aac-cli 0.2.11__tar.gz → 0.2.13__tar.gz

{aac_cli-0.2.11/aac_cli.egg-info → aac_cli-0.2.13}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aac-cli
-Version: 0.2.11
+Version: 0.2.13
 Summary: The aac platform CLI — headless operator interface to the AAC control plane (tenant registration, chain audit).
 Author: Agent Authority Cloud Project
 License-Expression: Apache-2.0
@@ -28,9 +28,9 @@ Dynamic: license-file
 # aac-cli — the `aac` command
 
 `aac` is the command-line tool for tenants of Agent Authority Cloud (AAC).
-AAC lets an organisation's AI agents and services prove, on every request,
-which tenant they belong to and what they were authorised to do. A
-**tenant** is one organisation registered with AAC. Each of its workloads
+AAC lets an organization's AI agents and services prove, on every request,
+which tenant they belong to and what they were authorized to do. A
+**tenant** is one organization registered with AAC. Each of its workloads
 runs beside an AAC sidecar that signs outgoing requests and verifies
 incoming ones against public trust material the tenant publishes.
 
@@ -69,7 +69,8 @@ pip install aac-cli
 aac --version
 ```
 
-Python 3.11 to 3.14 is supported. Release checks test all four versions.
+Supported platforms are macOS, Linux and Linux Docker containers. Python 3.11
+to 3.14 is supported. Release checks test all four versions.
 
 > **Mind the name.** `pip install aac` installs an unrelated project that
 > happens to share the acronym. The AAC package is **`aac-cli`**; the
@@ -183,7 +184,7 @@ never asks you to pick between GitHub and Google again.
   configuration references it by path.
 
 **By default everything `aac init` generates is development material.** The
-development CA lives seven days and the leaf certificates one day. Nothing
+development CA lives 365 days and the leaf certificates 90 days. Nothing
 there qualifies for production, whatever the tenant's domain. If your own
 issuer signs your agent's certificates instead, see "Two ways to get your
 agent's certificates" below; moving to production also means a tenant-admin
@@ -205,7 +206,7 @@ three commands look after it:
 
