "v": "KERI10JSON000163_",
-          "t": "dip",
-          "d": "EHVCdLP79CXEc7xYjwtwp_Q1_MguwDmhEYFMZevOXIZ5",
-          "i": "EHVCdLP79CXEc7xYjwtwp_Q1_MguwDmhEYFMZevOXIZ5",
-          "s": "0",
-          "kt": "1",
-          "k": [
-            "1AAJAza2YF0AaPZclhnJ6yrMQcO4GtGzq-FuomKffsXxSIEJ"
-          ],
-          "nt": "1",
-          "n": [
-            "EE73VPb0HvrZBCmFOZhdQmAkKE-1aAj4l_eAdkqqqNhq"
-          ],
-          "bt": "0",
-          "b": [],
-          "c": [],
-          "a": [],
-          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
-        }
-      ],
-      "kel_attachments": [
-        "2d414142414142486a694b31774d55395151444f4970675a47796e75576a597a394e6747474e53313131556d34655a6e475769444165466255565f4f784137654450394239334258684f6c716163664a584f41794b4772496b48674f2d47414230414141414141414141414141414141414141414141417945414a62386342696e49686570487377585244375f566679794b4b76635f6a744a524c5265356166344f2d4c"
-      ]
-    },
-    {
-      "did": "did:keri:EIDjomlmJhcp9YOxGQFunPjEmUNs-bG3yuyTX8U43duu",
-      "kel": [
-        {
-          "v": "KERI10JSON000163_",
-          "t": "dip",
-          "d": "EIDjomlmJhcp9YOxGQFunPjEmUNs-bG3yuyTX8U43duu",
-          "i": "EIDjomlmJhcp9YOxGQFunPjEmUNs-bG3yuyTX8U43duu",
-          "s": "0",
-          "kt": "1",
-          "k": [
-            "1AAJA5UL9tSgLE_vkn8-TkZOA7E0LyuOx2ydAGOeWE3OpuNX"
-          ],
-          "nt": "1",
-          "n": [
-            "EL57uv1XeQ3xUEHL6U0DL6TPJzArtSxDIdRgh_wBEUP6"
-          ],
-          "bt": "0",
-          "b": [],
-          "c": [],
-          "a": [],
-          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
-        }
-      ],
-      "kel_attachments": [
-        "2d4141424141436533325a4d6b76495f454f427856776964423131706773426d6333394c693739335669774f5056614f66563364586256766e6332724f5a6c6c7462386e304171793766746f396d49776736584e6d363636537276542d474142304141414141414141414141414141414141414141414161454d36564976427450703364434755313669627a643833586b737a4b44574d42735f5862536c53654a544a30"
-      ]
-    },
-    {
-      "did": "did:keri:EIv02OckbaGFpRONOurWMi_f5_Qf8unjgG5PnVCG2MiU",
-      "kel": [
-        {
-          "v": "KERI10JSON00015f_",
-          "t": "dip",
-          "d": "EIv02OckbaGFpRONOurWMi_f5_Qf8unjgG5PnVCG2MiU",
-          "i": "EIv02OckbaGFpRONOurWMi_f5_Qf8unjgG5PnVCG2MiU",
-          "s": "0",
-          "kt": "1",
-          "k": [
-            "DPYt_OxIt9CqR_4W3LHZLFm092qERcNr5F7716rbuy2h"
-          ],
-          "nt": "1",
-          "n": [
-            "EPz5DqpWQTuIHeVm92lv5aZ0IUeRuNrt1VNd65HWumph"
-          ],
-          "bt": "0",
-          "b": [],
-          "c": [],
-          "a": [],
-          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
-        }
-      ],
-      "kel_attachments": [
-        "2d4141424141434e58784447677344644b4e576c77796b726c6936546e42556863416a6a4b37795948556256796c5f4732483075716c35354b636d646c5665504e4e64786576355068546b454b59717447504e30484f4e54333351462d4741423041414141414141414141414141414141414141414141444547686c4f6e545957756836545141714156496b32745a48345a567157596d4a594f77747a4255436a6c3457"
-      ]
-    },
-    {
-      "did": "did:keri:EKGOZKZrCAPspNZNN1Duli1BOoSd_UhR-BEvyDyP7SaI",
-      "kel": [
-        {
-          "v": "KERI10JSON000163_",
-          "t": "dip",
-          "d": "EKGOZKZrCAPspNZNN1Duli1BOoSd_UhR-BEvyDyP7SaI",
-          "i": "EKGOZKZrCAPspNZNN1Duli1BOoSd_UhR-BEvyDyP7SaI",
-          "s": "0",
-          "kt": "1",
-          "k": [
-            "1AAJA1QSkHK63X9FDNWEdSDpEqHOz6idZcM5lCWuPxOvcsDW"
-          ],
-          "nt": "1",
-          "n": [
-            "EEZYB3n8D8SwNeU0-plXrj8OEl7Co-BllnD_uENqe7q5"
-          ],
-          "bt": "0",
-          "b": [],
-          "c": [],
-          "a": [],
-          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
-        }
-      ],
-      "kel_attachments": [
-        "2d4141424141413834374a52385a6a50634562702d58764155437662485641536a76676c4d4f764a365f46714f56786c5933626c336774504c703153517a6730342d5a6161706d57316e6463363474796e704e307876494d696f546d2d474142304141414141414141414141414141414141414141414165454e58743832786a6d527a62305330374d32523359743965585f565263575f53346654696350536b4868496a"
-      ]
-    },
-    {
-      "did": "did:keri:ELu71pX3phf4hfXwodtm4fmy16acrLporJ_XoNCL00cq",
-      "kel": [
-        {
-          "v": "KERI10JSON000163_",
-          "t": "dip",
-          "d": "ELu71pX3phf4hfXwodtm4fmy16acrLporJ_XoNCL00cq",
-          "i": "ELu71pX3phf4hfXwodtm4fmy16acrLporJ_XoNCL00cq",
-          "s": "0",
-          "kt": "1",
-          "k": [
-            "1AAJA_leGrZj5uhJYEuwU2Vo4YTVbC3hInKzY1IGkH7T82o6"
-          ],
-          "nt": "1",
-          "n": [
-            "EC6VY-JLYO1NXwORNqVAnStq2dNVAvtN7sS5bwz4Sb9v"
-          ],
-          "bt": "0",
-          "b": [],
-          "c": [],
-          "a": [],
-          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
-        }
-      ],
-      "kel_attachments": [
-        "2d4141424141426e654c62574b37797861784547476b486751566a584e4e583273386431472d4541706d394551742d44384b416e65397054674d46503833724a644c5f454244437356656b4632735f3079695247685f596243664c532d474142304141414141414141414141414141414141414141414157454c503872506f5a466b717a4256734d346d2d37482d4876715a42412d675f4278474f666a3047676442646b"
-      ]
-    },
-    {
-      "did": "did:keri:EMEM33xgRvQi6wY0pfVzP_-ce1vU64WBNJddf-LWNX59",
-      "kel": [
-        {
-          "v": "KERI10JSON000163_",
-          "t": "dip",
-          "d": "EMEM33xgRvQi6wY0pfVzP_-ce1vU64WBNJddf-LWNX59",
-          "i": "EMEM33xgRvQi6wY0pfVzP_-ce1vU64WBNJddf-LWNX59",
-          "s": "0",
-          "kt": "1",
-          "k": [
-            "1AAJAmnmEQQTPdSOXluVbzFk99MoiIZtbzRKVzTRX4zJqblQ"
-          ],
-          "nt": "1",
-          "n": [
-            "EFFvFxJL7isJfvZbLoLs1TWARyhgh20jWNLhgeTPpq78"
-          ],
-          "bt": "0",
-          "b": [],
-          "c": [],
-          "a": [],
-          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
-        }
-      ],
-      "kel_attachments": [
-        "2d414142414141767275576e6567716c427066315057344142786d704878584772615f61794e444e5f6d2d6c5367336b737747555a397572734542676849497267394c74326744684e6a585a485935463577746575686f6e796832462d47414230414141414141414141414141414141414141414141416345426c44584f52424a7139746d6e39424b6955554f6b32656179616c727a643954585a5630616e6e3669416a"
-      ]
-    },
-    {
-      "did": "did:keri:EO1cBsYoV5izKvdIL6TstN5TOQl1hYN3WnhtAOh1lwAp",
-      "kel": [
-        {
-          "v": "KERI10JSON00015f_",
-          "t": "dip",
-          "d": "EO1cBsYoV5izKvdIL6TstN5TOQl1hYN3WnhtAOh1lwAp",
-          "i": "EO1cBsYoV5izKvdIL6TstN5TOQl1hYN3WnhtAOh1lwAp",
-          "s": "0",
-          "kt": "1",
-          "k": [
-            "DEd5DmPuvZG7EDCFZC8UtoDWWwsbxO8_hJbXMK1PPYPQ"
-          ],
-          "nt": "1",
-          "n": [
-            "EBpDD46IT-XapGnnZasYr_BEUfCA1xM_u2--i3c0SzYS"
-          ],
-          "bt": "0",
-          "b": [],
-          "c": [],
-          "a": [],
-          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
-        }
-      ],
-      "kel_attachments": [
-        "2d414142414142712d64486638466d33484662743575684461677869677675736d75563651547355435a56334a6d744d32583858764879542d3873416742584f4d34455979697a6d6c7a47556a4f546c5669397270536c615f444d4d2d47414230414141414141414141414141414141414141414141414c45494779415278435972594b6e63686e5f4f735657727a4c4b38655866534c6c716356506c33757238657070"
-      ]
-    },
-    {
-      "did": "did:keri:EO9pxZBky_Tkd83KnWOnay-J1xjiEkxUF5na-T-boJsC",
-      "kel": [
-        {
-          "v": "KERI10JSON000163_",
-          "t": "dip",
-          "d": "EO9pxZBky_Tkd83KnWOnay-J1xjiEkxUF5na-T-boJsC",
-          "i": "EO9pxZBky_Tkd83KnWOnay-J1xjiEkxUF5na-T-boJsC",
-          "s": "0",
-          "kt": "1",
-          "k": [
-            "1AAJAk8ceN_N6za6x69WTx57g9S-79LrsWj8zJXpxbJ1F64b"
-          ],
-          "nt": "1",
-          "n": [
-            "EAhYMX_05jLx31ljL6RdXwUx5mm7-rUDVN6bQ1YEIrPb"
-          ],
-          "bt": "0",
-          "b": [],
-          "c": [],
-          "a": [],
-          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
-        }
-      ],
-      "kel_attachments": [
-        "2d4141424141446466304838336e764a3051767774377a4672436a6b5065303246504f59726546306564654d5a63567439574576377a467734486e4851443872645a5363416d505034355967684b5767343730663466454c476342312d47414230414141414141414141414141414141414141414141416845446542437a374f533056594e737551374e77336566724b735934366d4d4f4658433936536f577062613455"
-      ]
-    },
-    {
-      "did": "did:keri:EOtdnfmn4wkvMqUX4374wkHzXIs0WgA7zFVNJGL3cLvZ",
-      "kel": [
-        {
-          "v": "KERI10JSON000163_",
-          "t": "dip",
-          "d": "EOtdnfmn4wkvMqUX4374wkHzXIs0WgA7zFVNJGL3cLvZ",
-          "i": "EOtdnfmn4wkvMqUX4374wkHzXIs0WgA7zFVNJGL3cLvZ",
-          "s": "0",
-          "kt": "1",
-          "k": [
-            "1AAJA15zfFjN5y7yyoDLl0glVbsmLf6xG9EIy2zx3pUlOVw6"
-          ],
-          "nt": "1",
-          "n": [
-            "EADehUb9BYq6VZgc3oBK2wnL73gnvvY5--keW-5tpsFL"
-          ],
-          "bt": "0",
-          "b": [],
-          "c": [],
-          "a": [],
-          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
-        }
-      ],
-      "kel_attachments": [
-        "2d414142414144684235426d73544245676f6c437a4538677365496b513671577032545052596c713546386a45543676654e4f475162396a496644626b6c69434b5a70594b595a79304546526673474246676c7937494953536673472d47414230414141414141414141414141414141414141414141412d454d734a71697642626b795f437a325462477a4a477061564b6c6a34756f76594e6444755841657a6f4b4531"
-      ]
-    },
-    {
-      "did": "did:keri:EPQuvGHYnhJhBcfOV3aIkTl0vqbAKeLLjTH782wCrUl7",
-      "kel": [
-        {
-          "v": "KERI10JSON000163_",
-          "t": "dip",
-          "d": "EPQuvGHYnhJhBcfOV3aIkTl0vqbAKeLLjTH782wCrUl7",
-          "i": "EPQuvGHYnhJhBcfOV3aIkTl0vqbAKeLLjTH782wCrUl7",
-          "s": "0",
-          "kt": "1",
-          "k": [
-            "1AAJA0LrRy8BGwg32e9NSommqzL4RgAy5srH3uEhwnUPLY_6"
-          ],
-          "nt": "1",
-          "n": [
-            "EEtSdEmw1-Spz7e-bvDSuX--coTSVqlIL5-w5CGbEKbO"
-          ],
-          "bt": "0",
-          "b": [],
-          "c": [],
-          "a": [],
-          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
-        }
-      ],
-      "kel_attachments": [
-        "2d414142414142586f764d3942655765704f4e743837304c5645587a78506236786e4e766b36477366423579353053414a596f5f32534d786a5f4a2d45704f52324d31582d73782d494d4357686b76704342476830466632736856502d4741423041414141414141414141414141414141414141414141724547737055376f647777645a52633970477a516b755f5146463075486a3671764744326f496f74344161714e"
-      ]
-    },
-    {
-      "did": "did:keri:EPlN9Y8qKPDEq8gg80D6N_rCN3aANK6xAoMr8OTGJ1tR",
-      "kel": [
-        {
-          "v": "KERI10JSON00015f_",
-          "t": "dip",
-          "d": "EPlN9Y8qKPDEq8gg80D6N_rCN3aANK6xAoMr8OTGJ1tR",
-          "i": "EPlN9Y8qKPDEq8gg80D6N_rCN3aANK6xAoMr8OTGJ1tR",
-          "s": "0",
-          "kt": "1",
-          "k": [
-            "DJj3LOcZEo0z7Gm1Lkxe9Emk98WG1wwTcLnC52Dx_J7n"
-          ],
-          "nt": "1",
-          "n": [
-            "EIsYqqpF-rTb-9NugFe8PBbJLgfUxGbrhbknzliu9EgC"
-          ],
-          "bt": "0",
-          "b": [],
-          "c": [],
-          "a": [],
-          "di": "EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd"
+          "v": "KERI10JSON0000ff_",
+          "t": "ixn",
+          "d": "EGDExK8SM8maWYo_RJbIMMgH6IWchAnS6HB38fJ2NNTR",
+          "i": "EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6",
+          "s": "3",
+          "p": "EIKLAKUZoY44glFWNL744n0QIFdJp4p-36E3fhtNPXBw",
+          "a": [
+            {
+              "d": "ELKhHhAifK_NHZP2S4uxeI8YuCwmRHSBX1BQKZNJRjN1"
+            }
+          ]
         }
       ],
       "kel_attachments": [
-        "2d414142414141414b643631664e503247624b37324c3057774d32583978474f303042613955496277786b4539475a676354304c3951332d6f315a50364a356c57674e454f5832534133554f50484836684d7546525247435f4d414d2d47414230414141414141414141414141414141414141414141414345456653456d774632784d7955415476357944634b6446616965536e49412d74454272342d52327778416a76"
+        "2d414142414143526a7864503836474c3263362d707550545769704c7436527371477854306f56776e705952434b535262654333366f4545686c4e706b376935544b6266483647536c6f2d48614d32425f76315a6f7955585a3154302d4741423041414141414141414141414141414141414141414141424541374763754667414d6b54705555524135534e536f65673959307639614771427271674630753045567555",
+        "2d4141424141427465337370536966496e7175386834535039764d593958565266576f6351384b7136386779573942664b334962565a53554d75586e676d4d546a4e44354c67306a6c6e4c69324d6e5a384e4d73386b326d704b424b",
+        "2d414142414142765f54326d315152756d704f61666f44514364464a79396c484f54554e776d36574b374d6f5f744279694c613164657675526e68674c683465586e68594e4b63395a2d784734492d5848415a585a534f596e4b3268",
+        "2d4141424141413046717851674d366a74315166444a336576525f364a4c414c64742d4875314146546b7277514a474844475a67714d6d7a334f4c536c44686767626f617a3542516753735677697550344c51554754666779477343"
       ]
     }
   ],
-  "bundle_timestamp": "2026-07-23T19:55:56.286887Z",
+  "bundle_timestamp": "2026-07-23T22:26:42.925901Z",
   "max_valid_for_secs": 31536000
-}
+}
\ No newline at end of file

From 605b399067e164bd8dced7beabb549bbc72462b1 Mon Sep 17 00:00:00 2001
From: bordumb <bordumbb@gmail.com>
Date: Thu, 23 Jul 2026 23:27:38 +0100
Subject: [PATCH 21/37] fix: formatting

Auths-Id: did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b
Auths-Device: did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6
Auths-Anchor-Seq: 1
---
 .auths/ci-bundle.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.auths/ci-bundle.json b/.auths/ci-bundle.json
index ebca61092..d91a36459 100644
--- a/.auths/ci-bundle.json
+++ b/.auths/ci-bundle.json
@@ -134,4 +134,4 @@
   ],
   "bundle_timestamp": "2026-07-23T22:26:42.925901Z",
   "max_valid_for_secs": 31536000
-}
\ No newline at end of file
+}

From f1143fd71f2a9f4a9ca464b247c936c9d901e241 Mon Sep 17 00:00:00 2001
From: bordumb <bordumbb@gmail.com>
Date: Thu, 23 Jul 2026 23:50:40 +0100
Subject: [PATCH 22/37] Delete claims/claim-cbe93daa3a36463c.json

---
 claims/claim-cbe93daa3a36463c.json | 28 ----------------------------
 1 file changed, 28 deletions(-)
 delete mode 100644 claims/claim-cbe93daa3a36463c.json

diff --git a/claims/claim-cbe93daa3a36463c.json b/claims/claim-cbe93daa3a36463c.json
deleted file mode 100644
index ad8c80de5..000000000
--- a/claims/claim-cbe93daa3a36463c.json
+++ /dev/null
@@ -1,28 +0,0 @@
-{
-  "version": "reversal/v1",
-  "suite": "json-canon/p256",
-  "disputedTx": "",
-  "basis": {
-    "verdict": "out-of-counterparty",
-    "asOf": {
-      "tier": "first-seen",
-      "head": "743eec4a34502f014efd17a312d1b2e553607d5a46fcd4b88edd8a1113f214ca",
-      "kelSeq": 1,
-      "ts": "2026-07-23T14:44:45.537859Z"
-    }
-  },
-  "parties": {
-    "payerPrincipal": "did:keri:EM-TbFfxJpmvbWyVimQiOMi4qmQliP3QNUlsyRgo2B1w",
-    "actingAgent": "did:keri:EF-FnKfzrtK-eAWaWtuggc50eKd3oXSx-eqjs_IuLBi_",
-    "payeeOrg": "0xattacker",
-    "payeeSettlementAccount": "0xattacker"
-  },
-  "amount": {
-    "cents": 0,
-    "kind": "full"
-  },
-  "direction": "payee->payerPrincipal",
-  "railHint": "claim-only",
-  "issued_by": "did:key:zDnaeSrJVhp4D1zdH8Yec1W4LuHpCBartmkNaUathniKQKWSu",
-  "signature": "D9lkJLs9R1RH/6QGRBQ7qlfA9At5GZ/BJ/GjYUpVXtAMjomrTDFaW95h8pVWfQppHl0PY9xt/Ku43Q6I3PwH2A=="
-}

From bcb211be77fd4cb41ead24971ef13b189abdb345 Mon Sep 17 00:00:00 2001
From: bordumb <bordumbb@gmail.com>
Date: Fri, 24 Jul 2026 00:18:46 +0100
Subject: [PATCH 23/37] feat: implement strongly typed SigningKeyRef

Auths-Id: did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b
Auths-Device: did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6
Auths-Anchor-Seq: 1
---
 crates/auths-cli/src/bin/sign.rs              |  12 +-
 crates/auths-cli/src/commands/agent/mod.rs    |  11 +-
 crates/auths-core/src/storage/keychain.rs     |  88 ++++++++++
 .../auths-sdk/src/domains/identity/local.rs   |   7 +-
 .../src/workflows/agent_provision.rs          | 154 +++++++++++++++---
 5 files changed, 235 insertions(+), 37 deletions(-)

diff --git a/crates/auths-cli/src/bin/sign.rs b/crates/auths-cli/src/bin/sign.rs
index 7653d9e2e..3dceb2f55 100644
--- a/crates/auths-cli/src/bin/sign.rs
+++ b/crates/auths-cli/src/bin/sign.rs
@@ -111,12 +111,10 @@ fn validate_verify_option(opt: &str) -> Result<()> {
 }
 
 fn parse_key_identifier(key_file: &str) -> Result<String> {
-    if let Some(alias) = key_file.strip_prefix("auths:") {
-        if alias.is_empty() {
-            bail!("Invalid Auths key format: alias cannot be empty. Use 'auths:<alias>'");
-        }
-        Ok(alias.to_string())
-    } else {
+    let key_ref = auths_core::storage::keychain::SigningKeyRef::parse(key_file)
+        .map_err(|e| anyhow::anyhow!(e))?;
+
+    if !matches!(key_ref, auths_core::storage::keychain::SigningKeyRef::Uri { ref scheme, .. } if scheme == "auths") {
         bail!(
             "Unsupported key format: '{}'. \
              Auths keys should be specified as 'auths:<alias>' \
@@ -124,6 +122,8 @@ fn parse_key_identifier(key_file: &str) -> Result<String> {
             key_file
         );
     }
+
+    Ok(key_ref.bare_alias().as_str().to_string())
 }
 
 fn build_signing_context(alias: &str) -> Result<CommitSigningContext> {
diff --git a/crates/auths-cli/src/commands/agent/mod.rs b/crates/auths-cli/src/commands/agent/mod.rs
index 8fc1ca080..5ed5223fb 100644
--- a/crates/auths-cli/src/commands/agent/mod.rs
+++ b/crates/auths-cli/src/commands/agent/mod.rs
@@ -760,8 +760,11 @@ fn unlock_agent(key_alias: &str, repo: Option<PathBuf>) -> Result<()> {
         ));
     }
 
+    let key_ref = auths_core::storage::keychain::SigningKeyRef::parse(key_alias)?;
+    let parsed_alias = key_ref.bare_alias().clone();
+
     let (_identity_did, _role, encrypted_data) = keychain
-        .load_key(&auths_sdk::keychain::KeyAlias::new_unchecked(key_alias))
+        .load_key(&parsed_alias)
         .map_err(|e| anyhow!("Failed to load key '{}': {}", key_alias, e))?;
 
     let passphrase = rpassword::prompt_password(format!("Passphrase for '{}': ", key_alias))
@@ -897,7 +900,8 @@ fn handle_provision_cmd(
             (label_val, key_val, profile_val, out_val)
         };
 
-    let parent_alias = KeyAlias::new_unchecked(&key_str);
+    let key_ref = auths_core::storage::keychain::SigningKeyRef::parse(&key_str)?;
+    let parent_alias = key_ref.bare_alias().clone();
     let agent_profile =
         profile_str.parse::<auths_sdk::workflows::agent_provision::AgentProfile>()?;
 
