Module identity_tool 

Publisher identity management for the Hara CLI.

Private keys remain behind HARA_SIGNER. This client exchanges only canonical enrollment bytes, detached signatures and public key material.

Functions

canonical_enrollment

enroll_with_signer

Enroll a publisher key with a caller-owned signer. This lets an embedding host keep the private key in-process while the legacy CLI retains its external HARA_SIGNER adapter.

grant_policy_with_signer

Applies one reviewed, exact-coordinate grant to a policy and signs the exact replacement bytes with the caller-owned offline root signer. This function never contacts GitHub and refuses to replace a different key or authorization service key under an existing identifier.

publisher_proof_message

request_publication_authorization_with_signer

Obtains the short-lived authorization submitted alongside a canonical publisher intent. Registry intake independently verifies both this proof and the root-signed publisher grant.

request_publisher_grant_with_signer

Starts the browser-backed grant request used when a locally signed policy does not yet authorize the publisher key. The service receives only public material and the detached proof over its fresh device challenge.

run