 ```bash
 aac agent status --agent orders   # what exists, what is due, and the next step
-aac agent renew --agent orders    # replace the short-lived certificates
+aac agent renew --agent orders    # replace the certificates
 aac agent list                     # every agent on this machine
 ```
 
@@ -429,11 +430,11 @@ tell you later and `aac agent renew` behaves accordingly.
 
 The laptop case. The CLI creates a certificate authority on this machine and signs the agent's identity, receipt and HTTPS certificates with it.
 
-**Flags.** No flags are needed. To reuse a development CA across agents, pass `--ca-key-file` and `--ca-cert-file` together; neither one alone.
+**Flags.** No flags are needed. To reuse a development CA across agents, pass `--ca-key-file` and `--ca-cert-file` together; neither one alone. A CA that expires before the certificates it would sign is refused.
 
 **Keys and signatures.** The CA and the two identity keys are Ed25519; the HTTPS key is EC P-256.
 
-**The CLI** creates a 7-day certificate authority and keeps its private key in the agent's keep/ folder; issues the workload, receipt and HTTPS certificates; publishes the CA certificate as a trust anchor named `<agent>-dev-ca`.
+**The CLI** creates a 365-day certificate authority and keeps its private key in the agent's keep/ folder; issues the workload, receipt and HTTPS certificates; publishes the CA certificate as a trust anchor named `<agent>-dev-ca`.
 
 **The CLI does not** ask you for anything from your own certificate authority.
 
@@ -517,10 +518,10 @@ signs instead of this tool — see
 | 2 | tenant_admin_session | `~/.aac/credentials/<tenant-id>.session` | CLI admin calls | hours; `aac sso login` | No. sign in again |
 | 3 | tenant_admin_signing_key | `~/.aac/tenants/<tenant-id>/tenant-admin.pem`, `~/.aac/tenants/<tenant-id>/tenant-admin.pub.pem` | the publisher signs trust-material uploads; the public half is registered with AAC | until rotated; `aac tenant rotate-admin-key` | **Recommended.** recommended for developer tenants (loss needs `aac tenant rotate-admin-key`; a lost public half is derived from the private key); production custody belongs in an HSM/KMS, not a password manager |
 | 4 | root_signing_key | `~/.aac/agents/<agent>/sidecar/root.pem`, `~/.aac/agents/<agent>/sidecar/root.pub.pem`, `~/.aac/tenants/<tenant-id>/root-keys/<agent>-root-v1.pub.pem` | the sidecar mints authority chains; the public half is published under the key id | until you retire its key id (root key ids are fixed per agent name) | No. never restore the private key: a replacement agent gets a new name and therefore a new key id, published alongside the old one until the old one is retired; its public copies are recreated from it |
-| 5 | development_ca | `~/.aac/agents/<agent>/keep/ca.key`, `~/.aac/agents/<agent>/sidecar/ca.crt`, `~/.aac/agents/<agent>/agent/ca.crt`, `~/.aac/tenants/<tenant-id>/spiffe-bundle/<agent>-dev-ca.ca.pem` | signs the workload, terminal and TLS certificates; peers trust it via the published bundle | 7 days; `aac agent renew --ca` | No. development only; reissue; a lost copy of the certificate is copied back from `sidecar/ca.crt` |
-| 6 | workload_svid | `~/.aac/agents/<agent>/sidecar/workload.key`, `~/.aac/agents/<agent>/sidecar/workload.crt` | the sidecar's SPIFFE identity: proves on every live request that this workload holds the key behind its certificate | 1 day; `aac agent renew` | No. reissue |
-| 7 | terminal_attestation | `~/.aac/agents/<agent>/sidecar/terminal.key`, `~/.aac/agents/<agent>/sidecar/terminal.crt` | signs the receipt (terminal attestation) the sidecar issues when this workload completes a delegated request; auditors verify it offline against your published CA; setup gives it its own key so the two signing jobs stay separate, but a receipt is verified against your published CA and the expected agent identity, which the workload certificate also satisfies — treat both keys as one blast radius | 1 day; `aac agent renew` | No. reissue |
-| 8 | https_tls | `~/.aac/agents/<agent>/sidecar/server.key`, `~/.aac/agents/<agent>/sidecar/server.crt` | the sidecar's HTTPS listener | 1 day; `aac agent renew` | No. reissue |
+| 5 | development_ca | `~/.aac/agents/<agent>/keep/ca.key`, `~/.aac/agents/<agent>/sidecar/ca.crt`, `~/.aac/agents/<agent>/agent/ca.crt`, `~/.aac/tenants/<tenant-id>/spiffe-bundle/<agent>-dev-ca.ca.pem` | signs the workload, terminal and TLS certificates; peers trust it via the published bundle | 365 days; `aac agent renew --ca` | No. development only; reissue; a lost copy of the certificate is copied back from `sidecar/ca.crt` |
+| 6 | workload_svid | `~/.aac/agents/<agent>/sidecar/workload.key`, `~/.aac/agents/<agent>/sidecar/workload.crt` | the sidecar's SPIFFE identity: proves on every live request that this workload holds the key behind its certificate | 90 days; `aac agent renew` | No. reissue |
+| 7 | terminal_attestation | `~/.aac/agents/<agent>/sidecar/terminal.key`, `~/.aac/agents/<agent>/sidecar/terminal.crt` | signs the receipt (terminal attestation) the sidecar issues when this workload completes a delegated request; auditors verify it offline against your published CA; setup gives it its own key so the two signing jobs stay separate, but a receipt is verified against your published CA and the expected agent identity, which the workload certificate also satisfies — treat both keys as one blast radius | 90 days; `aac agent renew` | No. reissue |
+| 8 | https_tls | `~/.aac/agents/<agent>/sidecar/server.key`, `~/.aac/agents/<agent>/sidecar/server.crt` | the sidecar's HTTPS listener | 90 days; `aac agent renew` | No. reissue |
 | 9 | outbound_ca_bundle | `~/.aac/agents/<agent>/sidecar/outbound-ca.pem` | the sidecar verifies TLS to AAC and configured peers | rebuilt by renew; `aac agent renew` | No. derived |
 | 10 | pairing_secret | `~/.aac/agents/<agent>/agent/pairing.secret` | the sidecar and its agent authenticate each other (same bytes in both) | until regenerated | No. regenerable; both processes must read the same file |
 | 11 | agent_record | `~/.aac/agents/<agent>/record.json` | the agent's identities and progress; every `aac agent` verb reads it first | for the life of the agent | **Recommended.** cannot be recreated by any command; without it start a new agent under a new name (see the new-computer setup procedure) |
@@ -536,15 +537,15 @@ the machine is healthy. Everything else is regenerated.
 ```bash
 aac agent status --agent orders --output table   # what exists, expiry, permissions, next command
 aac agent status --agent orders --remote         # also: is the public trust material visible?
-aac agent renew --agent orders                   # replace the short-lived certificates; old ones archived
+aac agent renew --agent orders                   # replace the certificates; old ones archived
 aac agent list                                    # every agent on this machine, with its case
 aac init --profile stage --agent orders --layout container   # write the settings again, container paths
 ```
 
 `status` works offline by default and exits with code 3 when material is
-missing, expired or unsafely permissioned. `renew` reissues the one-day
+missing, expired or unsafely permissioned. `renew` reissues the 90-day
 certificates with fresh keys, and reissues the development CA only when it
-is expired or within a day of expiry (or when `--ca` is given); a new CA is
+is expired or within 90 days of expiry (or when `--ca` is given); a new CA is
 published under the next anchor id and needs the publisher restarted. For an
 agent whose own issuer signed its certificates, `renew` cannot reissue
 anything: it takes the replacements your issuer produced, through the same
@@ -577,20 +578,23 @@ id.
 
 It is the certificates that expire, and renewing replaces their keys with
 them. `aac agent status` shows when each certificate runs out and flags
-it before it does: six hours ahead for the one-day certificates, a day
-ahead for the development CA.
+it before it does: seven days ahead for the 90-day certificates, 90 days
+ahead for the development CA. That CA window covers a whole leaf lifetime, so
+a renewal never issues a certificate that would outlive its CA. Certificates
+your own issuer signed get the seven-day heads-up for the CA as well.
 
 | Material | Lasts | When it runs out | What to do |
 |---|---|---|---|
-| Workload, terminal-attestation and HTTPS certificates | 1 day | the sidecar can no longer prove its identity, sign receipts or serve HTTPS | `aac agent renew --agent <name>`, then restart the sidecar so it loads them |
-| Development CA | 7 days | certificates it signed stop being trusted, and no new ones can be issued | `renew` also replaces the CA when it is expired or within a day of expiry, or when `--ca` is given, and then reissues every certificate under it: restart the publisher so the new CA is published, restart the sidecar and anything else that trusted the old CA, and confirm with `aac agent status --agent <name> --remote` |
+| Workload, terminal-attestation and HTTPS certificates | 90 days | the sidecar can no longer prove its identity, sign receipts or serve HTTPS | `aac agent renew --agent <name>`, then restart the sidecar so it loads them |
+| Development CA | 365 days | certificates it signed stop being trusted, and no new ones can be issued | `renew` also replaces the CA when it is expired or within 90 days of expiry, or when `--ca` is given, and then reissues every certificate under it: restart the publisher so the new CA is published, restart the sidecar and anything else that trusted the old CA, and confirm with `aac agent status --agent <name> --remote` |
 | Tenant-admin session | hours | administration commands ask you to sign in again | `aac sso login` |
 | Tenant API key, tenant-admin signing key, root signing key | do not expire | — | replaced only on purpose: see "Keys" and "Setting up aac-cli on a new computer" |
 
 A simple routine: when you start work, run
 `aac agent status --agent <name>`, and when it names renewal, run
-`aac agent renew --agent <name>` and restart the sidecar. About once
-a week that renewal also replaces the development CA (`renew` then reports
+`aac agent renew --agent <name>` and restart the sidecar. About every nine
+months, once the CA is within 90 days of expiry, that renewal also replaces
+the development CA (`renew` then reports
 `republication_required: true`): restart the publisher, the sidecar and the
 agent, and anything else that trusted the old CA. Renewing is safe to
 repeat, but it is not a no-op: every run issues fresh keys and moves the old
@@ -756,7 +760,7 @@ stored value.
 
 `tenant_id` is managed for you. Profile commands display it but never ask
 for it; only `aac tenant register`, `aac init` and `aac sso login` write it.
-It is your organisation's identifier in the federation, allocated by AAC at
+It is your organization's identifier in the federation, allocated by AAC at
 registration in the form `tnt-<uuid>`, and it never changes.
 A binding makes that tenant the profile's stored default; it does not grant
 membership or configure an identity provider. Successful sign-in to an existing
@@ -953,12 +957,12 @@ code.
 Enterprise tenants are registered through an onboarding ceremony: AAC
 operations opens a registration window and hands the tenant operator a
 bootstrap token, which the commands below read from `--bootstrap-token` or
-the `AAC_BOOTSTRAP_TOKEN` environment variable. The token authorises only
+the `AAC_BOOTSTRAP_TOKEN` environment variable. The token authorizes only
 the onboarding steps shown with it; every other administration command runs
 under a signed-in session.
 
 For enterprise sign-in, AAC supports Microsoft Entra ID (also known as
-Azure Active Directory or Azure AD). If your organisation needs another
+Azure Active Directory or Azure AD). If your organization needs another
 identity provider, contact support@cascadeauth.com.
 
 ### Register the tenant

{aac_cli-0.2.11 → aac_cli-0.2.13}/README.md

@@ -1,9 +1,9 @@
 # aac-cli — the `aac` command
 
 `aac` is the command-line tool for tenants of Agent Authority Cloud (AAC).
-AAC lets an organisation's AI agents and services prove, on every request,
-which tenant they belong to and what they were authorised to do. A
-**tenant** is one organisation registered with AAC. Each of its workloads
+AAC lets an organization's AI agents and services prove, on every request,
+which tenant they belong to and what they were authorized to do. A
+**tenant** is one organization registered with AAC. Each of its workloads
 runs beside an AAC sidecar that signs outgoing requests and verifies
 incoming ones against public trust material the tenant publishes.
 
@@ -42,7 +42,8 @@ pip install aac-cli
 aac --version
 ```
 
