chio passport

chio passport

Create, verify, and present Agent Passport bundles.

chio passport [OPTIONS] <COMMAND>

• chio passport generate Synthesize a trust-tier-enriched Agent Passport for a named agent.
• chio passport create Create a single-issuer Agent Passport from local receipt and lineage data.
• chio passport verify Verify a passport and every embedded credential without external glue code.
• chio passport evaluate Evaluate a passport against a relying-party verifier policy.
• chio passport present Produce a filtered presentation from an existing passport.
• chio passport policy Create, verify, and manage signed verifier-policy artifacts.
• chio passport challenge Create and verify challenge-bound passport presentations.
• chio passport status Publish, resolve, and revoke passport lifecycle state.
• chio passport issuance Deliver Chio passports through an OID4VCI-style pre-authorized issuance flow.
• chio passport oid4vp Create and consume Chio’s narrow OID4VP verifier and holder interop flow.

chio passport generate

Synthesize a trust-tier-enriched Agent Passport for a named agent.

chio passport generate [OPTIONS] --agent <AGENT>

• --agent <AGENT> Agent identifier (DID or opaque subject) to stamp on the passport. Required.
• --output <OUTPUT> Optional output path for the passport JSON. When omitted, the passport is printed to stdout.
• --compliance-score <COMPLIANCE_SCORE> Compliance score override (0..=1000). Defaults to 1000 when omitted so that a freshly provisioned agent surfaces as Premier rather than Unverified.
• --behavioral-anomaly When set, treats the agent as having an active behavioral anomaly and caps the synthesized tier below Premier.
• --validity-days <VALIDITY_DAYS> Passport validity period in days. Default 30.

chio passport create

Create a single-issuer Agent Passport from local receipt and lineage data.

chio passport create [OPTIONS] --output <OUTPUT> --signing-seed-file <SIGNING_SEED_FILE>

• --subject-public-key <SUBJECT_PUBLIC_KEY> Subject Ed25519 public key in hex.
• --output <OUTPUT> Output path for the passport JSON. Required.
• --signing-seed-file <SIGNING_SEED_FILE> Persistent seed file used to sign the embedded reputation credential. Required.
• --validity-days <VALIDITY_DAYS> Passport validity period in days. Default 30.
• --since <SINCE> Optional lower bound for the attested receipt window, in Unix seconds.
• --until <UNTIL> Optional upper bound for the attested receipt window, in Unix seconds.
• --receipt-log-url <RECEIPT_LOG_URLS> Optional receipt log service endpoint(s) to embed in attestation evidence.
• --require-checkpoints Fail if any selected receipt lacks checkpoint coverage.
• --enterprise-identity <ENTERPRISE_IDENTITY> Optional enterprise identity context JSON to embed as portable provenance.
• --agent <AGENT> Agent to select, by the name you gave it (fixer) or its DID; resolved to the agent’s subject key from the operator’s agents.

chio passport verify

Verify a passport and every embedded credential without external glue code.

chio passport verify [OPTIONS] --input <INPUT>

• --input <INPUT> Passport JSON file to verify. Required.
• --at <AT> Verification timestamp override in Unix seconds. Defaults to now.
• --passport-statuses-file <PASSPORT_STATUSES_FILE> Local passport lifecycle registry file to inspect when not using --control-url.

chio passport evaluate

Evaluate a passport against a relying-party verifier policy.

chio passport evaluate [OPTIONS] --input <INPUT> --policy <POLICY>

• --input <INPUT> Passport JSON file to evaluate. Required.
• --policy <POLICY> YAML or JSON verifier policy file. Required.
• --at <AT> Verification timestamp override in Unix seconds. Defaults to now.
• --passport-statuses-file <PASSPORT_STATUSES_FILE> Local passport lifecycle registry file to inspect when not using --control-url.

chio passport present

Produce a filtered presentation from an existing passport.

chio passport present [OPTIONS] --input <INPUT> --output <OUTPUT>

• --input <INPUT> Input passport JSON file. Required.
• --output <OUTPUT> Output path for the presented passport JSON. Required.
• --issuer <ISSUERS> Optional issuer DID allowlist. Repeat to allow multiple issuers.
• --max-credentials <MAX_CREDENTIALS> Maximum number of credentials to include in the presentation.