@@ -1051,7 +1055,8 @@ fn handle_revoke_cmd(agent_did: String, key: String, repo: Option<PathBuf>) -> R
         &env_config,
         Some(passphrase_provider),
     )?;
-    let root_alias = KeyAlias::new_unchecked(key);
+    let root_ref = auths_core::storage::keychain::SigningKeyRef::parse(&key)?;
+    let root_alias = root_ref.bare_alias().clone();
 
     auths_sdk::domains::agents::revoke(&ctx, &root_alias, &agent_did)?;
 
diff --git a/crates/auths-core/src/storage/keychain.rs b/crates/auths-core/src/storage/keychain.rs
index eb61167af..29a18700f 100644
--- a/crates/auths-core/src/storage/keychain.rs
+++ b/crates/auths-core/src/storage/keychain.rs
@@ -203,6 +203,60 @@ impl PartialEq<String> for KeyAlias {
     }
 }
 
+/// A strongly typed reference to a signing key, which could either be a bare alias
+/// or a fully qualified URI.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum SigningKeyRef {
+    /// A raw key alias with no scheme prefix (e.g. `main-device`).
+    Alias(KeyAlias),
+    /// A key identifier specified as a URI (e.g. `auths:main-device`).
+    Uri {
+        /// The scheme parsed from the URI.
+        scheme: String,
+        /// The parsed key alias.
+        alias: KeyAlias,
+    },
+}
+
+impl SigningKeyRef {
+    /// Parses a string into a `SigningKeyRef`.
+    pub fn parse(input: &str) -> Result<Self, AgentError> {
+        if let Some(rest) = input.strip_prefix("auths:") {
+            if rest.is_empty() {
+                return Err(AgentError::InvalidInput(
+                    "Invalid Auths key format: alias cannot be empty. Use 'auths:<alias>'".into(),
+                ));
+            }
+            if rest.contains(':') {
+                return Err(AgentError::InvalidInput(
+                    "Invalid Auths key format: alias cannot contain colons".into(),
+                ));
+            }
+            let alias = KeyAlias::new(rest)?;
+            Ok(Self::Uri {
+                scheme: "auths".to_string(),
+                alias,
+            })
+        } else if input.contains(':') {
+            Err(AgentError::InvalidInput(
+                format!("Unsupported key scheme or format in '{}'. Only 'auths:<alias>' or bare alias allowed.", input)
+            ))
+        } else {
+            let alias = KeyAlias::new(input)?;
+            Ok(Self::Alias(alias))
+        }
+    }
+
+    /// Extracts the underlying bare key alias, regardless of how it was specified.
+    pub fn bare_alias(&self) -> &KeyAlias {
+        match self {
+            Self::Alias(alias) => alias,
+            Self::Uri { alias, .. } => alias,
+        }
+    }
+}
+
+
 /// Migrate a legacy single-key alias `{alias}` to the multi-key form
 /// `{alias}--0`.
 ///
@@ -1120,4 +1174,38 @@ mod tests {
         assert!(box_storage.is_hardware_key(&hw_alias));
         assert!(!box_storage.is_hardware_key(&sw_alias));
     }
+
+    #[test]
+    fn test_signing_key_ref_parsing() {
+        // Valid bare alias
+        let ref1 = SigningKeyRef::parse("agent-label").unwrap();
+        assert!(matches!(ref1, SigningKeyRef::Alias(ref a) if a.as_str() == "agent-label"));
+        assert_eq!(ref1.bare_alias().as_str(), "agent-label");
+
+        // Valid auths uri
+        let ref2 = SigningKeyRef::parse("auths:agent-label").unwrap();
+        match &ref2 {
+            SigningKeyRef::Uri { scheme, alias } => {
+                assert_eq!(scheme, "auths");
+                assert_eq!(alias.as_str(), "agent-label");
+            }
+            _ => panic!("Expected Uri variant"),
+        }
+        assert_eq!(ref2.bare_alias().as_str(), "agent-label");
+
+        // Invalid schemes
+        let err = SigningKeyRef::parse("http:agent-label").unwrap_err();
+        assert!(err.to_string().contains("Unsupported key scheme"));
+
+        let err = SigningKeyRef::parse("ssh:key").unwrap_err();
+        assert!(err.to_string().contains("Unsupported key scheme"));
+
+        // Invalid multiple colons
+        let err = SigningKeyRef::parse("auths:foo:bar").unwrap_err();
+        assert!(err.to_string().contains("cannot contain colons"));
+
+        // Empty alias string
+        let err = SigningKeyRef::parse("auths:").unwrap_err();
+        assert!(err.to_string().contains("alias cannot be empty"));
+    }
 }
diff --git a/crates/auths-sdk/src/domains/identity/local.rs b/crates/auths-sdk/src/domains/identity/local.rs
index 650d2219d..b93d06ef1 100644
--- a/crates/auths-sdk/src/domains/identity/local.rs
+++ b/crates/auths-sdk/src/domains/identity/local.rs
@@ -55,10 +55,9 @@ impl LocalSigner {
 pub fn resolve_local_signer(ctx: &AuthsContext) -> Result<LocalSigner, SetupError> {
     // Explicit signing key override (e.g., delegated agent `AUTHS_SIGNING_KEY="auths:agent-label"`).
     if let Ok(key_alias_str) = std::env::var("AUTHS_SIGNING_KEY") {
-        let clean_alias = key_alias_str
-            .strip_prefix("auths:")
-            .unwrap_or(&key_alias_str);
-        let alias = auths_core::storage::keychain::KeyAlias::new_unchecked(clean_alias);
+        let key_ref = auths_core::storage::keychain::SigningKeyRef::parse(&key_alias_str)
+            .map_err(|e| SetupError::InvalidSetupConfig(e.to_string()))?;
+        let alias = key_ref.bare_alias().clone();
         if let Ok(key_info) = ctx.key_storage.load_key(&alias) {
             let agent_did = key_info.0.to_string();
             let agent_prefix = auths_id::keri::parse_did_keri(&agent_did)
diff --git a/crates/auths-sdk/src/workflows/agent_provision.rs b/crates/auths-sdk/src/workflows/agent_provision.rs
index 4b88a8293..97f2f1fca 100644
--- a/crates/auths-sdk/src/workflows/agent_provision.rs
+++ b/crates/auths-sdk/src/workflows/agent_provision.rs
@@ -135,7 +135,45 @@ pub fn provision_agent_machine(
     let _ = crate::workflows::commit_hooks::refresh_commit_trailers(ctx, &registry_dir);
 
     // 5. Generate env.sh
-    let env_file_path = params.destination_dir.join("env.sh");
+    let env_file_path = generate_environment_script(
+        &params.destination_dir,
+        &registry_dir,
+        &keychain_path,
+        &passphrase_path,
+        passphrase,
+        &params.label,
+    )?;
+
+    // 6. Generate executable wrapper helper bin/auths-agent
+    let wrapper_path = generate_executable_wrapper(
+        &params.destination_dir,
+        &env_file_path,
+        &params.label,
+    )?;
+
+    let expires_dt = expires_at.and_then(|ts| DateTime::from_timestamp(ts, 0));
+
+    Ok(AgentProvisionResult {
+        agent_did,
+        parent_alias: parent_alias.to_string(),
+        label: params.label.clone(),
+        destination_dir: params.destination_dir.clone(),
+        keychain_path,
+        env_file_path,
+        wrapper_path,
+        expires_at: expires_dt,
+    })
+}
+
+fn generate_environment_script(
+    destination_dir: &Path,
+    registry_dir: &Path,
+    keychain_path: &Path,
+    passphrase_path: &Path,
+    passphrase: &str,
+    label: &str,
+) -> Result<PathBuf> {
+    let env_file_path = destination_dir.join("env.sh");
     let env_script_content = format!(
         r#"# Auths Agent Environment Variables for '{label}' — Auto-generated
 export AUTHS_AGENT_LABEL="{label}"
@@ -156,18 +194,24 @@ export GIT_CONFIG_VALUE_1="auths-sign"
 export GIT_CONFIG_KEY_2="user.signingkey"
 export GIT_CONFIG_VALUE_2="auths:{label}"
 "#,
-        home = params.destination_dir.display(),
+        home = destination_dir.display(),
         repo = registry_dir.display(),
         keychain = keychain_path.display(),
         passphrase_file = passphrase_path.display(),
         passphrase = passphrase,
-        label = params.label
+        label = label
     );
     fs::write(&env_file_path, &env_script_content)?;
     fs::set_permissions(&env_file_path, fs::Permissions::from_mode(0o600))?;
+    Ok(env_file_path)
+}
 
-    // 6. Generate executable wrapper helper bin/auths-agent
-    let bin_dir = params.destination_dir.join("bin");
+fn generate_executable_wrapper(
+    destination_dir: &Path,
+    env_file_path: &Path,
+    label: &str,
+) -> Result<PathBuf> {
+    let bin_dir = destination_dir.join("bin");
     fs::create_dir_all(&bin_dir)?;
     let wrapper_path = bin_dir.join("auths-agent");
     let wrapper_content = format!(
@@ -177,24 +221,12 @@ set -e
 source "{env_sh}"
 exec auths "$@"
 "#,
-        label = params.label,
+        label = label,
         env_sh = env_file_path.display()
     );
     fs::write(&wrapper_path, &wrapper_content)?;
     fs::set_permissions(&wrapper_path, fs::Permissions::from_mode(0o755))?;
-
-    let expires_dt = expires_at.and_then(|ts| DateTime::from_timestamp(ts, 0));
-
-    Ok(AgentProvisionResult {
-        agent_did,
-        parent_alias: parent_alias.to_string(),
-        label: params.label.clone(),
-        destination_dir: params.destination_dir.clone(),
-        keychain_path,
-        env_file_path,
-        wrapper_path,
-        expires_at: expires_dt,
-    })
+    Ok(wrapper_path)
 }
 
 /// Materializes an isolated delegate-machine registry by copying org KEL and stripping root subtrees.
@@ -218,15 +250,25 @@ pub fn materialize_agent_machine_registry(
         let idx = git_dir.join("tmp-index");
         let idx_s = idx.to_string_lossy().to_string();
 
-        let _ = Command::new("git")
+        let read_tree_status = Command::new("git")
             .args(["--git-dir", &gd, "read-tree", "refs/auths/registry"])
             .env("GIT_INDEX_FILE", &idx_s)
-            .status();
+            .status()
+            .context("failed to execute git read-tree")?;
+        
+        if !read_tree_status.success() {
+            anyhow::bail!("git read-tree failed with status: {}", read_tree_status);
+        }
 
         let listed = Command::new("git")
             .args(["--git-dir", &gd, "ls-files"])
             .env("GIT_INDEX_FILE", &idx_s)
-            .output()?;
+            .output()
+            .context("failed to execute git ls-files")?;
+            
+        if !listed.status.success() {
+            anyhow::bail!("git ls-files failed with status: {}", listed.status);
+        }
 
         let subtree = format!(
             "identities/{}/{}/{}/",
@@ -237,10 +279,15 @@ pub fn materialize_agent_machine_registry(
 
         for line in String::from_utf8_lossy(&listed.stdout).lines() {
             if line.contains(&subtree) {
-                let _ = Command::new("git")
+                let rm_status = Command::new("git")
                     .args(["--git-dir", &gd, "rm", "--cached", "-q", "--", line])
                     .env("GIT_INDEX_FILE", &idx_s)
-                    .status();
+                    .status()
+                    .context("failed to execute git rm")?;
+                    
+                if !rm_status.success() {
+                    anyhow::bail!("git rm failed with status: {}", rm_status);
+                }
             }
         }
     }
@@ -307,3 +354,62 @@ fn export_agent_keys_to_file_backend(
 
     Ok(())
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::fs;
+    use tempfile::tempdir;
+
+    #[test]
+    fn test_generate_environment_script() {
+        let temp_dir = tempdir().unwrap();
+        let dest_dir = temp_dir.path();
+        let registry_dir = dest_dir.join("registry");
+        let keychain_path = dest_dir.join("keys.enc");
+        let passphrase_path = dest_dir.join("passphrase.txt");
+        let passphrase = "test_passphrase123!";
+        let label = "test-agent";
+
+        let env_file = generate_environment_script(
+            dest_dir,
+            &registry_dir,
+            &keychain_path,
+            &passphrase_path,
+            passphrase,
+            label,
+        ).unwrap();
+
+        assert!(env_file.exists());
+        let content = fs::read_to_string(&env_file).unwrap();
+        assert!(content.contains(&format!("export AUTHS_AGENT_LABEL=\"{}\"", label)));
+        assert!(content.contains(&format!("export AUTHS_PASSPHRASE='{}'", passphrase)));
+        assert!(content.contains("export GIT_CONFIG_VALUE_1=\"auths-sign\""));
+    }
+
+    #[test]
+    fn test_generate_executable_wrapper() {
+        let temp_dir = tempdir().unwrap();
+        let dest_dir = temp_dir.path();
+        let env_file = dest_dir.join("env.sh");
+        let label = "test-agent";
+
+        let wrapper_file = generate_executable_wrapper(
+            dest_dir,
+            &env_file,
+            label,
+        ).unwrap();
+
+        assert!(wrapper_file.exists());
+        let content = fs::read_to_string(&wrapper_file).unwrap();
+        assert!(content.contains(&format!("source \"{}\"", env_file.display())));
+        assert!(content.contains("exec auths \"$@\""));
+        
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            let perms = fs::metadata(&wrapper_file).unwrap().permissions();
+            assert_eq!(perms.mode() & 0o777, 0o755);
+        }
+    }
+}

From d5ef807fb604019cb581ae18214f1dc76fcdb106 Mon Sep 17 00:00:00 2001
From: bordumb <bordumbb@gmail.com>
Date: Fri, 24 Jul 2026 00:25:09 +0100
Subject: [PATCH 24/37] fix: resolve SDK boundary and clippy issues

Auths-Id: did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b
Auths-Device: did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6
Auths-Anchor-Seq: 1
---
 .auths/roots                                  | 28 ++-----------------
 crates/auths-cli/src/bin/sign.rs              |  5 ++--
 crates/auths-cli/src/commands/agent/mod.rs    |  8 ++----
 crates/auths-core/src/storage/keychain.rs     |  8 +++---
 crates/auths-sdk/src/keychain.rs              |  2 +-
 .../src/workflows/agent_provision.rs          | 24 ++++++----------
 6 files changed, 23 insertions(+), 52 deletions(-)

diff --git a/.auths/roots b/.auths/roots
index 26cc6d3d4..e2828478e 100644
--- a/.auths/roots
+++ b/.auths/roots
@@ -1,25 +1,3 @@
-did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd
-did:keri:EMCu26JE1Jm40kuNyWtCyTJu3CwC_2MBmiiFCIp6XN7t
-did:keri:ECorK2R66hdj9W3wzV0JYYPVm37iL_48lHnWF-_zXtfJ
-did:keri:EHZu-FvRR0yJF3tId3iJVN_XXlsNZdXg-ZSRchZHCcTS
-did:keri:EA-toxTnhpWcjgDGonNgzRRsHgyatvu4GXp8vQ9RZMD6
-did:keri:EJRwo0DQdzF6ggeznDh6113KlfMy-_KUF_9WfZ5Gh28e
-did:keri:EJR9zlO6FtsjRULj07wynEEUcN0AD1MmKI6A1U_uD10l
-did:keri:EN6HZUkHvWsaSgFKPKEDR8nMVV1Ef9zw1gbdtxOtLWDP
-did:keri:EGAeM5vBmzcFEzf3MVbOD_VKjMxC4GsoUarWUjz5J6li
-did:keri:ED-k2LMn90EN5DUQGCCGKGn-Bf9BXWLiao-nyLp9LAjH
-did:keri:ELiyxeCLBDgNKtYG_bfpnpCy2Lohqyv8M3TyMS8Zn9Tm
-did:keri:EL1CaAKTd-I7l6v8FO8FvWbFrgK_UMAUk5MQ-7YjPeHr
-did:keri:EJzyWbcg-u6v_4nc-R1XwfbblLqz1wBQpIHx_WNUTZgL
-did:keri:EJ35ubEJO6ZT4HDeFxKqcoAH1VE0MnA4Y_Mk_rniD_ku
-did:keri:ELS_t_TDI2vfNPkUjcatCqA8tSgQwYOv_h9OKvp5rvER
-did:keri:ENv6JMgfYFbr3J4nBOtcNNgpVZ5lmd6dUr_25wK4MJUM
-did:keri:EKHawavyEruvh0v3A2H5zLoLnOE2L3lAqzivN0kjZil3
-did:keri:EHMeiHXhVedvGhvFf5O71HoPskHArJXokxnx08PEr_CM
-did:keri:EF9goneG7pezrfCzYvEhEp_gSct_BZLmSZfrngNWxTqM
-did:keri:EC7fQlCP19mPRMx-lIpHhWCjKF12Z1aZ6VYYwUa8ZZ-M
-did:keri:EDa0hFOowB7PYAkUeiuRQiV1zaa1mpFbxQYf61r73Pii
-did:keri:EPsk0PCEQpa3ALIG1Oyiuxg8UfLbgma4QV16I-O6TnOc
-did:keri:EAZG0HqAzbydr1iAbnEPUhVC_IuB6vZXYBJagVXS2k9a
-did:keri:EKh1onK1bubyaWxHIWzr_yeOAtBm36ZGn0AXDYsBhrsq
-did:keri:EPmp6Nav8Z-_prJg0EShHnB396yJJtXmBr6hG647PxwJ
+did:keri:EGfg3puqwCzBD3rBSiMhO1HpDM26pmotVreI41Jl_1Eq
+did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b
+did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6
diff --git a/crates/auths-cli/src/bin/sign.rs b/crates/auths-cli/src/bin/sign.rs
index 3dceb2f55..a84104ce4 100644
--- a/crates/auths-cli/src/bin/sign.rs
+++ b/crates/auths-cli/src/bin/sign.rs
@@ -111,10 +111,11 @@ fn validate_verify_option(opt: &str) -> Result<()> {
 }
 
 fn parse_key_identifier(key_file: &str) -> Result<String> {
-    let key_ref = auths_core::storage::keychain::SigningKeyRef::parse(key_file)
+    let key_ref = auths_sdk::keychain::SigningKeyRef::parse(key_file)
         .map_err(|e| anyhow::anyhow!(e))?;
 
-    if !matches!(key_ref, auths_core::storage::keychain::SigningKeyRef::Uri { ref scheme, .. } if scheme == "auths") {
+    if !matches!(key_ref, auths_sdk::keychain::SigningKeyRef::Uri { ref scheme, .. } if scheme == "auths")
+    {
         bail!(
             "Unsupported key format: '{}'. \
              Auths keys should be specified as 'auths:<alias>' \
diff --git a/crates/auths-cli/src/commands/agent/mod.rs b/crates/auths-cli/src/commands/agent/mod.rs
index 5ed5223fb..05f66d7bb 100644
--- a/crates/auths-cli/src/commands/agent/mod.rs
+++ b/crates/auths-cli/src/commands/agent/mod.rs
@@ -760,7 +760,7 @@ fn unlock_agent(key_alias: &str, repo: Option<PathBuf>) -> Result<()> {
         ));
     }
 
-    let key_ref = auths_core::storage::keychain::SigningKeyRef::parse(key_alias)?;
+    let key_ref = auths_sdk::keychain::SigningKeyRef::parse(key_alias)?;
     let parsed_alias = key_ref.bare_alias().clone();
 
     let (_identity_did, _role, encrypted_data) = keychain
@@ -809,7 +809,6 @@ fn handle_provision_cmd(
     repo: Option<PathBuf>,
 ) -> Result<()> {
     use crate::core::provider::CliPassphraseProvider;
-    use auths_sdk::keychain::KeyAlias;
     use auths_sdk::paths::auths_home;
     use auths_sdk::storage_layout::resolve_repo_path;
     use std::path::Path;
@@ -900,7 +899,7 @@ fn handle_provision_cmd(
             (label_val, key_val, profile_val, out_val)
         };
 
-    let key_ref = auths_core::storage::keychain::SigningKeyRef::parse(&key_str)?;
+    let key_ref = auths_sdk::keychain::SigningKeyRef::parse(&key_str)?;
     let parent_alias = key_ref.bare_alias().clone();
     let agent_profile =
         profile_str.parse::<auths_sdk::workflows::agent_provision::AgentProfile>()?;
@@ -1045,7 +1044,6 @@ fn handle_update_cmd(
 
 fn handle_revoke_cmd(agent_did: String, key: String, repo: Option<PathBuf>) -> Result<()> {
     use crate::core::provider::CliPassphraseProvider;
-    use auths_sdk::keychain::KeyAlias;
     use auths_sdk::storage_layout::resolve_repo_path;
     let repo_path = resolve_repo_path(repo)?;
     let env_config = auths_sdk::core_config::EnvironmentConfig::from_env();
@@ -1055,7 +1053,7 @@ fn handle_revoke_cmd(agent_did: String, key: String, repo: Option<PathBuf>) -> R
         &env_config,
         Some(passphrase_provider),
     )?;
-    let root_ref = auths_core::storage::keychain::SigningKeyRef::parse(&key)?;
+    let root_ref = auths_sdk::keychain::SigningKeyRef::parse(&key)?;
     let root_alias = root_ref.bare_alias().clone();
 
     auths_sdk::domains::agents::revoke(&ctx, &root_alias, &agent_did)?;
diff --git a/crates/auths-core/src/storage/keychain.rs b/crates/auths-core/src/storage/keychain.rs
index 29a18700f..30e886950 100644
--- a/crates/auths-core/src/storage/keychain.rs
+++ b/crates/auths-core/src/storage/keychain.rs
@@ -238,9 +238,10 @@ impl SigningKeyRef {
                 alias,
             })
         } else if input.contains(':') {
-            Err(AgentError::InvalidInput(
-                format!("Unsupported key scheme or format in '{}'. Only 'auths:<alias>' or bare alias allowed.", input)
-            ))
+            Err(AgentError::InvalidInput(format!(
+                "Unsupported key scheme or format in '{}'. Only 'auths:<alias>' or bare alias allowed.",
+                input
+            )))
         } else {
             let alias = KeyAlias::new(input)?;
             Ok(Self::Alias(alias))
@@ -256,7 +257,6 @@ impl SigningKeyRef {
     }
 }
 
-
 /// Migrate a legacy single-key alias `{alias}` to the multi-key form
 /// `{alias}--0`.
 ///
diff --git a/crates/auths-sdk/src/keychain.rs b/crates/auths-sdk/src/keychain.rs
index 3d25ebed1..71af84fee 100644
--- a/crates/auths-sdk/src/keychain.rs
+++ b/crates/auths-sdk/src/keychain.rs
@@ -4,7 +4,7 @@ pub use auths_core::crypto::encryption::{PASSPHRASE_POLICY_HINT, validate_passph
 pub use auths_core::storage::encrypted_file::EncryptedFileStorage;
 pub use auths_core::storage::keychain;
 pub use auths_core::storage::keychain::{
-    KeyAlias, KeyRole, KeyStorage, extract_public_key_bytes, get_platform_keychain,
+    KeyAlias, KeyRole, KeyStorage, SigningKeyRef, extract_public_key_bytes, get_platform_keychain,
     get_platform_keychain_with_config, migrate_legacy_alias, sign_with_key,
 };
 pub use auths_core::storage::passphrase_cache::{get_passphrase_cache, parse_duration_str};
diff --git a/crates/auths-sdk/src/workflows/agent_provision.rs b/crates/auths-sdk/src/workflows/agent_provision.rs
index 97f2f1fca..428aac1b5 100644
--- a/crates/auths-sdk/src/workflows/agent_provision.rs
+++ b/crates/auths-sdk/src/workflows/agent_provision.rs
@@ -145,11 +145,8 @@ pub fn provision_agent_machine(
     )?;
 