-Python 3.11 to 3.14 is supported. Release checks test all four versions.
+Supported platforms are macOS, Linux and Linux Docker containers. Python 3.11
+to 3.14 is supported. Release checks test all four versions.
 
 > **Mind the name.** `pip install aac` installs an unrelated project that
 > happens to share the acronym. The AAC package is **`aac-cli`**; the
@@ -156,7 +157,7 @@ never asks you to pick between GitHub and Google again.
   configuration references it by path.
 
 **By default everything `aac init` generates is development material.** The
-development CA lives seven days and the leaf certificates one day. Nothing
+development CA lives 365 days and the leaf certificates 90 days. Nothing
 there qualifies for production, whatever the tenant's domain. If your own
 issuer signs your agent's certificates instead, see "Two ways to get your
 agent's certificates" below; moving to production also means a tenant-admin
@@ -178,7 +179,7 @@ three commands look after it:
 
 ```bash
 aac agent status --agent orders   # what exists, what is due, and the next step
-aac agent renew --agent orders    # replace the short-lived certificates
+aac agent renew --agent orders    # replace the certificates
 aac agent list                     # every agent on this machine
 ```
 
@@ -402,11 +403,11 @@ tell you later and `aac agent renew` behaves accordingly.
 
 The laptop case. The CLI creates a certificate authority on this machine and signs the agent's identity, receipt and HTTPS certificates with it.
 
-**Flags.** No flags are needed. To reuse a development CA across agents, pass `--ca-key-file` and `--ca-cert-file` together; neither one alone.
+**Flags.** No flags are needed. To reuse a development CA across agents, pass `--ca-key-file` and `--ca-cert-file` together; neither one alone. A CA that expires before the certificates it would sign is refused.
 
