codeimprint 0.5.0a11__py3-none-any.whl

codeimprint_cli/cli.py

@@ -0,0 +1,2128 @@
+"""The `imprint` command: login, init, seal, check and verify."""
+
+from __future__ import annotations
+
+import argparse
+import getpass
+import hashlib
+import json
+import os
+import sys
+import time
+import webbrowser
+from datetime import datetime, timezone
+from pathlib import Path
+
+from . import (
+    __version__,
+    chainseal,
+    config,
+    gitrepo,
+    imprint_file,
+    linecount,
+    ownership,
+    project,
+    receipt,
+    trust,
+)
+from .api import ApiError, Client, NetworkError
+from .tsa_roots import PINNED_ROOTS
+
+DEFAULT_FAIL_ABOVE = 0.8
+DISCLAIMER = "Similarity is evidence for review, not proof of copying."
+SEAL_NOTE = ("A seal proves that this exact Imprint was registered at that time and has not "
+             "changed since; it does not prove who wrote the code.")
+
+
+def verify_url(imprint_id: str, hub: str | None) -> str | None:
+    """The seal's page on the hub (config.hub_url), or None when no hub is known."""
+    return f"{hub}/i/{imprint_id}" if hub else None
+
+
+NO_HUB = ("no hub URL known for this server: run `imprint login` (the server tells it), or "
+          "pass --hub-url")
+
+
+def _remember_hub(url: str, published: dict | None = None) -> None:
+    """Cache the hub the server reports in its keys file (never fails the command)."""
+    try:
+        published = published if published is not None else Client(url).published_keys()
+    except (ApiError, NetworkError):
+        return
+    config.save_hub(url, (published or {}).get("public_url"))
+
+
+def _verify_line(iid: str, hub: str | None, local: object) -> str:
+    link = verify_url(iid, hub)
+    return f"Verify     {link}  or  imprint verify {local}" if link else \
+        f"Verify     imprint verify {local}  ({NO_HUB})"
+
+HANDLING = {
+    "seal": "The server unpacks the files, seals them and deletes the code immediately (also "
+            "on errors). Only the Imprint is kept; it holds no file or function names.",
+    "check": "The server unpacks the files, compares them with the reference and deletes the "
+             "code immediately (also on errors). Nothing about this code is kept.",
+}
+
+WORKFLOW = """\
+# Added by `imprint init` — CodeImprint by Mudrika
+#
+# Seals the code on pushes to main and on tags (the seal and its receipt are kept as a build
+# artifact), and checks pull requests against a reference Imprint on your CodeImprint server.
+# It installs the client from PyPI (pip install --pre codeimprint) and runs `imprint`.
+# Secrets: CODEIMPRINT_URL (your server, for example https://api.codeimprint.ai; a repository
+# variable of that name works too), CODEIMPRINT_TOKEN, and CODEIMPRINT_DEVELOPER_KEY (the
+# contents of your developer key file) to sign seals. Variable: CODEIMPRINT_REFERENCE (an
+# Imprint ID) for pull request checks. The code is uploaded, processed and deleted at once.
+# Network and server problems are warnings, never failures; without CODEIMPRINT_URL (as in
+# pull requests from forks) the job is skipped with a notice.
+name: CodeImprint
+
+on:
+  push:
+    branches: [main]
+    tags: ["*"]
+  pull_request:
+
+permissions:
+  contents: read
+
+env:
+  CODEIMPRINT_URL: ${{ secrets.CODEIMPRINT_URL || vars.CODEIMPRINT_URL }}
+  CODEIMPRINT_TOKEN: ${{ secrets.CODEIMPRINT_TOKEN }}
+
+jobs:
+  seal:
+    if: github.event_name == 'push'
+    runs-on: ubuntu-latest
+    env:
+      CODEIMPRINT_DEVELOPER_KEY: ${{ secrets.CODEIMPRINT_DEVELOPER_KEY }}
+      KIND: ${{ startsWith(github.ref, 'refs/tags/') && 'release' || 'push' }}
+    steps:
+      - id: settings
+        run: |
+          if [ -n "$CODEIMPRINT_URL" ]; then echo "ready=true" >> "$GITHUB_OUTPUT"
+          else echo "::notice::CodeImprint: no CODEIMPRINT_URL secret, sealing skipped"; fi
+      - if: steps.settings.outputs.ready == 'true'
+        uses: actions/checkout@v7
+      - if: steps.settings.outputs.ready == 'true'
+        uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+      - if: steps.settings.outputs.ready == 'true'
+        run: python -m pip install --disable-pip-version-check --quiet --pre codeimprint
+      - if: steps.settings.outputs.ready == 'true'
+        run: imprint seal . --yes --kind "$KIND"
+      - if: steps.settings.outputs.ready == 'true'
+        uses: actions/upload-artifact@v7
+        with:
+          name: codeimprint-seal-${{ github.sha }}
+          path: |
+            .imprint/baseline.imprint
+            .imprint/baseline.receipt.json
+            .imprint/server-keys.json
+          if-no-files-found: warn
+
+  check:
+    if: github.event_name == 'pull_request' && vars.CODEIMPRINT_REFERENCE != ''
+    runs-on: ubuntu-latest
+    env:
+      CODEIMPRINT_REFERENCE: ${{ vars.CODEIMPRINT_REFERENCE }}
+    steps:
+      - id: settings
+        run: |
+          if [ -n "$CODEIMPRINT_URL" ]; then echo "ready=true" >> "$GITHUB_OUTPUT"
+          else echo "::notice::CodeImprint: no CODEIMPRINT_URL secret, check skipped"; fi
+      - if: steps.settings.outputs.ready == 'true'
+        uses: actions/checkout@v7
+      - if: steps.settings.outputs.ready == 'true'
+        uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+      - if: steps.settings.outputs.ready == 'true'
+        run: python -m pip install --disable-pip-version-check --quiet --pre codeimprint
+      - if: steps.settings.outputs.ready == 'true'
+        run: >-
+          imprint check . --yes --reference "$CODEIMPRINT_REFERENCE"
+          --fail-above "%(fail_above)s" --output codeimprint-result.json
+"""
+
+
+class Abort(Exception):
+    """A user-facing error: print it and exit 2."""
+
+
+class SealFailed(Abort):
+    """Sealing failed after the upload; a warning (exit 0) in CI, an error elsewhere."""
+
+
+def _say(*lines: str) -> None:
+    print("\n".join(lines))
+
+
+def _ci() -> bool:
+    return os.environ.get("GITHUB_ACTIONS") == "true"
+
+
+def _warn(message: str) -> None:
+    if _ci():
+        print(f"::warning::CodeImprint: {message}")
+    print(f"imprint: warning: {message}", file=sys.stderr)
+
+
+def _client(args, fallback_url: str | None = None) -> Client:
+    settings = config.resolve(getattr(args, "url", None))
+    url = settings.url or fallback_url
+    if not url:
+        raise Abort("no server configured: run `imprint login --url <server>` or set "
+                    "CODEIMPRINT_URL")
+    return Client(url, settings.token if settings.url else None)
+
+
+def _prepare_upload(path: str, action: str, client: Client, assume_yes: bool) -> bytes:
+    sel = project.select_files(path)
+    if sel.count == 0:
+        raise Abort(f"no Python files to send under {sel.root} (check .gitignore and "
+                    ".imprint/config.json excludes)")
+    data = project.build_zip(sel)
+    _say(f"About to send to {client.url}:",
+         f"  {sel.count} Python file(s), {project.human_size(sel.total_bytes)} "
+         f"({project.human_size(len(data))} zipped) from {sel.root}",
+         f"  {sel.ignored} path(s) left out by .gitignore, .imprint/config.json or defaults",
+         f"  {HANDLING[action]}")
+    if not assume_yes:
+        if not sys.stdin.isatty():
+            raise Abort("not sending without confirmation: pass --yes (for example in CI)")
+        if input("Continue? [y/N] ").strip().lower() not in {"y", "yes"}:
+            raise Abort("cancelled; nothing was sent")
+    return data
+
+
+def receipt_path_for(imprint_path: Path) -> Path:
+    """``baseline.imprint`` -> ``baseline.receipt.json`` in the same folder."""
+    return imprint_path.with_name(imprint_path.name.removesuffix(".imprint") + ".receipt.json")
+
+
+# -- commands ------------------------------------------------------------------------------
+PROVIDER_ORDER = ("github", "gitlab", "google", "microsoft", "email")
+
+
+def _signin(args, url: str) -> int:
+    """Sign in through the browser (or an e-mail link); the terminal gets a short-lived
+    session once the browser confirms the code shown here."""
+    client = Client(url)
+    try:
+        enabled = {k for k, v in client.login_providers().items() if v.get("enabled")}
+    except (ApiError, NetworkError) as exc:
+        raise Abort(f"this server does not offer sign-in: {exc}") from exc
+    provider = args.provider or next((p for p in PROVIDER_ORDER if p in enabled), None)
+    if provider is None or provider not in enabled:
+        raise Abort(f"sign-in with {provider or 'any provider'} is not configured on {url}"
+                    + (f" (available: {', '.join(sorted(enabled))})" if enabled else ""))
+    email = args.email
+    if provider == "email" and not email:
+        email = input("E-mail address: ").strip()
+    try:
+        start = client.login_start(provider, email)
+    except (ApiError, NetworkError) as exc:
+        raise Abort(f"sign-in failed: {exc}") from exc
+    _say(f"Code       {start['user_code']}   (the browser must show the same code)")
+    if provider == "email":
+        _say(f"Sent       a sign-in link to {email}: open it, check the code and confirm")
+    else:
+        _say(f"Open       {start['verification_url']}")
+        if not args.no_browser:
+            webbrowser.open(start["verification_url"])
+    deadline = time.monotonic() + start["expires_in"]
+    while time.monotonic() < deadline:
+        time.sleep(start.get("interval", 2))
+        try:
+            done = client.login_poll(start["login_id"], start["device_secret"])
+        except ApiError as exc:
+            raise Abort(f"sign-in failed: {exc.message}") from exc
+        except NetworkError as exc:
+            raise Abort(str(exc)) from exc
+        if done.get("status") == "complete":
+            path = config.save_session(url, done)
+            who = done.get("handle") or done.get("email") or provider
+            _say(f"Signed in  with {provider} as {who}, until {done['expires_at']}",
+                 f"Session    saved to {path} (readable by you only)")
+            try:
+                me = Client(url, done["token"]).me()
+            except (ApiError, NetworkError):
+                me = {}
+            _remember_hub(url)
+            if me.get("terms_required"):
+                _say(f"Terms      {_terms_hint(url)}")
+            return 0
+    raise Abort("the sign-in expired: run `imprint login` again")
+
+
+def cmd_login(args) -> int:
+    url = (args.url or os.environ.get("CODEIMPRINT_URL") or config.load_user_config().get("url")
+           or (input("CodeImprint server URL: ") if not args.token_stdin else ""))
+    url = url.strip().rstrip("/")
+    if not url.startswith(("https://", "http://")):
+        raise Abort("the URL must start with https:// (or http:// for a local server)")
+    if args.cf_access:
+        client_id = input("Cloudflare Access service token, Client ID: ").strip()
+        client_secret = getpass.getpass("Client Secret (not shown): ").strip()
+        if not client_id or not client_secret:
+            raise Abort("both the Client ID and the Client Secret are needed")
+        path = config.save_cf_access(url, client_id, client_secret)
+        _say(f"Saved the Cloudflare Access service token for {url} to {path} (readable by you "
+             "only; sent to that server only)")
+    if args.public_url:
+        _warn("--public-url is no longer used: the hub URL comes from the server; pass "
+              "--hub-url to `imprint seal` or set CODEIMPRINT_HUB_URL to override it")
+    if not (args.token_stdin or args.api_token):
+        return _signin(args, url)
+    token = sys.stdin.readline().strip() if args.token_stdin else getpass.getpass(
+        "API token (leave empty if the server needs none): ").strip()
+    try:
+        health = Client(url, token).health()
+    except (ApiError, NetworkError) as exc:
+        raise Abort(str(exc)) from exc
+    if health.get("auth") and not token:
+        _warn("this server requires a token; seal and check will fail without one")
+    path = config.save_user_config(url, token)
+    _remember_hub(url)
+    _say(f"Saved {url} to {path}",
+         f"Server {health.get('version', '?')}, {health.get('key_mode', '?')} key, "
+         f"auth: {health.get('auth_mode', 'unknown')}")
+    if url.startswith("http://") and "localhost" not in url and "127.0.0.1" not in url:
+        _warn("this URL is not HTTPS: your code and token would travel unencrypted")
+    return 0
+
+
+def cmd_init(args) -> int:
+    root = Path(args.path).resolve()
+    if not root.is_dir():
+        raise Abort(f"no such folder: {root}")
+    cfg_path = root / project.CONFIG_DIR / project.CONFIG_FILE
+    existing = project.load_config(root)
+    cfg = {"version": 1, "exclude": existing.get("exclude", project.DEFAULT_EXCLUDE),
+           "fail_above": existing.get("fail_above", DEFAULT_FAIL_ABOVE),
+           "reference": existing.get("reference")}
+    written, skipped = [], []
+
+    key, key_note = None, ""
+    if not args.no_key:
+        key = trust.load_developer_key()
+        key_note = "found"
+        if key is None:
+            key, key_note = trust.create_developer_key(), "created"
+        cfg["developer"] = existing.get("developer") or trust.fingerprint(trust.public_raw(key))
+    elif existing.get("developer"):
+        cfg["developer"] = existing["developer"]
+
+    def write(path: Path, text: str) -> None:
+        rel = path.relative_to(root).as_posix()
+        if path.exists() and not args.force:
+            skipped.append(rel)
+            return
+        path.parent.mkdir(parents=True, exist_ok=True)
+        path.write_text(text, encoding="utf-8")
+        written.append(rel)
+
+    if cfg_path.exists() and not args.force and "developer" in cfg and "developer" not in existing:
+        existing["developer"] = cfg["developer"]          # record the key in our own file
+        cfg_path.write_text(json.dumps(existing, indent=2) + "\n", encoding="utf-8")
+        _say(f"updated  {cfg_path.relative_to(root).as_posix()} (developer key)")
+    else:
+        write(cfg_path, json.dumps(cfg, indent=2) + "\n")
+    if not args.no_ci:
+        write(root / ".github" / "workflows" / "codeimprint.yml",
+              WORKFLOW % {"fail_above": cfg["fail_above"]})
+    for rel in written:
+        _say(f"created  {rel}")
+    for rel in skipped:
+        _say(f"kept     {rel} (exists; --force to overwrite)")
+    if key is not None:
+        fp = trust.fingerprint(trust.public_raw(key))
+        _say("", f"Developer key {fp} ({key_note}): {trust.developer_key_path()}",
+             "  It stays on this machine: never uploaded, never in the repository. Back it up.",
+             "  To sign seals in CI, store the file's contents as the secret "
+             "CODEIMPRINT_DEVELOPER_KEY.")