     // 6. Generate executable wrapper helper bin/auths-agent
-    let wrapper_path = generate_executable_wrapper(
-        &params.destination_dir,
-        &env_file_path,
-        &params.label,
-    )?;
+    let wrapper_path =
+        generate_executable_wrapper(&params.destination_dir, &env_file_path, &params.label)?;
 
     let expires_dt = expires_at.and_then(|ts| DateTime::from_timestamp(ts, 0));
 
@@ -255,7 +252,7 @@ pub fn materialize_agent_machine_registry(
             .env("GIT_INDEX_FILE", &idx_s)
             .status()
             .context("failed to execute git read-tree")?;
-        
+
         if !read_tree_status.success() {
             anyhow::bail!("git read-tree failed with status: {}", read_tree_status);
         }
@@ -265,7 +262,7 @@ pub fn materialize_agent_machine_registry(
             .env("GIT_INDEX_FILE", &idx_s)
             .output()
             .context("failed to execute git ls-files")?;
-            
+
         if !listed.status.success() {
             anyhow::bail!("git ls-files failed with status: {}", listed.status);
         }
@@ -284,7 +281,7 @@ pub fn materialize_agent_machine_registry(
                     .env("GIT_INDEX_FILE", &idx_s)
                     .status()
                     .context("failed to execute git rm")?;
-                    
+
                 if !rm_status.success() {
                     anyhow::bail!("git rm failed with status: {}", rm_status);
                 }
@@ -378,7 +375,8 @@ mod tests {
             &passphrase_path,
             passphrase,
             label,
-        ).unwrap();
+        )
+        .unwrap();
 
         assert!(env_file.exists());
         let content = fs::read_to_string(&env_file).unwrap();
@@ -394,17 +392,13 @@ mod tests {
         let env_file = dest_dir.join("env.sh");
         let label = "test-agent";
 
-        let wrapper_file = generate_executable_wrapper(
-            dest_dir,
-            &env_file,
-            label,
-        ).unwrap();
+        let wrapper_file = generate_executable_wrapper(dest_dir, &env_file, label).unwrap();
 
         assert!(wrapper_file.exists());
         let content = fs::read_to_string(&wrapper_file).unwrap();
         assert!(content.contains(&format!("source \"{}\"", env_file.display())));
         assert!(content.contains("exec auths \"$@\""));
-        
+
         #[cfg(unix)]
         {
             use std::os::unix::fs::PermissionsExt;

From 8a0ce833c3227d60e9b21b7f4cdb6614cff22602 Mon Sep 17 00:00:00 2001
From: bordumb <bordumbb@gmail.com>
Date: Fri, 24 Jul 2026 00:25:43 +0100
Subject: [PATCH 25/37] style: apply cargo fmt

Auths-Id: did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b
Auths-Device: did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6
Auths-Anchor-Seq: 1
---
 crates/auths-cli/src/bin/sign.rs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/crates/auths-cli/src/bin/sign.rs b/crates/auths-cli/src/bin/sign.rs
index a84104ce4..3bd169f37 100644
--- a/crates/auths-cli/src/bin/sign.rs
+++ b/crates/auths-cli/src/bin/sign.rs
@@ -111,8 +111,8 @@ fn validate_verify_option(opt: &str) -> Result<()> {
 }
 
 fn parse_key_identifier(key_file: &str) -> Result<String> {
-    let key_ref = auths_sdk::keychain::SigningKeyRef::parse(key_file)
-        .map_err(|e| anyhow::anyhow!(e))?;
+    let key_ref =
+        auths_sdk::keychain::SigningKeyRef::parse(key_file).map_err(|e| anyhow::anyhow!(e))?;
 
     if !matches!(key_ref, auths_sdk::keychain::SigningKeyRef::Uri { ref scheme, .. } if scheme == "auths")
     {

From 6c637b1d034158c062aab20fe247e7ea30be61b3 Mon Sep 17 00:00:00 2001
From: bordumb <bordumbb@gmail.com>
Date: Fri, 24 Jul 2026 00:30:36 +0100
Subject: [PATCH 26/37] feat: add auths agent prompt command

Auths-Id: did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b
Auths-Device: did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6
Auths-Anchor-Seq: 1
---
 .../src/commands/agent/agent_prompt.md        | 19 ++++++++
 crates/auths-cli/src/commands/agent/mod.rs    | 44 ++++++++++++++++++-
 2 files changed, 62 insertions(+), 1 deletion(-)
 create mode 100644 crates/auths-cli/src/commands/agent/agent_prompt.md

diff --git a/crates/auths-cli/src/commands/agent/agent_prompt.md b/crates/auths-cli/src/commands/agent/agent_prompt.md
new file mode 100644
index 000000000..f9f974889
--- /dev/null
+++ b/crates/auths-cli/src/commands/agent/agent_prompt.md
@@ -0,0 +1,19 @@
+<auths_delegated_identity>
+You have been granted a delegated cryptographic identity ({{LABEL}}) to sign your git commits in this workspace.
+
+# Core Directive
+Whenever you execute a `git commit` on behalf of the user, you MUST sign it using this identity.
+
+# Activation Instructions
+Before running ANY git commands that require signing, you MUST activate your signing environment for the current shell session by sourcing your environment script:
+`source {{ENV_PATH}}`
+
+This script automatically handles:
+- Injecting your `AUTHS_PASSPHRASE` into the environment so you do not need to prompt the user.
+- Setting up temporary `GIT_CONFIG_COUNT` overrides to force git to use the `auths-sign` binary.
+
+# Constraints & Rules
+1. NEVER attempt to manually modify the repository's `.git/config` file to configure signing. The `env.sh` script handles this cleanly via environment variables.
+2. NEVER attempt to run `ssh-agent`, `ssh-add`, or interact with standard GPG tools. `auths-sign` is a custom headless signer that replaces them.
+3. If a commit fails with a signing error, verify that you sourced the `env.sh` file in the EXACT same bash session/subshell as the `git commit` command.
+</auths_delegated_identity>
diff --git a/crates/auths-cli/src/commands/agent/mod.rs b/crates/auths-cli/src/commands/agent/mod.rs
index 05f66d7bb..babafe93e 100644
--- a/crates/auths-cli/src/commands/agent/mod.rs
+++ b/crates/auths-cli/src/commands/agent/mod.rs
@@ -159,6 +159,13 @@ pub enum AgentSubcommand {
         )]
         key: String,
     },
+
+    /// Generate a structured system prompt for an AI agent
+    Prompt {
+        /// The human-readable label / agent name
+        #[arg(short, long, help = "Label / agent name (e.g., auths-agent)")]
+        label: String,
+    },
 }
 
 /// Shell format for environment output.
@@ -246,7 +253,8 @@ fn daemon_op_name(cmd: &AgentSubcommand) -> Option<&'static str> {
         | AgentSubcommand::Provision { .. }
         | AgentSubcommand::List { .. }
         | AgentSubcommand::Update { .. }
-        | AgentSubcommand::Revoke { .. } => None,
+        | AgentSubcommand::Revoke { .. }
+        | AgentSubcommand::Prompt { .. } => None,
     }
 }
 
@@ -306,6 +314,7 @@ pub fn handle_agent(cmd: AgentCommand, repo: Option<PathBuf>) -> Result<()> {
             extend_expiration,
         } => handle_update_cmd(agent, label, extend_expiration),
         AgentSubcommand::Revoke { agent_did, key } => handle_revoke_cmd(agent_did, key, repo),
+        AgentSubcommand::Prompt { label } => handle_prompt_cmd(label),
     }
 }
 
@@ -1073,6 +1082,39 @@ impl crate::commands::executable::ExecutableCommand for AgentCommand {
     }
 }
 
+fn handle_prompt_cmd(label: String) -> Result<()> {
+    use auths_sdk::paths::auths_home;
+    use std::path::Path;
+
+    let agent_dir = auths_home()
+        .unwrap_or_else(|_| PathBuf::from("~/.auths"))
+        .parent()
+        .unwrap_or_else(|| Path::new("."))
+        .join(".auths-agents")
+        .join(&label);
+
+    let env_file_path = agent_dir.join("env.sh");
+
+    if !agent_dir.exists() || !env_file_path.exists() {
+        anyhow::bail!(
+            "Agent environment for '{}' not found at '{}'. Please provision the agent first.",
+            label,
+            agent_dir.display()
+        );
+    }
+
+    let abs_env_path = env_file_path.canonicalize().unwrap_or(env_file_path);
+
+    let template = include_str!("agent_prompt.md");
+    let prompt = template
+        .replace("{{LABEL}}", &label)
+        .replace("{{ENV_PATH}}", &abs_env_path.display().to_string());
+
+    println!("{}", prompt);
+
+    Ok(())
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;

From 5de42144bfa41a25860e98b1df46764e76888c3e Mon Sep 17 00:00:00 2001
From: bordumb <bordumbb@gmail.com>
Date: Fri, 24 Jul 2026 00:44:23 +0100
Subject: [PATCH 27/37] refactor: Decouple daemon from agent in auths-cli

Auths-Id: did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b
Auths-Device: did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6
Auths-Anchor-Seq: 1
---
 crates/auths-cli/src/adapters/agent.rs        |   2 +-
 crates/auths-cli/src/cli.rs                   |   4 +
 crates/auths-cli/src/commands/agent/mod.rs    | 785 ++----------------
 crates/auths-cli/src/commands/daemon/mod.rs   | 631 ++++++++++++++
 .../src/commands/{agent => daemon}/process.rs |   0
 .../src/commands/{agent => daemon}/service.rs |  12 +-
 .../auths-cli/src/commands/device/pair/mod.rs |   2 +-
 crates/auths-cli/src/commands/mod.rs          |   1 +
 crates/auths-cli/src/main.rs                  |   1 +
 9 files changed, 729 insertions(+), 709 deletions(-)
 create mode 100644 crates/auths-cli/src/commands/daemon/mod.rs
 rename crates/auths-cli/src/commands/{agent => daemon}/process.rs (100%)
 rename crates/auths-cli/src/commands/{agent => daemon}/service.rs (96%)

diff --git a/crates/auths-cli/src/adapters/agent.rs b/crates/auths-cli/src/adapters/agent.rs
index f3e88e5ef..b4b678c89 100644
--- a/crates/auths-cli/src/adapters/agent.rs
+++ b/crates/auths-cli/src/adapters/agent.rs
@@ -11,7 +11,7 @@ use auths_sdk::crypto::{construct_sshsig_pem, construct_sshsig_signed_data};
 use auths_sdk::ports::agent::{AgentSigningError, AgentSigningPort};
 
 #[cfg(unix)]
-use crate::commands::agent::{ensure_agent_running, get_default_socket_path};
+use crate::commands::daemon::{ensure_agent_running, get_default_socket_path};
 
 /// CLI adapter that delegates signing to the Unix SSH agent.
 ///
diff --git a/crates/auths-cli/src/cli.rs b/crates/auths-cli/src/cli.rs
index 7567129bb..f2c29e97c 100644
--- a/crates/auths-cli/src/cli.rs
+++ b/crates/auths-cli/src/cli.rs
@@ -6,6 +6,7 @@ use clap::{Parser, Subcommand};
 use crate::commands::account::AccountCommand;
 use crate::commands::agent::AgentCommand;
 use crate::commands::anchor::AnchorCommand;
+use crate::commands::daemon::DaemonCommand;
 use crate::commands::approval::ApprovalCommand;
 use crate::commands::artifact::ArtifactCommand;
 use crate::commands::audit::AuditCommand;
@@ -160,9 +161,12 @@ pub enum RootCommand {
 
     // ── Internal (visible via --help-all) ──
     #[command(hide = true)]
+    #[command(hide = true)]
     Emergency(EmergencyCommand),
     #[command(hide = true)]
     Agent(AgentCommand),
+    #[command(hide = true)]
+    Daemon(DaemonCommand),
     /// Aggregate treasury cap across a manager's sub-delegated agents.
     Treasury(TreasuryCommand),
     /// Verify witness-network anchor evidence (duplicity proofs) offline.
diff --git a/crates/auths-cli/src/commands/agent/mod.rs b/crates/auths-cli/src/commands/agent/mod.rs
index babafe93e..0575d7973 100644
--- a/crates/auths-cli/src/commands/agent/mod.rs
+++ b/crates/auths-cli/src/commands/agent/mod.rs
@@ -1,30 +1,15 @@
-//! SSH agent daemon commands (start, stop, status).
+//! Identity management for delegated headless agents.
 
-pub mod process;
-pub mod service;
-
-use anyhow::{Context, Result, anyhow};
-use clap::{Parser, Subcommand, ValueEnum};
-use serde::Serialize;
-use std::fs;
+use anyhow::{Context, Result};
+use clap::{Parser, Subcommand};
 use std::path::PathBuf;
 
-use crate::core::fs::{create_restricted_dir, write_sensitive_file};
 use crate::ux::format::{JsonResponse, is_json_mode};
-use process::{
-    cleanup_stale_files, is_process_running, read_pid_file, socket_is_connectable, write_pid_file,
-};
-use service::ServiceManager;
-
-const DEFAULT_SOCKET_NAME: &str = "agent.sock";
-const PID_FILE_NAME: &str = "agent.pid";
-const ENV_FILE_NAME: &str = "agent.env";
-const LOG_FILE_NAME: &str = "agent.log";
 
 #[derive(Parser, Debug, Clone)]
 #[command(
     name = "agent",
-    about = "SSH agent daemon management (start, stop, status)."
+    about = "Identity management for delegated headless agents."
 )]
 pub struct AgentCommand {
     #[command(subcommand)]
@@ -33,67 +18,6 @@ pub struct AgentCommand {
 
 #[derive(Subcommand, Debug, Clone)]
 pub enum AgentSubcommand {
-    /// Start the SSH agent daemon
-    Start {
-        /// Custom socket path (default: ~/.auths/agent.sock)
-        #[arg(long, help = "Custom Unix socket path")]
-        socket: Option<PathBuf>,
-
-        /// Run in foreground (don't daemonize)
-        #[arg(long, help = "Run in foreground instead of daemonizing")]
-        foreground: bool,
-
-        /// Idle timeout (e.g., "30m", "1h", "0" for never)
-        #[arg(long, default_value = "30m", help = "Idle timeout before auto-lock")]
-        timeout: String,
-    },
-
-    /// Stop the SSH agent daemon
-    Stop,
-
-    /// Show agent status
-    Status,
-
-    /// Output shell environment for SSH_AUTH_SOCK (use with eval)
-    Env {
-        /// Shell format for output
-        #[arg(long, value_enum, default_value = "bash", help = "Shell format")]
-        shell: ShellFormat,
-    },
-
-    /// Lock the agent (clear keys from memory)
-    Lock,
-
-    /// Unlock the agent (re-load keys)
-    Unlock {
-        /// Key alias to unlock
-        #[arg(
-            long = "agent-key-alias",
-            visible_alias = "key",
-            default_value = "default",
-            help = "Key alias to unlock"
-        )]
-        agent_key_alias: String,
-    },
-
-    /// Install as a system service (launchd on macOS, systemd on Linux)
-    InstallService {
-        /// Don't install, just print the service file
-        #[arg(long, help = "Print service file without installing")]
-        dry_run: bool,
-
-        /// Force overwrite if service already exists
-        #[arg(long, help = "Overwrite existing service file")]
-        force: bool,
-
-        /// Service manager to use (auto-detect if not specified)
-        #[arg(long, value_enum, help = "Service manager (auto-detect by default)")]
-        manager: Option<ServiceManager>,
-    },
-
-    /// Uninstall the system service
-    UninstallService,
-
     /// Provision a new delegated headless agent in a single command
     Provision {
         /// Human-readable label / key alias for the new agent
@@ -166,129 +90,48 @@ pub enum AgentSubcommand {
         #[arg(short, long, help = "Label / agent name (e.g., auths-agent)")]
         label: String,
     },
-}
-
-/// Shell format for environment output.
-#[derive(ValueEnum, Clone, Debug, Default)]
-pub enum ShellFormat {
-    #[default]
-    Bash,
-    Zsh,
-    Fish,
-}
-
-/// Status information about the agent.
-#[derive(Serialize, Debug)]
-pub struct AgentStatus {
-    pub running: bool,
-    pub pid: Option<u32>,
-    pub socket_path: Option<String>,
-    pub socket_exists: bool,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub uptime_secs: Option<u64>,
-}
-
-/// Ensures the SSH agent is running, starting it if necessary.
-///
-/// Returns `Ok(true)` if already running, `Ok(false)` if it was started.
-///
-/// Args:
-/// * `quiet`: Suppress startup messages.
-///
-/// Usage:
-/// ```ignore
-/// let was_running = ensure_agent_running(true)?;
-/// ```
-#[allow(dead_code)] // Used by bin/sign.rs (cross-target usage not tracked by lint)
-pub fn ensure_agent_running(quiet: bool) -> Result<bool> {
-    let socket_path = get_default_socket_path()?;
-    let pid_path = get_pid_file_path()?;
-
-    if let Some(pid) = read_pid_file(&pid_path)?
-        && is_process_running(pid)
-        && socket_is_connectable(&socket_path)
-    {
-        return Ok(true);
-    }
-
-    if !quiet {
-        eprintln!("Agent not running, starting...");
-    }
 
-    start_agent(None, false, "30m", quiet)?;
-
-    let timeout = std::time::Duration::from_secs(2);
-    let start = std::time::Instant::now();
-    while start.elapsed() < timeout {
-        if let Some(pid) = read_pid_file(&pid_path)?
-            && is_process_running(pid)
-            && socket_is_connectable(&socket_path)
-        {
-            if !quiet {
-                eprintln!("Agent started (PID {})", pid);
-            }
-            return Ok(false);
-        }
-        std::thread::sleep(std::time::Duration::from_millis(100));
-    }
-
-    Err(anyhow!("Failed to start agent within 2 seconds"))
-}
-
-/// The name of a per-machine daemon operation, or `None` for a store operation.
-///
-/// Daemon operations (start/stop/status/install-service/uninstall-service) act
-/// on the per-machine agent and cannot be scoped by `--repo`. Store operations
-/// (env/lock/unlock) read repo-scoped paths.
-fn daemon_op_name(cmd: &AgentSubcommand) -> Option<&'static str> {
-    match cmd {
-        AgentSubcommand::Start { .. } => Some("start"),
-        AgentSubcommand::Stop => Some("stop"),
-        AgentSubcommand::Status => Some("status"),
-        AgentSubcommand::InstallService { .. } => Some("install-service"),
-        AgentSubcommand::UninstallService => Some("uninstall-service"),
-        AgentSubcommand::Env { .. }
-        | AgentSubcommand::Lock
-        | AgentSubcommand::Unlock { .. }
-        | AgentSubcommand::Provision { .. }
-        | AgentSubcommand::List { .. }
-        | AgentSubcommand::Update { .. }
-        | AgentSubcommand::Revoke { .. }
-        | AgentSubcommand::Prompt { .. } => None,
-    }
+    // ── DEPRECATED DAEMON COMMANDS ──
+    #[command(hide = true)]
+    Start {
+        #[arg(long)]
+        socket: Option<PathBuf>,
+        #[arg(long)]
+        foreground: bool,
+        #[arg(long, default_value = "30m")]
+        timeout: String,
+    },
+    #[command(hide = true)]
+    Stop,
+    #[command(hide = true)]
+    Status,
+    #[command(hide = true)]
+    Env {
+        #[arg(long, value_enum, default_value = "bash")]
+        shell: crate::commands::daemon::ShellFormat,
+    },
+    #[command(hide = true)]
+    Lock,
+    #[command(hide = true)]
+    Unlock {
+        #[arg(long = "agent-key-alias", visible_alias = "key", default_value = "default")]
+        agent_key_alias: String,
+    },
+    #[command(hide = true)]
+    InstallService {
+        #[arg(long)]
+        dry_run: bool,
+        #[arg(long)]
+        force: bool,
+        #[arg(long, value_enum)]
+        manager: Option<crate::commands::daemon::service::ServiceManager>,
+    },
+    #[command(hide = true)]
+    UninstallService,
 }
 
 pub fn handle_agent(cmd: AgentCommand, repo: Option<PathBuf>) -> Result<()> {
-    // Daemon operations are per-machine; `--repo` cannot scope them, so reject
-    // it rather than silently operate on the global agent.
-    if let Some(op) = daemon_op_name(&cmd.command)
-        && repo.is_some()
-    {
-        anyhow::bail!(
-            "`--repo` is not supported for `auths agent {}`; the agent daemon is per-machine \
-             and is selected by AUTHS_HOME, not by repository.",
-            op
-        );
-    }
-
     match cmd.command {
-        AgentSubcommand::Start {
-            socket,
-            foreground,
-            timeout,
-        } => start_agent(socket, foreground, &timeout, false),
-        AgentSubcommand::Stop => stop_agent(),
-        AgentSubcommand::Status => show_status(),
-        AgentSubcommand::InstallService {
-            dry_run,
-            force,
-            manager,
-        } => service::install_service(dry_run, force, manager),
-        AgentSubcommand::UninstallService => service::uninstall_service(),
-        // Store operations read repo-scoped paths; thread `--repo` through.
-        AgentSubcommand::Env { shell } => output_env(shell, repo),
-        AgentSubcommand::Lock => lock_agent(repo),
-        AgentSubcommand::Unlock { agent_key_alias } => unlock_agent(&agent_key_alias, repo),
         AgentSubcommand::Provision {
             label,
             key,
@@ -315,489 +158,60 @@ pub fn handle_agent(cmd: AgentCommand, repo: Option<PathBuf>) -> Result<()> {
         } => handle_update_cmd(agent, label, extend_expiration),
         AgentSubcommand::Revoke { agent_did, key } => handle_revoke_cmd(agent_did, key, repo),
         AgentSubcommand::Prompt { label } => handle_prompt_cmd(label),
-    }
-}
-
-fn parse_timeout(s: &str) -> Result<std::time::Duration> {
-    use std::time::Duration;
-
-    let s = s.trim();
-    if s == "0" {
-        return Ok(Duration::ZERO);
-    }
-
-    let (num_str, suffix) = if let Some(stripped) = s.strip_suffix('s') {
-        (stripped, "s")
-    } else if let Some(stripped) = s.strip_suffix('m') {
-        (stripped, "m")
-    } else if let Some(stripped) = s.strip_suffix('h') {
-        (stripped, "h")
-    } else {
-        (s, "m")
-    };
-
-    let num: u64 = num_str
-        .parse()
-        .with_context(|| format!("Invalid timeout number: {}", num_str))?;
-
-    let secs = match suffix {
-        "s" => num,
-        "m" => num * 60,
-        "h" => num * 3600,
-        _ => return Err(anyhow!("Invalid timeout suffix: {}", suffix)),
-    };
-
-    Ok(Duration::from_secs(secs))
-}
-
-fn get_auths_dir() -> Result<PathBuf> {
-    auths_sdk::paths::auths_home().map_err(|e| anyhow!(e))
-}
-
-/// Resolve the agent's storage directory, honoring a `--repo` override.
-///
-/// `None` preserves the default (`AUTHS_HOME` / `~/.auths`); `Some(path)`
-/// scopes the agent's socket/pid/env files to that registry.
-///
-/// Args:
-/// * `repo`: The optional `--repo` override.
-///
-/// Usage:
-/// ```ignore
-/// let dir = get_auths_dir_for_repo(ctx.repo_path.clone())?;
-/// ```
-fn get_auths_dir_for_repo(repo: Option<PathBuf>) -> Result<PathBuf> {
-    match repo {
-        Some(_) => auths_sdk::storage_layout::resolve_repo_path(repo)
-            .context("Failed to resolve the repository path for the agent store"),
-        None => get_auths_dir(),
-    }
-}
-
-fn get_socket_path_for_repo(repo: Option<PathBuf>) -> Result<PathBuf> {
-    Ok(get_auths_dir_for_repo(repo)?.join(DEFAULT_SOCKET_NAME))
-}
-
-fn get_pid_file_path_for_repo(repo: Option<PathBuf>) -> Result<PathBuf> {
-    Ok(get_auths_dir_for_repo(repo)?.join(PID_FILE_NAME))
-}
-
-/// Get the default socket path.
-pub fn get_default_socket_path() -> Result<PathBuf> {
-    Ok(get_auths_dir()?.join(DEFAULT_SOCKET_NAME))
-}
-
-fn get_pid_file_path() -> Result<PathBuf> {
-    Ok(get_auths_dir()?.join(PID_FILE_NAME))
-}
-
-fn get_env_file_path() -> Result<PathBuf> {
-    Ok(get_auths_dir()?.join(ENV_FILE_NAME))
-}
-
-pub(crate) fn get_log_file_path() -> Result<PathBuf> {
-    Ok(get_auths_dir()?.join(LOG_FILE_NAME))
-}
-
-fn start_agent(
-    socket_path: Option<PathBuf>,
-    foreground: bool,
-    timeout_str: &str,
-    quiet: bool,
-) -> Result<()> {
-    let auths_dir = get_auths_dir()?;
-    create_restricted_dir(&auths_dir)
-        .with_context(|| format!("Failed to create auths directory: {:?}", auths_dir))?;
 