 **Keys and signatures.** The CA and the two identity keys are Ed25519; the HTTPS key is EC P-256.
 
-**The CLI** creates a 7-day certificate authority and keeps its private key in the agent's keep/ folder; issues the workload, receipt and HTTPS certificates; publishes the CA certificate as a trust anchor named `<agent>-dev-ca`.
+**The CLI** creates a 365-day certificate authority and keeps its private key in the agent's keep/ folder; issues the workload, receipt and HTTPS certificates; publishes the CA certificate as a trust anchor named `<agent>-dev-ca`.
 
 **The CLI does not** ask you for anything from your own certificate authority.
 
@@ -490,10 +491,10 @@ signs instead of this tool — see
 | 2 | tenant_admin_session | `~/.aac/credentials/<tenant-id>.session` | CLI admin calls | hours; `aac sso login` | No. sign in again |
 | 3 | tenant_admin_signing_key | `~/.aac/tenants/<tenant-id>/tenant-admin.pem`, `~/.aac/tenants/<tenant-id>/tenant-admin.pub.pem` | the publisher signs trust-material uploads; the public half is registered with AAC | until rotated; `aac tenant rotate-admin-key` | **Recommended.** recommended for developer tenants (loss needs `aac tenant rotate-admin-key`; a lost public half is derived from the private key); production custody belongs in an HSM/KMS, not a password manager |
 | 4 | root_signing_key | `~/.aac/agents/<agent>/sidecar/root.pem`, `~/.aac/agents/<agent>/sidecar/root.pub.pem`, `~/.aac/tenants/<tenant-id>/root-keys/<agent>-root-v1.pub.pem` | the sidecar mints authority chains; the public half is published under the key id | until you retire its key id (root key ids are fixed per agent name) | No. never restore the private key: a replacement agent gets a new name and therefore a new key id, published alongside the old one until the old one is retired; its public copies are recreated from it |
-| 5 | development_ca | `~/.aac/agents/<agent>/keep/ca.key`, `~/.aac/agents/<agent>/sidecar/ca.crt`, `~/.aac/agents/<agent>/agent/ca.crt`, `~/.aac/tenants/<tenant-id>/spiffe-bundle/<agent>-dev-ca.ca.pem` | signs the workload, terminal and TLS certificates; peers trust it via the published bundle | 7 days; `aac agent renew --ca` | No. development only; reissue; a lost copy of the certificate is copied back from `sidecar/ca.crt` |
-| 6 | workload_svid | `~/.aac/agents/<agent>/sidecar/workload.key`, `~/.aac/agents/<agent>/sidecar/workload.crt` | the sidecar's SPIFFE identity: proves on every live request that this workload holds the key behind its certificate | 1 day; `aac agent renew` | No. reissue |
-| 7 | terminal_attestation | `~/.aac/agents/<agent>/sidecar/terminal.key`, `~/.aac/agents/<agent>/sidecar/terminal.crt` | signs the receipt (terminal attestation) the sidecar issues when this workload completes a delegated request; auditors verify it offline against your published CA; setup gives it its own key so the two signing jobs stay separate, but a receipt is verified against your published CA and the expected agent identity, which the workload certificate also satisfies — treat both keys as one blast radius | 1 day; `aac agent renew` | No. reissue |
-| 8 | https_tls | `~/.aac/agents/<agent>/sidecar/server.key`, `~/.aac/agents/<agent>/sidecar/server.crt` | the sidecar's HTTPS listener | 1 day; `aac agent renew` | No. reissue |
+| 5 | development_ca | `~/.aac/agents/<agent>/keep/ca.key`, `~/.aac/agents/<agent>/sidecar/ca.crt`, `~/.aac/agents/<agent>/agent/ca.crt`, `~/.aac/tenants/<tenant-id>/spiffe-bundle/<agent>-dev-ca.ca.pem` | signs the workload, terminal and TLS certificates; peers trust it via the published bundle | 365 days; `aac agent renew --ca` | No. development only; reissue; a lost copy of the certificate is copied back from `sidecar/ca.crt` |
+| 6 | workload_svid | `~/.aac/agents/<agent>/sidecar/workload.key`, `~/.aac/agents/<agent>/sidecar/workload.crt` | the sidecar's SPIFFE identity: proves on every live request that this workload holds the key behind its certificate | 90 days; `aac agent renew` | No. reissue |
+| 7 | terminal_attestation | `~/.aac/agents/<agent>/sidecar/terminal.key`, `~/.aac/agents/<agent>/sidecar/terminal.crt` | signs the receipt (terminal attestation) the sidecar issues when this workload completes a delegated request; auditors verify it offline against your published CA; setup gives it its own key so the two signing jobs stay separate, but a receipt is verified against your published CA and the expected agent identity, which the workload certificate also satisfies — treat both keys as one blast radius | 90 days; `aac agent renew` | No. reissue |
+| 8 | https_tls | `~/.aac/agents/<agent>/sidecar/server.key`, `~/.aac/agents/<agent>/sidecar/server.crt` | the sidecar's HTTPS listener | 90 days; `aac agent renew` | No. reissue |
 | 9 | outbound_ca_bundle | `~/.aac/agents/<agent>/sidecar/outbound-ca.pem` | the sidecar verifies TLS to AAC and configured peers | rebuilt by renew; `aac agent renew` | No. derived |
 | 10 | pairing_secret | `~/.aac/agents/<agent>/agent/pairing.secret` | the sidecar and its agent authenticate each other (same bytes in both) | until regenerated | No. regenerable; both processes must read the same file |
 | 11 | agent_record | `~/.aac/agents/<agent>/record.json` | the agent's identities and progress; every `aac agent` verb reads it first | for the life of the agent | **Recommended.** cannot be recreated by any command; without it start a new agent under a new name (see the new-computer setup procedure) |
@@ -509,15 +510,15 @@ the machine is healthy. Everything else is regenerated.
 ```bash
 aac agent status --agent orders --output table   # what exists, expiry, permissions, next command
 aac agent status --agent orders --remote         # also: is the public trust material visible?
-aac agent renew --agent orders                   # replace the short-lived certificates; old ones archived
+aac agent renew --agent orders                   # replace the certificates; old ones archived
 aac agent list                                    # every agent on this machine, with its case
 aac init --profile stage --agent orders --layout container   # write the settings again, container paths
 ```
 