+        if cfg.get("developer") != fp:
+            _warn(f"this project expects developer key {cfg['developer']}, not {fp}")
+    if key is not None and not args.no_project:
+        _init_project(args, root, cfg_path, key)
+    if key is not None:
+        _offer_identity(args, key)
+    _say("", "Next: `imprint seal` after each commit (or `imprint hook install --on commit`).")
+    return 0
+
+
+def default_project_name(root: Path) -> str:
+    """The repository's ``owner/repo`` from its origin remote, else the folder's name."""
+    if gitrepo.is_repo(root):
+        _host, name = gitrepo.repository_name(gitrepo.remote_url(root))
+        if name:
+            return name
+    return Path(root).resolve().name or "project"
+
+
+def _init_project(args, root: Path, cfg_path: Path, key) -> None:
+    """Create the project and its genesis seal, so its start is fixed before any code."""
+    current = project.load_config(root)
+    settings = config.resolve(getattr(args, "url", None))
+    if current.get("project_id"):
+        _say(f"Project    {current['project_id']} (already created)")
+        if getattr(args, "name", None) and settings.url:
+            _rename(Client(settings.url, settings.token), current["project_id"], key,
+                    args.name, True)
+        return
+    if not settings.url:
+        _say("", "No server configured: run `imprint login`, then `imprint init` again to "
+                 "create the project and its genesis seal.")
+        return
+    client = Client(settings.url, settings.token)
+    name = getattr(args, "name", None) or default_project_name(root)
+    try:
+        made = chainseal.create_project(client, key, name)
+    except (ApiError, NetworkError) as exc:
+        _warn(f"the project was not created ({exc}); run `imprint init` again later")
+        return
+    g = made["genesis"]
+    current["project_id"] = made["project_id"]
+    cfg_path.parent.mkdir(parents=True, exist_ok=True)
+    cfg_path.write_text(json.dumps(current, indent=2) + "\n", encoding="utf-8")
+    folder = root / project.CONFIG_DIR
+    imprint_file.save(g["imprint"], folder / "genesis.imprint")
+    (folder / "genesis.receipt.json").write_text(
+        json.dumps(g["receipt"], indent=1, sort_keys=True) + "\n", encoding="utf-8")
+    if gitrepo.is_repo(root):
+        chainseal.record(root, g, "", None)
+    _say("", f"Project    {made['project_id']} (in .imprint/config.json)",
+         f"Name       {name} (shown on the project's public page; change it with "
+         "`imprint project rename`, or --name)",
+         f"Genesis    {g['id']}, sealed {g['receipt']['attestation']['statement']['attested_at']} "
+         f"(log entry #{g['receipt']['log']['index']}): the project's chain starts here",
+         "Saved      .imprint/genesis.imprint and .imprint/genesis.receipt.json (commit them)")
+
+
+def _rename(client: Client, project_id: str, key, name: str, public: bool) -> dict:
+    statement = {"type": "codeimprint.project-name.v1", "project": project_id,
+                 "name": " ".join(name.split()), "public": public}
+    try:
+        out = client.rename_project(project_id, statement["name"], public,
+                                    chainseal.public_key(key), chainseal.sign(key, statement))
+    except (ApiError, NetworkError) as exc:
+        raise Abort(f"the project was not renamed: {exc}") from exc
+    _say(f"Name       {out['name']} ({'public' if out['public'] else 'shown to you only'})")
+    return out
+
+
+# -- onboarding: the key's identity (CIM-BE-19-v1) -----------------------------------------------
+IDENTITY_WHY = ("The hub's \"My projects\" finds your projects through your key's verified "
+                "identity, and so do ownership claims.")
+
+
+def _offer_identity(args, key, once: bool = False) -> None:
+    """If the developer key has no valid identity on this server, offer to bind it now (asked
+    in a terminal only, never silently; in CI or without a terminal, a hint). ``once``: ask at
+    most once per server and key (the first seal)."""
+    settings = config.resolve(getattr(args, "url", None))
+    if not settings.url or _ci():
+        return
+    fp = trust.fingerprint(trust.public_raw(key))
+    marker = config.config_dir() / "identity-offered.json"
+    try:
+        asked = json.loads(marker.read_text()) if marker.is_file() else {}
+    except (OSError, ValueError):
+        asked = {}
+    tag = f"{settings.url}|{fp}"
+    if once and tag in asked:
+        return
+    try:
+        status = Client(settings.url, settings.token).key_identity(fp)
+    except (ApiError, NetworkError):
+        return                                         # never in the way of init or a seal
+    if any(i.get("status") == "valid" for i in status.get("identities") or []):
+        return
+    try:
+        marker.parent.mkdir(parents=True, exist_ok=True)
+        marker.write_text(json.dumps({**asked, tag: _now_iso()}, indent=1) + "\n")
+    except OSError:
+        pass
+    _say("", f"Identity   your developer key {fp} has no verified identity on this server.",
+         f"  {IDENTITY_WHY}")
+    if not sys.stdin.isatty():
+        _say("  Bind it with: imprint identity bind --level email")
+        return
+    if input("  Bind it to your verified e-mail address now (imprint identity bind --level "
+             "email)? [y/N] ").strip().lower() not in {"y", "yes"}:
+        _say("  Not bound. Later: imprint identity bind --level email")
+        return
+    try:
+        _bind(args, key, "email", False)
+    except Abort as exc:
+        _warn(f"not bound: {exc}")
+
+
+# -- hooks, chain, export ------------------------------------------------------------------
+def cmd_hook(args) -> int:
+    root = Path(args.path)
+    if not gitrepo.is_repo(root):
+        raise Abort("not a Git repository")
+    hook = gitrepo.git_dir(root) / "hooks" / chainseal.HOOK_FILES[args.on]
+    if args.action == "install":
+        if hook.exists() and chainseal.HOOK_MARK not in hook.read_text(errors="replace"):
+            raise Abort(f"{hook} already exists: add this line to it instead:\n"
+                        f'  "{sys.executable}" -m codeimprint_cli hook run --on {args.on} || true')
+        hook.parent.mkdir(parents=True, exist_ok=True)
+        hook.write_text(chainseal.hook_script(sys.executable, args.on), encoding="utf-8")
+        hook.chmod(0o755)
+        _say(f"Installed {hook}: every {args.on} is sealed (kind {args.on}). The hook never "
+             "blocks: offline, it queues the seal and sends it on the next run.")
+        return 0
+    return _hook_run(args, root)
+
+
+def _hook_run(args, root: Path) -> int:
+    """Seal queued commits and HEAD; never fails: problems queue the seal with one warning."""
+    def warn(message: str) -> int:
+        print(f"imprint: warning: {message}", file=sys.stderr)
+        return 0
+
+    try:
+        cfg = project.load_config(gitrepo.toplevel(root))
+        if not cfg.get("project_id"):
+            return warn("this repository has no CodeImprint project; run `imprint init`")
+        key = trust.load_developer_key()
+        if key is None:
+            return warn("no developer key; run `imprint init`")
+        settings = config.resolve(None)
+        head = gitrepo.resolve(root, "HEAD")
+    except (gitrepo.GitError, ValueError, OSError) as exc:
+        return warn(f"seal skipped ({exc})")
+    queue = chainseal.load_queue(root)
+    if head not in {q["commit"] for q in queue}:
+        queue.append({"commit": head, "kind": args.on})
+    if not settings.url:
+        chainseal.save_queue(root, queue)
+        return warn(f"no server configured; {len(queue)} seal(s) queued")
+    client = Client(settings.url, settings.token, timeout=60)
+    for i, item in enumerate(queue):
+        try:
+            out = chainseal.seal_commit(client, root, cfg["project_id"], item["commit"],
+                                        item["kind"], key, cfg.get("exclude"))
+        except Exception as exc:  # noqa: BLE001 — a hook never blocks a commit or push
+            chainseal.save_queue(root, queue[i:])
+            return warn(f"seal of {item['commit'][:12]} queued ({len(queue) - i} waiting): "
+                        f"{exc}")
+        if "already" in out:
+            continue
+        chainseal.record(root, out["result"], item["commit"], out["info"]["ref"])
+        print(f"imprint: sealed {item['commit'][:12]} as {out['result']['id']} "
+              f"({out['uploaded']} file(s) uploaded)", file=sys.stderr)
+    chainseal.save_queue(root, [])
+    return 0
+
+
+def cmd_chain(args) -> int:
+    root = Path(args.path)
+    cfg = project.load_config(root) if root.is_dir() else {}
+    project_id = args.project or cfg.get("project_id")
+    if not project_id:
+        raise Abort("no project: run `imprint init` (or pass --project)")
+    local = {c["seal"]: c for c in chainseal.local_chain(root)} if gitrepo.is_repo(root) else {}
+    client = _client(args)
+    seals, after = [], None
+    try:
+        while True:
+            page = client.public_chain(project_id, after)
+            seals += page["seals"]
+            if page.get("next") is None:
+                break
+            after = page["next"]
+    except (ApiError, NetworkError) as exc:
+        raise Abort(f"cannot read the chain: {exc}") from exc
+    _say(f"Project    {project_id}  ({len(seals)} seal(s) on the server, "
+         f"{len(local)} made from this clone)", "",
+         f"{'log':>6}  {'seal':<27} {'kind':<8} {'attested':<21} {'commit':<12} parent")
+    for s in seals:
+        commit = (local.get(s["seal"], {}).get("commit") or "")[:12]
+        parent = ", ".join(s["parents"]) or "-"
+        _say(f"{s['log_index']:>6}  {s['seal']:<27} {s['kind']:<8} {s['attested_at']:<21} "
+             f"{commit:<12} {parent}")
+    missing = [c for c in local if c not in {s["seal"] for s in seals}]
+    if missing:
+        _warn(f"{len(missing)} seal(s) recorded locally are not in the server's chain")
+        return 1
+    return 0
+
+
+def _now_iso() -> str:
+    return datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
+
+
+def _session_client(args) -> Client:
+    settings = config.resolve(getattr(args, "url", None))
+    if not settings.url:
+        raise Abort("no server configured: run `imprint login --url <server>`")
+    s = config.load_session(settings.url)
+    if not s:
+        raise Abort(f"not signed in to {settings.url} (or the session expired): run "
+                    "`imprint login`")
+    return Client(settings.url, s["token"])
+
+
+def _checked(client: Client, rec: dict, what: str) -> None:
+    """Verify a record receipt the server returned before showing or saving it."""