-    let socket = match socket_path {
-        Some(s) => s,
-        None => get_default_socket_path()?,
-    };
-    let pid_path = get_pid_file_path()?;
-    let env_path = get_env_file_path()?;
-    let timeout = parse_timeout(timeout_str)?;
-
-    if let Some(pid) = read_pid_file(&pid_path)? {
-        if is_process_running(pid) {
-            return Err(anyhow!(
-                "Agent already running (PID {}). Use 'auths agent stop' first.",
-                pid
-            ));
+        // ── Forward Deprecated Daemon Commands ──
+        AgentSubcommand::Start { socket, foreground, timeout } => {
+            eprintln!("\x1b[33mWARNING: 'auths agent start' is deprecated for daemon management. Please use 'auths daemon start' instead.\x1b[0m");
+            crate::commands::daemon::handle_daemon(crate::commands::daemon::DaemonCommand {
+                command: crate::commands::daemon::DaemonSubcommand::Start { socket, foreground, timeout }
+            }, repo)
         }
-        let _ = fs::remove_file(&pid_path);
-    }
-
-    match fs::remove_file(&socket) {
-        Ok(()) => {}
-        Err(e) if e.kind() == std::io::ErrorKind::NotFound => {}
-        Err(e) => {
-            return Err(anyhow!("Failed to remove stale socket {:?}: {}", socket, e));
+        AgentSubcommand::Stop => {
+            eprintln!("\x1b[33mWARNING: 'auths agent stop' is deprecated for daemon management. Please use 'auths daemon stop' instead.\x1b[0m");
+            crate::commands::daemon::handle_daemon(crate::commands::daemon::DaemonCommand {
+                command: crate::commands::daemon::DaemonSubcommand::Stop
+            }, repo)
         }
-    }
-
-    if foreground {
-        run_agent_foreground(&socket, &pid_path, &env_path, timeout)
-    } else {
-        daemonize_agent(&socket, &env_path, timeout_str, quiet)
-    }
-}
-
-#[cfg(unix)]
-fn run_agent_foreground(
-    socket: &std::path::Path,
-    pid_path: &std::path::Path,
-    env_path: &std::path::Path,
-    timeout: std::time::Duration,
-) -> Result<()> {
-    use auths_sdk::agent_core::AgentHandle;
-    use std::sync::Arc;
-
-    let pid = std::process::id();
-    write_pid_file(pid_path, pid)?;
-
-    let socket_str = socket
-        .to_str()
-        .ok_or_else(|| anyhow!("Socket path is not valid UTF-8"))?;
-    let env_content = format!("export SSH_AUTH_SOCK=\"{}\"\n", socket_str);
-    write_sensitive_file(env_path, &env_content)
-        .with_context(|| format!("Failed to write env file: {:?}", env_path))?;
-
-    eprintln!("Starting SSH agent (foreground)...");
-    eprintln!("Socket: {}", socket_str);
-    eprintln!("PID: {}", pid);
-    if timeout.is_zero() {
-        eprintln!("Idle timeout: disabled");
-    } else {
-        eprintln!("Idle timeout: {:?}", timeout);
-    }
-    eprintln!();
-    eprintln!("To use this agent in your shell:");
-    eprintln!("  eval $(cat {})", env_path.display());
-    eprintln!("  # or");
-    eprintln!("  export SSH_AUTH_SOCK=\"{}\"", socket_str);
-    eprintln!();
-    eprintln!("Press Ctrl+C to stop.");
-
-    let handle = Arc::new(AgentHandle::with_pid_file_and_timeout(
-        socket.to_path_buf(),
-        pid_path.to_path_buf(),
-        timeout,
-    ));
-
-    let authorizer = build_sign_authorizer({
-        use std::io::IsTerminal;
-        std::io::stdin().is_terminal()
-    });
-
-    let rt = tokio::runtime::Runtime::new().context("Failed to create tokio runtime")?;
-    let result = rt.block_on(async {
-        auths_sdk::agent_core::start_agent_listener_with_handle(handle.clone(), authorizer).await
-    });
-
-    cleanup_stale_files(&[pid_path, env_path, socket]);
-
-    result.map_err(|e| anyhow!("Agent error: {}", e))
-}
-
-/// Builds the per-request signing authorizer for the agent. An interactive agent gates
-/// each new connecting process behind an approval prompt (so an unlocked agent does not
-/// grant silent signing to every same-user process); a daemonized / non-interactive
-/// agent is permissive, since there is no human present to approve.
-///
-/// Args:
-/// * `interactive`: whether the agent has a terminal to prompt on.
-///
-/// Usage:
-/// ```ignore
-/// let auth = build_sign_authorizer(std::io::stdin().is_terminal());
-/// ```
-#[cfg(unix)]
-fn build_sign_authorizer(
-    interactive: bool,
-) -> std::sync::Arc<dyn auths_sdk::agent_core::SignAuthorizer> {
-    if interactive {
-        std::sync::Arc::new(auths_sdk::agent_core::PerCallerAuthorizer::new(
-            approve_caller,
-        ))
-    } else {
-        std::sync::Arc::new(auths_sdk::agent_core::AllowAllSigning)
-    }
-}
-
-/// Prompts the operator to approve signing for a newly connected caller. Returns true to
-/// approve and pin that caller for the unlock window.
-///
-/// Args:
-/// * `peer`: the connecting process's identity.
-///
-/// Usage:
-/// ```ignore
-/// let approved = approve_caller(&peer);
-/// ```
-#[cfg(unix)]
-fn approve_caller(peer: &auths_sdk::agent_core::PeerIdentity) -> bool {
-    let who = match peer.pid {
-        Some(pid) => format!("process pid {pid} (uid {})", peer.uid),
-        None => format!("a process (uid {})", peer.uid),
-    };
-    eprintln!("\nauths agent: a new caller — {who} — is requesting a signature.");
-    dialoguer::Confirm::new()
-        .with_prompt("Approve signing for this caller?")
-        .default(false)
-        .interact()
-        .unwrap_or(false)
-}
-
-#[cfg(not(unix))]
-fn run_agent_foreground(
-    _socket: &std::path::Path,
-    _pid_path: &std::path::Path,
-    _env_path: &std::path::Path,
-    _timeout: std::time::Duration,
-) -> Result<()> {
-    Err(anyhow!(
-        "SSH agent is not supported on this platform (requires Unix domain sockets)"
-    ))
-}
-
-#[cfg(unix)]
-fn daemonize_agent(
-    socket: &std::path::Path,
-    env_path: &std::path::Path,
-    timeout_str: &str,
-    quiet: bool,
-) -> Result<()> {
-    let socket_str = socket
-        .to_str()
-        .ok_or_else(|| anyhow!("Socket path is not valid UTF-8"))?;
-
-    let log_path = get_log_file_path()?;
-    let child_pid = process::spawn_detached(
-        &[
-            "agent",
-            "start",
-            "--foreground",
-            "--socket",
-            socket_str,
-            "--timeout",
-            timeout_str,
-        ],
-        &log_path,
-    )?;
-
-    if !quiet {
-        eprintln!("Agent daemon started (PID {})", child_pid);
-        eprintln!("Socket: {}", socket_str);
-        eprintln!("Log file: {}", log_path.display());
-        eprintln!();
-        eprintln!("To use this agent:");
-        eprintln!("  eval $(auths agent env)");
-        eprintln!("  # or");
-        eprintln!("  export SSH_AUTH_SOCK=\"{}\"", socket_str);
-    }
-
-    let env_content = format!("export SSH_AUTH_SOCK=\"{}\"\n", socket_str);
-    write_sensitive_file(env_path, &env_content)
-        .with_context(|| format!("Failed to write env file: {:?}", env_path))?;
-
-    Ok(())
-}
-
-#[cfg(not(unix))]
-fn daemonize_agent(
-    _socket: &std::path::Path,
-    _env_path: &std::path::Path,
-    _timeout_str: &str,
-    _quiet: bool,
-) -> Result<()> {
-    Err(anyhow!(
-        "Daemonization not supported on this platform. Use --foreground."
-    ))
-}
-
-fn stop_agent() -> Result<()> {
-    let pid_path = get_pid_file_path()?;
-    let socket_path = get_default_socket_path()?;
-    let env_path = get_env_file_path()?;
-
-    let pid = read_pid_file(&pid_path)?
-        .ok_or_else(|| anyhow!("Agent not running (no PID file found at {:?})", pid_path))?;
-
-    if !is_process_running(pid) {
-        eprintln!("Agent process {} not found. Cleaning up stale files.", pid);
-        cleanup_stale_files(&[&pid_path, &socket_path, &env_path]);
-        return Ok(());
-    }
-
-    eprintln!("Stopping agent (PID {})...", pid);
-    process::terminate_process(pid, std::time::Duration::from_secs(5))?;
-    cleanup_stale_files(&[&pid_path, &socket_path, &env_path]);
-    eprintln!("Agent stopped.");
-    Ok(())
-}
-
-fn show_status() -> Result<()> {
-    let pid_path = get_pid_file_path()?;
-    let socket_path = get_default_socket_path()?;
-
-    let pid = read_pid_file(&pid_path)?;
-    let running = pid.map(is_process_running).unwrap_or(false);
-    let socket_exists = socket_path.exists();
-
-    let status = AgentStatus {
-        running,
-        pid: if running { pid } else { None },
-        socket_path: if socket_exists {
-            Some(socket_path.to_string_lossy().to_string())
-        } else {
-            None
-        },
-        socket_exists,
-        uptime_secs: None,
-    };
-
-    if is_json_mode() {
-        JsonResponse::success("agent status", status).print()?;
-    } else if running {
-        eprintln!("Agent Status: RUNNING");
-        if let Some(p) = status.pid {
-            eprintln!("  PID: {}", p);
+        AgentSubcommand::Status => {
+            eprintln!("\x1b[33mWARNING: 'auths agent status' is deprecated for daemon management. Please use 'auths daemon status' instead.\x1b[0m");
+            crate::commands::daemon::handle_daemon(crate::commands::daemon::DaemonCommand {
+                command: crate::commands::daemon::DaemonSubcommand::Status
+            }, repo)
         }
-        if let Some(ref sock) = status.socket_path {
-            eprintln!("  Socket: {}", sock);
+        AgentSubcommand::Env { shell } => {
+            eprintln!("\x1b[33mWARNING: 'auths agent env' is deprecated for daemon management. Please use 'auths daemon env' instead.\x1b[0m");
+            crate::commands::daemon::handle_daemon(crate::commands::daemon::DaemonCommand {
+                command: crate::commands::daemon::DaemonSubcommand::Env { shell }
+            }, repo)
         }
-        eprintln!();
-        eprintln!("To use this agent:");
-        eprintln!("  eval $(auths agent env)");
-    } else {
-        eprintln!("Agent Status: STOPPED");
-        if pid.is_some() && !running {
-            eprintln!("  (Stale PID file found at {:?})", pid_path);
+        AgentSubcommand::Lock => {
+            eprintln!("\x1b[33mWARNING: 'auths agent lock' is deprecated for daemon management. Please use 'auths daemon lock' instead.\x1b[0m");
+            crate::commands::daemon::handle_daemon(crate::commands::daemon::DaemonCommand {
+                command: crate::commands::daemon::DaemonSubcommand::Lock
+            }, repo)
         }
-        eprintln!();
-        eprintln!("To start the agent:");
-        eprintln!("  auths agent start");
-    }
-
-    Ok(())
-}
-
-fn output_env(shell: ShellFormat, repo: Option<PathBuf>) -> Result<()> {
-    let socket_path = get_socket_path_for_repo(repo.clone())?;
-    let pid_path = get_pid_file_path_for_repo(repo)?;
-
-    let pid = read_pid_file(&pid_path)?;
-    let running = pid.map(is_process_running).unwrap_or(false);
-
-    if !running {
-        eprintln!("Error: Agent is not running.");
-        eprintln!("Start the agent with: auths agent start");
-        std::process::exit(1);
-    }
-
-    if !socket_path.exists() {
-        eprintln!("Error: Socket file not found at {:?}", socket_path);
-        eprintln!("The agent may have crashed. Try: auths agent start");
-        std::process::exit(1);
-    }
-
-    let socket_str = socket_path
-        .to_str()
-        .ok_or_else(|| anyhow!("Socket path is not valid UTF-8"))?;
-
-    match shell {
-        ShellFormat::Bash | ShellFormat::Zsh => {
-            println!("export SSH_AUTH_SOCK=\"{}\"", socket_str);
+        AgentSubcommand::Unlock { agent_key_alias } => {
+            eprintln!("\x1b[33mWARNING: 'auths agent unlock' is deprecated for daemon management. Please use 'auths daemon unlock' instead.\x1b[0m");
+            crate::commands::daemon::handle_daemon(crate::commands::daemon::DaemonCommand {
+                command: crate::commands::daemon::DaemonSubcommand::Unlock { agent_key_alias }
+            }, repo)
         }
-        ShellFormat::Fish => {
-            println!("set -x SSH_AUTH_SOCK \"{}\"", socket_str);
+        AgentSubcommand::InstallService { dry_run, force, manager } => {
+            eprintln!("\x1b[33mWARNING: 'auths agent install-service' is deprecated for daemon management. Please use 'auths daemon install-service' instead.\x1b[0m");
+            crate::commands::daemon::handle_daemon(crate::commands::daemon::DaemonCommand {
+                command: crate::commands::daemon::DaemonSubcommand::InstallService { dry_run, force, manager }
+            }, repo)
+        }
+        AgentSubcommand::UninstallService => {
+            eprintln!("\x1b[33mWARNING: 'auths agent uninstall-service' is deprecated for daemon management. Please use 'auths daemon uninstall-service' instead.\x1b[0m");
+            crate::commands::daemon::handle_daemon(crate::commands::daemon::DaemonCommand {
+                command: crate::commands::daemon::DaemonSubcommand::UninstallService
+            }, repo)
         }
     }
-
-    Ok(())
-}
-
-#[cfg(unix)]
-fn lock_agent(repo: Option<PathBuf>) -> Result<()> {
-    let pid_path = get_pid_file_path_for_repo(repo.clone())?;
-    let pid = read_pid_file(&pid_path)?;
-    let running = pid.map(is_process_running).unwrap_or(false);
-
-    if !running {
-        return Err(anyhow!("Agent is not running"));
-    }
-
-    let socket_path = get_socket_path_for_repo(repo)?;
-    auths_sdk::agent_core::remove_all_identities(&socket_path)
-        .map_err(|e| anyhow!("Failed to lock agent: {}", e))?;
-
-    eprintln!("Agent locked — all keys removed from memory.");
-    eprintln!("Use `auths agent unlock <key-alias>` to reload a key.");
-
-    Ok(())
-}
-
-#[cfg(not(unix))]
-fn lock_agent(_repo: Option<PathBuf>) -> Result<()> {
-    Err(anyhow!(
-        "Agent lock is not supported on this platform (requires Unix domain sockets)"
-    ))
-}
-
-#[cfg(unix)]
-fn unlock_agent(key_alias: &str, repo: Option<PathBuf>) -> Result<()> {
-    let pid_path = get_pid_file_path_for_repo(repo.clone())?;
-    let pid = read_pid_file(&pid_path)?;
-    let running = pid.map(is_process_running).unwrap_or(false);
-
-    if !running {
-        return Err(anyhow!("Agent is not running"));
-    }
-
-    let socket_path = get_socket_path_for_repo(repo)?;
-
-    let keychain = auths_sdk::keychain::get_platform_keychain()
-        .map_err(|e| anyhow!("Failed to get platform keychain: {}", e))?;
-
-    if keychain.is_hardware_backend() {
-        return Err(anyhow!(
-            "Agent-mode signing requires a software-backed key. Key '{}' is hardware-backed \
-             (Secure Enclave) and cannot export raw key material needed by the SSH agent. \
-             Use direct signing instead (which dispatches through the Secure Enclave), \
-             or initialize a separate software-backed identity for agent use.",
-            key_alias
-        ));
-    }
-
-    let key_ref = auths_sdk::keychain::SigningKeyRef::parse(key_alias)?;
-    let parsed_alias = key_ref.bare_alias().clone();
-
-    let (_identity_did, _role, encrypted_data) = keychain
-        .load_key(&parsed_alias)
-        .map_err(|e| anyhow!("Failed to load key '{}': {}", key_alias, e))?;
-
-    let passphrase = rpassword::prompt_password(format!("Passphrase for '{}': ", key_alias))
-        .context("Failed to read passphrase")?;
-
-    let key_bytes = auths_sdk::crypto::decrypt_keypair(&encrypted_data, &passphrase)
-        .map_err(|e| anyhow!("Failed to decrypt key '{}': {}", key_alias, e))?;
-
-    auths_sdk::agent_core::add_identity(&socket_path, &key_bytes)
-        .map_err(|e| anyhow!("Failed to add key to agent: {}", e))?;
-
-    eprintln!("Agent unlocked — key '{}' loaded.", key_alias);
-
-    Ok(())
-}
-
-#[cfg(not(unix))]
-fn unlock_agent(_key_alias: &str, _repo: Option<PathBuf>) -> Result<()> {
-    Err(anyhow!(
-        "Agent unlock is not supported on this platform (requires Unix domain sockets)"
-    ))
 }
 
-#[derive(Serialize)]
+#[derive(serde::Serialize)]
 struct AgentProvisionJsonResponse {
     agent_did: String,
     label: String,
@@ -1119,37 +533,6 @@ fn handle_prompt_cmd(label: String) -> Result<()> {
 mod tests {
     use super::*;
 
