maqpna dev attest
Print a sandbox's kernel, rootfs and image digests and prove its egress is the gateway only
Synopsis#
maqpna dev attest [--session S] [--sandbox kosa8] [-o json]Description#
From the help of maqpna dev:
up starts maqpna-identity, maqpna-gateway and (unless --no-echo) mcp-echo from the installed binaries (next to maqpna or on PATH); in a source checkout with --from-source, or when they are missing, they are built with go build. run mints a session token from the local broker and runs CMD with the same environment the operator gives a sandbox (MAQPNA_GATEWAY_URL, MAQPNA_TOKEN, MAQPNA_SESSION, MAQPNA_AGENT, MAQPNA_TOOL_<NAME>_URL), then prints what the session did. Exit code: CMD's. up --llamay MODEL also serves MODEL with llamay as model route "llamay": each session gets its own llamay inference context, forked with the session, and llamay's request audit is anchored in the ledger (fail closed). up --kosa8 serves the gateway on this host's LAN address and cross-anchors the ledger with kosa8d's audit; run --kosa8-image then runs CMD in a kosa8 microVM that can reach only the gateway, and fork live-forks a kept sandbox into a governed child session with its own token. snapshot checkpoints a kept sandbox together with its llamay inference contexts; restore boots the checkpoint as a new session (its own token, the checkpointed session as parent) and resumes those contexts. attest prints the sandbox's measurements (kernel, rootfs, image digests) and proves its egress is the gateway only (exit code 3 when it is not).
Flags#
| Flag | Type | Description | Default |
|---|---|---|---|
--dir | string | state directory (keys, config, ledger, logs) | .maqpna |
--sandbox | string | sandbox driver (agent-sandbox, e2b, kosa8) | kosa8 |
--session | string | session (default: the last one) | none |
The global flags (--context, -o, --no-color, ...) work with every command.
Examples#
maqpna dev attest --session dev-1a2b3c4d -o jsonWhat happens when you run it#
- Prints a table by default;
-o jsonor-o yamlprint the data, and--jq EXPRfilters the JSON.
Exit codes#
| Code | Meaning |
|---|---|
0 | success |
1 | error (the message says what failed, with a hint when there is one) |
2 | usage error: unknown flag, missing argument or bad value; the synopsis is printed |
3 | a check failed, a change is blocked, or a result did not match (tamper, policy mismatch) (not used by this command) |