+    try:
+        keys, problems = trust.trust_server_keys(client.url, client.published_keys())
+    except (ApiError, NetworkError) as exc:
+        raise Abort(f"cannot fetch the server's keys: {exc}") from exc
+    if problems:
+        raise Abort("the server's attestation keys changed unexpectedly (" + "; ".join(problems)
+                    + ")")
+    bad = _failed(receipt.verify(rec, keys, anchors=_anchors(argparse.Namespace(
+        tsa_certs=None))))
+    if bad:
+        raise Abort(f"the {what} does not verify (" + "; ".join(
+            f"{c.name}: {c.detail}" for c in bad) + ")")
+
+
+def cmd_identity(args) -> int:
+    key = _developer_key(required=True)
+    fp = trust.fingerprint(trust.public_raw(key))
+    if args.action == "show":
+        client = _client(args)
+        try:
+            s = client.key_identity((args.key or fp).lower())
+        except (ApiError, NetworkError) as exc:
+            raise Abort(f"cannot read the key's identity: {exc}") from exc
+        _say(f"Key        {s['key']}" + ("  (your developer key)" if s["key"] == fp else ""))
+        if not s["identities"]:
+            _say("Identity   none: run `imprint login`, then `imprint identity bind`")
+        for i in s["identities"]:
+            subject = f" {i['subject']}" if i.get("subject") else ""
+            state = (f"revoked by {i['revoked_by']}" if i["status"] == "revoked" else
+                     f"{i['status']}, until {i['valid_until']}")
+            _say(f"Identity   {i['id']}  {i['level']} via {i['provider']}{subject}  ({state})")
+        for r in s["revocations"]:
+            since = f", compromised since {r['compromised_since']}" \
+                if r.get("compromised_since") else ""
+            _say(f"Revoked    {r['id']}  {r['reason']} from {r['effective_at']}{since}")
+        if s.get("compromised_since"):
+            _warn(f"this key was reported compromised since {s['compromised_since']}: anything "
+                  "it signed from then on is flagged")
+        return 0
+    if args.action == "bind":
+        _bind(args, key, args.level, args.show_email_domain)
+        return 0
+    return _revoke_identity(args, key, fp)
+
+
+def _bind(args, key, level: str, show_email_domain: bool) -> dict:
+    """Bind the developer key to the signed-in identity (an IDT1 record)."""
+    sc = _session_client(args)
+    try:
+        ch = sc.identity_challenge(chainseal.public_key(key), level, show_email_domain)
+        rec = sc.identity_attest(ch["challenge_id"], chainseal.sign(key, ch["statement"]))
+    except (ApiError, NetworkError) as exc:
+        raise Abort(f"binding failed: {exc}") from exc
+    _checked(sc, rec, "identity record")
+    out = config.config_dir() / "identity" / f"{rec['imprint_id']}.receipt.json"
+    out.parent.mkdir(parents=True, exist_ok=True)
+    out.write_text(json.dumps(rec, indent=1, sort_keys=True) + "\n", encoding="utf-8")
+    doc = rec["record"]["document"]
+    subject = f" as {doc['subject']}" if doc.get("subject") else ""
+    _say(f"Identity   {rec['imprint_id']}",
+         f"Key        {doc['key']} verified at level {doc['level']} via "
+         f"{doc['provider']}{subject}",
+         f"Valid      {doc['valid_from']} to {doc['valid_until']}",
+         f"Log        entry #{rec['log']['index']}",
+         f"Receipt    {out}",
+         "Public     level, provider and (for GitHub/GitLab) your handle; your e-mail address "
+         "is never public")
+    return rec
+
+
+def _revoke_identity(args, key, fp: str) -> int:
+    if args.reason != "key-compromised" and not args.record:   # a compromise can name the key
+        raise Abort("name the identity record to revoke (IDT1-...)")
+    document = {"type": "codeimprint.revocation.v1", "key": fp, "reason": args.reason,
+                "effective_at": _now_iso()}
+    if args.record:
+        document["revokes"] = imprint_file.clean_id(args.record)
+    if args.compromised_since:
+        document["compromised_since"] = args.compromised_since
+    from . import records
+
+    digest = hashlib.sha256(imprint_file.canonical(document)).hexdigest()
+    sig = chainseal.sign(key, records.sign_statement(document["type"], digest))
+    client = _client(args)
+    try:
+        rec = client.revoke(document, [{"role": "holder", "public_key":
+                                        chainseal.public_key(key), "signature": sig}])
+    except (ApiError, NetworkError) as exc:
+        raise Abort(f"revocation failed: {exc}") from exc
+    _checked(client, rec, "revocation record")
+    _say(f"Revoked    {rec['imprint_id']}  ({args.reason}"
+         + (f", compromised since {args.compromised_since}" if args.compromised_since else "")
+         + ")", f"Log        entry #{rec['log']['index']}")
+    return 0
+
+
+# -- ownership claims (ADR 0002 steps 1.12-1.14) -------------------------------------------
+WARRANTY = ("You state that this claim is truthful: the claimant warrants it. CodeImprint "
+            "records, verifies and timestamps the claim; it never decides who owns the code.")
+
+
+def _project_id(args) -> str:
+    root = Path(getattr(args, "path", None) or ".")
+    cfg = project.load_config(root) if root.is_dir() else {}
+    project_id = getattr(args, "project", None) or cfg.get("project_id")
+    if not project_id:
+        raise Abort("no project: run `imprint init` (or pass --project)")
+    return project_id
+
+
+def _signing_keys(args) -> dict:
+    """{fingerprint: private key}: the developer key first, then each --also-sign key file."""
+    from cryptography.hazmat.primitives import serialization
+    from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+
+    key = _developer_key(required=True)
+    out = {trust.fingerprint(trust.public_raw(key)): key}
+    for path in getattr(args, "also_sign", None) or []:
+        extra = serialization.load_pem_private_key(Path(path).read_bytes(), password=None)
+        if not isinstance(extra, Ed25519PrivateKey):
+            raise Abort(f"{path} is not an Ed25519 private key")
+        out[trust.fingerprint(trust.public_raw(extra))] = extra
+    return out
+
+
+def _sign_record(key, document: dict, role: str) -> dict:
+    from . import records
+
+    digest = ownership.digest(document)
+    return {"role": role, "public_key": chainseal.public_key(key),
+            "signature": chainseal.sign(key, records.sign_statement(document["type"], digest))}
+
+
+def _ask(args, question: str) -> None:
+    if args.yes:
+        return
+    if not sys.stdin.isatty():
+        raise Abort("not signing without confirmation: pass --yes")
+    if input(f"{question} [y/N] ").strip().lower() not in {"y", "yes"}:
+        raise Abort("cancelled")
+
+
+def _claims_folder(args) -> Path:
+    root = Path(getattr(args, "path", None) or ".")
+    folder = root / ".imprint" if (root / ".imprint").is_dir() else config.config_dir()
+    return folder / "claims"
+
+
+def _claimant_identity(client: Client, args, fp: str) -> str:
+    """The identity record for a person's claim, or an organisation's (--org)."""
+    if args.org:
+        org = client.public_org(args.org)
+        for d in org["domains"]:
+            if d.get("disclosed") and d["status"] == "verified":
+                rec = client.public_record(d["identity"])["record"]["document"]
+                if rec["key"] == fp:
+                    return d["identity"]
+        raise Abort("the organisation has no disclosed, verified domain held by your key: "
+                    "verify and disclose a domain first (its first claim makes it public)")
+    if args.identity:
+        return imprint_file.clean_id(args.identity)
+    for i in client.key_identity(fp)["identities"]:
+        if i["status"] == "valid" and i["level"] in ownership.PERSON_LEVELS:
+            return i["id"]
+    raise Abort("your key has no valid identity at level email or higher: run `imprint "
+                "login`, then `imprint identity bind`")
+
+
+def cmd_claim(args) -> int:
+    client = _client(args)
+    if args.action == "show":
+        return _claim_show(args, client)
+    if args.action != "withdraw":                # records need a signed-in, accepted account
+        client = _session_client(args)
+    keys = _signing_keys(args)
+    fp = next(iter(keys))
+    if args.action == "create":
+        return _claim_create(args, client, keys, fp)
+    if not args.claim:
+        raise Abort("name the claim (CLM1-...)")
+    claim_id = imprint_file.clean_id(args.claim)
+    try:
+        claim = client.public_record(claim_id)
+    except (ApiError, NetworkError) as exc:
+        raise Abort(f"cannot read the claim: {exc}") from exc
+    _checked(client, claim, "claim record")
+    project_id = claim["record"]["document"]["project"]
+    if args.action == "withdraw":
+        document = {"type": ownership.REVOCATION, "revokes": claim_id, "key": fp,
+                    "reason": "withdrawn", "effective_at": _now_iso()}
+        _say(f"Withdraw   {claim_id} from now (seals until now stay covered by it)")
+        _ask(args, "Withdraw this claim?")
+        try:
+            rec = client.revoke(document, [_sign_record(keys[fp], document, "holder")])
+        except (ApiError, NetworkError) as exc:
+            raise Abort(f"withdrawal failed: {exc}") from exc
+        _checked(client, rec, "withdrawal record")
+        _say(f"Withdrawn  {rec['imprint_id']}", f"Log        entry #{rec['log']['index']}")
+        return 0
+    if args.action == "add-key":                     # a person's claim
+        if len(keys) != 2:
+            raise Abort("add-key: pass the new key's private key file with --also-sign FILE")
+        new_fp, new_key = list(keys.items())[1]
+        document = {"type": ownership.CLAIM_KEY, "claim": claim_id, "action": "add",
+                    "key": new_fp}
+        sigs = [_sign_record(keys[fp], document, "authorised"),
+                _sign_record(new_key, document, "key")]
+    else:
+        if not args.key:
+            raise Abort("retire-key: name the key's fingerprint with --key")
+        document = {"type": ownership.CLAIM_KEY, "claim": claim_id, "action": "retire",
+                    "key": args.key.lower()}
+        sigs = [_sign_record(keys[fp], document, "authorised")]
+    try:
+        rec = client.claim_key(project_id, claim_id, document, sigs)
+    except (ApiError, NetworkError) as exc:
+        raise Abort(f"{args.action} failed: {exc}") from exc
+    _checked(client, rec, "claim key record")
+    done = "Added" if document["action"] == "add" else "Retired"
+    _say(f"{done:<10} key {document['key']} on {claim_id} ({rec['imprint_id']}, log entry "
+         f"#{rec['log']['index']})")
+    return 0
+
+
+def _claim_create(args, client: Client, keys: dict, fp: str) -> int:
+    project_id = _project_id(args)
+    try:
+        identity = _claimant_identity(client, args, fp)
+        if args.org:
+            listed = sorted(k["fingerprint"] for k in client.public_org(args.org)["keys"]
+                            if k["valid_until"] is None)
+        else:
+            listed = sorted(keys)
+    except (ApiError, NetworkError) as exc:
+        raise Abort(f"cannot prepare the claim: {exc}") from exc
+    documents, private = [], []
+    for spec in args.document or []:
+        kind, sep, path = spec.partition("=")
+        if not sep or not Path(path).is_file():
+            raise Abort(f"--document wants KIND=FILE (got {spec!r})")
+        c = ownership.document_commitment(Path(path))
+        documents.append({"kind": kind, "commitment": c["commitment"]})
+        private.append({"kind": kind, **c})
+    document = {"type": ownership.CLAIM, "project": project_id,
+                "effective_at": args.effective_at or _now_iso(),
+                "claimant": {"kind": "org" if args.org else "person", "identity": identity,
+                             "org": args.org},
+                "keys": listed, "basis": args.basis, "share": args.share,
+                "documents": documents, "jurisdiction": args.jurisdiction,
+                "counters": [], "supersedes": None}
+    try:
+        prep = client.claim_prepare(project_id, document)
+    except (ApiError, NetworkError) as exc:
+        raise Abort(f"the server refused the claim: {exc}") from exc
+    missing = [s["fingerprint"] for s in prep["signers"] if s["fingerprint"] not in keys]
+    if missing:
+        raise Abort("every listed key must sign: pass --also-sign FILE for "
+                    + ", ".join(missing))
+    kind = "Licence claim" if args.basis == "licensee" else "Ownership claim"
+    who = f"organisation {args.org}" if args.org else "you"
+    _say(f"{kind} on project {project_id}",
+         f"  claimant   {who} ({identity})",
+         f"  basis      {args.basis}",
+         f"  from       {document['effective_at']}",
+         f"  keys       {', '.join(listed)} (each signs)",
+         f"  documents  {len(documents)} (only salted commitments are sent)",
+         f"  {WARRANTY}",
+         "  Claims are public, logged and timestamped; withdrawing ends one but never "
+         "deletes it.")
+    _ask(args, "Sign and record this claim?")
+    sigs = [{"role": s["role"], "public_key": chainseal.public_key(keys[s["fingerprint"]]),
+             "signature": chainseal.sign(keys[s["fingerprint"]], prep["statement"])}
+            for s in prep["signers"]]
+    try:
+        rec = client.claim_finalise(project_id, document, sigs)
+    except (ApiError, NetworkError) as exc:
+        raise Abort(f"the claim was not recorded: {exc}") from exc
+    _checked(client, rec, "claim record")
+    folder = _claims_folder(args)
+    folder.mkdir(parents=True, exist_ok=True)
+    out = folder / f"{rec['imprint_id']}.receipt.json"
+    out.write_text(json.dumps(rec, indent=1, sort_keys=True) + "\n", encoding="utf-8")
+    _say(f"Claim      {rec['imprint_id']}", f"Log        entry #{rec['log']['index']}",
+         f"Receipt    {out}")
+    if private:
+        salts = folder / f"{rec['imprint_id']}.documents.json"
+        salts.write_text(json.dumps(private, indent=1) + "\n", encoding="utf-8")
+        _say(f"Documents  {salts} (the salts: keep this file private; with the file it "
+             "reveals a document, never without it)")
+    return 0
+
+
+def _claim_show(args, client: Client) -> int:
+    if not args.claim:
+        raise Abort("name the claim (CLM1-...)")