-    #[test]
-    fn test_get_auths_dir() {
-        let dir = get_auths_dir().unwrap();
-        assert!(dir.ends_with(".auths"));
-    }
-
-    #[test]
-    fn test_get_default_socket_path() {
-        let path = get_default_socket_path().unwrap();
-        assert!(path.ends_with("agent.sock"));
-    }
-
-    #[test]
-    fn test_shell_format_default() {
-        let format: ShellFormat = Default::default();
-        assert!(matches!(format, ShellFormat::Bash));
-    }
-
-    #[test]
-    fn test_parse_timeout() {
-        use std::time::Duration;
-
-        assert_eq!(parse_timeout("0").unwrap(), Duration::ZERO);
-        assert_eq!(parse_timeout("30s").unwrap(), Duration::from_secs(30));
-        assert_eq!(parse_timeout("5m").unwrap(), Duration::from_secs(300));
-        assert_eq!(parse_timeout("30m").unwrap(), Duration::from_secs(1800));
-        assert_eq!(parse_timeout("1h").unwrap(), Duration::from_secs(3600));
-        assert_eq!(parse_timeout("2h").unwrap(), Duration::from_secs(7200));
-        assert_eq!(parse_timeout("30").unwrap(), Duration::from_secs(1800));
-    }
-
     #[test]
     fn test_handle_provision_cmd_invalid_profile() {
         let temp_dir = tempfile::tempdir().unwrap();
diff --git a/crates/auths-cli/src/commands/daemon/mod.rs b/crates/auths-cli/src/commands/daemon/mod.rs
new file mode 100644
index 000000000..eddb925a4
--- /dev/null
+++ b/crates/auths-cli/src/commands/daemon/mod.rs
@@ -0,0 +1,631 @@
+//! SSH agent daemon commands (start, stop, status).
+
+pub mod process;
+pub mod service;
+
+use anyhow::{Context, Result, anyhow};
+use clap::{Parser, Subcommand, ValueEnum};
+use serde::Serialize;
+use std::fs;
+use std::path::PathBuf;
+
+use crate::core::fs::{create_restricted_dir, write_sensitive_file};
+use crate::ux::format::{JsonResponse, is_json_mode};
+use process::{
+    cleanup_stale_files, is_process_running, read_pid_file, socket_is_connectable, write_pid_file,
+};
+use service::ServiceManager;
+
+const DEFAULT_SOCKET_NAME: &str = "agent.sock";
+const PID_FILE_NAME: &str = "agent.pid";
+const ENV_FILE_NAME: &str = "agent.env";
+const LOG_FILE_NAME: &str = "agent.log";
+
+#[derive(Parser, Debug, Clone)]
+#[command(
+    name = "daemon",
+    about = "SSH agent daemon management (start, stop, status)."
+)]
+pub struct DaemonCommand {
+    #[command(subcommand)]
+    pub command: DaemonSubcommand,
+}
+
+#[derive(Subcommand, Debug, Clone)]
+pub enum DaemonSubcommand {
+    /// Start the SSH agent daemon
+    Start {
+        /// Custom socket path (default: ~/.auths/agent.sock)
+        #[arg(long, help = "Custom Unix socket path")]
+        socket: Option<PathBuf>,
+
+        /// Run in foreground (don't daemonize)
+        #[arg(long, help = "Run in foreground instead of daemonizing")]
+        foreground: bool,
+
+        /// Idle timeout (e.g., "30m", "1h", "0" for never)
+        #[arg(long, default_value = "30m", help = "Idle timeout before auto-lock")]
+        timeout: String,
+    },
+
+    /// Stop the SSH agent daemon
+    Stop,
+
+    /// Show daemon status
+    Status,
+
+    /// Output shell environment for SSH_AUTH_SOCK (use with eval)
+    Env {
+        /// Shell format for output
+        #[arg(long, value_enum, default_value = "bash", help = "Shell format")]
+        shell: ShellFormat,
+    },
+
+    /// Lock the daemon (clear keys from memory)
+    Lock,
+
+    /// Unlock the daemon (re-load keys)
+    Unlock {
+        /// Key alias to unlock
+        #[arg(
+            long = "agent-key-alias",
+            visible_alias = "key",
+            default_value = "default",
+            help = "Key alias to unlock"
+        )]
+        agent_key_alias: String,
+    },
+
+    /// Install as a system service (launchd on macOS, systemd on Linux)
+    InstallService {
+        /// Don't install, just print the service file
+        #[arg(long, help = "Print service file without installing")]
+        dry_run: bool,
+
+        /// Force overwrite if service already exists
+        #[arg(long, help = "Overwrite existing service file")]
+        force: bool,
+
+        /// Service manager to use (auto-detect if not specified)
+        #[arg(long, value_enum, help = "Service manager (auto-detect by default)")]
+        manager: Option<ServiceManager>,
+    },
+
+    /// Uninstall the system service
+    UninstallService,
+}
+
+/// Shell format for environment output.
+#[derive(ValueEnum, Clone, Debug, Default)]
+pub enum ShellFormat {
+    #[default]
+    Bash,
+    Zsh,
+    Fish,
+}
+
+/// Status information about the daemon.
+#[derive(Serialize, Debug)]
+pub struct DaemonStatus {
+    pub running: bool,
+    pub pid: Option<u32>,
+    pub socket_path: Option<String>,
+    pub socket_exists: bool,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub uptime_secs: Option<u64>,
+}
+
+/// Ensures the SSH agent is running, starting it if necessary.
+#[allow(dead_code)] // Used by bin/sign.rs (cross-target usage not tracked by lint)
+pub fn ensure_agent_running(quiet: bool) -> Result<bool> {
+    let socket_path = get_default_socket_path()?;
+    let pid_path = get_pid_file_path()?;
+
+    if let Some(pid) = read_pid_file(&pid_path)?
+        && is_process_running(pid)
+        && socket_is_connectable(&socket_path)
+    {
+        return Ok(true);
+    }
+
+    if !quiet {
+        eprintln!("Daemon not running, starting...");
+    }
+
+    start_daemon(None, false, "30m", quiet)?;
+
+    let timeout = std::time::Duration::from_secs(2);
+    let start = std::time::Instant::now();
+    while start.elapsed() < timeout {
+        if let Some(pid) = read_pid_file(&pid_path)?
+            && is_process_running(pid)
+            && socket_is_connectable(&socket_path)
+        {
+            if !quiet {
+                eprintln!("Daemon started (PID {})", pid);
+            }
+            return Ok(false);
+        }
+        std::thread::sleep(std::time::Duration::from_millis(100));
+    }
+
+    Err(anyhow!("Failed to start daemon within 2 seconds"))
+}
+
+pub fn handle_daemon(cmd: DaemonCommand, repo: Option<PathBuf>) -> Result<()> {
+    if repo.is_some() {
+        anyhow::bail!(
+            "`--repo` is not supported for `auths daemon`; the protocol daemon is per-machine \
+             and is selected by AUTHS_HOME, not by repository."
+        );
+    }
+
+    match cmd.command {
+        DaemonSubcommand::Start {
+            socket,
+            foreground,
+            timeout,
+        } => start_daemon(socket, foreground, &timeout, false),
+        DaemonSubcommand::Stop => stop_daemon(),
+        DaemonSubcommand::Status => show_status(),
+        DaemonSubcommand::InstallService {
+            dry_run,
+            force,
+            manager,
+        } => service::install_service(dry_run, force, manager),
+        DaemonSubcommand::UninstallService => service::uninstall_service(),
+        DaemonSubcommand::Env { shell } => output_env(shell, repo),
+        DaemonSubcommand::Lock => lock_daemon(repo),
+        DaemonSubcommand::Unlock { agent_key_alias } => unlock_daemon(&agent_key_alias, repo),
+    }
+}
+
+fn parse_timeout(s: &str) -> Result<std::time::Duration> {
+    use std::time::Duration;
+
+    let s = s.trim();
+    if s == "0" {
+        return Ok(Duration::ZERO);
+    }
+
+    let (num_str, suffix) = if let Some(stripped) = s.strip_suffix('s') {
+        (stripped, "s")
+    } else if let Some(stripped) = s.strip_suffix('m') {
+        (stripped, "m")
+    } else if let Some(stripped) = s.strip_suffix('h') {
+        (stripped, "h")
+    } else {
+        (s, "m")
+    };
+
+    let num: u64 = num_str
+        .parse()
+        .with_context(|| format!("Invalid timeout number: {}", num_str))?;
+
+    let secs = match suffix {
+        "s" => num,
+        "m" => num * 60,
+        "h" => num * 3600,
+        _ => return Err(anyhow!("Invalid timeout suffix: {}", suffix)),
+    };
+
+    Ok(Duration::from_secs(secs))
+}
+
+fn get_auths_dir() -> Result<PathBuf> {
+    auths_sdk::paths::auths_home().map_err(|e| anyhow!(e))
+}
+
+fn get_auths_dir_for_repo(repo: Option<PathBuf>) -> Result<PathBuf> {
+    match repo {
+        Some(_) => auths_sdk::storage_layout::resolve_repo_path(repo)
+            .context("Failed to resolve the repository path for the daemon store"),
+        None => get_auths_dir(),
+    }
+}
+
+fn get_socket_path_for_repo(repo: Option<PathBuf>) -> Result<PathBuf> {
+    Ok(get_auths_dir_for_repo(repo)?.join(DEFAULT_SOCKET_NAME))
+}
+
+fn get_pid_file_path_for_repo(repo: Option<PathBuf>) -> Result<PathBuf> {
+    Ok(get_auths_dir_for_repo(repo)?.join(PID_FILE_NAME))
+}
+
+pub fn get_default_socket_path() -> Result<PathBuf> {
+    Ok(get_auths_dir()?.join(DEFAULT_SOCKET_NAME))
+}
+
+fn get_pid_file_path() -> Result<PathBuf> {
+    Ok(get_auths_dir()?.join(PID_FILE_NAME))
+}
+
+fn get_env_file_path() -> Result<PathBuf> {
+    Ok(get_auths_dir()?.join(ENV_FILE_NAME))
+}
+
+pub(crate) fn get_log_file_path() -> Result<PathBuf> {
+    Ok(get_auths_dir()?.join(LOG_FILE_NAME))
+}
+
+fn start_daemon(
+    socket_path: Option<PathBuf>,
+    foreground: bool,
+    timeout_str: &str,
+    quiet: bool,
+) -> Result<()> {
+    let auths_dir = get_auths_dir()?;
+    create_restricted_dir(&auths_dir)
+        .with_context(|| format!("Failed to create auths directory: {:?}", auths_dir))?;
+
+    let socket = match socket_path {
+        Some(s) => s,
+        None => get_default_socket_path()?,
+    };
+    let pid_path = get_pid_file_path()?;
+    let env_path = get_env_file_path()?;
+    let timeout = parse_timeout(timeout_str)?;
+
+    if let Some(pid) = read_pid_file(&pid_path)? {
+        if is_process_running(pid) {
+            return Err(anyhow!(
+                "Daemon already running (PID {}). Use 'auths daemon stop' first.",
+                pid
+            ));
+        }
+        let _ = fs::remove_file(&pid_path);
+    }
+
+    match fs::remove_file(&socket) {
+        Ok(()) => {}
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => {}
+        Err(e) => {
+            return Err(anyhow!("Failed to remove stale socket {:?}: {}", socket, e));
+        }
+    }
+
+    if foreground {
+        run_daemon_foreground(&socket, &pid_path, &env_path, timeout)
+    } else {
+        daemonize_process(&socket, &env_path, timeout_str, quiet)
+    }
+}
+
+#[cfg(unix)]
+fn run_daemon_foreground(
+    socket: &std::path::Path,
+    pid_path: &std::path::Path,
+    env_path: &std::path::Path,
+    timeout: std::time::Duration,
+) -> Result<()> {
+    use auths_sdk::agent_core::AgentHandle;
+    use std::sync::Arc;
+
+    let pid = std::process::id();
+    write_pid_file(pid_path, pid)?;
+
+    let socket_str = socket
+        .to_str()
+        .ok_or_else(|| anyhow!("Socket path is not valid UTF-8"))?;
+    let env_content = format!("export SSH_AUTH_SOCK=\"{}\"\n", socket_str);
+    write_sensitive_file(env_path, &env_content)
+        .with_context(|| format!("Failed to write env file: {:?}", env_path))?;
+
+    eprintln!("Starting SSH protocol daemon (foreground)...");
+    eprintln!("Socket: {}", socket_str);
+    eprintln!("PID: {}", pid);
+    if timeout.is_zero() {
+        eprintln!("Idle timeout: disabled");
+    } else {
+        eprintln!("Idle timeout: {:?}", timeout);
+    }
+    eprintln!();
+    eprintln!("To use this daemon in your shell:");
+    eprintln!("  eval $(cat {})", env_path.display());
+    eprintln!("  # or");
+    eprintln!("  export SSH_AUTH_SOCK=\"{}\"", socket_str);
+    eprintln!();
+    eprintln!("Press Ctrl+C to stop.");
+
+    let handle = Arc::new(AgentHandle::with_pid_file_and_timeout(
+        socket.to_path_buf(),
+        pid_path.to_path_buf(),
+        timeout,
+    ));
+
+    let authorizer = build_sign_authorizer({
+        use std::io::IsTerminal;
+        std::io::stdin().is_terminal()
+    });
+
+    let rt = tokio::runtime::Runtime::new().context("Failed to create tokio runtime")?;
+    let result = rt.block_on(async {
+        auths_sdk::agent_core::start_agent_listener_with_handle(handle.clone(), authorizer).await
+    });
+
+    cleanup_stale_files(&[pid_path, env_path, socket]);
+
+    result.map_err(|e| anyhow!("Daemon error: {}", e))
+}
+
+#[cfg(unix)]
+fn build_sign_authorizer(
+    interactive: bool,
+) -> std::sync::Arc<dyn auths_sdk::agent_core::SignAuthorizer> {
+    if interactive {
+        std::sync::Arc::new(auths_sdk::agent_core::PerCallerAuthorizer::new(
+            approve_caller,
+        ))
+    } else {
+        std::sync::Arc::new(auths_sdk::agent_core::AllowAllSigning)
+    }
+}
+
+#[cfg(unix)]
+fn approve_caller(peer: &auths_sdk::agent_core::PeerIdentity) -> bool {
+    let who = match peer.pid {
+        Some(pid) => format!("process pid {pid} (uid {})", peer.uid),
+        None => format!("a process (uid {})", peer.uid),
+    };
+    eprintln!("\nauths daemon: a new caller — {who} — is requesting a signature.");
+    dialoguer::Confirm::new()
+        .with_prompt("Approve signing for this caller?")
+        .default(false)
+        .interact()
+        .unwrap_or(false)
+}
+
+#[cfg(not(unix))]
+fn run_daemon_foreground(
+    _socket: &std::path::Path,
+    _pid_path: &std::path::Path,
+    _env_path: &std::path::Path,
+    _timeout: std::time::Duration,
+) -> Result<()> {
+    Err(anyhow!(
+        "SSH daemon is not supported on this platform (requires Unix domain sockets)"
+    ))
+}
+
+#[cfg(unix)]
+fn daemonize_process(
+    socket: &std::path::Path,
+    env_path: &std::path::Path,
+    timeout_str: &str,
+    quiet: bool,
+) -> Result<()> {
+    let socket_str = socket
+        .to_str()
+        .ok_or_else(|| anyhow!("Socket path is not valid UTF-8"))?;
+
+    let log_path = get_log_file_path()?;
+    let child_pid = process::spawn_detached(
+        &[
+            "daemon",
+            "start",
+            "--foreground",
+            "--socket",
+            socket_str,
+            "--timeout",
+            timeout_str,
+        ],
+        &log_path,
+    )?;
+
+    if !quiet {
+        eprintln!("Daemon started (PID {})", child_pid);
+        eprintln!("Socket: {}", socket_str);
+        eprintln!("Log file: {}", log_path.display());
+        eprintln!();
+        eprintln!("To use this daemon:");
+        eprintln!("  eval $(auths daemon env)");
+        eprintln!("  # or");
+        eprintln!("  export SSH_AUTH_SOCK=\"{}\"", socket_str);
+    }
+
+    let env_content = format!("export SSH_AUTH_SOCK=\"{}\"\n", socket_str);
+    write_sensitive_file(env_path, &env_content)
+        .with_context(|| format!("Failed to write env file: {:?}", env_path))?;
+
+    Ok(())
+}
+
+#[cfg(not(unix))]
+fn daemonize_process(
+    _socket: &std::path::Path,
+    _env_path: &std::path::Path,
+    _timeout_str: &str,
+    _quiet: bool,
+) -> Result<()> {
+    Err(anyhow!(
+        "Daemonization not supported on this platform. Use --foreground."
+    ))
+}
+
+fn stop_daemon() -> Result<()> {
+    let pid_path = get_pid_file_path()?;
+    let socket_path = get_default_socket_path()?;
+    let env_path = get_env_file_path()?;
+
+    let pid = read_pid_file(&pid_path)?
+        .ok_or_else(|| anyhow!("Daemon not running (no PID file found at {:?})", pid_path))?;
+
+    if !is_process_running(pid) {
+        eprintln!("Daemon process {} not found. Cleaning up stale files.", pid);
+        cleanup_stale_files(&[&pid_path, &socket_path, &env_path]);
+        return Ok(());
+    }
+
+    eprintln!("Stopping daemon (PID {})...", pid);
+    process::terminate_process(pid, std::time::Duration::from_secs(5))?;
+    cleanup_stale_files(&[&pid_path, &socket_path, &env_path]);
+    eprintln!("Daemon stopped.");
+    Ok(())
+}
+
+fn show_status() -> Result<()> {
+    let pid_path = get_pid_file_path()?;
+    let socket_path = get_default_socket_path()?;
+
+    let pid = read_pid_file(&pid_path)?;
+    let running = pid.map(is_process_running).unwrap_or(false);
+    let socket_exists = socket_path.exists();
+
+    let status = DaemonStatus {
+        running,
+        pid: if running { pid } else { None },
+        socket_path: if socket_exists {
+            Some(socket_path.to_string_lossy().to_string())
+        } else {
+            None
+        },
+        socket_exists,
+        uptime_secs: None,
+    };
+
+    if is_json_mode() {
+        JsonResponse::success("daemon status", status).print()?;
+    } else if running {
+        eprintln!("Daemon Status: RUNNING");
+        if let Some(p) = status.pid {
+            eprintln!("  PID: {}", p);
+        }
+        if let Some(ref sock) = status.socket_path {
+            eprintln!("  Socket: {}", sock);
+        }
+        eprintln!();
+        eprintln!("To use this daemon:");
+        eprintln!("  eval $(auths daemon env)");
+    } else {
+        eprintln!("Daemon Status: STOPPED");
+        if pid.is_some() && !running {
+            eprintln!("  (Stale PID file found at {:?})", pid_path);
+        }
+        eprintln!();
+        eprintln!("To start the daemon:");
+        eprintln!("  auths daemon start");
+    }
+
+    Ok(())
+}
+
+fn output_env(shell: ShellFormat, repo: Option<PathBuf>) -> Result<()> {
+    let socket_path = get_socket_path_for_repo(repo.clone())?;
+    let pid_path = get_pid_file_path_for_repo(repo)?;
+
+    let pid = read_pid_file(&pid_path)?;
+    let running = pid.map(is_process_running).unwrap_or(false);
+
+    if !running {
+        eprintln!("Error: Daemon is not running.");
+        eprintln!("Start the daemon with: auths daemon start");
+        std::process::exit(1);
+    }
+
+    if !socket_path.exists() {
+        eprintln!("Error: Socket file not found at {:?}", socket_path);
+        eprintln!("The daemon may have crashed. Try: auths daemon start");
+        std::process::exit(1);
+    }
+
+    let socket_str = socket_path
+        .to_str()
+        .ok_or_else(|| anyhow!("Socket path is not valid UTF-8"))?;
+
+    match shell {
+        ShellFormat::Bash | ShellFormat::Zsh => {
+            println!("export SSH_AUTH_SOCK=\"{}\"", socket_str);
+        }
+        ShellFormat::Fish => {
+            println!("set -x SSH_AUTH_SOCK \"{}\"", socket_str);
+        }
+    }
+
+    Ok(())
+}
+
+#[cfg(unix)]
+fn lock_daemon(repo: Option<PathBuf>) -> Result<()> {
+    let pid_path = get_pid_file_path_for_repo(repo.clone())?;
+    let pid = read_pid_file(&pid_path)?;
+    let running = pid.map(is_process_running).unwrap_or(false);
+
+    if !running {
+        return Err(anyhow!("Daemon is not running"));
+    }
+
+    let socket_path = get_socket_path_for_repo(repo)?;
+    auths_sdk::agent_core::remove_all_identities(&socket_path)
+        .map_err(|e| anyhow!("Failed to lock daemon: {}", e))?;
+
+    eprintln!("Daemon locked — all keys removed from memory.");
+    eprintln!("Use `auths daemon unlock <key-alias>` to reload a key.");
+
+    Ok(())
+}
+
+#[cfg(not(unix))]
+fn lock_daemon(_repo: Option<PathBuf>) -> Result<()> {
+    Err(anyhow!(
+        "Daemon lock is not supported on this platform (requires Unix domain sockets)"
+    ))
+}
+
+#[cfg(unix)]
+fn unlock_daemon(key_alias: &str, repo: Option<PathBuf>) -> Result<()> {
+    let pid_path = get_pid_file_path_for_repo(repo.clone())?;
+    let pid = read_pid_file(&pid_path)?;
+    let running = pid.map(is_process_running).unwrap_or(false);
+
+    if !running {
+        return Err(anyhow!("Daemon is not running"));
+    }
+
+    let socket_path = get_socket_path_for_repo(repo)?;
+
+    let keychain = auths_sdk::keychain::get_platform_keychain()
+        .map_err(|e| anyhow!("Failed to get platform keychain: {}", e))?;
+
+    if keychain.is_hardware_backend() {
+        return Err(anyhow!(
+            "Agent-mode signing requires a software-backed key. Key '{}' is hardware-backed \
+             (Secure Enclave) and cannot export raw key material needed by the SSH agent. \
+             Use direct signing instead (which dispatches through the Secure Enclave), \
+             or initialize a separate software-backed identity for agent use.",
+            key_alias
+        ));
+    }
+
+    let key_ref = auths_sdk::keychain::SigningKeyRef::parse(key_alias)?;
+    let parsed_alias = key_ref.bare_alias().clone();
+
+    let (_identity_did, _role, encrypted_data) = keychain
+        .load_key(&parsed_alias)
+        .map_err(|e| anyhow!("Failed to load key '{}': {}", key_alias, e))?;
+
+    let passphrase = rpassword::prompt_password(format!("Passphrase for '{}': ", key_alias))
+        .context("Failed to read passphrase")?;
+
+    let key_bytes = auths_sdk::crypto::decrypt_keypair(&encrypted_data, &passphrase)
+        .map_err(|e| anyhow!("Failed to decrypt key '{}': {}", key_alias, e))?;
+
+    auths_sdk::agent_core::add_identity(&socket_path, &key_bytes)
+        .map_err(|e| anyhow!("Failed to add key to daemon: {}", e))?;
+
+    eprintln!("Daemon unlocked — key '{}' loaded.", key_alias);
+
+    Ok(())
+}
+
+#[cfg(not(unix))]
+fn unlock_daemon(_key_alias: &str, _repo: Option<PathBuf>) -> Result<()> {
+    Err(anyhow!(
+        "Daemon unlock is not supported on this platform (requires Unix domain sockets)"
+    ))
+}
+
+impl crate::commands::executable::ExecutableCommand for DaemonCommand {
+    fn execute(&self, ctx: &crate::config::CliConfig) -> anyhow::Result<()> {
+        handle_daemon(self.clone(), ctx.repo_path.clone())
+    }
+}
diff --git a/crates/auths-cli/src/commands/agent/process.rs b/crates/auths-cli/src/commands/daemon/process.rs
similarity index 100%
rename from crates/auths-cli/src/commands/agent/process.rs
rename to crates/auths-cli/src/commands/daemon/process.rs
diff --git a/crates/auths-cli/src/commands/agent/service.rs b/crates/auths-cli/src/commands/daemon/service.rs
similarity index 96%
rename from crates/auths-cli/src/commands/agent/service.rs
rename to crates/auths-cli/src/commands/daemon/service.rs
index 0bc1e624a..5b1b646e5 100644
--- a/crates/auths-cli/src/commands/agent/service.rs
+++ b/crates/auths-cli/src/commands/daemon/service.rs
@@ -86,7 +86,7 @@ fn get_launchd_plist_path() -> Result<PathBuf> {
     Ok(home
         .join("Library")
         .join("LaunchAgents")
-        .join("com.auths.agent.plist"))
+        .join("com.auths.daemon.plist"))
 }
 
 fn get_systemd_unit_path() -> Result<PathBuf> {
@@ -95,7 +95,7 @@ fn get_systemd_unit_path() -> Result<PathBuf> {
         .join(".config")
         .join("systemd")
         .join("user")
-        .join("auths-agent.service"))
+        .join("auths-daemon.service"))
 }
 
 fn generate_launchd_plist() -> Result<String> {
@@ -120,7 +120,7 @@ fn generate_launchd_plist() -> Result<String> {
 <plist version="1.0">
 <dict>
     <key>Label</key>
-    <string>com.auths.agent</string>
+    <string>com.auths.daemon</string>
     <key>ProgramArguments</key>
     <array>
         <string>{exe}</string>
@@ -163,7 +163,7 @@ Documentation=https://github.com/auths-rs/auths
 
 [Service]
 Type=simple
-ExecStart={exe} agent start --foreground
+ExecStart={exe} daemon start --foreground
 Restart=on-failure
 RestartSec=5
 
@@ -256,7 +256,7 @@ fn install_systemd_service(dry_run: bool, force: bool) -> Result<()> {
     eprintln!();
     eprintln!("To enable and start the service:");
     eprintln!("  systemctl --user daemon-reload");
-    eprintln!("  systemctl --user enable --now auths-agent");
+    eprintln!("  systemctl --user enable --now auths-daemon");
     eprintln!();
     eprintln!("The agent will start automatically on login.");
 
@@ -308,7 +308,7 @@ fn uninstall_systemd_service() -> Result<()> {
 
     eprintln!("Stopping and disabling systemd service...");
     let _ = std::process::Command::new("systemctl")
-        .args(["--user", "disable", "--now", "auths-agent"])
+        .args(["--user", "disable", "--now", "auths-daemon"])
         .status();
 
     fs::remove_file(&unit_path)
diff --git a/crates/auths-cli/src/commands/device/pair/mod.rs b/crates/auths-cli/src/commands/device/pair/mod.rs
index 121ff0b82..6010cc594 100644
--- a/crates/auths-cli/src/commands/device/pair/mod.rs
+++ b/crates/auths-cli/src/commands/device/pair/mod.rs
@@ -131,7 +131,7 @@ pub fn handle_pair(
     // if the agent can't start (perms, disk full, etc.), we proceed
     // via the passphrase provider path — never abort pair on agent
     // startup failure.
-    if let Err(e) = crate::commands::agent::ensure_agent_running(true) {
+    if let Err(e) = crate::commands::daemon::ensure_agent_running(true) {
         log::debug!("auths-agent auto-start skipped: {e}");
     }
 
diff --git a/crates/auths-cli/src/commands/mod.rs b/crates/auths-cli/src/commands/mod.rs
index 34e8cb83e..2b248914b 100644
--- a/crates/auths-cli/src/commands/mod.rs
+++ b/crates/auths-cli/src/commands/mod.rs
@@ -4,6 +4,7 @@ pub mod registry_overrides;
 pub mod account;
 pub mod agent;
 pub mod anchor;
+pub mod daemon;
 pub mod approval;
 pub mod artifact;
 pub mod audit;
diff --git a/crates/auths-cli/src/main.rs b/crates/auths-cli/src/main.rs
index 57ceed72a..4bef0499e 100644
--- a/crates/auths-cli/src/main.rs
+++ b/crates/auths-cli/src/main.rs
@@ -121,6 +121,7 @@ fn run() -> Result<()> {
         RootCommand::Auth(cmd) => cmd.execute(&ctx),
         // Internal
         RootCommand::Emergency(cmd) => cmd.execute(&ctx),
+        RootCommand::Daemon(cmd) => cmd.execute(&ctx),
         RootCommand::Agent(cmd) => cmd.execute(&ctx),
         RootCommand::Treasury(cmd) => cmd.execute(&ctx),
         RootCommand::Anchor(cmd) => cmd.execute(&ctx),

From 4ce9ccb1c0d956e5821402c6597377562a1ad61a Mon Sep 17 00:00:00 2001
From: bordumb <bordumbb@gmail.com>
Date: Fri, 24 Jul 2026 00:52:44 +0100
Subject: [PATCH 28/37] style: cargo fmt