 `status` works offline by default and exits with code 3 when material is
-missing, expired or unsafely permissioned. `renew` reissues the one-day
+missing, expired or unsafely permissioned. `renew` reissues the 90-day
 certificates with fresh keys, and reissues the development CA only when it
-is expired or within a day of expiry (or when `--ca` is given); a new CA is
+is expired or within 90 days of expiry (or when `--ca` is given); a new CA is
 published under the next anchor id and needs the publisher restarted. For an
 agent whose own issuer signed its certificates, `renew` cannot reissue
 anything: it takes the replacements your issuer produced, through the same
@@ -550,20 +551,23 @@ id.
 
 It is the certificates that expire, and renewing replaces their keys with
 them. `aac agent status` shows when each certificate runs out and flags
-it before it does: six hours ahead for the one-day certificates, a day
-ahead for the development CA.
+it before it does: seven days ahead for the 90-day certificates, 90 days
+ahead for the development CA. That CA window covers a whole leaf lifetime, so
+a renewal never issues a certificate that would outlive its CA. Certificates
+your own issuer signed get the seven-day heads-up for the CA as well.
 
 | Material | Lasts | When it runs out | What to do |
 |---|---|---|---|
-| Workload, terminal-attestation and HTTPS certificates | 1 day | the sidecar can no longer prove its identity, sign receipts or serve HTTPS | `aac agent renew --agent <name>`, then restart the sidecar so it loads them |
-| Development CA | 7 days | certificates it signed stop being trusted, and no new ones can be issued | `renew` also replaces the CA when it is expired or within a day of expiry, or when `--ca` is given, and then reissues every certificate under it: restart the publisher so the new CA is published, restart the sidecar and anything else that trusted the old CA, and confirm with `aac agent status --agent <name> --remote` |
+| Workload, terminal-attestation and HTTPS certificates | 90 days | the sidecar can no longer prove its identity, sign receipts or serve HTTPS | `aac agent renew --agent <name>`, then restart the sidecar so it loads them |
+| Development CA | 365 days | certificates it signed stop being trusted, and no new ones can be issued | `renew` also replaces the CA when it is expired or within 90 days of expiry, or when `--ca` is given, and then reissues every certificate under it: restart the publisher so the new CA is published, restart the sidecar and anything else that trusted the old CA, and confirm with `aac agent status --agent <name> --remote` |
 | Tenant-admin session | hours | administration commands ask you to sign in again | `aac sso login` |
 | Tenant API key, tenant-admin signing key, root signing key | do not expire | — | replaced only on purpose: see "Keys" and "Setting up aac-cli on a new computer" |
 
 A simple routine: when you start work, run
 `aac agent status --agent <name>`, and when it names renewal, run
-`aac agent renew --agent <name>` and restart the sidecar. About once
-a week that renewal also replaces the development CA (`renew` then reports
+`aac agent renew --agent <name>` and restart the sidecar. About every nine
+months, once the CA is within 90 days of expiry, that renewal also replaces
+the development CA (`renew` then reports
 `republication_required: true`): restart the publisher, the sidecar and the
 agent, and anything else that trusted the old CA. Renewing is safe to
 repeat, but it is not a no-op: every run issues fresh keys and moves the old
@@ -729,7 +733,7 @@ stored value.
 
 `tenant_id` is managed for you. Profile commands display it but never ask
 for it; only `aac tenant register`, `aac init` and `aac sso login` write it.
-It is your organisation's identifier in the federation, allocated by AAC at
+It is your organization's identifier in the federation, allocated by AAC at
 registration in the form `tnt-<uuid>`, and it never changes.
 A binding makes that tenant the profile's stored default; it does not grant
 membership or configure an identity provider. Successful sign-in to an existing
@@ -926,12 +930,12 @@ code.
 Enterprise tenants are registered through an onboarding ceremony: AAC
 operations opens a registration window and hands the tenant operator a
 bootstrap token, which the commands below read from `--bootstrap-token` or
-the `AAC_BOOTSTRAP_TOKEN` environment variable. The token authorises only
+the `AAC_BOOTSTRAP_TOKEN` environment variable. The token authorizes only
 the onboarding steps shown with it; every other administration command runs
 under a signed-in session.
 
 For enterprise sign-in, AAC supports Microsoft Entra ID (also known as
-Azure Active Directory or Azure AD). If your organisation needs another
+Azure Active Directory or Azure AD). If your organization needs another
 identity provider, contact support@cascadeauth.com.
 