+    claim_id = imprint_file.clean_id(args.claim)
+    try:
+        rec = client.public_record(claim_id)
+        _checked(client, rec, "claim record")
+        doc = rec["record"]["document"]
+        view = client.public_ownership(doc["project"])
+    except (ApiError, NetworkError) as exc:
+        raise Abort(f"cannot read the claim: {exc}") from exc
+    c = next((x for x in view["claims"] if x["id"] == claim_id), None)
+    share = f", share {doc['share']}" if doc["share"] else ""
+    _say(f"Claim      {claim_id}  (log entry #{rec['log']['index']}, "
+         f"{rec['attestation']['statement']['attested_at']})")
+    if c:
+        _say(f"           {c['label']}")
+    _say(f"Project    {doc['project']}",
+         f"Basis      {c['basis_label'] if c else doc['basis']}",
+         f"From       {doc['effective_at']}{share}",
+         f"Keys       {', '.join(doc['keys'])}",
+         f"Documents  {len(doc['documents'])} committed by salted hash")
+    if c:
+        state = c["status"] + (f" at {c['ended_at']} ({c['ended_by']})" if c["ended_at"]
+                               else "")
+        _say(f"Status     {state}", f"Covers     {c['covered_seals']} seal(s)")
+    _say("", view.get("disclaimer") or ownership.DISCLAIMER)
+    return 0
+
+
+def cmd_assign(args) -> int:
+    """An assignment from a contributor key to a claim: both sides sign. Run by one side, it
+    writes a file for the other side to complete (`--complete FILE`)."""
+    client = _client(args)
+    keys = _signing_keys(args)
+    if args.complete:
+        data = json.loads(Path(args.complete).read_text(encoding="utf-8"))
+        document, sigs = data["document"], data["signatures"]
+    else:
+        if not args.claim or not args.start:
+            raise Abort("assign: name the claim (CLM1-...) and --from TIME")
+        claim_id = imprint_file.clean_id(args.claim)
+        try:
+            claim = client.public_record(claim_id)
+        except (ApiError, NetworkError) as exc:
+            raise Abort(f"cannot read the claim: {exc}") from exc
+        _checked(client, claim, "claim record")
+        document = {"type": ownership.ASSIGNMENT,
+                    "project": claim["record"]["document"]["project"],
+                    "from_key": (args.from_key or next(iter(keys))).lower(),
+                    "to_claim": claim_id, "from": args.start, "until": args.until}
+        sigs = []
+    roles = {s["role"] for s in sigs}
+    for kfp, key in keys.items():
+        role = "assignor" if kfp == document["from_key"] else "assignee"
+        if role not in roles:
+            sigs.append(_sign_record(key, document, role))
+            roles.add(role)
+    _say(f"Assignment of the seals by key {document['from_key']} from {document['from']} "
+         f"until {document['until'] or 'the claim ends'} to {document['to_claim']}")
+    if roles != {"assignor", "assignee"}:
+        out = Path(args.output or f"assignment-{ownership.digest(document)[:12]}.json")
+        out.write_text(json.dumps({"document": document, "signatures": sigs}, indent=1)
+                       + "\n", encoding="utf-8")
+        _say(f"Signed as  {', '.join(sorted(roles))}; written to {out}",
+             f"Next       the other side runs `imprint assign --complete {out}`")
+        return 0
+    client = _session_client(args)
+    _ask(args, "Record this assignment?")
+    try:
+        rec = client.assignment(document["project"], document, sigs)
+    except (ApiError, NetworkError) as exc:
+        raise Abort(f"the assignment was not recorded: {exc}") from exc
+    _checked(client, rec, "assignment record")
+    _say(f"Assigned   {rec['imprint_id']}", f"Log        entry #{rec['log']['index']}")
+    return 0
+
+
+def cmd_ownership(args) -> int:
+    client = _client(args)
+    project_id = _project_id(args)
+    try:
+        keys, problems = trust.trust_server_keys(client.url, client.published_keys())
+        if problems:
+            raise Abort("the server's attestation keys changed unexpectedly ("
+                        + "; ".join(problems) + ")")
+        view, checks = ownership.verify(client, project_id, keys,
+                                        anchors=_anchors(argparse.Namespace(tsa_certs=None)))
+    except (ApiError, NetworkError) as exc:
+        raise Abort(f"cannot read the ownership listing: {exc}") from exc
+    if args.json:
+        print(json.dumps({"ownership": view, "checks": [c.as_dict() for c in checks]},
+                         indent=1))
+        return 1 if _failed(checks) else 0
+    _say(f"Project    {project_id}", f"Ownership  {view['label']}")
+    for label in view.get("licence_claims") or []:
+        _say(f"Licence    {label}")
+    for c in view["claims"]:
+        end = f", ended {c['ended_at']}" if c["ended_at"] else ""
+        share = f"; share {c['share']}" if c["share"] else ""
+        _say("", f"{c['id']}  {c['label']}",
+             f"  basis {c['basis_label']}; from {c['effective_at']}; {c['status']}{end}; "
+             f"covers {c['covered_seals']} seal(s){share}")
+    _say("", f"{'log':>6}  {'seal':<27} {'signer':<16}  covered by")
+    for s in view["seals"]:
+        by = ", ".join(f"{x['claim']} ({x['reason']})" for x in s["covered_by"]) or (
+            "not covered (key reported compromised)" if s["suspect"] else "not covered")
+        _say(f"{s['log_index']:>6}  {s['seal']:<27} {s['signer'] or '-':<16}  {by}")
+    for w in view.get("warnings") or []:
+        _warn(w)
+    _say("")
+    for c in checks:
+        _say(f"{c.status:<4}  {c.name}: {c.detail}")
+    _say("", view["disclaimer"],
+         "Checked here: every record's receipt and signatures, the claim rules, and each "
+         "seal's coverage. Not checked: that the server listed every record, the evidence "
+         "behind identities, organisation key windows, legal validity.")
+    return 1 if _failed(checks) else 0
+
+
+# -- organisations and contributors (ADR 0002 steps 1.9-1.12) -------------------------------
+def _checked_digest(document: dict, digest: str, statement: dict) -> None:
+    """A prepared record is signed only if its statement is for exactly this document."""
+    from . import records
+
+    if ownership.digest(document) != digest or statement != records.sign_statement(
+            document["type"], digest):
+        raise Abort("the server's statement does not match the document; not signing")
+
+
+def _ascii_domain(domain: str) -> str:
+    """The domain as the server names it: lower case, punycode for international names."""
+    d = domain.strip().rstrip(".").lower()
+    try:
+        return d.encode("idna").decode("ascii")
+    except UnicodeError as exc:
+        raise Abort(f"not a domain name: {domain!r}") from exc
+
+
+def _challenge_path(org: str, domain: str) -> Path:
+    return config.config_dir() / "orgs" / org / f"{domain}.challenge.json"
+
+
+def _org_show(client: Client, org_id: str) -> int:
+    try:
+        org = client.public_org(org_id)
+    except (ApiError, NetworkError) as exc:
+        raise Abort(f"cannot read the organisation: {exc}") from exc
+    _say(f"Organisation {org['org_id']}  ({org['label']})",
+         f"Name       {org['name'] or 'none until a verified domain is disclosed'}"
+         + (f"  ({org['reserved_name']})" if org.get("reserved_name") else ""))
+    for k in org["keys"]:
+        until = f" until {k['valid_until']}" if k["valid_until"] else ""
+        _say(f"Key        {k['fingerprint']}  {k['role']} from {k['valid_from']}{until}")
+    for d in org["domains"]:
+        name = d["domain"] or "(not disclosed)"
+        _say(f"Domain     {name}  {d['status']}, DNSSEC {d['dnssec']}")
+        for w in d.get("warnings") or []:
+            _warn(f"{name}: {w}")
+    for m in org["members"]:
+        until = f" until {m['valid_until']}" if m["valid_until"] else ""
+        _say(f"Member     {m['member_key']}  {m['basis']} from {m['valid_from']}{until}  "
+             f"({m['membership']})")
+    return 0
+
+
+def cmd_org(args) -> int:
+    client = _client(args)
+    if args.action == "show":
+        if not args.org:
+            raise Abort("name the organisation (its ID)")
+        return _org_show(client, args.org)
+    if args.action != "end":                     # records need a signed-in, accepted account
+        client = _session_client(args)
+    keys = _signing_keys(args)
+    fp, key = next(iter(keys.items()))
+    pub = chainseal.public_key(key)
+    if args.action == "create":
+        sc = _session_client(args)
+        _say(f"Create an organisation with your key {fp} as its single admin")
+        _ask(args, "Create it?")
+        try:
+            org = sc.org_create(pub, chainseal.sign(key, {"type": "codeimprint.org-create.v1",
+                                                          "public_key": pub}))
+        except (ApiError, NetworkError) as exc:
+            raise Abort(f"the organisation was not created: {exc}") from exc
+        _say(f"Organisation {org['org_id']}  ({org['label']})",
+             f"Next       imprint org domain {org['org_id']} <domain>")
+        return 0
+    if args.action == "approve":
+        return _org_approve(args, client, key)
+    if not args.org:
+        raise Abort("name the organisation (its ID)")
+    org = args.org
+    if args.action in ("domain", "verify", "disclose") and not args.target:
+        raise Abort(f"{args.action}: name the domain")
+    try:
+        if args.action == "domain":
+            ch = client.org_domain_challenge(org, args.target, pub)
+            path = _challenge_path(org, _ascii_domain(ch["domain"]))
+            path.parent.mkdir(parents=True, exist_ok=True)
+            path.write_text(json.dumps(ch, indent=1) + "\n", encoding="utf-8")
+            _say(f"Publish this DNS TXT record for {ch['domain']}:",
+                 f"  name   {ch['txt_name']}", f"  value  {ch['txt_value']}",
+                 "Use DNSSEC on the domain if you can (pages show \"DNSSEC validated\" or "
+                 "\"not signed\").",
+                 f"Then     imprint org verify {org} {ch['domain']}")
+            for w in (ch.get("assessment") or {}).get("warnings") or []:
+                _warn(w)
+            return 0
+        if args.action == "verify":
+            path = _challenge_path(org, _ascii_domain(args.target))
+            if not path.is_file():
+                raise Abort(f"no saved challenge: run `imprint org domain {org} {args.target}` "
+                            "first")
+            ch = json.loads(path.read_text(encoding="utf-8"))
+            rec = client.org_domain_verify(org, ch["domain"], chainseal.sign(key,
+                                                                            ch["statement"]))
+            _checked(client, rec, "domain identity record")
+            path.unlink()
+            doc = rec["record"]["document"]
+            _say(f"Verified   {ch['domain']} for {org}: identity {rec['imprint_id']}, DNSSEC "
+                 f"{doc['dnssec']}",
+                 "Private    the domain stays private until you disclose it: "
+                 f"imprint org disclose {org} {ch['domain']}")
+            return 0
+        if args.action == "disclose":
+            doc = client.org_disclosure_document(org, args.target)
+            _checked_digest(doc["document"], doc["digest"], doc["statement"])
+            _say(f"Disclose   {doc['document']['value']} for organisation {org}: from now on it "
+                 "is public, and the organisation is shown as \"verified domain "
+                 f"{doc['document']['value']}\"")
+            _ask(args, "Disclose it?")
+            rec = client.org_disclose(org, args.target, pub, chainseal.sign(key,
+                                                                            doc["statement"]))
+            _checked(client, rec, "disclosure record")
+            _say(f"Disclosed  {rec['imprint_id']}  (log entry #{rec['log']['index']})")
+            return 0
+        if args.action == "join":
+            return _org_join(args, client, org, keys)
+        # end a membership
+        if not args.target:
+            raise Abort("end: name the membership (MBR1-...)")
+        membership = imprint_file.clean_id(args.target)
+        rec = client.public_record(membership)
+        member_key = rec["record"]["document"]["member_key"]
+        document = {"type": "codeimprint.org-member-end.v1", "org": org,
+                    "membership": membership, "valid_until": _now_iso()}
+        role = "member" if fp == member_key else "admin"
+        _say(f"End        membership {membership} of key {member_key} now (as the {role}); "
+             "its seals from now on are not covered by the organisation's claims")
+        _ask(args, "End it?")
+        rec = client.org_member_end(org, membership, document["valid_until"],
+                                    [_sign_record(key, document, role)])
+        _checked(client, rec, "membership end record")
+        _say(f"Ended      {rec['imprint_id']}  (log entry #{rec['log']['index']})")
+        return 0
+    except (ApiError, NetworkError) as exc:
+        raise Abort(f"{args.action} failed: {exc}") from exc
+
+
+def _org_join(args, client: Client, org: str, keys: dict) -> int:
+    """The member key asks to join; a company-domain sign-in proves it alone, else the
+    admin approves (here with --also-sign, or later with `imprint org approve FILE`)."""
