@umbra-privacy/qos-ceremony

Operator CLI for QOS TEE ceremonies. Run the steps that require your operator key — keygen, share, approve, provision, status — plus shift-traffic (blue-green cutover). Your master seed never leaves your device; all crypto runs in qos_client.

Ships no coordinator code. qos_client is embedded for common platforms (darwin-arm64, linux-x64); on others, install it and point QOS_CLIENT_BIN / --qos-client at it.

Install

npm i -g @umbra-privacy/qos-ceremony      # provides the `qos-ceremony` command

Use

export CEREMONY_API=https://<coordinator>/ \
       CEREMONY_NAMESPACE=<service> CEREMONY_NONCE=<nonce> \
       CEREMONY_ALIAS=p1 CEREMONY_SECRET=/path/to/p1.secret

qos-ceremony keygen                # once, offline — generate your key; give the pubkey to an admin
qos-ceremony share                 # shareSet: derive + upload your (encrypted) genesis share
qos-ceremony approve --yes         # manifestSet: review + sign the manifest (verify the pivot hash!)
qos-ceremony provision             # shareSet: re-encrypt your share to the enclave's ephemeral key
qos-ceremony status                # read-only phase + blockers

shift-traffic (ops, needs AWS creds): qos-ceremony shift-traffic --service arith --stack <s> --weights '{"<old>":0,"<new>":100}'.

Commands

| Command | Set | What | | --------------- | ----------- | --------------------------------------------------------- | | keygen | any | generate seed (local) + print pubkey to register | | share | shareSet | derive quorum-key share from genesis; upload (ciphertext) | | approve | manifestSet | review + sign the manifest | | provision | shareSet | re-encrypt share to the enclave ephemeral key; post it | | status | — | read-only phase + blockers | | shift-traffic | ops | blue-green weighted ALB cutover across a service's colors |

Flags mirror env: --api --namespace --nonce --alias --secret-path --yubikey --pcr3-preimage-path --qos-release-dir --qos-client.