 ### Register the tenant

{aac_cli-0.2.11 → aac_cli-0.2.13}/aac_cli/__init__.py

@@ -10,4 +10,4 @@ entrypoint (`aac_cli.cli:entrypoint`).
 # test in bin/tests/test_cli_version_parity.py. A literal keeps the
 # shipped code free of import-time metadata lookups (and their
 # not-installed failure mode).
-__version__ = "0.2.11"
+__version__ = "0.2.13"

{aac_cli-0.2.11 → aac_cli-0.2.13}/aac_cli/_aeg/cli.py

@@ -204,15 +204,18 @@ def _render(args, events, query: Query, sources: list[SourceInput]) -> int:
     if args.output.resolve() in {path.resolve() for path in protected}:
         raise InputError("--output must not overwrite an evidence input")
     visual = build_visual_aeg(graph)
-    visual.provenance = summarize_sources(sources, selected, central_status=central_status)
+    visual.provenance = summarize_sources(
+        sources, selected, central_status=central_status, evidence_complete=graph.evidence_complete
+    )
     with tempfile.TemporaryDirectory(prefix="aac-aeg-") as directory:
         rendered = write_html_aeg(visual, root, out_dir=Path(directory))
         args.output.parent.mkdir(parents=True, exist_ok=True)
         args.output.write_text(rendered.read_text(encoding="utf-8"), encoding="utf-8")
     for diagnostic in diagnostics:
         print(diagnostic, file=sys.stderr)
+    coverage = "" if graph.evidence_complete else "; partial evidence"
     print(
-        f"AEG written to {args.output} ({len(graph.tokens)} observed/referenced tokens; partial evidence)",
+        f"AEG written to {args.output} ({len(graph.tokens)} observed/referenced tokens{coverage})",
         file=sys.stderr,
     )
     return 4 if query_failed else 0

{aac_cli-0.2.11 → aac_cli-0.2.13}/aac_cli/_aeg/data/renderer-source.json

@@ -1,20 +1,20 @@
 {
-  "content_sha256": "6e8bcd00bd94c415e04af65deb527be4d1581a6a5396d74c95708d6dda97fca4",
+  "content_sha256": "f45099fcfa1d1ceca5f31244dfa526ea096094ced6cfc7faf27cc1babe482163",
   "files": {
     "__init__.py": "80d80a1ba35353d271cddf02532801c60b57f5ec06fb268ae823747742ce8979",
-    "cli.py": "98aa2b0c528fefb5f1f90a16584a6fbda1f075ebfcf61605f52948cdb940a1af",
+    "cli.py": "a180a171b4d1f819fd96d0821394eee19b45fafddddbd50c74778af6ac3d5fb0",
     "data/action-taken-v1.json": "d863343afe7f314646a73cf063480a7e650f93857d2ed5ec3a7b1f9838671fdf",
     "data/predicates-v1.json": "35e83a29feada10e8cfbef7009245146a9717d4f4fd58d74124e0ec91ae922c8",
-    "from_sidecar.py": "6ac023f6925a13e94e0fee762656a02ca98981f2add194b052e9014ca48e2219",
-    "inputs.py": "ebf1ca77957d29d59683348f6916bac3c21e2037f087f26ff7c7242d75edc77c",
-    "model.py": "b631dcd7af587dcc89c18e1058bc81fb1043f04250a0d6ea585f9c595fd75cfc",
+    "from_sidecar.py": "8671c3e0efe9bfe9ecf9be057b70e245ca8d0d645b6bad8819f6fb1b882e255e",
+    "inputs.py": "047a6b7dd788e04c49e10f090de9336ed3870e754b547c469371369d27b55b8b",
+    "model.py": "715d0e92c3aafd9e0a194a74b4df7354bd24d1bf815767d590cf245da3d60018",
     "narrative.py": "8ac4b12add84cc8be907cff5f25e58731ab1144888aec8d376e286de461a6179",
-    "provenance.py": "d310e13bfd45cb16edcc72e7b2bc28c916e3ff45208e2b44240e589f0ec0558d",
+    "provenance.py": "3f611a8c129a2856e2cf76561bde29dc1884719083dfdddea72810e026946b90",
     "schemas.py": "c47e0138fb8bfeaf1db1725a00d4a37ff4a136a9e8f5907356b1006f301a9ded",
     "temporal.py": "b69081e9280d578dc1261a276da3178e979a02efaf1137f720b4520ed543a36d",
     "theme.py": "ded47be13f5c591da95a1bb91ee1b665c1570c929d842bdaa1a41325d0b40caa",
     "timeline_source.py": "dc875458d69c6135b3ffe0db9c35e511da603b5d52409f780f3e1b74dc464520",
-    "visualizer.py": "5eb7b863652c51a4a5751bcd8ae735b688e6e3e61089f0c158473ebb52ae6655"
+    "visualizer.py": "3213a1cbfe901f320c687b5eafcc09bed46bd2270c6cd427a7f74472c80a3bfe"
   },
   "legal": {
     "LICENSE": "0d542e0c8804e39aa7f37eb00da5a762149dc682d7829451287e11b938e94594",