+    fp, key = next(iter(keys.items()))
+    sc = _session_client(args) if args.basis != "admin-approval" else client
+    p = sc.org_member_prepare(org, chainseal.public_key(key), args.basis)
+    _checked_digest(p["document"], p["digest"], p["statement"])
+    sigs = [{"role": "member", "public_key": chainseal.public_key(key),
+             "signature": chainseal.sign(key, p["statement"])}]
+    _say(f"Join       organisation {org} with key {fp} ({args.basis})")
+    if "admin" in p["roles"]:
+        admins = [k for k in list(keys)[1:]]
+        if not admins:
+            out = Path(args.output or f"membership-{p['digest'][:12]}.json")
+            out.write_text(json.dumps({"org": org, **p, "signatures": sigs}, indent=1) + "\n",
+                           encoding="utf-8")
+            _say(f"Signed as  member; written to {out}",
+                 f"Next       the admin runs `imprint org approve {out}` within an hour")
+            return 0
+        sigs.append({"role": "admin", "public_key": chainseal.public_key(keys[admins[0]]),
+                     "signature": chainseal.sign(keys[admins[0]], p["statement"])})
+    _ask(args, "Join?")
+    rec = client.org_member_finalise(org, p["pending_id"], sigs)
+    _checked(client, rec, "membership record")
+    _say(f"Member     {rec['imprint_id']}  from {rec['record']['document']['valid_from']} "
+         f"(log entry #{rec['log']['index']})")
+    return 0
+
+
+def _org_approve(args, client: Client, key) -> int:
+    if not args.org or not Path(args.org).is_file():
+        raise Abort("approve: name the membership file the member wrote")
+    data = json.loads(Path(args.org).read_text(encoding="utf-8"))
+    _checked_digest(data["document"], data["digest"], data["statement"])
+    d = data["document"]
+    _say(f"Approve    key {d['member_key']} as a member of {d['org']} ({d['basis']}), from "
+         f"{d['valid_from']}")
+    _ask(args, "Approve?")
+    sigs = data["signatures"] + [{"role": "admin", "public_key": chainseal.public_key(key),
+                                  "signature": chainseal.sign(key, data["statement"])}]
+    try:
+        rec = client.org_member_finalise(d["org"], data["pending_id"], sigs)
+    except (ApiError, NetworkError) as exc:
+        raise Abort(f"approval failed: {exc}") from exc
+    _checked(client, rec, "membership record")
+    _say(f"Member     {rec['imprint_id']}  (log entry #{rec['log']['index']})")
+    return 0
+
+
+def cmd_contributor(args) -> int:
+    """A contributor record: the contributor key and a project key sign. Run by one side, it
+    writes a file for the other side to complete (`--complete FILE`)."""
+    client = _client(args)
+    keys = _signing_keys(args)
+    private = None
+    if args.complete:
+        data = json.loads(Path(args.complete).read_text(encoding="utf-8"))
+        document, sigs = data["document"], data["signatures"]
+    else:
+        if not args.role:
+            raise Abort("contributor: give the contributor's --role (for example developer)")
+        document = {"type": "codeimprint.contributor.v1", "project": _project_id(args),
+                    "contributor_key": (args.contributor_key or next(iter(keys))).lower(),
+                    "evidence": "signed-commits", "role": args.role}
+        if args.agreement:
+            if not args.start:
+                raise Abort("an agreement needs --from TIME")
+            agreement = {"kind": args.agreement, "from": args.start, "until": args.until}
+            if args.assigns_to:
+                agreement["assigns_to"] = imprint_file.clean_id(args.assigns_to)
+            if args.agreement_document:
+                c = ownership.document_commitment(Path(args.agreement_document))
+                agreement["commitment"], private = c["commitment"], c
+            document["agreement"] = agreement
+        if args.share:
+            document["share"] = args.share
+        sigs = []
+    roles = {s["role"] for s in sigs}
+    for kfp, key in keys.items():
+        role = "contributor" if kfp == document["contributor_key"] else "project"
+        if role not in roles:
+            sigs.append(_sign_record(key, document, role))
+            roles.add(role)
+    ag = document.get("agreement")
+    _say(f"Contributor key {document['contributor_key']} ({document['role']}) on project "
+         f"{document['project']}" + (f"; {ag['kind']} agreement from {ag['from']}"
+                                     + (f", assigning to {ag['assigns_to']}"
+                                        if ag.get("assigns_to") else "") if ag else ""))
+    if private:
+        folder = _claims_folder(args)
+        folder.mkdir(parents=True, exist_ok=True)
+        salts = folder / f"contributor-{ownership.digest(document)[:12]}.documents.json"
+        salts.write_text(json.dumps([private], indent=1) + "\n", encoding="utf-8")
+        _say(f"Documents  {salts} (the salt: keep this file private)")
+    if roles != {"contributor", "project"}:
+        out = Path(args.output or f"contributor-{ownership.digest(document)[:12]}.json")
+        out.write_text(json.dumps({"document": document, "signatures": sigs}, indent=1) + "\n",
+                       encoding="utf-8")
+        _say(f"Signed as  {', '.join(sorted(roles))}; written to {out}",
+             f"Next       the other side runs `imprint contributor --complete {out}`")
+        return 0
+    client = _session_client(args)
+    _ask(args, "Record this contributor?")
+    try:
+        rec = client.contributor(document["project"], document, sigs)
+    except (ApiError, NetworkError) as exc:
+        raise Abort(f"the contributor record was not recorded: {exc}") from exc
+    _checked(client, rec, "contributor record")
+    _say(f"Recorded   {rec['imprint_id']}  (log entry #{rec['log']['index']})")
+    return 0
+
+
+def cmd_export(args) -> int:
+    client = _client(args)
+    iid = imprint_file.clean_id(args.imprint_id)
+    if not imprint_file.is_valid_id(iid):
+        raise Abort(f"not a valid Imprint ID: {args.imprint_id}")
+    try:
+        doc = client.export(iid)
+    except (ApiError, NetworkError) as exc:
+        raise Abort(f"export failed: {exc}") from exc
+    status = imprint_file.verify_document(doc)
+    bound = doc.get("export_of", {})
+    if not status["valid"] or bound.get("seal") != iid:
+        raise Abort("the export does not verify or names another seal; not saved")
+    rec_path = Path(args.path) / project.CONFIG_DIR / "baseline.receipt.json"
+    if rec_path.is_file():
+        rec = imprint_file.load(rec_path)
+        if rec.get("imprint_id") == iid and bound.get("manifest_root") != rec[
+                "attestation"]["statement"].get("manifest_root"):
+            raise Abort("the export's manifest root differs from the sealed one; not saved")
+    out = Path(args.output) if args.output else Path(f"{iid}.full.imprint")
+    imprint_file.save(doc, out)
+    _say(f"Exported   {iid} -> {out} ({doc.get('unit_count')} units)",
+         f"It is a self-contained Imprint of the seal (export_of: {bound.get('seal')}, "
+         f"manifest root {bound.get('manifest_root', '')[:16]}…); the server checked that its "
+         "units reproduce the sealed manifest root.")
+    return 0
+
+
+def _failed(checks: list[receipt.Check]) -> list[receipt.Check]:
+    return [c for c in checks if c.status == receipt.FAIL]
+
+
+def _developer_key(required: bool = False):
+    try:
+        key = trust.load_developer_key()
+    except ValueError as exc:
+        raise SealFailed(f"cannot read the developer key: {exc}") from exc
+    if key is None and required:
+        raise SealFailed("this project's seals are signed by your developer key, and none was "
+                         "found: run `imprint init` (or set CODEIMPRINT_DEVELOPER_KEY in CI)")
+    return key
+
+
+def _accept(args, client: Client, result: dict) -> tuple[list, list, list[receipt.Check]]:
+    """Trust the server's keys and check the seal before saving anything."""
+    doc, iid = result["imprint"], result["id"]
+    status = imprint_file.verify_document(doc)
+    if not status["valid"] or status["id"] != iid:
+        raise SealFailed("the server returned an Imprint that does not verify; not saved")
+    if not result.get("receipt"):
+        raise SealFailed("the server returned no seal receipt (it predates tamper-evident "
+                         "sealing); not saved")
+    try:
+        published = client.published_keys()
+    except (ApiError, NetworkError) as exc:
+        raise SealFailed(f"cannot fetch the server's keys: {exc}") from exc
+    config.save_hub(client.url, published.get("public_url"))
+    keys, problems = trust.trust_server_keys(client.url, published)
+    if problems:
+        raise SealFailed("the server's attestation keys changed unexpectedly ("
+                         + "; ".join(problems) + "); not saved")
+    anchors = _anchors(args)
+    checks = receipt.verify(result["receipt"], keys, doc, anchors=anchors)
+    bad = _failed(checks)
+    if bad:
+        raise SealFailed("the seal does not verify (" + "; ".join(
+            f"{c.name}: {c.detail}" for c in bad) + "); not saved")
+    return keys, anchors, checks
+
+
+def _finish(args, client: Client, root: Path, result: dict, keys: list,
+            checks: list[receipt.Check], signer: str | None, extra: list[str] = ()) -> int:
+    """Save the Imprint, its receipt and the server keys, then print the summary."""
+    doc, iid, rec = result["imprint"], result["id"], result["receipt"]
+    out = (Path(args.output) if getattr(args, "output", None)
+           else root / project.CONFIG_DIR / "baseline.imprint")
+    imprint_file.save(doc, out)
+    rec_path = receipt_path_for(out)
+    rec_path.write_text(json.dumps(rec, indent=1, sort_keys=True) + "\n", encoding="utf-8")
+    trust.save_project_keys(out.parent, client.url, keys)
+    for warning in rec.get("warnings") or []:
+        _warn(warning)
+    cp, st = rec["log"]["checkpoint"], rec["attestation"]["statement"]
+    stamps = [c for c in checks if c.name.startswith("timestamp")]
+    parents = ", ".join(st.get("parents") or []) or "none"
+    hub = config.hub_url(client.url, getattr(args, "hub_url", None))
+    _say(f"Imprint    {iid}",
+         *([f"Kind       {st['kind']} (parent: {parents})"] if "kind" in st else []),
+         *extra,
+         f"Units      {result['units']}",
+         *([f"Lines      {linecount.summary(doc['lines'])}"] if doc.get("lines") else []),
+         f"Sealed     {st['attested_at']}, attested by {rec['attestation']['key_id']}",
+         f"Log        entry #{rec['log']['index']}, checkpoint of "
+         f"{cp['statement']['tree_size']} entries",
+         "Timestamps")
+    for c in stamps:
+        _say(f"  {c.status:<5} {c.name.removeprefix('timestamp').strip() or '-':<10} {c.detail}")
+    _say(f"Signed     {'developer key ' + signer if signer else 'not signed by you'}",
+         f"Saved      {out}",
+         f"Receipt    {rec_path}",
+         _verify_line(iid, hub, out))
+    if hub:
+        _say("", "README badge:", imprint_file.badge(iid, hub))
+    _say("", SEAL_NOTE)
+    _step_summary(iid, rec, stamps, signer, hub)
+    return 0
+
+
+def _folder_lines(path: str) -> dict:
+    """The line count of a folder sealed as a zip (every file type, docs/line-count.md)."""
+    sel = project.select_files(path, suffixes=None, use_excludes=False)
+    return linecount.count_folder(sel.root, sel.files).payload()
+
+
+def _seal_zip(args, client: Client, data: bytes, project_id: str | None,
+              lines: dict | None = None) -> int:
+    """A zip seal (kind manual): code without Git, or `--zip`. Joins the project's chain
+    when the project is known."""
+    key = _developer_key(required=bool(project_id))
+    try:
+        result = client.seal(data, name=args.name, lines=lines, project_id=project_id)
+        if "pending_id" in result:                       # chained: sign, then finalise
+            pub = chainseal.public_key(key)
+            result = client.finalise(project_id, result["pending_id"], pub,
+                                     chainseal.sign(key, result["statement"]))
+        if lines is not None:
+            chainseal.check_lines(lines, result)
+    except (ApiError, NetworkError) as exc:
+        raise SealFailed(f"sealing failed: {exc}") from exc
+    except RuntimeError as exc:
+        raise SealFailed(str(exc)) from exc
+    if result.get("already_sealed"):
+        _say(f"Already sealed: {result['id']} (this exact content was sealed before)")
+    keys, _unused, checks = _accept(args, client, result)
+    root = Path(args.path)
+    signer = None
+    if project_id:
+        signer = trust.fingerprint(trust.public_raw(key))
+    elif key is not None and not result.get("already_sealed"):
+        expected = project.load_config(root).get("developer") if root.is_dir() else None
+        signer = trust.fingerprint(trust.public_raw(key))
+        if expected and signer != expected:
+            _warn(f"signing with key {signer}, but this project expects {expected}")
+        try:
+            client.add_signature(result["id"], trust.sign_digest(key, result["receipt"]["digest"]))
+            result["receipt"] = client.public_imprint(result["id"])
+        except (ApiError, NetworkError) as exc:
+            _warn(f"the seal is saved but not signed by you: {exc}")
+            signer = None
+        checks = receipt.verify(result["receipt"], keys, result["imprint"],
+                                anchors=_anchors(args))
+        bad = _failed(checks)
+        if bad:
+            raise SealFailed("the signed receipt does not verify (" + "; ".join(
+                f"{c.name}: {c.detail}" for c in bad) + "); not saved")
+    elif key is None:
+        _warn("no developer key, so this seal is not signed by you: run `imprint init` "
+              "(or set CODEIMPRINT_DEVELOPER_KEY in CI)")
+    return _finish(args, client, root, result, keys, checks, signer)
+
+
+def _confirm_upload(args, client: Client):
+    def ask(count: int, size: int) -> bool:
+        _say(f"About to send to {client.url}:",
+             f"  {count} Python file(s) the server has not fingerprinted yet "
+             f"({project.human_size(size)}); everything else is already known to it",
+             f"  {HANDLING['seal']}")
+        if args.yes:
+            return True
+        if not sys.stdin.isatty():
+            raise Abort("not sending without confirmation: pass --yes (for example in CI)")
+        return input("Continue? [y/N] ").strip().lower() in {"y", "yes"}
+    return ask
+
+
+def _seal_git(args, client: Client, root: Path, cfg: dict) -> int:
+    """Incremental seals of one commit or a range (ADR 0001): only new blobs are sent."""