chio passport policy

Create, verify, and manage signed verifier-policy artifacts.

chio passport policy [OPTIONS] <COMMAND>

• chio passport policy create Create a signed verifier-policy artifact from a raw policy file.
• chio passport policy verify Verify a signed verifier-policy artifact.
• chio passport policy list List verifier-policy artifacts from a local registry or remote service.
• chio passport policy get Read one verifier-policy artifact.
• chio passport policy upsert Create or update one verifier-policy artifact in a local registry or remote service.
• chio passport policy delete Delete one verifier-policy artifact from a local registry or remote service.

chio passport policy create

Create a signed verifier-policy artifact from a raw policy file.

chio passport policy create [OPTIONS] --output <OUTPUT> --policy-id <POLICY_ID> --verifier <VERIFIER> --signing-seed-file <SIGNING_SEED_FILE> --policy <POLICY> --expires-at <EXPIRES_AT>

• --output <OUTPUT> Output path for the signed verifier-policy document JSON. Required.
• --policy-id <POLICY_ID> Stable verifier policy ID. Required.
• --verifier <VERIFIER> Relying-party identifier or audience string that owns this policy. Required.
• --signing-seed-file <SIGNING_SEED_FILE> Persistent seed file used to sign the verifier policy. Required.
• --policy <POLICY> YAML or JSON file containing the raw verifier policy body. Required.
• --expires-at <EXPIRES_AT> Policy expiration as Unix seconds. Required.
• --verifier-policies-file <VERIFIER_POLICIES_FILE> Optional local verifier policy registry to update after creation.

chio passport policy verify

Verify a signed verifier-policy artifact.

chio passport policy verify [OPTIONS] --input <INPUT>

• --input <INPUT> Signed verifier-policy document JSON file. Required.
• --at <AT> Verification timestamp override in Unix seconds. Defaults to now.

chio passport policy list

List verifier-policy artifacts from a local registry or remote service.

chio passport policy list [OPTIONS]

• --verifier-policies-file <VERIFIER_POLICIES_FILE> Local verifier policy registry file to inspect when not using --control-url.

chio passport policy get

Read one verifier-policy artifact.

chio passport policy get [OPTIONS] --policy-id <POLICY_ID>

• --policy-id <POLICY_ID> Verifier policy ID to fetch. Required.
• --verifier-policies-file <VERIFIER_POLICIES_FILE> Local verifier policy registry file to inspect when not using --control-url.

chio passport policy upsert

Create or update one verifier-policy artifact in a local registry or remote service.

chio passport policy upsert [OPTIONS] --input <INPUT>

• --input <INPUT> Input JSON file containing a signed verifier-policy document. Required.
• --verifier-policies-file <VERIFIER_POLICIES_FILE> Local verifier policy registry file to update when not using --control-url.

chio passport policy delete

Delete one verifier-policy artifact from a local registry or remote service.

chio passport policy delete [OPTIONS] --policy-id <POLICY_ID>

• --policy-id <POLICY_ID> Verifier policy ID to delete. Required.
• --verifier-policies-file <VERIFIER_POLICIES_FILE> Local verifier policy registry file to update when not using --control-url.

chio passport challenge

Create and verify challenge-bound passport presentations.

chio passport challenge [OPTIONS] <COMMAND>

• chio passport challenge create Create a presentation challenge for a relying party.
• chio passport challenge respond Respond to a presentation challenge using the passport subject key.
• chio passport challenge submit Submit a signed challenge response to a public verifier transport URL.
• chio passport challenge verify Verify a challenge-bound passport presentation response.

chio passport challenge create

Create a presentation challenge for a relying party.

chio passport challenge create [OPTIONS] --output <OUTPUT> --verifier <VERIFIER>

• --output <OUTPUT> Output path for the challenge JSON. Required.
• --verifier <VERIFIER> Relying-party identifier or audience string. Required.
• --ttl-secs <TTL_SECS> Challenge lifetime in seconds. Default 300.
• --issuer <ISSUERS> Optional issuer DID allowlist for selective disclosure. Repeat to allow multiple issuers.
• --max-credentials <MAX_CREDENTIALS> Maximum number of credentials a holder may disclose.
• --policy <POLICY> Optional verifier policy to embed in the challenge.
• --policy-id <POLICY_ID> Optional stored verifier policy ID to reference instead of embedding raw policy.
• --verifier-policies-file <VERIFIER_POLICIES_FILE> Optional verifier policy registry file used when resolving --policy-id locally.
• --verifier-challenge-db <VERIFIER_CHALLENGE_DB> Optional SQLite challenge-state database used for replay-safe local verification.