{aac_cli-0.2.11 → aac_cli-0.2.13}/aac_cli/_aeg/from_sidecar.py

@@ -463,6 +463,9 @@ def _translate_mint(
         "tenant_id": sidecar_event.get("tenant_id"),
         "presenter_spiffe_id": sidecar_event.get("actor_spiffe_id"),
         "originator_human_id_hash": None,
+        # The sidecar records the sign-in issuer, never the person's identity;
+        # the originator node shows it when no identity hash is available.
+        "originator_issuer": sidecar_event.get("originator_issuer"),
         # T0 has no parent and no parent_token_ids_list (not a composite).
     }
     t0_event = UnifiedEvent(
@@ -624,6 +627,7 @@ def _translate_composite_mint(
         "parent_root_token_ids": sidecar_event.get("parent_root_token_ids") or [],
         "parent_tenant_ids": sidecar_event.get("parent_tenant_ids") or [],
         "originator_human_id_hash": sidecar_event.get("originator_human_id_hash"),
+        "originator_issuer": sidecar_event.get("originator_issuer"),
         "task_ref": sidecar_event.get("task_ref"),
     }
     t_comp_0_event = UnifiedEvent(

{aac_cli-0.2.11 → aac_cli-0.2.13}/aac_cli/_aeg/inputs.py

@@ -100,6 +100,7 @@ def _sidecar_types(row: dict, label: str) -> None:
         "agent_decision_action",
         "destination",
         "terminal_attestation_verification",
+        "originator_issuer",
     ):
         if row.get(key) is not None and not isinstance(row[key], str):
             raise InputError(f"{label}: {key} must be a string or null")
@@ -232,6 +233,7 @@ def read_trace(body, source: str) -> tuple[str, list[UnifiedEvent]]:
             "terminal_attestation_verification",
             "destination",
             "agent_decision_action",
+            "originator_issuer",
         ):
             if raw.get(key) is not None and not isinstance(raw[key], str):
                 raise InputError(f"{label}: {key} must be a string or null")

{aac_cli-0.2.11 → aac_cli-0.2.13}/aac_cli/_aeg/model.py

@@ -215,6 +215,11 @@ class TerminalNode:
     action_payload: dict = field(default_factory=dict)
     action_taken_by_spiffe_id: str | None = None
     action_taken_timestamp: str | None = None
+    # True only when an action record's actor is the workload the audience
+    # names (exact match, or a match of the audience pattern). Any other
+    # token-correlated action stays an observation and never proves that the
+    # addressed recipient acted.
+    recipient_acted: bool = False
     # Canonical associations observed for this leaf and exact receiver workload.
     # A trust-domain match, another token, or a wildcard is not such evidence.
     observed_tenant_ids: tuple[str, ...] = ()
@@ -274,6 +279,21 @@ class TokenRelationGraph:
     # become unknown. Receiving/reporting observations cannot supply this map.
     creator_tenant_claims: dict[str, tuple[str, ...]] = field(default_factory=dict)
 
+    @property
+    def evidence_complete(self) -> bool:
+        """True when the supplied records leave no structural gap.
+
+        Every referenced token was observed (no placeholder stands in for a
+        token only named by another), and each recipient's own records show
+        its action. A complete set is still a set of supplied observations,
+        not independently verified business truth.
+        """
+        if not self.tokens or not self.terminals:
+            return False
+        if any(token.placeholder for token in self.tokens.values()):
+            return False
+        return all(terminal.recipient_acted for terminal in self.terminals)
+
 
 # ---------------------------------------------------------------------------
 # Extraction — events → TokenRelationGraph
@@ -729,14 +749,49 @@ def _extract_originators(
         if e.source.startswith(TENANT_SOURCE_PREFIX) and e.event_type == "human_authenticated"
     }
 
-    out: list[OriginatorNode] = []
+    # Every observation of the same root (local sidecar record, central
+    # metadata, a second file) describes ONE originator. Merge them per root so
+    # the canvas label and the details are built from the same facts: a SIEM
+    # match on any observed hash wins, otherwise the first issuer any
+    # observation carries.
+    by_root: dict[str, list[UnifiedEvent]] = {}
     for mint in mint_root_events:
-        h_hash = mint.raw_event.get("originator_human_id_hash") or ""
-        root_tid = mint.root_token_id
-        token = tokens.get(mint.token_id)
-        tenant_id = token.tenant_id if token else (mint.raw_event.get("tenant_id") or "")
+        by_root.setdefault(mint.root_token_id, []).append(mint)
+
+    out: list[OriginatorNode] = []
+    for root_tid, observations in by_root.items():
+        h_hash = next(
+            (
+                str(o.raw_event.get("originator_human_id_hash"))
+                for o in observations
+                if o.raw_event.get("originator_human_id_hash")
+            ),
+            "",
+        )
+        issuer = next(
+            (
+                o.raw_event.get("originator_issuer")
+                for o in observations
+                if isinstance(o.raw_event.get("originator_issuer"), str)
+                and o.raw_event.get("originator_issuer")
+            ),
+            None,
+        )
+        token = next((tokens[o.token_id] for o in observations if o.token_id in tokens), None)
+        tenant_id = (
+            token.tenant_id
+            if token
+            else next(
+                (
+                    str(o.raw_event.get("tenant_id"))
+                    for o in observations
+                    if o.raw_event.get("tenant_id")
+                ),
+                "",
+            )
+        )
         # Optional enrichment from tenant SIEM.
-        siem = siem_human_events.get(h_hash)
+        siem = siem_human_events.get(h_hash) if h_hash else None
         if siem:
             raw = siem.raw_event
             out.append(
@@ -757,6 +812,9 @@ def _extract_originators(
                     human_id_hash=h_hash,
                     root_token_id=root_tid,
                     tenant_id=tenant_id,
+                    # The sidecar's mint record names the sign-in issuer even
+                    # when no identity hash reaches these records.
+                    human_iss=issuer,
                 )
             )
     return out
@@ -812,6 +870,35 @@ def _extract_auth_summary(
 # ---------------------------------------------------------------------------
 