+    key = _developer_key(required=True)
+    try:
+        commits = (gitrepo.commits(root, args.all_commits) if args.all_commits
+                   else [gitrepo.resolve(root, args.rev)])
+    except gitrepo.GitError as exc:
+        raise Abort(f"cannot read the repository: {exc}") from exc
+    last = None
+    for i, commit in enumerate(commits):
+        try:
+            tag = args.tag
+            if args.kind == "release" and not tag:
+                tag = next(iter(gitrepo.tags_at(root, commit)), None)
+            out = chainseal.seal_commit(client, root, cfg["project_id"], commit, args.kind, key,
+                                        cfg.get("exclude"), _confirm_upload(args, client),
+                                        tag=tag, public_tag=args.public_tag)
+        except (ApiError, NetworkError) as exc:
+            raise SealFailed(f"sealing failed: {exc}") from exc
+        except (gitrepo.GitError, RuntimeError) as exc:
+            raise SealFailed(str(exc)) from exc
+        if out.get("cancelled"):
+            raise Abort("cancelled; nothing was sent")
+        if "release" in out:
+            _finish_release(args, client, root, out, key)
+            continue
+        if out.get("released"):
+            _say(f"Already released: {out['released']} labels seal {out['already']} with this "
+                 f"tag (commit {commit[:12]}; nothing logged)")
+            continue
+        if "already" in out:
+            _say(f"Already sealed: {out['already']} (commit {commit[:12]}: this tree is "
+                 "already in the project's chain; no new seal, nothing logged)")
+            continue
+        chainseal.record(root, out["result"], commit, out["info"]["ref"])
+        if i < len(commits) - 1:
+            _say(f"sealed {commit[:12]} as {out['result']['id']} "
+                 f"({out['uploaded']} file(s) uploaded)")
+        last = out
+    if last is None:
+        return 0
+    result = last["result"]
+    keys, _a, checks = _accept(args, client, result)
+    signer = trust.fingerprint(trust.public_raw(key))
+    extra = [f"Commit     {last['commit'][:12]}" + (f" ({last['info']['ref']})"
+                                                     if last["info"]["ref"] else ""),
+             (f"Files      {last['files']} Python file(s); uploaded {last['uploaded']} "
+              f"({project.human_size(last['upload_bytes'])}), the rest were already "
+              "fingerprinted")]
+    rel = result["imprint"].get("release")
+    if rel:
+        extra.append(f"Tag        {last['tag']} (public)" if "tag" in rel else
+                     f"Tag        {last['tag']} (private: only a salted commitment is public; "
+                     "--public-tag publishes it)")
+    return _finish(args, client, root, result, keys, checks, signer, extra)
+
+
+def _finish_release(args, client: Client, root: Path, out: dict, key) -> None:
+    """Check a release record's receipt, save it, and print the summary."""
+    result = out["release"]
+    rid, rec, rel = result["id"], result["receipt"], result["release"]
+    try:
+        keys, problems = trust.trust_server_keys(client.url, client.published_keys())
+    except (ApiError, NetworkError) as exc:
+        raise SealFailed(f"cannot fetch the server's keys: {exc}") from exc
+    if problems:
+        raise SealFailed("the server's attestation keys changed unexpectedly ("
+                         + "; ".join(problems) + "); not saved")
+    checks = receipt.verify(rec, keys, None, anchors=_anchors(args))
+    bad = _failed(checks)
+    if bad:
+        raise SealFailed("the release record does not verify (" + "; ".join(
+            f"{c.name}: {c.detail}" for c in bad) + "); not saved")
+    folder = root / project.CONFIG_DIR
+    folder.mkdir(parents=True, exist_ok=True)
+    rec_path = folder / f"{rid}.receipt.json"
+    rec_path.write_text(json.dumps(rec, indent=1, sort_keys=True) + "\n", encoding="utf-8")
+    trust.save_project_keys(folder, client.url, keys)
+    chainseal.record(root, result, out["commit"], out["info"]["ref"])
+    for warning in rec.get("warnings") or []:
+        _warn(warning)
+    st, cp = rec["attestation"]["statement"], rec["log"]["checkpoint"]
+    tag = out.get("tag")
+    tag_line = ("none (pass --tag NAME)" if not tag else f"{tag} (public)" if "tag" in rel
+                else f"{tag} (private: only a salted commitment is public; --public-tag "
+                     "publishes it)")
+    _say(f"Release    {rid}",
+         f"Of seal    {rel['seal']} (commit {out['commit'][:12]}: this tree was already sealed)",
+         f"Tag        {tag_line}",
+         f"Sealed     {st['attested_at']}, attested by {rec['attestation']['key_id']}",
+         f"Log        entry #{rec['log']['index']}, checkpoint of "
+         f"{cp['statement']['tree_size']} entries",
+         "Timestamps")
+    for c in checks:
+        if c.name.startswith("timestamp"):
+            _say(f"  {c.status:<5} {c.name.removeprefix('timestamp').strip() or '-':<10} "
+                 f"{c.detail}")
+    signer = trust.fingerprint(trust.public_raw(key))
+    _say(f"Signed     developer key {signer}",
+         f"Receipt    {rec_path}",
+         _verify_line(rid, config.hub_url(client.url, getattr(args, "hub_url", None)),
+                      rec_path), "", SEAL_NOTE)
+
+
+def _anchors(args) -> list:
+    """Trusted TSA roots: the pinned ones, plus a PEM bundle the user chose (--tsa-certs)."""
+    from . import timestamp
+
+    try:
+        return timestamp.load_anchors(getattr(args, "tsa_certs", None))
+    except (OSError, ValueError) as exc:
+        raise Abort(f"cannot read --tsa-certs {args.tsa_certs}: {exc}") from exc
+
+
+def _step_summary(iid: str, rec: dict, stamps: list[receipt.Check], signer: str | None,
+                  hub: str | None = None) -> None:
+    """In GitHub Actions, show the seal and its timestamp lines on the run's summary page."""
+    path = os.environ.get("GITHUB_STEP_SUMMARY")
+    if not path:
+        return
+    lines = [f"### CodeImprint seal `{iid}`", "",
+             (f"- Log entry #{rec['log']['index']}, attested "
+              f"{rec['attestation']['statement']['attested_at']}"),
+             f"- Developer signature: {signer or 'none'}",
+             f"- Verify: {verify_url(iid, hub) or 'imprint verify (no hub URL known)'}", "",
+             "| Timestamp | Result | Detail |",
+             "| --- | --- | --- |"]
+    lines += [f"| {c.name.removeprefix('timestamp').strip() or '-'} | {c.status} | "
+              f"{c.detail.replace('|', '/')} |" for c in stamps]
+    with open(path, "a", encoding="utf-8") as f:
+        f.write("\n".join(lines) + "\n\n")
+
+
+def cmd_seal(args) -> int:
+    client = _client(args)
+    root = Path(args.path)
+    cfg = project.load_config(root) if root.is_dir() else {}
+    try:
+        if cfg.get("project_id") and not args.zip and gitrepo.is_repo(root):
+            if not gitrepo.has_commits(root):
+                raise Abort("this repository has no commits yet: commit first, then seal")
+            rc = _seal_git(args, client, root, cfg)
+        else:
+            data = _prepare_upload(args.path, "seal", client, args.yes)
+            rc = _seal_zip(args, client, data, cfg.get("project_id"), _folder_lines(args.path))
+    except SealFailed as exc:
+        if _ci():                       # never break a build by surprise
+            _warn(f"seal skipped — {exc}")
+            return 0
+        raise
+    if rc == 0 and not getattr(args, "all_commits", None):
+        try:
+            key = _developer_key()
+        except SealFailed:
+            key = None
+        if key is not None:
+            _offer_identity(args, key, once=True)       # the first seal on this server
+    return rc
+
+
+# -- project names and the GitHub App (CIM-BE-19-v1) ---------------------------------------
+def cmd_project(args) -> int:
+    key = _developer_key(required=True)
+    project_id = _project_id(args)
+    _rename(_client(args), project_id, key, args.name, not args.private)
+    return 0
+
+
+GITHUB_MODES = {
+    "upgrade": "The App made this project with a key CodeImprint holds. Your developer key "
+               "becomes its key too, and authorises the App's key to keep sealing pushes: "
+               "the project moves to your own key (non-custodial).",
+    "attach": "This repository will be sealed into your existing project {project}: your key "
+              "adds the App's key to it and authorises it to seal pushes. The project the App "
+              "made ({replaces}) stays, with its history.",
+    "authorise": "Your key authorises the App's key to seal pushes into this project.",
+}
+
+
+def cmd_github(args) -> int:
+    key = _developer_key(required=True)
+    root = Path(args.path)
+    repository = args.repository
+    if not repository and gitrepo.is_repo(root):
+        host, name = gitrepo.repository_name(gitrepo.remote_url(root))
+        repository = name if host == "github.com" else None
+    if not repository:
+        raise Abort("no GitHub repository: pass --repository owner/repo (the origin remote is "
+                    "not on github.com)")
+    cfg = project.load_config(root) if root.is_dir() else {}
+    project_id = args.project or cfg.get("project_id")
+    pub = chainseal.public_key(key)
+    sc = _session_client(args)
+    try:
+        prep = sc.github_link_prepare(repository, pub, project_id)
+    except (ApiError, NetworkError) as exc:
+        raise Abort(f"cannot link {repository}: {exc}") from exc
+    fp = trust.fingerprint(trust.public_raw(key))
+    if prep["mode"] == "authorised":
+        _say(f"Repository {repository}", f"Project    {prep['project_id']} (custody: "
+             f"{prep.get('custody', 'owner')})", f"Already authorised by your key {fp} "
+             f"({prep['authorisation']}): nothing to do.")
+        return 0
+    doc = prep["document"]
+    if doc.get("authorised_by") != fp or doc.get("project") != prep["project_id"]:
+        raise Abort("the server's authorisation names another key or project; not signing")
+    _checked_digest(doc, prep["statement"]["digest"], prep["statement"])
+    _say(f"Repository {repository}",
+         f"Project    {prep['project_id']}",
+         f"App key    {doc['key']} (held by CodeImprint; scope: {', '.join(doc['scope'])})",
+         f"Your key   {fp}", "",
+         GITHUB_MODES[prep["mode"]].format(project=prep["project_id"],
+                                           replaces=prep.get("replaces")), "",
+         "You can withdraw it later by retiring the App's key from the project.")
+    _ask(args, "Sign the authorisation (INT1) with your developer key?")