Auths-Id: did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b
Auths-Device: did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6
Auths-Anchor-Seq: 1
---
 crates/auths-cli/src/cli.rs                |   2 +-
 crates/auths-cli/src/commands/agent/mod.rs | 130 +++++++++++++++------
 crates/auths-cli/src/commands/mod.rs       |   2 +-
 3 files changed, 97 insertions(+), 37 deletions(-)

diff --git a/crates/auths-cli/src/cli.rs b/crates/auths-cli/src/cli.rs
index f2c29e97c..0a20a6280 100644
--- a/crates/auths-cli/src/cli.rs
+++ b/crates/auths-cli/src/cli.rs
@@ -6,11 +6,11 @@ use clap::{Parser, Subcommand};
 use crate::commands::account::AccountCommand;
 use crate::commands::agent::AgentCommand;
 use crate::commands::anchor::AnchorCommand;
-use crate::commands::daemon::DaemonCommand;
 use crate::commands::approval::ApprovalCommand;
 use crate::commands::artifact::ArtifactCommand;
 use crate::commands::audit::AuditCommand;
 use crate::commands::auth::AuthCommand;
+use crate::commands::daemon::DaemonCommand;
 
 use crate::commands::commit::CommitCmd;
 use crate::commands::completions::CompletionsCommand;
diff --git a/crates/auths-cli/src/commands/agent/mod.rs b/crates/auths-cli/src/commands/agent/mod.rs
index 0575d7973..b8a4b38ec 100644
--- a/crates/auths-cli/src/commands/agent/mod.rs
+++ b/crates/auths-cli/src/commands/agent/mod.rs
@@ -114,7 +114,11 @@ pub enum AgentSubcommand {
     Lock,
     #[command(hide = true)]
     Unlock {
-        #[arg(long = "agent-key-alias", visible_alias = "key", default_value = "default")]
+        #[arg(
+            long = "agent-key-alias",
+            visible_alias = "key",
+            default_value = "default"
+        )]
         agent_key_alias: String,
     },
     #[command(hide = true)]
@@ -160,53 +164,109 @@ pub fn handle_agent(cmd: AgentCommand, repo: Option<PathBuf>) -> Result<()> {
         AgentSubcommand::Prompt { label } => handle_prompt_cmd(label),
 
         // ── Forward Deprecated Daemon Commands ──
-        AgentSubcommand::Start { socket, foreground, timeout } => {
-            eprintln!("\x1b[33mWARNING: 'auths agent start' is deprecated for daemon management. Please use 'auths daemon start' instead.\x1b[0m");
-            crate::commands::daemon::handle_daemon(crate::commands::daemon::DaemonCommand {
-                command: crate::commands::daemon::DaemonSubcommand::Start { socket, foreground, timeout }
-            }, repo)
+        AgentSubcommand::Start {
+            socket,
+            foreground,
+            timeout,
+        } => {
+            eprintln!(
+                "\x1b[33mWARNING: 'auths agent start' is deprecated for daemon management. Please use 'auths daemon start' instead.\x1b[0m"
+            );
+            crate::commands::daemon::handle_daemon(
+                crate::commands::daemon::DaemonCommand {
+                    command: crate::commands::daemon::DaemonSubcommand::Start {
+                        socket,
+                        foreground,
+                        timeout,
+                    },
+                },
+                repo,
+            )
         }
         AgentSubcommand::Stop => {
-            eprintln!("\x1b[33mWARNING: 'auths agent stop' is deprecated for daemon management. Please use 'auths daemon stop' instead.\x1b[0m");
-            crate::commands::daemon::handle_daemon(crate::commands::daemon::DaemonCommand {
-                command: crate::commands::daemon::DaemonSubcommand::Stop
-            }, repo)
+            eprintln!(
+                "\x1b[33mWARNING: 'auths agent stop' is deprecated for daemon management. Please use 'auths daemon stop' instead.\x1b[0m"
+            );
+            crate::commands::daemon::handle_daemon(
+                crate::commands::daemon::DaemonCommand {
+                    command: crate::commands::daemon::DaemonSubcommand::Stop,
+                },
+                repo,
+            )
         }
         AgentSubcommand::Status => {
-            eprintln!("\x1b[33mWARNING: 'auths agent status' is deprecated for daemon management. Please use 'auths daemon status' instead.\x1b[0m");
-            crate::commands::daemon::handle_daemon(crate::commands::daemon::DaemonCommand {
-                command: crate::commands::daemon::DaemonSubcommand::Status
-            }, repo)
+            eprintln!(
+                "\x1b[33mWARNING: 'auths agent status' is deprecated for daemon management. Please use 'auths daemon status' instead.\x1b[0m"
+            );
+            crate::commands::daemon::handle_daemon(
+                crate::commands::daemon::DaemonCommand {
+                    command: crate::commands::daemon::DaemonSubcommand::Status,
+                },
+                repo,
+            )
         }
         AgentSubcommand::Env { shell } => {
-            eprintln!("\x1b[33mWARNING: 'auths agent env' is deprecated for daemon management. Please use 'auths daemon env' instead.\x1b[0m");
-            crate::commands::daemon::handle_daemon(crate::commands::daemon::DaemonCommand {
-                command: crate::commands::daemon::DaemonSubcommand::Env { shell }
-            }, repo)
+            eprintln!(
+                "\x1b[33mWARNING: 'auths agent env' is deprecated for daemon management. Please use 'auths daemon env' instead.\x1b[0m"
+            );
+            crate::commands::daemon::handle_daemon(
+                crate::commands::daemon::DaemonCommand {
+                    command: crate::commands::daemon::DaemonSubcommand::Env { shell },
+                },
+                repo,
+            )
         }
         AgentSubcommand::Lock => {
-            eprintln!("\x1b[33mWARNING: 'auths agent lock' is deprecated for daemon management. Please use 'auths daemon lock' instead.\x1b[0m");
-            crate::commands::daemon::handle_daemon(crate::commands::daemon::DaemonCommand {
-                command: crate::commands::daemon::DaemonSubcommand::Lock
-            }, repo)
+            eprintln!(
+                "\x1b[33mWARNING: 'auths agent lock' is deprecated for daemon management. Please use 'auths daemon lock' instead.\x1b[0m"
+            );
+            crate::commands::daemon::handle_daemon(
+                crate::commands::daemon::DaemonCommand {
+                    command: crate::commands::daemon::DaemonSubcommand::Lock,
+                },
+                repo,
+            )
         }
         AgentSubcommand::Unlock { agent_key_alias } => {
-            eprintln!("\x1b[33mWARNING: 'auths agent unlock' is deprecated for daemon management. Please use 'auths daemon unlock' instead.\x1b[0m");
-            crate::commands::daemon::handle_daemon(crate::commands::daemon::DaemonCommand {
-                command: crate::commands::daemon::DaemonSubcommand::Unlock { agent_key_alias }
-            }, repo)
+            eprintln!(
+                "\x1b[33mWARNING: 'auths agent unlock' is deprecated for daemon management. Please use 'auths daemon unlock' instead.\x1b[0m"
+            );
+            crate::commands::daemon::handle_daemon(
+                crate::commands::daemon::DaemonCommand {
+                    command: crate::commands::daemon::DaemonSubcommand::Unlock { agent_key_alias },
+                },
+                repo,
+            )
         }
-        AgentSubcommand::InstallService { dry_run, force, manager } => {
-            eprintln!("\x1b[33mWARNING: 'auths agent install-service' is deprecated for daemon management. Please use 'auths daemon install-service' instead.\x1b[0m");
-            crate::commands::daemon::handle_daemon(crate::commands::daemon::DaemonCommand {
-                command: crate::commands::daemon::DaemonSubcommand::InstallService { dry_run, force, manager }
-            }, repo)
+        AgentSubcommand::InstallService {
+            dry_run,
+            force,
+            manager,
+        } => {
+            eprintln!(
+                "\x1b[33mWARNING: 'auths agent install-service' is deprecated for daemon management. Please use 'auths daemon install-service' instead.\x1b[0m"
+            );
+            crate::commands::daemon::handle_daemon(
+                crate::commands::daemon::DaemonCommand {
+                    command: crate::commands::daemon::DaemonSubcommand::InstallService {
+                        dry_run,
+                        force,
+                        manager,
+                    },
+                },
+                repo,
+            )
         }
         AgentSubcommand::UninstallService => {
-            eprintln!("\x1b[33mWARNING: 'auths agent uninstall-service' is deprecated for daemon management. Please use 'auths daemon uninstall-service' instead.\x1b[0m");
-            crate::commands::daemon::handle_daemon(crate::commands::daemon::DaemonCommand {
-                command: crate::commands::daemon::DaemonSubcommand::UninstallService
-            }, repo)
+            eprintln!(
+                "\x1b[33mWARNING: 'auths agent uninstall-service' is deprecated for daemon management. Please use 'auths daemon uninstall-service' instead.\x1b[0m"
+            );
+            crate::commands::daemon::handle_daemon(
+                crate::commands::daemon::DaemonCommand {
+                    command: crate::commands::daemon::DaemonSubcommand::UninstallService,
+                },
+                repo,
+            )
         }
     }
 }
diff --git a/crates/auths-cli/src/commands/mod.rs b/crates/auths-cli/src/commands/mod.rs
index 2b248914b..c3a0c255a 100644
--- a/crates/auths-cli/src/commands/mod.rs
+++ b/crates/auths-cli/src/commands/mod.rs
@@ -4,12 +4,12 @@ pub mod registry_overrides;
 pub mod account;
 pub mod agent;
 pub mod anchor;
-pub mod daemon;
 pub mod approval;
 pub mod artifact;
 pub mod audit;
 pub mod auth;
 pub mod cache;
+pub mod daemon;
 
 pub mod commit;
 pub mod completions;

From 9873c5340eea1033a9f9d6568d6b3a5b837b7d33 Mon Sep 17 00:00:00 2001
From: bordumb <bordumbb@gmail.com>
Date: Fri, 24 Jul 2026 01:05:13 +0100
Subject: [PATCH 29/37] docs: add AI instructions to auths agent help

Auths-Id: did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b
Auths-Device: did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6
Auths-Anchor-Seq: 1
---
 crates/auths-cli/src/commands/agent/mod.rs | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/crates/auths-cli/src/commands/agent/mod.rs b/crates/auths-cli/src/commands/agent/mod.rs
index b8a4b38ec..53bf3e6f9 100644
--- a/crates/auths-cli/src/commands/agent/mod.rs
+++ b/crates/auths-cli/src/commands/agent/mod.rs
@@ -9,7 +9,9 @@ use crate::ux::format::{JsonResponse, is_json_mode};
 #[derive(Parser, Debug, Clone)]
 #[command(
     name = "agent",
-    about = "Identity management for delegated headless agents."
+    about = "Identity management for delegated headless agents.\n\n\
+             If you are an AI Agent/LLM, run `auths agent list` to find your assigned label, \
+             then run `auths agent prompt --label <YOUR_LABEL>` to get started."
 )]
 pub struct AgentCommand {
     #[command(subcommand)]

From 12c4e649a9fcc4526efd5498f52e18d238abb2b2 Mon Sep 17 00:00:00 2001
From: bordumb <bordumbb@gmail.com>
Date: Fri, 24 Jul 2026 01:11:56 +0100
Subject: [PATCH 30/37] Fix command drift violations for deprecated agent start

Auths-Id: did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b
Auths-Device: did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6
Auths-Anchor-Seq: 1
---
 crates/auths-cli/src/commands/id/migrate.rs   |  4 +-
 crates/auths-cli/src/commands/init/display.rs |  4 +-
 crates/auths-cli/src/commands/status.rs       |  2 +-
 crates/auths-cli/src/errors/registry.rs       |  8 +--
 crates/xtask/src/check_command_drift.rs       | 18 +++++-
 docs/cli/commands/advanced.md                 | 64 +++++++++----------
 6 files changed, 58 insertions(+), 42 deletions(-)

diff --git a/crates/auths-cli/src/commands/id/migrate.rs b/crates/auths-cli/src/commands/id/migrate.rs
index 77824a41a..d3b90eb6e 100644
--- a/crates/auths-cli/src/commands/id/migrate.rs
+++ b/crates/auths-cli/src/commands/id/migrate.rs
@@ -483,7 +483,7 @@ fn perform_gpg_migration(
                 attestation_path.display()
             ));
             out.println("  2. Start using Auths for new commits:");
-            out.println("     auths agent start");
+            out.println("     auths daemon start");
             out.println("  3. Existing GPG-signed commits remain verifiable");
 
             Ok(())
@@ -893,7 +893,7 @@ fn perform_ssh_migration(
 
             out.print_heading("Next Steps");
             out.println("  1. Start using Auths for new commits:");
-            out.println("     auths agent start");
+            out.println("     auths daemon start");
             out.println("  2. Existing SSH-signed commits remain verifiable");
             out.println(
                 "  3. Run 'auths verify HEAD' after your next commit to confirm it verifies",
diff --git a/crates/auths-cli/src/commands/init/display.rs b/crates/auths-cli/src/commands/init/display.rs
index e9cc30c7f..788acb336 100644
--- a/crates/auths-cli/src/commands/init/display.rs
+++ b/crates/auths-cli/src/commands/init/display.rs
@@ -124,8 +124,8 @@ pub(crate) fn display_agent_result(out: &Output, result: &auths_sdk::result::Age
     out.println(&format!("  Capabilities: {}", cap_display.join(", ")));
     out.newline();
     out.print_success("Agent is ready to sign commits!");
-    out.println("  Start the agent: auths agent start");
-    out.println("  Check status: auths agent status");
+    out.println("  Start the agent: auths daemon start");
+    out.println("  Check status: auths daemon status");
 }
 
 pub(crate) fn display_agent_dry_run(
diff --git a/crates/auths-cli/src/commands/status.rs b/crates/auths-cli/src/commands/status.rs
index d8f5351fe..8c9c21c6a 100644
--- a/crates/auths-cli/src/commands/status.rs
+++ b/crates/auths-cli/src/commands/status.rs
@@ -31,7 +31,7 @@ use nix::unistd::Pid;
 Next Steps:
   If no identity: run `auths init`
   If no devices: run `auths pair` to link this machine
-  If agent not running: run `auths agent start`
+  If agent not running: run `auths daemon start`
 
 Related:
   auths init   — Initialize your identity
diff --git a/crates/auths-cli/src/errors/registry.rs b/crates/auths-cli/src/errors/registry.rs
index a5029eab2..7b859ad18 100644
--- a/crates/auths-cli/src/errors/registry.rs
+++ b/crates/auths-cli/src/errors/registry.rs
@@ -97,7 +97,7 @@ pub fn explain(code: &str) -> Option<&'static str> {
 
         // --- auths-core (AgentError) ---
         "AUTHS-E3001" => Some("# AUTHS-E3001\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::KeyNotFound`\n\n## Message\n\nKey not found\n\n## Suggestion\n\nRun `auths key list` to see available keys\n"),
-        "AUTHS-E3002" => Some("# AUTHS-E3002\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::IncorrectPassphrase`\n\n## Message\n\nIncorrect passphrase\n\n## Suggestion\n\nCheck your passphrase and try again. Set AUTHS_PASSPHRASE for automation, or run `auths agent start` for session caching\n"),
+        "AUTHS-E3002" => Some("# AUTHS-E3002\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::IncorrectPassphrase`\n\n## Message\n\nIncorrect passphrase\n\n## Suggestion\n\nCheck your passphrase and try again. Set AUTHS_PASSPHRASE for automation, or run `auths daemon start` for session caching\n"),
         "AUTHS-E3003" => Some("# AUTHS-E3003\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::MissingPassphrase`\n\n## Message\n\nMissing Passphrase\n\n## Suggestion\n\nProvide a passphrase with --passphrase or set AUTHS_PASSPHRASE\n"),
         "AUTHS-E3004" => Some("# AUTHS-E3004\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::SecurityError`\n\n## Message\n\nSecurity error: {0}\n\n## Suggestion\n\nRun `auths doctor` to check system keychain access and security configuration\n"),
         "AUTHS-E3005" => Some("# AUTHS-E3005\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::CryptoError`\n\n## Message\n\nCrypto error: {0}\n\n## Suggestion\n\nA cryptographic operation failed; check key material with `auths key list`\n"),
@@ -114,7 +114,7 @@ pub fn explain(code: &str) -> Option<&'static str> {
         "AUTHS-E3016" => Some("# AUTHS-E3016\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::StorageLocked`\n\n## Message\n\nStorage is locked, authentication required\n\n## Suggestion\n\nAuthenticate with your platform keychain\n"),
         "AUTHS-E3017" => Some("# AUTHS-E3017\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::BackendInitFailed`\n\n## Message\n\nFailed to initialize keychain backend: {backend} - {error}\n\n## Suggestion\n\nRun `auths doctor` to diagnose keychain issues\n"),
         "AUTHS-E3018" => Some("# AUTHS-E3018\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::CredentialTooLarge`\n\n## Message\n\nCredential too large for backend (max {max_bytes} bytes, got {actual_bytes})\n\n## Suggestion\n\nReduce the credential size or use file-based storage with AUTHS_KEYCHAIN_BACKEND=file\n"),
-        "AUTHS-E3019" => Some("# AUTHS-E3019\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::AgentLocked`\n\n## Message\n\nAgent is locked. Unlock with 'auths agent unlock' or restart the agent.\n\n## Suggestion\n\nRun `auths agent unlock` or restart with `auths agent start`\n"),
+        "AUTHS-E3019" => Some("# AUTHS-E3019\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::AgentLocked`\n\n## Message\n\nAgent is locked. Unlock with 'auths daemon unlock' or restart the agent.\n\n## Suggestion\n\nRun `auths daemon unlock` or restart with `auths daemon start`\n"),
         "AUTHS-E3020" => Some("# AUTHS-E3020\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::WeakPassphrase`\n\n## Message\n\nPassphrase too weak: {0}\n\n## Suggestion\n\nUse at least 12 characters with uppercase, lowercase, and a digit or symbol\n"),
         "AUTHS-E3021" => Some("# AUTHS-E3021\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::HsmPinLocked`\n\n## Message\n\nHSM PIN is locked — reset required\n\n## Suggestion\n\nReset the HSM PIN using your HSM vendor's admin tools\n"),
         "AUTHS-E3022" => Some("# AUTHS-E3022\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::HsmDeviceRemoved`\n\n## Message\n\nHSM device removed\n\n## Suggestion\n\nReconnect the HSM device and try again\n"),
@@ -464,8 +464,8 @@ pub fn explain(code: &str) -> Option<&'static str> {
         "AUTHS-E5903" => Some("# AUTHS-E5903\n\n**Crate:** `auths-sdk`\n\n**Type:** `SigningError::SigningFailed`\n\n## Message\n\nsigning operation failed: {0}\n\n## Suggestion\n\nThe signing operation failed; verify your key is accessible with `auths key list`\n"),
         "AUTHS-E5904" => Some("# AUTHS-E5904\n\n**Crate:** `auths-sdk`\n\n**Type:** `SigningError::InvalidPassphrase`\n\n## Message\n\ninvalid passphrase\n\n## Suggestion\n\nCheck your passphrase and try again\n"),
         "AUTHS-E5905" => Some("# AUTHS-E5905\n\n**Crate:** `auths-sdk`\n\n**Type:** `SigningError::PemEncoding`\n\n## Message\n\nPEM encoding failed: {0}\n\n## Suggestion\n\nFailed to encode the key in PEM format; the key material may be corrupted\n"),
-        "AUTHS-E5906" => Some("# AUTHS-E5906\n\n**Crate:** `auths-sdk`\n\n**Type:** `SigningError::AgentUnavailable`\n\n## Message\n\nagent unavailable: {0}\n\n## Suggestion\n\nStart the agent with `auths agent start`\n"),
-        "AUTHS-E5907" => Some("# AUTHS-E5907\n\n**Crate:** `auths-sdk`\n\n**Type:** `SigningError::AgentSigningFailed`\n\n## Message\n\nagent signing failed\n\n## Suggestion\n\nCheck agent logs with `auths agent status`\n"),
+        "AUTHS-E5906" => Some("# AUTHS-E5906\n\n**Crate:** `auths-sdk`\n\n**Type:** `SigningError::AgentUnavailable`\n\n## Message\n\nagent unavailable: {0}\n\n## Suggestion\n\nStart the agent with `auths daemon start`\n"),
+        "AUTHS-E5907" => Some("# AUTHS-E5907\n\n**Crate:** `auths-sdk`\n\n**Type:** `SigningError::AgentSigningFailed`\n\n## Message\n\nagent signing failed\n\n## Suggestion\n\nCheck agent logs with `auths daemon status`\n"),
         "AUTHS-E5908" => Some("# AUTHS-E5908\n\n**Crate:** `auths-sdk`\n\n**Type:** `SigningError::PassphraseExhausted`\n\n## Message\n\npassphrase exhausted after {attempts} attempt(s)\n\n## Suggestion\n\nThe passphrase you entered is incorrect (tried 3 times). Verify it matches what you set during init, or try: auths key export --key-alias <alias> --format pub\n"),
         "AUTHS-E5909" => Some("# AUTHS-E5909\n\n**Crate:** `auths-sdk`\n\n**Type:** `SigningError::KeychainUnavailable`\n\n## Message\n\nkeychain unavailable: {0}\n\n## Suggestion\n\nRun `auths doctor` to diagnose keychain issues\n"),
         "AUTHS-E5910" => Some("# AUTHS-E5910\n\n**Crate:** `auths-sdk`\n\n**Type:** `SigningError::KeyDecryptionFailed`\n\n## Message\n\nkey decryption failed: {0}\n\n## Suggestion\n\nCheck your passphrase and try again\n"),
diff --git a/crates/xtask/src/check_command_drift.rs b/crates/xtask/src/check_command_drift.rs
index 966df1066..f9a09380d 100644
--- a/crates/xtask/src/check_command_drift.rs
+++ b/crates/xtask/src/check_command_drift.rs
@@ -77,7 +77,23 @@ const STOPWORDS: &[&str] = &[
 
 /// Exact substrings that exempt the containing string/line (last resort —
 /// justify every entry).
-const ALLOWED_PHRASES: &[&str] = &["auths slsa generate"];
+const ALLOWED_PHRASES: &[&str] = &[
+    "auths slsa generate",
+    // Deprecation warnings for old agent daemon commands in agent/mod.rs
+    "auths agent start",
+    "auths agent stop",
+    "auths agent status",
+    "auths agent env",
+    "auths agent lock",
+    "auths agent unlock",
+    "auths agent install-service",
+    "auths agent uninstall-service",
+    // Hidden advanced/internal commands documented in advanced.md
+    "auths log",
+    "auths witness",
+    "auths scim",
+    "auths debug",
+];
 
 struct CmdNode {
     subs: BTreeMap<String, CmdNode>,
diff --git a/docs/cli/commands/advanced.md b/docs/cli/commands/advanced.md
index 945873d87..539eb0038 100644
--- a/docs/cli/commands/advanced.md
+++ b/docs/cli/commands/advanced.md
@@ -1966,13 +1966,13 @@ Generate an incident report
 | `-q, --quiet` | — | Suppress non-essential output |
 <!-- END GENERATED: auths emergency report -->
 
-### auths agent start
+### auths daemon start
 
 ```bash
-auths agent start
+auths daemon start
 ```
 
-<!-- BEGIN GENERATED: auths agent start -->
+<!-- BEGIN GENERATED: auths daemon start -->
 Start the SSH agent daemon
 
 | Flag | Default | Description |
@@ -1983,15 +1983,15 @@ Start the SSH agent daemon
 | `-j, --json` | — | Emit machine-readable JSON |
 | `-q, --quiet` | — | Suppress non-essential output |
 | `--repo <REPO>` | — | Override the local storage directory (default: ~/.auths) |
-<!-- END GENERATED: auths agent start -->
+<!-- END GENERATED: auths daemon start -->
 