chio passport challenge respond

Respond to a presentation challenge using the passport subject key.

chio passport challenge respond [OPTIONS] --input <INPUT> --holder-seed-file <HOLDER_SEED_FILE> --output <OUTPUT>

• --input <INPUT> Input passport JSON file. Required.
• --challenge <CHALLENGE> Input challenge JSON file.
• --challenge-url <CHALLENGE_URL> Public holder-facing challenge URL.
• --holder-seed-file <HOLDER_SEED_FILE> Existing seed file for the passport subject key. Required.
• --output <OUTPUT> Output path for the signed response JSON. Required.
• --at <AT> Response timestamp override in Unix seconds. Defaults to now.

chio passport challenge submit

Submit a signed challenge response to a public verifier transport URL.

chio passport challenge submit [OPTIONS] --input <INPUT> --submit-url <SUBMIT_URL>

• --input <INPUT> Input response JSON file. Required.
• --submit-url <SUBMIT_URL> Public submit URL returned by the verifier transport. Required.

chio passport challenge verify

Verify a challenge-bound passport presentation response.

chio passport challenge verify [OPTIONS] --input <INPUT>

• --input <INPUT> Input response JSON file. Required.
• --challenge <CHALLENGE> Optional expected challenge JSON file for exact-match verification.
• --verifier-policies-file <VERIFIER_POLICIES_FILE> Optional verifier policy registry file used to resolve policy references locally.
• --verifier-challenge-db <VERIFIER_CHALLENGE_DB> Optional SQLite challenge-state database used for replay-safe local verification.
• --passport-statuses-file <PASSPORT_STATUSES_FILE> Local passport lifecycle registry file to inspect when not using --control-url.
• --at <AT> Verification timestamp override in Unix seconds. Defaults to now.

chio passport status

Publish, resolve, and revoke passport lifecycle state.

chio passport status [OPTIONS] <COMMAND>

• chio passport status publish Publish one passport into the lifecycle registry as the current active artifact.
• chio passport status list List lifecycle records from a local registry or remote service.
• chio passport status get Read one lifecycle record by passport id.
• chio passport status resolve Resolve lifecycle state for a passport artifact id.
• chio passport status revoke Revoke one passport lifecycle record.

chio passport status publish

Publish one passport into the lifecycle registry as the current active artifact.

chio passport status publish [OPTIONS] --input <INPUT>

• --input <INPUT> Passport JSON file to publish. Required.
• --passport-statuses-file <PASSPORT_STATUSES_FILE> Local passport lifecycle registry file to update when not using --control-url.
• --resolve-url <RESOLVE_URLS> Optional resolve endpoint verifiers can query for lifecycle state.
• --cache-ttl-secs <CACHE_TTL_SECS> Optional cache TTL verifiers may apply to lifecycle state.

chio passport status list

List lifecycle records from a local registry or remote service.

chio passport status list [OPTIONS]

• --passport-statuses-file <PASSPORT_STATUSES_FILE> Local passport lifecycle registry file to inspect when not using --control-url.

chio passport status get

Read one lifecycle record by passport id.

chio passport status get [OPTIONS] --passport-id <PASSPORT_ID>

• --passport-id <PASSPORT_ID> Passport artifact id to fetch. Required.
• --passport-statuses-file <PASSPORT_STATUSES_FILE> Local passport lifecycle registry file to inspect when not using --control-url.

chio passport status resolve

Resolve lifecycle state for a passport artifact id.

chio passport status resolve [OPTIONS] --passport-id <PASSPORT_ID>

• --passport-id <PASSPORT_ID> Passport artifact id to resolve. Required.
• --passport-statuses-file <PASSPORT_STATUSES_FILE> Local passport lifecycle registry file to inspect when not using --control-url.