+    try:
+        done = sc.github_link_finalise(
+            repository, pub, project_id, chainseal.sign(key, prep["statement"]),
+            chainseal.sign(key, prep["key_statement"]) if prep.get("key_statement") else None)
+    except (ApiError, NetworkError) as exc:
+        raise Abort(f"linking failed: {exc}") from exc
+    _checked(sc, done["receipt"], "authorisation record")
+    folder = root / project.CONFIG_DIR
+    if root.is_dir() and (folder.is_dir() or gitrepo.is_repo(root)):
+        folder.mkdir(parents=True, exist_ok=True)
+        (folder / f"{done['authorisation']}.receipt.json").write_text(
+            json.dumps(done["receipt"], indent=1, sort_keys=True) + "\n", encoding="utf-8")
+        if not cfg.get("project_id"):
+            cfg_path = folder / project.CONFIG_FILE
+            current = project.load_config(root)
+            current["project_id"] = done["project_id"]
+            current.setdefault("developer", fp)
+            cfg_path.write_text(json.dumps(current, indent=2) + "\n", encoding="utf-8")
+            _say(f"Saved      project {done['project_id']} in .imprint/config.json")
+    _say(f"Authorised {done['authorisation']}  (log entry #{done['receipt']['log']['index']})",
+         f"Custody    {done['custody']}: your key {fp} controls the project's chain; the App "
+         "seals each push with its own key, authorised by yours")
+    return 0
+
+
+def _print_result(r: dict, fail_above: float) -> None:
+    _say(f"Reference  {r.get('reference')}",
+         f"Suspect    {r.get('suspect')}",
+         "",
+         f"Score      {r['score']:.2f}  ({r['band']})   reverse {r['reverse_score']:.2f}",
+         f"Matched    {len(r['matches'])} of {r['reference_units']} reference units "
+         f"(coverage {r['coverage']:.0%})")
+    if r["matches"]:
+        _say("", "Top matching units:")
+        for m in r["matches"][:10]:
+            ref = m["reference"].get("label") or f"unit {m['reference']['uid']}"
+            sus = m["suspect"].get("label") or f"unit {m['suspect']['uid']}"
+            _say(f"  {m['similarity']:.2f}  {ref}  <->  {sus}")
+    _say("", f"Fails at   {fail_above:.2f}", f"Note: {r.get('note') or DISCLAIMER}")
+
+
+def cmd_check(args) -> int:
+    root = Path(args.path)
+    cfg = project.load_config(root) if root.is_dir() else {}
+    reference = args.reference or os.environ.get("CODEIMPRINT_REFERENCE") or cfg.get("reference")
+    if not reference:
+        raise Abort("no reference: pass --reference <Imprint ID>")
+    if not imprint_file.is_valid_id(reference):
+        raise Abort(f"not a valid Imprint ID: {reference}")
+    fail_above = args.fail_above if args.fail_above is not None else float(
+        cfg.get("fail_above", DEFAULT_FAIL_ABOVE))
+    client = _client(args)
+    data = _prepare_upload(args.path, "check", client, args.yes)
+    try:
+        result = client.check(data, imprint_file.clean_id(reference))
+    except NetworkError as exc:
+        # Never break a build by surprise: an unreachable server is a warning, not a failure.
+        _warn(f"check skipped — {exc}")
+        return 0
+    except ApiError as exc:
+        if exc.status in {401, 403, 429} or exc.status >= 500:
+            _warn(f"check skipped — {exc}")
+            return 0
+        raise Abort(f"check failed: {exc}") from exc
+    if args.output:
+        Path(args.output).write_text(json.dumps(result, indent=2) + "\n", encoding="utf-8")
+    if args.format == "json":
+        print(json.dumps(result, indent=2))
+    else:
+        _print_result(result, fail_above)
+    return 1 if result["score"] >= fail_above else 0
+
+
+# -- verify --------------------------------------------------------------------------------
+def _project_root(path: Path) -> Path:
+    folder = path.resolve().parent
+    return folder.parent if folder.name == project.CONFIG_DIR else folder
+
+
+def _load_target(args) -> tuple[dict | None, dict | None, Path]:
+    """Find the .imprint document and the receipt for a file or an Imprint ID."""
+    target = Path(args.target)
+    if target.is_file():
+        try:
+            data = imprint_file.load(target)
+        except (OSError, ValueError) as exc:
+            raise Abort(f"cannot read {target}: {exc}") from exc
+        if isinstance(data, dict) and data.get("format") == imprint_file.FORMAT:
+            rec_path = Path(args.receipt) if args.receipt else receipt_path_for(target)
+            rec = imprint_file.load(rec_path) if rec_path.is_file() else None
+            return data, rec, _project_root(target)
+        if isinstance(data, dict) and "attestation" in data:
+            doc_path = target.with_name(target.name.removesuffix(".receipt.json") + ".imprint")
+            doc = imprint_file.load(doc_path) if doc_path.is_file() else None
+            return doc, data, _project_root(target)
+        raise Abort(f"{target} is neither an .imprint file nor a seal receipt")
+    if not imprint_file.is_valid_id(args.target, imprint_file.ALL_PREFIXES):
+        raise Abort(f"no such file, and not an Imprint ID: {args.target}")
+    iid = imprint_file.clean_id(args.target)
+    root = Path(args.project or ".")
+    for rec_path in sorted((root / project.CONFIG_DIR).glob("*.receipt.json")):
+        rec = imprint_file.load(rec_path)
+        if rec.get("imprint_id") == iid:
+            doc_path = rec_path.with_name(rec_path.name.removesuffix(".receipt.json")
+                                          + ".imprint")
+            return (imprint_file.load(doc_path) if doc_path.is_file() else None), rec, root
+    if not args.online:
+        raise Abort(f"no local receipt for {iid} in {root / project.CONFIG_DIR}: pass "
+                    "--online to fetch its public record")
+    return None, None, root
+
+
+def _trusted_keys(args, root: Path, client: Client | None,
+                  checks: list[receipt.Check]) -> list[dict]:
+    if args.keys:
+        try:
+            keys = trust.load_keys_file(args.keys)
+        except (OSError, ValueError, KeyError) as exc:
+            raise Abort(f"cannot read {args.keys}: {exc}") from exc
+        checks.append(receipt.Check("keys", receipt.PASS, f"pinned from {args.keys}"))
+        return keys
+    if client is not None:
+        try:
+            keys, problems = trust.trust_server_keys(client.url, client.published_keys())
+        except (ApiError, NetworkError) as exc:
+            raise Abort(f"cannot fetch the server's keys: {exc}") from exc
+        if problems:
+            checks.append(receipt.Check("keys", receipt.FAIL, "the server's published keys "
+                                        "do not extend the ones trusted before: "
+                                        + "; ".join(problems)))
+            return trust.load_trusted().get(client.url, [])
+        checks.append(receipt.Check("keys", receipt.PASS, f"trusted for {client.url}, "
+                                    "consistent with every earlier fetch"))
+        return keys
+    keys = trust.all_trusted_keys()
+    if keys:
+        checks.append(receipt.Check("keys", receipt.PASS,
+                                    "cached from earlier contact with the server"))
+        return keys
+    project_keys = root / project.CONFIG_DIR / trust.PROJECT_KEYS
+    if project_keys.is_file():
+        checks.append(receipt.Check("keys", receipt.WARN, f"read from {project_keys}, which "
+                                    "travels with the code: pin keys with --keys FILE or "
+                                    "check --online for an independent check"))
+        return trust.load_keys_file(project_keys)
+    return []
+
+
+def _server_from_project(root: Path) -> str | None:
+    path = root / project.CONFIG_DIR / trust.PROJECT_KEYS
+    try:
+        return json.loads(path.read_text(encoding="utf-8")).get("server")
+    except (OSError, ValueError, AttributeError):
+        return None
+
+
+def _file_only(doc: dict) -> list[receipt.Check]:
+    status = imprint_file.verify_document(doc)
+    sig = ("not signed" if not status["signed"] else
+           f"OK (signer {status['signer']})" if status["signature_ok"] else "INVALID")
+    return [receipt.Check("digest", receipt.PASS if status["digest_ok"] else receipt.FAIL,
+                          "OK" if status["digest_ok"] else "MISMATCH — the file was changed"),
+            receipt.Check("file signature",
+                          receipt.FAIL if status["signature_ok"] is False else receipt.PASS,
+                          sig),
+            receipt.Check("receipt", receipt.WARN, "none found: this file is not sealed in a "
+                          "transparency log (run `imprint seal`)")]
+
+
+def cmd_verify(args) -> int:
+    if not args.target:
+        default = Path(".imprint") / "baseline.imprint"
+        if not default.is_file():
+            args.verify_parser.error("the following arguments are required: target")
+        args.target = str(default)
+    doc, rec, root = _load_target(args)
+    checks: list[receipt.Check] = []
+    client = _client(args, _server_from_project(root)) if args.online else None
+    if rec is None and client is not None:
+        iid = imprint_file.clean_id(args.target) if doc is None else (
+            imprint_file.verify_document(doc)["id"])
+        try:
+            rec = (client.public_record(iid)
+                   if iid.split("-", 1)[0] in imprint_file.RECORD_PREFIXES
+                   else client.public_imprint(iid))
+        except ApiError as exc:
+            if doc is None:
+                raise Abort(f"no public record for {iid}: {exc}") from exc
+        except NetworkError as exc:
+            raise Abort(str(exc)) from exc
+    if rec is None:
+        checks = _file_only(doc)
+        iid = imprint_file.verify_document(doc)["id"]
+    else:
+        iid = rec.get("imprint_id")
+        keys = _trusted_keys(args, root, client, checks)
+        developer = project.load_config(root).get("developer") if root.is_dir() else None
+        anchors = _anchors(args)
+        if args.tsa_certs:
+            extra = len(anchors) - len(PINNED_ROOTS)
+            checks.append(receipt.Check("tsa roots", receipt.WARN,
+                                        f"also trusting {extra} certificate(s) from "
+                                        f"{args.tsa_certs}, beyond the pinned roots"))
+        checks += receipt.verify(rec, keys, doc, developer=args.developer or developer,
+                                 anchors=anchors)
+        if client is not None and keys:
+            try:
+                checks += receipt.verify_online(rec, client, keys, anchors)
+            except (ApiError, NetworkError, KeyError) as exc:
+                checks.append(receipt.Check("log consistency", receipt.FAIL,
+                                            f"cannot check the live log: {exc}"))
+    failed = [c for c in checks if c.status == receipt.FAIL]
+    warned = [c for c in checks if c.status == receipt.WARN]
+    valid = not failed and not (args.strict and warned)
+    if args.json:
+        print(json.dumps({"imprint_id": iid, "valid": valid,
+                          "checks": [c.as_dict() for c in checks]}, indent=2))
+    else:
+        _say(f"{'Record ' if rec and 'record' in rec else 'Imprint'}    {iid}", "")
+        for c in checks:
+            _say(f"{c.status:<5} {c.name:<20} {c.detail}")
+        verdict = ("VALID" if valid else
+                   f"NOT VALID ({len(failed)} check(s) failed)" if failed else
+                   f"NOT VALID with --strict ({len(warned)} warning(s))")
+        _say("", f"Result     {verdict}", "", SEAL_NOTE)
+    return 0 if valid else 1
+
+
+# -- parser --------------------------------------------------------------------------------
+def build_parser() -> argparse.ArgumentParser:
+    p = argparse.ArgumentParser(prog="imprint", description="CodeImprint by Mudrika — seal and "
+                                "check your code with a CodeImprint server.")
+    p.add_argument("--version", action="version", version=f"codeimprint {__version__}")
+    sub = p.add_subparsers(dest="command", required=True)
+
+    lg = sub.add_parser("login", help="sign in (browser or e-mail link), or save an API token")
+    lg.add_argument("--url", help="server URL, for example https://imprint.example.com")
+    lg.add_argument("--provider", choices=["github", "gitlab", "google", "microsoft", "email"],
+                    help="sign in with this provider (default: the first one the server offers)")
+    lg.add_argument("--email", help="your address, for --provider email")
+    lg.add_argument("--no-browser", action="store_true",
+                    help="print the sign-in link instead of opening the browser")
+    lg.add_argument("--api-token", action="store_true",
+                    help="save an API token for seal and check instead of signing in")
+    lg.add_argument("--token-stdin", action="store_true",
+                    help="read an API token from stdin (CI) instead of signing in")
+    lg.add_argument("--cf-access", action="store_true",
+                    help="also save a Cloudflare Access service token for this server (asks for "
+                         "the Client ID and Secret)")
+    lg.add_argument("--public-url", help=argparse.SUPPRESS)   # retired: the server names the hub
+    lg.set_defaults(func=cmd_login)
+
+    n = sub.add_parser("init", help="create your developer key, .imprint/config.json and a "
+                                    "GitHub workflow")
+    n.add_argument("path", nargs="?", default=".")
+    n.add_argument("--no-ci", action="store_true", help="do not add a GitHub workflow")
+    n.add_argument("--no-key", action="store_true", help="do not create a developer key")
+    n.add_argument("--force", action="store_true", help="overwrite files that already exist")
+    n.add_argument("--url", help="server URL for creating the project (else login or "
+                                 "CODEIMPRINT_URL)")
+    n.add_argument("--no-project", action="store_true",
+                   help="do not create the project and its genesis seal now")
+    n.add_argument("--name", help="the project's display name (default: owner/repo from the "
+                                  "origin remote, else the folder's name); public")
+    n.set_defaults(func=cmd_init)
+
+    pj = sub.add_parser("project", help="the project's display name: rename")
+    pj.add_argument("action", choices=["rename"])
+    pj.add_argument("name", help="the new name (1-100 characters)")
+    pj.add_argument("path", nargs="?", default=".")
+    pj.add_argument("--private", action="store_true",
+                    help="show the name to you only, not on the public project page")
+    pj.add_argument("--project", help="project ID (default: .imprint/config.json)")
+    pj.add_argument("--url", help="server URL (overrides login and CODEIMPRINT_URL)")
+    pj.set_defaults(func=cmd_project)
+
+    gh = sub.add_parser("github", help="the GitHub App: link this repository's project to your "
+                                       "developer key")
+    gh.add_argument("action", choices=["link"])
+    gh.add_argument("path", nargs="?", default=".")