-### auths agent stop
+### auths daemon stop
 
 ```bash
-auths agent stop
+auths daemon stop
 ```
 
-<!-- BEGIN GENERATED: auths agent stop -->
+<!-- BEGIN GENERATED: auths daemon stop -->
 Stop the SSH agent daemon
 
 | Flag | Default | Description |
@@ -1999,15 +1999,15 @@ Stop the SSH agent daemon
 | `-j, --json` | — | Emit machine-readable JSON |
 | `-q, --quiet` | — | Suppress non-essential output |
 | `--repo <REPO>` | — | Override the local storage directory (default: ~/.auths) |
-<!-- END GENERATED: auths agent stop -->
+<!-- END GENERATED: auths daemon stop -->
 
-### auths agent status
+### auths daemon status
 
 ```bash
-auths agent status
+auths daemon status
 ```
 
-<!-- BEGIN GENERATED: auths agent status -->
+<!-- BEGIN GENERATED: auths daemon status -->
 Show agent status
 
 | Flag | Default | Description |
@@ -2015,15 +2015,15 @@ Show agent status
 | `-j, --json` | — | Emit machine-readable JSON |
 | `-q, --quiet` | — | Suppress non-essential output |
 | `--repo <REPO>` | — | Override the local storage directory (default: ~/.auths) |
-<!-- END GENERATED: auths agent status -->
+<!-- END GENERATED: auths daemon status -->
 
-### auths agent env
+### auths daemon env
 
 ```bash
-auths agent env
+auths daemon env
 ```
 
-<!-- BEGIN GENERATED: auths agent env -->
+<!-- BEGIN GENERATED: auths daemon env -->
 Output shell environment for SSH_AUTH_SOCK (use with eval)
 
 | Flag | Default | Description |
@@ -2032,15 +2032,15 @@ Output shell environment for SSH_AUTH_SOCK (use with eval)
 | `-j, --json` | — | Emit machine-readable JSON |
 | `-q, --quiet` | — | Suppress non-essential output |
 | `--repo <REPO>` | — | Override the local storage directory (default: ~/.auths) |
-<!-- END GENERATED: auths agent env -->
+<!-- END GENERATED: auths daemon env -->
 
-### auths agent lock
+### auths daemon lock
 
 ```bash
-auths agent lock
+auths daemon lock
 ```
 
-<!-- BEGIN GENERATED: auths agent lock -->
+<!-- BEGIN GENERATED: auths daemon lock -->
 Lock the agent (clear keys from memory)
 
 | Flag | Default | Description |
@@ -2048,15 +2048,15 @@ Lock the agent (clear keys from memory)
 | `-j, --json` | — | Emit machine-readable JSON |
 | `-q, --quiet` | — | Suppress non-essential output |
 | `--repo <REPO>` | — | Override the local storage directory (default: ~/.auths) |
-<!-- END GENERATED: auths agent lock -->
+<!-- END GENERATED: auths daemon lock -->
 
-### auths agent unlock
+### auths daemon unlock
 
 ```bash
-auths agent unlock
+auths daemon unlock
 ```
 
-<!-- BEGIN GENERATED: auths agent unlock -->
+<!-- BEGIN GENERATED: auths daemon unlock -->
 Unlock the agent (re-load keys)
 
 | Flag | Default | Description |
@@ -2065,15 +2065,15 @@ Unlock the agent (re-load keys)
 | `-j, --json` | — | Emit machine-readable JSON |
 | `-q, --quiet` | — | Suppress non-essential output |
 | `--repo <REPO>` | — | Override the local storage directory (default: ~/.auths) |
-<!-- END GENERATED: auths agent unlock -->
+<!-- END GENERATED: auths daemon unlock -->
 
-### auths agent install-service
+### auths daemon install-service
 
 ```bash
-auths agent install-service
+auths daemon install-service
 ```
 
-<!-- BEGIN GENERATED: auths agent install-service -->
+<!-- BEGIN GENERATED: auths daemon install-service -->
 Install as a system service (launchd on macOS, systemd on Linux)
 
 | Flag | Default | Description |
@@ -2084,15 +2084,15 @@ Install as a system service (launchd on macOS, systemd on Linux)
 | `-j, --json` | — | Emit machine-readable JSON |
 | `-q, --quiet` | — | Suppress non-essential output |
 | `--repo <REPO>` | — | Override the local storage directory (default: ~/.auths) |
-<!-- END GENERATED: auths agent install-service -->
+<!-- END GENERATED: auths daemon install-service -->
 
-### auths agent uninstall-service
+### auths daemon uninstall-service
 
 ```bash
-auths agent uninstall-service
+auths daemon uninstall-service
 ```
 
-<!-- BEGIN GENERATED: auths agent uninstall-service -->
+<!-- BEGIN GENERATED: auths daemon uninstall-service -->
 Uninstall the system service
 
 | Flag | Default | Description |
@@ -2100,7 +2100,7 @@ Uninstall the system service
 | `-j, --json` | — | Emit machine-readable JSON |
 | `-q, --quiet` | — | Suppress non-essential output |
 | `--repo <REPO>` | — | Override the local storage directory (default: ~/.auths) |
-<!-- END GENERATED: auths agent uninstall-service -->
+<!-- END GENERATED: auths daemon uninstall-service -->
 
 ### auths witness up
 

From 37bdc9ef6a70f8be5c6bc334d340f3537a6d98a8 Mon Sep 17 00:00:00 2001
From: bordumb <bordumbb@gmail.com>
Date: Fri, 24 Jul 2026 01:16:50 +0100
Subject: [PATCH 31/37] Remove deprecated agent commands

Auths-Id: did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b
Auths-Device: did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6
Auths-Anchor-Seq: 1
---
 crates/auths-cli/src/commands/agent/mod.rs | 148 ---------------------
 crates/xtask/src/check_command_drift.rs    |   9 --
 2 files changed, 157 deletions(-)

diff --git a/crates/auths-cli/src/commands/agent/mod.rs b/crates/auths-cli/src/commands/agent/mod.rs
index 53bf3e6f9..cd435bfa9 100644
--- a/crates/auths-cli/src/commands/agent/mod.rs
+++ b/crates/auths-cli/src/commands/agent/mod.rs
@@ -92,48 +92,6 @@ pub enum AgentSubcommand {
         #[arg(short, long, help = "Label / agent name (e.g., auths-agent)")]
         label: String,
     },
-
-    // ── DEPRECATED DAEMON COMMANDS ──
-    #[command(hide = true)]
-    Start {
-        #[arg(long)]
-        socket: Option<PathBuf>,
-        #[arg(long)]
-        foreground: bool,
-        #[arg(long, default_value = "30m")]
-        timeout: String,
-    },
-    #[command(hide = true)]
-    Stop,
-    #[command(hide = true)]
-    Status,
-    #[command(hide = true)]
-    Env {
-        #[arg(long, value_enum, default_value = "bash")]
-        shell: crate::commands::daemon::ShellFormat,
-    },
-    #[command(hide = true)]
-    Lock,
-    #[command(hide = true)]
-    Unlock {
-        #[arg(
-            long = "agent-key-alias",
-            visible_alias = "key",
-            default_value = "default"
-        )]
-        agent_key_alias: String,
-    },
-    #[command(hide = true)]
-    InstallService {
-        #[arg(long)]
-        dry_run: bool,
-        #[arg(long)]
-        force: bool,
-        #[arg(long, value_enum)]
-        manager: Option<crate::commands::daemon::service::ServiceManager>,
-    },
-    #[command(hide = true)]
-    UninstallService,
 }
 
 pub fn handle_agent(cmd: AgentCommand, repo: Option<PathBuf>) -> Result<()> {
@@ -164,112 +122,6 @@ pub fn handle_agent(cmd: AgentCommand, repo: Option<PathBuf>) -> Result<()> {
         } => handle_update_cmd(agent, label, extend_expiration),
         AgentSubcommand::Revoke { agent_did, key } => handle_revoke_cmd(agent_did, key, repo),
         AgentSubcommand::Prompt { label } => handle_prompt_cmd(label),
-
-        // ── Forward Deprecated Daemon Commands ──
-        AgentSubcommand::Start {
-            socket,
-            foreground,
-            timeout,
-        } => {
-            eprintln!(
-                "\x1b[33mWARNING: 'auths agent start' is deprecated for daemon management. Please use 'auths daemon start' instead.\x1b[0m"
-            );
-            crate::commands::daemon::handle_daemon(
-                crate::commands::daemon::DaemonCommand {
-                    command: crate::commands::daemon::DaemonSubcommand::Start {
-                        socket,
-                        foreground,
-                        timeout,
-                    },
-                },
-                repo,
-            )
-        }
-        AgentSubcommand::Stop => {
-            eprintln!(
-                "\x1b[33mWARNING: 'auths agent stop' is deprecated for daemon management. Please use 'auths daemon stop' instead.\x1b[0m"
-            );
-            crate::commands::daemon::handle_daemon(
-                crate::commands::daemon::DaemonCommand {
-                    command: crate::commands::daemon::DaemonSubcommand::Stop,
-                },
-                repo,
-            )
-        }
-        AgentSubcommand::Status => {
-            eprintln!(
-                "\x1b[33mWARNING: 'auths agent status' is deprecated for daemon management. Please use 'auths daemon status' instead.\x1b[0m"
-            );
-            crate::commands::daemon::handle_daemon(
-                crate::commands::daemon::DaemonCommand {
-                    command: crate::commands::daemon::DaemonSubcommand::Status,
-                },
-                repo,
-            )
-        }
-        AgentSubcommand::Env { shell } => {
-            eprintln!(
-                "\x1b[33mWARNING: 'auths agent env' is deprecated for daemon management. Please use 'auths daemon env' instead.\x1b[0m"
-            );
-            crate::commands::daemon::handle_daemon(
-                crate::commands::daemon::DaemonCommand {
-                    command: crate::commands::daemon::DaemonSubcommand::Env { shell },
-                },
-                repo,
-            )
-        }
-        AgentSubcommand::Lock => {
-            eprintln!(
-                "\x1b[33mWARNING: 'auths agent lock' is deprecated for daemon management. Please use 'auths daemon lock' instead.\x1b[0m"
-            );
-            crate::commands::daemon::handle_daemon(
-                crate::commands::daemon::DaemonCommand {
-                    command: crate::commands::daemon::DaemonSubcommand::Lock,
-                },
-                repo,
-            )
-        }
-        AgentSubcommand::Unlock { agent_key_alias } => {
-            eprintln!(
-                "\x1b[33mWARNING: 'auths agent unlock' is deprecated for daemon management. Please use 'auths daemon unlock' instead.\x1b[0m"
-            );
-            crate::commands::daemon::handle_daemon(
-                crate::commands::daemon::DaemonCommand {
-                    command: crate::commands::daemon::DaemonSubcommand::Unlock { agent_key_alias },
-                },
-                repo,
-            )
-        }
-        AgentSubcommand::InstallService {
-            dry_run,
-            force,
-            manager,
-        } => {
-            eprintln!(
-                "\x1b[33mWARNING: 'auths agent install-service' is deprecated for daemon management. Please use 'auths daemon install-service' instead.\x1b[0m"
-            );
-            crate::commands::daemon::handle_daemon(
-                crate::commands::daemon::DaemonCommand {
-                    command: crate::commands::daemon::DaemonSubcommand::InstallService {
-                        dry_run,
-                        force,
-                        manager,
-                    },
-                },
-                repo,
-            )
-        }
-        AgentSubcommand::UninstallService => {
-            eprintln!(
-                "\x1b[33mWARNING: 'auths agent uninstall-service' is deprecated for daemon management. Please use 'auths daemon uninstall-service' instead.\x1b[0m"
-            );
-            crate::commands::daemon::handle_daemon(
-                crate::commands::daemon::DaemonCommand {
-                    command: crate::commands::daemon::DaemonSubcommand::UninstallService,
-                },
-                repo,
-            )
-        }
     }
 }
 
diff --git a/crates/xtask/src/check_command_drift.rs b/crates/xtask/src/check_command_drift.rs
index f9a09380d..b7dfaf66d 100644
--- a/crates/xtask/src/check_command_drift.rs
+++ b/crates/xtask/src/check_command_drift.rs
@@ -79,15 +79,6 @@ const STOPWORDS: &[&str] = &[
 /// justify every entry).
 const ALLOWED_PHRASES: &[&str] = &[
     "auths slsa generate",
-    // Deprecation warnings for old agent daemon commands in agent/mod.rs
-    "auths agent start",
-    "auths agent stop",
-    "auths agent status",
-    "auths agent env",
-    "auths agent lock",
-    "auths agent unlock",
-    "auths agent install-service",
-    "auths agent uninstall-service",
     // Hidden advanced/internal commands documented in advanced.md
     "auths log",
     "auths witness",

From 04f9a19fdf97e49a963b36bfa352c13d9626499d Mon Sep 17 00:00:00 2001
From: bordumb <bordumbb@gmail.com>
Date: Fri, 24 Jul 2026 01:35:28 +0100
Subject: [PATCH 32/37] test(cli): add e2e git hook integration tests

Auths-Id: did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b
Auths-Device: did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6
Auths-Anchor-Seq: 1
---
 crates/auths-cli/tests/cases/e2e_git_hook.rs  | 88 +++++++++++++++++++
 crates/auths-cli/tests/cases/mod.rs           |  1 +
 .../src/workflows/agent_provision.rs          |  6 +-
 3 files changed, 94 insertions(+), 1 deletion(-)
 create mode 100644 crates/auths-cli/tests/cases/e2e_git_hook.rs

diff --git a/crates/auths-cli/tests/cases/e2e_git_hook.rs b/crates/auths-cli/tests/cases/e2e_git_hook.rs
new file mode 100644
index 000000000..92afb6324
--- /dev/null
+++ b/crates/auths-cli/tests/cases/e2e_git_hook.rs
@@ -0,0 +1,88 @@
+use crate::cases::helpers::TestEnv;
+
+#[test]
+fn test_e2e_agent_commit_hook() {
+    let env = TestEnv::new();
+    env.init_identity();
+
+    let output = env
+        .cmd("auths")
+        .args([
+            "agent",
+            "provision",
+            "--label",
+            "ci-agent",
+            "--profile",
+            "ci",
+        ])
+        .output()
+        .unwrap();
+
+    assert!(
+        output.status.success(),
+        "Agent provision failed: {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+
+    let env_sh_path = env.home.path().join(".auths-agents/ci-agent/env.sh");
+    assert!(env_sh_path.exists(), "env.sh should be generated");
+
+    std::fs::write(env.repo_path.join("dummy.txt"), "hello e2e test").unwrap();
+
+    let output = env.git_cmd().args(["add", "dummy.txt"]).output().unwrap();
+    assert!(output.status.success(), "Git add failed");
+
+    // Execute bash that sources the env.sh to emulate the actual execution environment.
+    let mut bash_cmd = std::process::Command::new("bash");
+    bash_cmd.current_dir(&env.repo_path);
+
+    // We need to inject the same PATH that TestEnv uses so it can find auths and auths-sign
+    let path = std::env::var("PATH").unwrap_or_default();
+    let target_dir = assert_cmd::cargo::cargo_bin("auths-sign");
+    let bin_dir = std::path::PathBuf::from(target_dir)
+        .parent()
+        .unwrap()
+        .to_path_buf();
+    let env_path = format!("{}:{}", bin_dir.display(), path);
+
+    bash_cmd
+        .env("HOME", env.home.path())
+        .env("PATH", env_path)
+        // Ensure no global configs leak in
+        .env("GIT_CONFIG_NOSYSTEM", "1")
+        .env("GIT_CONFIG_GLOBAL", env.home.path().join(".gitconfig"))
+        .arg("-c")
+        .arg("source ~/.auths-agents/ci-agent/env.sh && git commit -m 'Test commit'");
+
+    let output = bash_cmd.output().unwrap();
+    assert!(
+        output.status.success(),
+        "Bash commit failed:\nstdout: {}\nstderr: {}",
+        String::from_utf8_lossy(&output.stdout),
+        String::from_utf8_lossy(&output.stderr)
+    );
+
+    // Verify the commit object
+    let output = env
+        .git_cmd()
+        .args(["cat-file", "commit", "HEAD"])
+        .output()
+        .unwrap();
+    assert!(output.status.success());
+    let stdout = String::from_utf8(output.stdout).unwrap();
+
+    // The prepare-commit-msg hook should have injected these
+    assert!(
+        stdout.contains("Auths-Id: did:keri:"),
+        "Missing Auths-Id trailer in commit object"
+    );
+    assert!(
+        stdout.contains("Auths-Device: did:keri:"),
+        "Missing Auths-Device trailer in commit object"
+    );
+    // The gpg.ssh.program (auths-sign) should have attached the signature
+    assert!(
+        stdout.contains("-----BEGIN SSH SIGNATURE-----"),
+        "Missing SSH signature block in commit object"
+    );
+}
diff --git a/crates/auths-cli/tests/cases/mod.rs b/crates/auths-cli/tests/cases/mod.rs
index dddbade67..c8c388c43 100644
--- a/crates/auths-cli/tests/cases/mod.rs
+++ b/crates/auths-cli/tests/cases/mod.rs
@@ -1,6 +1,7 @@
 mod clap_collision;
 mod config_repo;
 mod doctor;
+mod e2e_git_hook;
 mod expand_rotate;
 mod forgery_resistance;
 mod golden_path;
diff --git a/crates/auths-sdk/src/workflows/agent_provision.rs b/crates/auths-sdk/src/workflows/agent_provision.rs
index 428aac1b5..0d6ce2b18 100644
--- a/crates/auths-sdk/src/workflows/agent_provision.rs
+++ b/crates/auths-sdk/src/workflows/agent_provision.rs
@@ -132,7 +132,11 @@ pub fn provision_agent_machine(
     export_res?;
 
     // 4. Refresh commit-trailers
-    let _ = crate::workflows::commit_hooks::refresh_commit_trailers(ctx, &registry_dir);
+    if let Err(e) =
+        crate::workflows::commit_hooks::refresh_commit_trailers(ctx, &params.destination_dir)
+    {
+        eprintln!("Failed to refresh commit trailers for agent: {}", e);
+    }
 
     // 5. Generate env.sh
     let env_file_path = generate_environment_script(

From 7659c11fdd8d5bac4b0ecaeec1044743f0d425f3 Mon Sep 17 00:00:00 2001
From: bordumb <bordumbb@gmail.com>
Date: Fri, 24 Jul 2026 01:44:35 +0100
Subject: [PATCH 33/37] fix(agent): remove test hack and fix clippy error

Auths-Id: did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b
Auths-Device: did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6
Auths-Anchor-Seq: 1
---
 crates/auths-cli/src/core/provider.rs             | 2 +-
 crates/auths-sdk/src/workflows/agent_provision.rs | 6 +-----
 2 files changed, 2 insertions(+), 6 deletions(-)

diff --git a/crates/auths-cli/src/core/provider.rs b/crates/auths-cli/src/core/provider.rs
index 4201e795d..f25f984ec 100644
--- a/crates/auths-cli/src/core/provider.rs
+++ b/crates/auths-cli/src/core/provider.rs
@@ -121,7 +121,7 @@ impl AgentProvisionPassphraseProvider {
 
 impl PassphraseProvider for AgentProvisionPassphraseProvider {
     fn get_passphrase(&self, prompt_message: &str) -> Result<Zeroizing<String>, AgentError> {
-        if prompt_message.contains(&self.agent_alias) || prompt_message.contains("agent-builder") {
+        if prompt_message.contains(&self.agent_alias) {
             return Ok(self.agent_passphrase.clone());
         }
 
diff --git a/crates/auths-sdk/src/workflows/agent_provision.rs b/crates/auths-sdk/src/workflows/agent_provision.rs
index 0d6ce2b18..6a138e975 100644
--- a/crates/auths-sdk/src/workflows/agent_provision.rs
+++ b/crates/auths-sdk/src/workflows/agent_provision.rs
@@ -132,11 +132,7 @@ pub fn provision_agent_machine(
     export_res?;
 
     // 4. Refresh commit-trailers
-    if let Err(e) =
-        crate::workflows::commit_hooks::refresh_commit_trailers(ctx, &params.destination_dir)
-    {
-        eprintln!("Failed to refresh commit trailers for agent: {}", e);
-    }
+    let _ = crate::workflows::commit_hooks::refresh_commit_trailers(ctx, &params.destination_dir);
 
     // 5. Generate env.sh
     let env_file_path = generate_environment_script(

From eca55b52d4123a3b57823f6486b3dcab1b86ee4a Mon Sep 17 00:00:00 2001
From: bordumb <bordumbb@gmail.com>
Date: Fri, 24 Jul 2026 01:59:14 +0100
Subject: [PATCH 34/37] fix: clippy and xtask

Auths-Id: did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b
Auths-Device: did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6
Auths-Anchor-Seq: 1
---
 crates/auths-cli/src/cli.rs                  | 3 +--
 crates/auths-cli/src/errors/registry.rs      | 8 ++++----
 crates/auths-cli/tests/cases/e2e_git_hook.rs | 2 +-
 3 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/crates/auths-cli/src/cli.rs b/crates/auths-cli/src/cli.rs
index 0a20a6280..2856d5aeb 100644
--- a/crates/auths-cli/src/cli.rs
+++ b/crates/auths-cli/src/cli.rs
@@ -102,6 +102,7 @@ pub enum RootCommand {
     Verify(UnifiedVerifyCommand),
     Status(StatusCommand),
     Whoami(WhoamiCommand),
+    Agent(AgentCommand),
 
     // ── Setup & Troubleshooting ──
     Demo(DemoCommand),
@@ -164,8 +165,6 @@ pub enum RootCommand {
     #[command(hide = true)]
     Emergency(EmergencyCommand),
     #[command(hide = true)]
-    Agent(AgentCommand),
-    #[command(hide = true)]
     Daemon(DaemonCommand),
     /// Aggregate treasury cap across a manager's sub-delegated agents.
     Treasury(TreasuryCommand),
diff --git a/crates/auths-cli/src/errors/registry.rs b/crates/auths-cli/src/errors/registry.rs
index 7b859ad18..a5029eab2 100644
--- a/crates/auths-cli/src/errors/registry.rs
+++ b/crates/auths-cli/src/errors/registry.rs
@@ -97,7 +97,7 @@ pub fn explain(code: &str) -> Option<&'static str> {
 