 
+# The AAC audience grammar (AAC Design, "SPIFFE-ID pattern matching for
+# audience"), as the verifier implements it: a concrete SPIFFE ID, or a trailing
+# `/*` that stands for exactly one non-empty path segment. Trust domains match
+# exactly; a SPIFFE ID itself never contains a wildcard.
+_AUDIENCE_PATTERN = re.compile(r"^spiffe://[A-Za-z0-9.\-_]+(?:/[^/*]+)*(?:/\*)?$")
+_CONCRETE_SPIFFE_ID = re.compile(r"^spiffe://[A-Za-z0-9.\-_]+(?:/[^/*]+)+$")
+
+
+def _actor_matches_audience(actor: object, audience: str) -> bool:
+    """Whether an action's actor is the workload the audience constraint names.
+
+    Only a concrete SPIFFE ID can be the addressed recipient, and only under
+    the audience grammar above. Anything else (an opaque identity, a pattern
+    used as an actor, an unsupported audience shape) is kept as an observation
+    without claiming a match. A shared token or tenant never counts.
+    """
+    if not isinstance(actor, str) or not _CONCRETE_SPIFFE_ID.fullmatch(actor):
+        return False
+    if any(character.isspace() for character in actor) or not _AUDIENCE_PATTERN.fullmatch(audience):
+        return False
+    if audience.endswith("/*"):
+        prefix = audience[:-2]
+        if not actor.startswith(prefix + "/"):
+            return False
+        tail = actor[len(prefix) + 1 :]
+        return bool(tail) and "/" not in tail
+    return actor == audience
+
+
 def _extract_terminals(
     events: list[UnifiedEvent],
     tokens: dict[str, TokenNode],
@@ -882,6 +969,9 @@ def _extract_terminals(
             action_by_token.get(tid, []),
             key=lambda e: (e.timestamp_iso, json.dumps(e.raw_event, sort_keys=True)),
         )
+        recipient_acted = any(
+            _actor_matches_audience(e.raw_event.get("actor_spiffe_id"), audience) for e in actions
+        )
         if actions:
             action = actions[0]
             raw: dict = (
@@ -911,6 +1001,7 @@ def _extract_terminals(
                     # alias is needed.
                     action_taken_by_spiffe_id=raw.get("actor_spiffe_id"),
                     action_taken_timestamp=action.timestamp_iso,
+                    recipient_acted=recipient_acted,
                 )
             )
         else:

{aac_cli-0.2.11 → aac_cli-0.2.13}/aac_cli/_aeg/provenance.py

@@ -50,10 +50,16 @@ class SourceSummary:
 class Provenance:
     sources: tuple[SourceSummary, ...]
     central_status: str
+    # Structural completeness of the supplied records (TokenRelationGraph.evidence_complete).
+    evidence_complete: bool = False
 
 
 def summarize_sources(
-    sources: list[SourceInput], selected: list[UnifiedEvent], *, central_status: str
+    sources: list[SourceInput],
+    selected: list[UnifiedEvent],
+    *,
+    central_status: str,
+    evidence_complete: bool = False,
 ) -> Provenance:
     # Selection retains the original event objects. Track membership by identity,
     # not by a filename, timestamp or caller-controlled event field that could
@@ -81,7 +87,7 @@ def summarize_sources(
                 times[-1] if times else None,
             )
         )
-    return Provenance(tuple(summaries), central_status)
+    return Provenance(tuple(summaries), central_status, evidence_complete)
 
 
 def source_panel(provenance: Provenance | None, diagnostics: list[str]) -> str:
@@ -143,11 +149,21 @@ def source_panel(provenance: Provenance | None, diagnostics: list[str]) -> str:
             "observations for hosted data, not unique business actions. Timestamp spans describe "
             "available records, not execution start/end or continuous coverage.</p>"
         )
+    if provenance and provenance.evidence_complete:
+        coverage = (
+            "<li>Every referenced token was observed and each recipient's own records show its "
+            "action. Records are supplied, correlated observations, not independently verified "
+            "business truth.</li>"
+        )
+    else:
+        coverage = (
+            "<li>Partial evidence: only supplied, correlated observations are shown. Missing "
+            "records do not establish success or failure.</li>"
+        )
     parts.append(
-        "<h2>Limitations for these inputs</h2><ul><li>Partial evidence: only supplied, "
-        "correlated observations are shown. Missing records do not establish success or failure.</li>"
-        "<li>An intended recipient is named by an audience constraint; that constraint alone "
-        "does not prove delivery or completion. Mint/transport success does not prove a business result.</li>"
+        "<h2>Limitations for these inputs</h2><ul>" + coverage + "<li>A recipient is named by an "
+        'audience constraint ("addressed to"); that constraint alone does not prove delivery or '
+        "completion. Mint/transport success does not prove a business result.</li>"
     )
     if "Control-plane trace data" in used:
         parts.append(