+    gh.add_argument("--repository", help="owner/repo (default: the origin remote on github.com)")
+    gh.add_argument("--project", help="your existing project to attach (default: "
+                                      ".imprint/config.json, else the App's project)")
+    gh.add_argument("--yes", action="store_true", help="sign without asking")
+    gh.add_argument("--url", help="server URL (overrides login and CODEIMPRINT_URL)")
+    gh.set_defaults(func=cmd_github)
+
+    s = sub.add_parser("seal", help="seal a project on the server; saves .imprint/baseline.imprint "
+                                    "and its receipt")
+    s.add_argument("path", nargs="?", default=".")
+    s.add_argument("--name", help="project name to store in the Imprint (optional)")
+    s.add_argument("--hub-url", help="hub for the verify link and badge (default: "
+                                     "CODEIMPRINT_HUB_URL, else the hub the server names)")
+    s.add_argument("-o", "--output", help="where to save the Imprint")
+    s.add_argument("--url", help="server URL (overrides login and CODEIMPRINT_URL)")
+    s.add_argument("--yes", action="store_true", help="do not ask before uploading (CI)")
+    s.add_argument("--tsa-certs", metavar="FILE",
+                   help="also trust the time-stamping authorities in this PEM bundle")
+    s.add_argument("--kind", choices=["commit", "push", "release"], default="commit",
+                   help="seal kind in a Git repository (default commit)")
+    s.add_argument("--rev", default="HEAD", help="commit to seal (default HEAD)")
+    s.add_argument("--all-commits", metavar="RANGE",
+                   help="seal every commit in a range, oldest first (for example v1.0..HEAD)")
+    s.add_argument("--tag", help="release tag to record (default: the tag on the commit); "
+                                 "kept private unless --public-tag")
+    s.add_argument("--public-tag", action="store_true",
+                   help="publish the tag name in the release record")
+    s.add_argument("--zip", action="store_true",
+                   help="send the folder as a zip even in a Git repository")
+    s.set_defaults(func=cmd_seal)
+    hk = sub.add_parser("hook", help="install or run the Git hook that seals each commit or push")
+    hk.add_argument("action", choices=["install", "run"])
+    hk.add_argument("path", nargs="?", default=".")
+    hk.add_argument("--on", choices=["commit", "push"], default="commit")
+    hk.set_defaults(func=cmd_hook)
+
+    ch = sub.add_parser("chain", help="show the project's chain (server, plus this clone's commits)")
+    ch.add_argument("path", nargs="?", default=".")
+    ch.add_argument("--project", help="project ID (default: .imprint/config.json)")
+    ch.add_argument("--url", help="server URL (overrides login and CODEIMPRINT_URL)")
+    ch.set_defaults(func=cmd_chain)
+
+    idn = sub.add_parser("identity", help="your developer key's verified identity: show, bind, "
+                                          "revoke")
+    idn.add_argument("action", choices=["show", "bind", "revoke"])
+    idn.add_argument("record", nargs="?", help="revoke: the identity record (IDT1-...)")
+    idn.add_argument("--level", choices=["email", "vcs"], default="email",
+                     help="bind: e-mail (a verified address) or vcs (GitHub/GitLab account)")
+    idn.add_argument("--show-email-domain", action="store_true",
+                     help="bind: show your e-mail's domain publicly (never the address)")
+    idn.add_argument("--reason", choices=["holder-request", "key-compromised", "withdrawn"],
+                     default="holder-request", help="revoke: why")
+    idn.add_argument("--compromised-since", metavar="TIME",
+                     help="revoke --reason key-compromised: UTC time, e.g. 2026-11-01T12:00:00Z")
+    idn.add_argument("--key", help="show: another key's fingerprint")
+    idn.add_argument("--url", help="server URL (overrides login and CODEIMPRINT_URL)")
+    idn.set_defaults(func=cmd_identity)
+
+    cl = sub.add_parser("claim", help="ownership claims: create, show, withdraw, add-key, "
+                                      "retire-key")
+    cl.add_argument("action", choices=["create", "show", "withdraw", "add-key", "retire-key"])
+    cl.add_argument("claim", nargs="?", help="the claim (CLM1-...), except for create")
+    cl.add_argument("--basis", choices=["original-author", "employer", "assignee", "licensee"],
+                    default="original-author", help="create: on what basis (licensee is a "
+                                                    "licence claim, not ownership)")
+    cl.add_argument("--org", help="create: claim for this organisation (you hold its admin key)")
+    cl.add_argument("--identity", help="create: your identity record (default: your key's "
+                                       "valid one)")
+    cl.add_argument("--effective-at", metavar="TIME", help="create: UTC time the claim starts "
+                                                           "(default now)")
+    cl.add_argument("--share", help='create: a share such as "0.5" (default: whole)')
+    cl.add_argument("--jurisdiction", help="create: ISO 3166 code, e.g. AU")
+    cl.add_argument("--document", action="append", metavar="KIND=FILE",
+                    help="create: commit to a supporting document (only a salted hash is "
+                         "sent); KIND is employment-contract, assignment, licence, cla or other")
+    cl.add_argument("--also-sign", action="append", metavar="KEYFILE",
+                    help="another key (PEM) that must sign: a listed key, or the new key for "
+                         "add-key")
+    cl.add_argument("--key", help="retire-key: the key's fingerprint")
+    cl.add_argument("--project", help="project ID (default: .imprint/config.json)")
+    cl.add_argument("--path", default=".", help="the project folder (default: .)")
+    cl.add_argument("--url", help="server URL (overrides login and CODEIMPRINT_URL)")
+    cl.add_argument("--yes", action="store_true", help="do not ask before signing")
+    cl.set_defaults(func=cmd_claim)
+
+    asg = sub.add_parser("assign", help="assign a contributor key's seals to a claim (both "
+                                        "sides sign)")
+    asg.add_argument("claim", nargs="?", help="the claim (CLM1-...) the seals are assigned to")
+    asg.add_argument("--from", dest="start", metavar="TIME", help="start of the window (UTC)")
+    asg.add_argument("--until", metavar="TIME", help="end of the window (default: none)")
+    asg.add_argument("--from-key", metavar="FINGERPRINT",
+                     help="the contributor key (default: your developer key)")
+    asg.add_argument("--also-sign", action="append", metavar="KEYFILE",
+                     help="the other side's key (PEM), if you hold it")
+    asg.add_argument("--complete", metavar="FILE", help="add your signature to a file the "
+                                                        "other side wrote, and submit it")
+    asg.add_argument("-o", "--output", help="where to write a half-signed assignment")
+    asg.add_argument("--url", help="server URL (overrides login and CODEIMPRINT_URL)")
+    asg.add_argument("--yes", action="store_true", help="do not ask before submitting")
+    asg.set_defaults(func=cmd_assign)
+
+    own = sub.add_parser("ownership", help="show and verify a project's ownership claims and "
+                                           "the seals they cover")
+    own.add_argument("action", choices=["show"])
+    own.add_argument("path", nargs="?", default=".")
+    own.add_argument("--project", help="project ID (default: .imprint/config.json)")
+    own.add_argument("--json", action="store_true")
+    own.add_argument("--url", help="server URL (overrides login and CODEIMPRINT_URL)")
+    own.set_defaults(func=cmd_ownership)
+
+    og = sub.add_parser("org", help="organisations: create, show, domain, verify, disclose, join, "
+                                    "approve, end")
+    og.add_argument("action", choices=["create", "show", "domain", "verify", "disclose", "join",
+                                       "approve", "end"])
+    og.add_argument("org", nargs="?", help="the organisation's ID (approve: the membership file)")
+    og.add_argument("target", nargs="?",
+                    help="domain, verify, disclose: the domain; end: the membership (MBR1-...)")
+    og.add_argument("--basis", choices=["admin-approval", "domain-email", "google-workspace",
+                                        "microsoft-365"], default="admin-approval",
+                    help="join: how membership is proven (the others use your sign-in on the "
+                         "organisation's verified domain)")
+    og.add_argument("--also-sign", action="append", metavar="KEYFILE",
+                    help="join: the admin key (PEM), if you hold it")
+    og.add_argument("-o", "--output", help="join: where to write the membership for the admin")
+    og.add_argument("--url", help="server URL (overrides login and CODEIMPRINT_URL)")
+    og.add_argument("--yes", action="store_true", help="do not ask before signing")
+    og.set_defaults(func=cmd_org)
+
+    ct = sub.add_parser("contributor", help="record a contributor key on a project (the "
+                                            "contributor and a project key sign)")
+    ct.add_argument("--role", help="the contributor's role, for example developer")
+    ct.add_argument("--contributor-key", metavar="FINGERPRINT",
+                    help="the contributor's key (default: your developer key)")
+    ct.add_argument("--agreement", choices=["cla", "dco", "employment", "contract",
+                                            "assignment"], help="an agreement with the "
+                                                                "contributor")
+    ct.add_argument("--assigns-to", metavar="CLAIM",
+                    help="the claim (CLM1-...) the agreement assigns rights to (not for dco)")
+    ct.add_argument("--from", dest="start", metavar="TIME", help="the agreement's start (UTC)")
+    ct.add_argument("--until", metavar="TIME", help="the agreement's end (default: none)")
+    ct.add_argument("--agreement-document", metavar="FILE",
+                    help="commit to the signed agreement (only a salted hash is sent)")
+    ct.add_argument("--share", help='a share such as "0.25" (optional)')
+    ct.add_argument("--also-sign", action="append", metavar="KEYFILE",
+                    help="the other side's key (PEM), if you hold it")
+    ct.add_argument("--complete", metavar="FILE", help="add your signature to a file the other "
+                                                       "side wrote, and submit it")
+    ct.add_argument("-o", "--output", help="where to write a half-signed record")
+    ct.add_argument("--project", help="project ID (default: .imprint/config.json)")
+    ct.add_argument("--path", default=".", help="the project folder (default: .)")
+    ct.add_argument("--url", help="server URL (overrides login and CODEIMPRINT_URL)")
+    ct.add_argument("--yes", action="store_true", help="do not ask before submitting")
+    ct.set_defaults(func=cmd_contributor)
+
+    ex = sub.add_parser("export", help="download the full Imprint of a Git seal (owner)")
+    ex.add_argument("imprint_id")
+    ex.add_argument("path", nargs="?", default=".")
+    ex.add_argument("-o", "--output", help="where to save it (default <ID>.full.imprint)")
+    ex.add_argument("--url", help="server URL (overrides login and CODEIMPRINT_URL)")
+    ex.set_defaults(func=cmd_export)
+
+
+    c = sub.add_parser("check", help="check a project against a reference Imprint")
+    c.add_argument("path", nargs="?", default=".")
+    c.add_argument("--reference", help="Imprint ID of the reference stored on the server")
+    c.add_argument("--fail-above", type=float,
+                   help=f"exit 1 when the score reaches this value (default {DEFAULT_FAIL_ABOVE})")
+    c.add_argument("--format", choices=["text", "json"], default="text")
+    c.add_argument("-o", "--output", help="also write the JSON result to this file")
+    c.add_argument("--url", help="server URL (overrides login and CODEIMPRINT_URL)")
+    c.add_argument("--yes", action="store_true", help="do not ask before uploading (CI)")
+    c.set_defaults(func=cmd_check)
+
+    v = sub.add_parser("verify", help="verify a seal offline: .imprint file, receipt or ID")
+    v.add_argument("target", nargs="?",
+                   help=".imprint file, .receipt.json file or Imprint ID (default: "
+                        ".imprint/baseline.imprint in this folder)")
+    v.add_argument("--receipt", help="the receipt (default: <name>.receipt.json next to it)")
+    v.add_argument("--keys", metavar="FILE",
+                   help="trust only these server keys (a codeimprint-keys.json)")
+    v.add_argument("--developer", metavar="FINGERPRINT",
+                   help="require a signature by this developer key")
+    v.add_argument("--online", action="store_true",
+                   help="also check the server's live log (consistency, order, registry)")
+    v.add_argument("--project", help="where to look for receipts when given an ID")
+    v.add_argument("--url", help="server URL for --online")
+    v.add_argument("--tsa-certs", metavar="FILE",
+                   help="also trust the time-stamping authorities in this PEM bundle")
+    v.add_argument("--strict", action="store_true", help="treat warnings as failures")
+    v.add_argument("--json", action="store_true")
+    v.set_defaults(func=cmd_verify, verify_parser=v)
+    return p
+
+
+TERMS_HINT = ("accept the CodeImprint terms of service and privacy notice first: open "
+              "{account}, sign in and accept them, then run this again")
+
+
+def _terms_hint(server_url: str | None) -> str:
+    hub = config.hub_url(server_url)
+    return TERMS_HINT.format(account=f"{hub}/account" if hub else "your account page on the hub")
+
+
+def main(argv: list[str] | None = None) -> int:
+    args = build_parser().parse_args(argv)
+    try:
+        return args.func(args)
+    except (Abort, FileNotFoundError, ValueError) as exc:
+        cause = exc.__cause__
+        if isinstance(cause, ApiError) and cause.code == "terms_required":
+            exc = _terms_hint(config.resolve(getattr(args, "url", None)).url)
+        print(f"imprint: error: {exc}", file=sys.stderr)
+        return 2
+    except KeyboardInterrupt:
+        print("imprint: cancelled", file=sys.stderr)
+        return 130
+
+
+if __name__ == "__main__":
+    sys.exit(main())