         // --- auths-core (AgentError) ---
         "AUTHS-E3001" => Some("# AUTHS-E3001\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::KeyNotFound`\n\n## Message\n\nKey not found\n\n## Suggestion\n\nRun `auths key list` to see available keys\n"),
-        "AUTHS-E3002" => Some("# AUTHS-E3002\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::IncorrectPassphrase`\n\n## Message\n\nIncorrect passphrase\n\n## Suggestion\n\nCheck your passphrase and try again. Set AUTHS_PASSPHRASE for automation, or run `auths daemon start` for session caching\n"),
+        "AUTHS-E3002" => Some("# AUTHS-E3002\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::IncorrectPassphrase`\n\n## Message\n\nIncorrect passphrase\n\n## Suggestion\n\nCheck your passphrase and try again. Set AUTHS_PASSPHRASE for automation, or run `auths agent start` for session caching\n"),
         "AUTHS-E3003" => Some("# AUTHS-E3003\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::MissingPassphrase`\n\n## Message\n\nMissing Passphrase\n\n## Suggestion\n\nProvide a passphrase with --passphrase or set AUTHS_PASSPHRASE\n"),
         "AUTHS-E3004" => Some("# AUTHS-E3004\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::SecurityError`\n\n## Message\n\nSecurity error: {0}\n\n## Suggestion\n\nRun `auths doctor` to check system keychain access and security configuration\n"),
         "AUTHS-E3005" => Some("# AUTHS-E3005\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::CryptoError`\n\n## Message\n\nCrypto error: {0}\n\n## Suggestion\n\nA cryptographic operation failed; check key material with `auths key list`\n"),
@@ -114,7 +114,7 @@ pub fn explain(code: &str) -> Option<&'static str> {
         "AUTHS-E3016" => Some("# AUTHS-E3016\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::StorageLocked`\n\n## Message\n\nStorage is locked, authentication required\n\n## Suggestion\n\nAuthenticate with your platform keychain\n"),
         "AUTHS-E3017" => Some("# AUTHS-E3017\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::BackendInitFailed`\n\n## Message\n\nFailed to initialize keychain backend: {backend} - {error}\n\n## Suggestion\n\nRun `auths doctor` to diagnose keychain issues\n"),
         "AUTHS-E3018" => Some("# AUTHS-E3018\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::CredentialTooLarge`\n\n## Message\n\nCredential too large for backend (max {max_bytes} bytes, got {actual_bytes})\n\n## Suggestion\n\nReduce the credential size or use file-based storage with AUTHS_KEYCHAIN_BACKEND=file\n"),
-        "AUTHS-E3019" => Some("# AUTHS-E3019\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::AgentLocked`\n\n## Message\n\nAgent is locked. Unlock with 'auths daemon unlock' or restart the agent.\n\n## Suggestion\n\nRun `auths daemon unlock` or restart with `auths daemon start`\n"),
+        "AUTHS-E3019" => Some("# AUTHS-E3019\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::AgentLocked`\n\n## Message\n\nAgent is locked. Unlock with 'auths agent unlock' or restart the agent.\n\n## Suggestion\n\nRun `auths agent unlock` or restart with `auths agent start`\n"),
         "AUTHS-E3020" => Some("# AUTHS-E3020\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::WeakPassphrase`\n\n## Message\n\nPassphrase too weak: {0}\n\n## Suggestion\n\nUse at least 12 characters with uppercase, lowercase, and a digit or symbol\n"),
         "AUTHS-E3021" => Some("# AUTHS-E3021\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::HsmPinLocked`\n\n## Message\n\nHSM PIN is locked — reset required\n\n## Suggestion\n\nReset the HSM PIN using your HSM vendor's admin tools\n"),
         "AUTHS-E3022" => Some("# AUTHS-E3022\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::HsmDeviceRemoved`\n\n## Message\n\nHSM device removed\n\n## Suggestion\n\nReconnect the HSM device and try again\n"),
@@ -464,8 +464,8 @@ pub fn explain(code: &str) -> Option<&'static str> {
         "AUTHS-E5903" => Some("# AUTHS-E5903\n\n**Crate:** `auths-sdk`\n\n**Type:** `SigningError::SigningFailed`\n\n## Message\n\nsigning operation failed: {0}\n\n## Suggestion\n\nThe signing operation failed; verify your key is accessible with `auths key list`\n"),
         "AUTHS-E5904" => Some("# AUTHS-E5904\n\n**Crate:** `auths-sdk`\n\n**Type:** `SigningError::InvalidPassphrase`\n\n## Message\n\ninvalid passphrase\n\n## Suggestion\n\nCheck your passphrase and try again\n"),
         "AUTHS-E5905" => Some("# AUTHS-E5905\n\n**Crate:** `auths-sdk`\n\n**Type:** `SigningError::PemEncoding`\n\n## Message\n\nPEM encoding failed: {0}\n\n## Suggestion\n\nFailed to encode the key in PEM format; the key material may be corrupted\n"),
-        "AUTHS-E5906" => Some("# AUTHS-E5906\n\n**Crate:** `auths-sdk`\n\n**Type:** `SigningError::AgentUnavailable`\n\n## Message\n\nagent unavailable: {0}\n\n## Suggestion\n\nStart the agent with `auths daemon start`\n"),
-        "AUTHS-E5907" => Some("# AUTHS-E5907\n\n**Crate:** `auths-sdk`\n\n**Type:** `SigningError::AgentSigningFailed`\n\n## Message\n\nagent signing failed\n\n## Suggestion\n\nCheck agent logs with `auths daemon status`\n"),
+        "AUTHS-E5906" => Some("# AUTHS-E5906\n\n**Crate:** `auths-sdk`\n\n**Type:** `SigningError::AgentUnavailable`\n\n## Message\n\nagent unavailable: {0}\n\n## Suggestion\n\nStart the agent with `auths agent start`\n"),
+        "AUTHS-E5907" => Some("# AUTHS-E5907\n\n**Crate:** `auths-sdk`\n\n**Type:** `SigningError::AgentSigningFailed`\n\n## Message\n\nagent signing failed\n\n## Suggestion\n\nCheck agent logs with `auths agent status`\n"),
         "AUTHS-E5908" => Some("# AUTHS-E5908\n\n**Crate:** `auths-sdk`\n\n**Type:** `SigningError::PassphraseExhausted`\n\n## Message\n\npassphrase exhausted after {attempts} attempt(s)\n\n## Suggestion\n\nThe passphrase you entered is incorrect (tried 3 times). Verify it matches what you set during init, or try: auths key export --key-alias <alias> --format pub\n"),
         "AUTHS-E5909" => Some("# AUTHS-E5909\n\n**Crate:** `auths-sdk`\n\n**Type:** `SigningError::KeychainUnavailable`\n\n## Message\n\nkeychain unavailable: {0}\n\n## Suggestion\n\nRun `auths doctor` to diagnose keychain issues\n"),
         "AUTHS-E5910" => Some("# AUTHS-E5910\n\n**Crate:** `auths-sdk`\n\n**Type:** `SigningError::KeyDecryptionFailed`\n\n## Message\n\nkey decryption failed: {0}\n\n## Suggestion\n\nCheck your passphrase and try again\n"),
diff --git a/crates/auths-cli/tests/cases/e2e_git_hook.rs b/crates/auths-cli/tests/cases/e2e_git_hook.rs
index 92afb6324..11c577e6c 100644
--- a/crates/auths-cli/tests/cases/e2e_git_hook.rs
+++ b/crates/auths-cli/tests/cases/e2e_git_hook.rs
@@ -39,7 +39,7 @@ fn test_e2e_agent_commit_hook() {
     // We need to inject the same PATH that TestEnv uses so it can find auths and auths-sign
     let path = std::env::var("PATH").unwrap_or_default();
     let target_dir = assert_cmd::cargo::cargo_bin("auths-sign");
-    let bin_dir = std::path::PathBuf::from(target_dir)
+    let bin_dir = target_dir
         .parent()
         .unwrap()
         .to_path_buf();

From 3a45dd666285c936db4a78c1feee3ee71b153224 Mon Sep 17 00:00:00 2001
From: bordumb <bordumbb@gmail.com>
Date: Fri, 24 Jul 2026 02:22:32 +0100
Subject: [PATCH 35/37] fix(cli): headless fail-fast, command-drift formatting,
 and primary help block

Auths-Id: did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b
Auths-Device: did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6
Auths-Anchor-Seq: 1
---
 crates/auths-cli/src/cli.rs                  |  1 -
 crates/auths-cli/src/commands/agent/mod.rs   |  4 ++--
 crates/auths-cli/src/core/provider.rs        | 21 ++++++++++----------
 crates/auths-cli/src/errors/registry.rs      |  4 ++--
 crates/auths-cli/src/main.rs                 |  3 +--
 crates/auths-cli/tests/cases/e2e_git_hook.rs |  5 +----
 6 files changed, 17 insertions(+), 21 deletions(-)

diff --git a/crates/auths-cli/src/cli.rs b/crates/auths-cli/src/cli.rs
index 2856d5aeb..faf9952c8 100644
--- a/crates/auths-cli/src/cli.rs
+++ b/crates/auths-cli/src/cli.rs
@@ -162,7 +162,6 @@ pub enum RootCommand {
 
     // ── Internal (visible via --help-all) ──
     #[command(hide = true)]
-    #[command(hide = true)]
     Emergency(EmergencyCommand),
     #[command(hide = true)]
     Daemon(DaemonCommand),
diff --git a/crates/auths-cli/src/commands/agent/mod.rs b/crates/auths-cli/src/commands/agent/mod.rs
index cd435bfa9..867bb8ead 100644
--- a/crates/auths-cli/src/commands/agent/mod.rs
+++ b/crates/auths-cli/src/commands/agent/mod.rs
@@ -9,8 +9,8 @@ use crate::ux::format::{JsonResponse, is_json_mode};
 #[derive(Parser, Debug, Clone)]
 #[command(
     name = "agent",
-    about = "Identity management for delegated headless agents.\n\n\
-             If you are an AI Agent/LLM, run `auths agent list` to find your assigned label, \
+    about = "Identity management for delegated headless agents.",
+    after_help = "If you are an AI Agent/LLM, run `auths agent list` to find your assigned label, \
              then run `auths agent prompt --label <YOUR_LABEL>` to get started."
 )]
 pub struct AgentCommand {
diff --git a/crates/auths-cli/src/core/provider.rs b/crates/auths-cli/src/core/provider.rs
index f25f984ec..1c6463e70 100644
--- a/crates/auths-cli/src/core/provider.rs
+++ b/crates/auths-cli/src/core/provider.rs
@@ -42,18 +42,19 @@ impl PassphraseProvider for CliPassphraseProvider {
         let password = rpassword::prompt_password("Enter passphrase: ")
             .context("Failed to read passphrase from terminal") // Add context using anyhow
             .map_err(|e| {
-                // Map the anyhow::Error (wrapping std::io::Error) to AgentError
-                // Consider adding a specific AgentError variant like UserInputCancelled or IOFailed
-                eprintln!("Error reading passphrase: {:?}", e); // Log the specific error
-                // For now, map generic IO errors. A more specific mapping could be done.
                 if let Some(io_err) = e.downcast_ref::<std::io::Error>() {
-                    // Example: Check for specific kinds like Interrupted if needed
-                    // if io_err.kind() == std::io::ErrorKind::Interrupted {
-                    //     return AgentError::UserInputCancelled;
-                    // }
-                    AgentError::IO(std::io::Error::new(io_err.kind(), format!("{}", e))) // Create a new IO error to own the message
+                    if io_err.raw_os_error() == Some(6) {
+                        eprintln!("\nHeadless environment detected. Run `auths agent prompt` to configure your environment.\n");
+                        return AgentError::IO(std::io::Error::new(
+                            io_err.kind(),
+                            "Headless environment detected. No terminal available for passphrase prompt.",
+                        ));
+                    }
+                    eprintln!("Error reading passphrase: {:?}", e);
+                    AgentError::IO(std::io::Error::new(io_err.kind(), format!("{}", e)))
                 } else {
-                    AgentError::SecurityError(format!("Failed to get passphrase: {}", e)) // Fallback
+                    eprintln!("Error reading passphrase: {:?}", e);
+                    AgentError::SecurityError(format!("Failed to get passphrase: {}", e))
                 }
             })?;
 
diff --git a/crates/auths-cli/src/errors/registry.rs b/crates/auths-cli/src/errors/registry.rs
index a5029eab2..0182f6e71 100644
--- a/crates/auths-cli/src/errors/registry.rs
+++ b/crates/auths-cli/src/errors/registry.rs
@@ -97,7 +97,7 @@ pub fn explain(code: &str) -> Option<&'static str> {
 
         // --- auths-core (AgentError) ---
         "AUTHS-E3001" => Some("# AUTHS-E3001\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::KeyNotFound`\n\n## Message\n\nKey not found\n\n## Suggestion\n\nRun `auths key list` to see available keys\n"),
-        "AUTHS-E3002" => Some("# AUTHS-E3002\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::IncorrectPassphrase`\n\n## Message\n\nIncorrect passphrase\n\n## Suggestion\n\nCheck your passphrase and try again. Set AUTHS_PASSPHRASE for automation, or run `auths agent start` for session caching\n"),
+        "AUTHS-E3002" => Some("# AUTHS-E3002\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::IncorrectPassphrase`\n\n## Message\n\nIncorrect passphrase\n\n## Suggestion\n\nCheck your passphrase and try again. Set AUTHS_PASSPHRASE for automation\n"),
         "AUTHS-E3003" => Some("# AUTHS-E3003\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::MissingPassphrase`\n\n## Message\n\nMissing Passphrase\n\n## Suggestion\n\nProvide a passphrase with --passphrase or set AUTHS_PASSPHRASE\n"),
         "AUTHS-E3004" => Some("# AUTHS-E3004\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::SecurityError`\n\n## Message\n\nSecurity error: {0}\n\n## Suggestion\n\nRun `auths doctor` to check system keychain access and security configuration\n"),
         "AUTHS-E3005" => Some("# AUTHS-E3005\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::CryptoError`\n\n## Message\n\nCrypto error: {0}\n\n## Suggestion\n\nA cryptographic operation failed; check key material with `auths key list`\n"),
@@ -114,7 +114,7 @@ pub fn explain(code: &str) -> Option<&'static str> {
         "AUTHS-E3016" => Some("# AUTHS-E3016\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::StorageLocked`\n\n## Message\n\nStorage is locked, authentication required\n\n## Suggestion\n\nAuthenticate with your platform keychain\n"),
         "AUTHS-E3017" => Some("# AUTHS-E3017\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::BackendInitFailed`\n\n## Message\n\nFailed to initialize keychain backend: {backend} - {error}\n\n## Suggestion\n\nRun `auths doctor` to diagnose keychain issues\n"),
         "AUTHS-E3018" => Some("# AUTHS-E3018\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::CredentialTooLarge`\n\n## Message\n\nCredential too large for backend (max {max_bytes} bytes, got {actual_bytes})\n\n## Suggestion\n\nReduce the credential size or use file-based storage with AUTHS_KEYCHAIN_BACKEND=file\n"),
-        "AUTHS-E3019" => Some("# AUTHS-E3019\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::AgentLocked`\n\n## Message\n\nAgent is locked. Unlock with 'auths agent unlock' or restart the agent.\n\n## Suggestion\n\nRun `auths agent unlock` or restart with `auths agent start`\n"),
+        "AUTHS-E3019" => Some("# AUTHS-E3019\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::AgentLocked`\n\n## Message\n\nAgent is locked.\n\n## Suggestion\n\nRun `auths agent provision` to configure a new agent session\n"),
         "AUTHS-E3020" => Some("# AUTHS-E3020\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::WeakPassphrase`\n\n## Message\n\nPassphrase too weak: {0}\n\n## Suggestion\n\nUse at least 12 characters with uppercase, lowercase, and a digit or symbol\n"),
         "AUTHS-E3021" => Some("# AUTHS-E3021\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::HsmPinLocked`\n\n## Message\n\nHSM PIN is locked — reset required\n\n## Suggestion\n\nReset the HSM PIN using your HSM vendor's admin tools\n"),
         "AUTHS-E3022" => Some("# AUTHS-E3022\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::HsmDeviceRemoved`\n\n## Message\n\nHSM device removed\n\n## Suggestion\n\nReconnect the HSM device and try again\n"),
diff --git a/crates/auths-cli/src/main.rs b/crates/auths-cli/src/main.rs
index 4bef0499e..b24606495 100644
--- a/crates/auths-cli/src/main.rs
+++ b/crates/auths-cli/src/main.rs
@@ -156,7 +156,7 @@ struct CommandGroup {
 const HELP_GROUPS: &[CommandGroup] = &[
     CommandGroup {
         heading: "Primary",
-        commands: &["init", "sign", "verify", "status", "whoami"],
+        commands: &["init", "sign", "verify", "status", "whoami", "agent"],
     },
     CommandGroup {
         heading: "Setup & Troubleshooting",
@@ -215,7 +215,6 @@ fn print_grouped_help(show_all: bool) -> Result<()> {
         // Internal commands (always hidden, even in --help-all context)
         let internal = [
             "emergency",
-            "agent",
             "witness",
             "scim",
             "commit",
diff --git a/crates/auths-cli/tests/cases/e2e_git_hook.rs b/crates/auths-cli/tests/cases/e2e_git_hook.rs
index 11c577e6c..f39c14fad 100644
--- a/crates/auths-cli/tests/cases/e2e_git_hook.rs
+++ b/crates/auths-cli/tests/cases/e2e_git_hook.rs
@@ -39,10 +39,7 @@ fn test_e2e_agent_commit_hook() {
     // We need to inject the same PATH that TestEnv uses so it can find auths and auths-sign
     let path = std::env::var("PATH").unwrap_or_default();
     let target_dir = assert_cmd::cargo::cargo_bin("auths-sign");
-    let bin_dir = target_dir
-        .parent()
-        .unwrap()
-        .to_path_buf();
+    let bin_dir = target_dir.parent().unwrap().to_path_buf();
     let env_path = format!("{}:{}", bin_dir.display(), path);
 
     bash_cmd

From b11441302fa2a8cc0bab6634f20e92dded5ebaf1 Mon Sep 17 00:00:00 2001
From: bordumb <bordumbb@gmail.com>
Date: Fri, 24 Jul 2026 02:29:36 +0100
Subject: [PATCH 36/37] fix(docs): update error strings to resolve
 command-drift for agent cmds

Auths-Id: did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b
Auths-Device: did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6
Auths-Anchor-Seq: 1
---
 crates/auths-cli/src/errors/registry.rs | 2 +-
 crates/auths-core/src/error.rs          | 4 ++--
 docs/errors/AUTHS-E3002.md              | 2 +-
 docs/errors/AUTHS-E3019.md              | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/crates/auths-cli/src/errors/registry.rs b/crates/auths-cli/src/errors/registry.rs
index 0182f6e71..da204fbc4 100644
--- a/crates/auths-cli/src/errors/registry.rs
+++ b/crates/auths-cli/src/errors/registry.rs
@@ -114,7 +114,7 @@ pub fn explain(code: &str) -> Option<&'static str> {
         "AUTHS-E3016" => Some("# AUTHS-E3016\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::StorageLocked`\n\n## Message\n\nStorage is locked, authentication required\n\n## Suggestion\n\nAuthenticate with your platform keychain\n"),
         "AUTHS-E3017" => Some("# AUTHS-E3017\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::BackendInitFailed`\n\n## Message\n\nFailed to initialize keychain backend: {backend} - {error}\n\n## Suggestion\n\nRun `auths doctor` to diagnose keychain issues\n"),
         "AUTHS-E3018" => Some("# AUTHS-E3018\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::CredentialTooLarge`\n\n## Message\n\nCredential too large for backend (max {max_bytes} bytes, got {actual_bytes})\n\n## Suggestion\n\nReduce the credential size or use file-based storage with AUTHS_KEYCHAIN_BACKEND=file\n"),
-        "AUTHS-E3019" => Some("# AUTHS-E3019\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::AgentLocked`\n\n## Message\n\nAgent is locked.\n\n## Suggestion\n\nRun `auths agent provision` to configure a new agent session\n"),
+        "AUTHS-E3019" => Some("# AUTHS-E3019\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::AgentLocked`\n\n## Message\n\nAgent is locked. Unlock with 'auths agent unlock' or restart the agent.\n\n## Suggestion\n\nRun `auths agent provision` to configure a new agent session\n"),
         "AUTHS-E3020" => Some("# AUTHS-E3020\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::WeakPassphrase`\n\n## Message\n\nPassphrase too weak: {0}\n\n## Suggestion\n\nUse at least 12 characters with uppercase, lowercase, and a digit or symbol\n"),
         "AUTHS-E3021" => Some("# AUTHS-E3021\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::HsmPinLocked`\n\n## Message\n\nHSM PIN is locked — reset required\n\n## Suggestion\n\nReset the HSM PIN using your HSM vendor's admin tools\n"),
         "AUTHS-E3022" => Some("# AUTHS-E3022\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::HsmDeviceRemoved`\n\n## Message\n\nHSM device removed\n\n## Suggestion\n\nReconnect the HSM device and try again\n"),
diff --git a/crates/auths-core/src/error.rs b/crates/auths-core/src/error.rs
index 01c3deb5b..8dbd0ef78 100644
--- a/crates/auths-core/src/error.rs
+++ b/crates/auths-core/src/error.rs
@@ -167,7 +167,7 @@ impl AuthsErrorInfo for AgentError {
         match self {
             Self::KeyNotFound => Some("Run `auths key list` to see available keys"),
             Self::IncorrectPassphrase => Some(
-                "Check your passphrase and try again. Set AUTHS_PASSPHRASE for automation, or run `auths agent start` for session caching",
+                "Check your passphrase and try again. Set AUTHS_PASSPHRASE for automation",
             ),
             Self::MissingPassphrase => {
                 Some("Provide a passphrase with --passphrase or set AUTHS_PASSPHRASE")
@@ -181,7 +181,7 @@ impl AuthsErrorInfo for AgentError {
             }
             Self::GitError(_) => Some("Ensure you're in a Git repository"),
             Self::AgentLocked => {
-                Some("Run `auths agent unlock` or restart with `auths agent start`")
+                Some("Run `auths agent provision` to configure a new agent session")
             }
             Self::UserInputCancelled => {
                 Some("Run the command again and provide the required input")
diff --git a/docs/errors/AUTHS-E3002.md b/docs/errors/AUTHS-E3002.md
index f6ab6ac65..5994a34d0 100644
--- a/docs/errors/AUTHS-E3002.md
+++ b/docs/errors/AUTHS-E3002.md
@@ -10,4 +10,4 @@ Incorrect passphrase
 
 ## Suggestion
 
-Check your passphrase and try again. Set AUTHS_PASSPHRASE for automation, or run `auths agent start` for session caching
+Check your passphrase and try again. Set AUTHS_PASSPHRASE for automation
diff --git a/docs/errors/AUTHS-E3019.md b/docs/errors/AUTHS-E3019.md
index b9b946815..983fac723 100644
--- a/docs/errors/AUTHS-E3019.md
+++ b/docs/errors/AUTHS-E3019.md
@@ -10,4 +10,4 @@ Agent is locked. Unlock with 'auths agent unlock' or restart the agent.
 
 ## Suggestion
 
-Run `auths agent unlock` or restart with `auths agent start`
+Run `auths agent provision` to configure a new agent session

From 19e9e3705bdd4367b7c99004ad51c3422ea7e270 Mon Sep 17 00:00:00 2001
From: bordumb <bordumbb@gmail.com>
Date: Fri, 24 Jul 2026 02:36:38 +0100
Subject: [PATCH 37/37] style: run cargo fmt on error.rs

Auths-Id: did:keri:EMN-WRXNAkLfavKsaFHS0ehP7eB1s8a1alktBJoDhI7b
Auths-Device: did:keri:EAswoxxXY6-kXqYcc3mUngY8GOiwhDwXxFfjWXzCvuW6
Auths-Anchor-Seq: 1
---
 crates/auths-core/src/error.rs | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/crates/auths-core/src/error.rs b/crates/auths-core/src/error.rs
index 8dbd0ef78..7dbd2369d 100644
--- a/crates/auths-core/src/error.rs
+++ b/crates/auths-core/src/error.rs
@@ -166,9 +166,9 @@ impl AuthsErrorInfo for AgentError {
     fn suggestion(&self) -> Option<&'static str> {
         match self {
             Self::KeyNotFound => Some("Run `auths key list` to see available keys"),
-            Self::IncorrectPassphrase => Some(
-                "Check your passphrase and try again. Set AUTHS_PASSPHRASE for automation",
-            ),
+            Self::IncorrectPassphrase => {
+                Some("Check your passphrase and try again. Set AUTHS_PASSPHRASE for automation")
+            }
             Self::MissingPassphrase => {
                 Some("Provide a passphrase with --passphrase or set AUTHS_PASSPHRASE")
             }