chio passport status revoke

Revoke one passport lifecycle record.

chio passport status revoke [OPTIONS] --passport-id <PASSPORT_ID>

• --passport-id <PASSPORT_ID> Passport artifact id to revoke. Required.
• --passport-statuses-file <PASSPORT_STATUSES_FILE> Local passport lifecycle registry file to update when not using --control-url.
• --reason <REASON> Optional revocation reason.
• --revoked-at <REVOKED_AT> Optional revocation timestamp override in Unix seconds.

chio passport issuance

Deliver Chio passports through an OID4VCI-style pre-authorized issuance flow.

chio passport issuance [OPTIONS] <COMMAND>

• chio passport issuance metadata Render OID4VCI-style issuer metadata for Chio passport issuance.
• chio passport issuance offer Create a pre-authorized credential offer for one Chio passport.
• chio passport issuance token Redeem a pre-authorized code into an issuance access token.
• chio passport issuance credential Redeem an issuance access token into the delivered Chio passport.

chio passport issuance metadata

Render OID4VCI-style issuer metadata for Chio passport issuance.

chio passport issuance metadata [OPTIONS]

• --issuer-url <ISSUER_URL> Local credential issuer base URL when not using --control-url.
• --signing-seed-file <SIGNING_SEED_FILE> Optional local signing seed used to advertise the standards-native portable credential profile.
• --passport-status-url <PASSPORT_STATUS_URL> Optional public passport lifecycle resolve endpoint to advertise in local metadata.
• --passport-status-cache-ttl-secs <PASSPORT_STATUS_CACHE_TTL_SECS> Optional cache hint paired with --passport-status-url in local metadata.

chio passport issuance offer

Create a pre-authorized credential offer for one Chio passport.

chio passport issuance offer [OPTIONS] --input <INPUT>

• --input <INPUT> Input passport JSON file to deliver. Required.
• --output <OUTPUT> Optional output path for the credential offer JSON.
• --issuer-url <ISSUER_URL> Local credential issuer base URL when not using --control-url.
• --passport-issuance-offers-file <PASSPORT_ISSUANCE_OFFERS_FILE> Local issuance registry file to update when not using --control-url.
• --passport-statuses-file <PASSPORT_STATUSES_FILE> Optional local passport lifecycle registry used to require published active status before portable issuance.
• --signing-seed-file <SIGNING_SEED_FILE> Optional local signing seed required when offering portable compact credential configurations.
• --credential-configuration-id <CREDENTIAL_CONFIGURATION_ID> Optional credential configuration ID. Defaults to Chio’s single passport profile.
• --ttl-secs <TTL_SECS> Offer lifetime in seconds. Default 600.

chio passport issuance token

Redeem a pre-authorized code into an issuance access token.

chio passport issuance token [OPTIONS] --offer <OFFER>

• --offer <OFFER> Input credential offer JSON file. Required.
• --output <OUTPUT> Optional output path for the token response JSON.
• --passport-issuance-offers-file <PASSPORT_ISSUANCE_OFFERS_FILE> Local issuance registry file to update when not using --control-url.

chio passport issuance credential

Redeem an issuance access token into the delivered Chio passport.

chio passport issuance credential [OPTIONS] --offer <OFFER> --token <TOKEN>

• --offer <OFFER> Input credential offer JSON file. Required.
• --token <TOKEN> Input token response JSON file. Required.
• --output <OUTPUT> Optional output path for the delivered passport JSON.
• --passport-issuance-offers-file <PASSPORT_ISSUANCE_OFFERS_FILE> Local issuance registry file to update when not using --control-url.
• --passport-statuses-file <PASSPORT_STATUSES_FILE> Optional local passport lifecycle registry used to attach portable lifecycle status references.
• --signing-seed-file <SIGNING_SEED_FILE> Optional local signing seed required when redeeming portable compact credential configurations without --control-url.
• --credential-configuration-id <CREDENTIAL_CONFIGURATION_ID> Optional credential configuration ID override used for fail-closed validation.
• --credential-format <CREDENTIAL_FORMAT> Optional format override used for fail-closed validation.

chio passport oid4vp

Create and consume Chio’s narrow OID4VP verifier and holder interop flow.

chio passport oid4vp [OPTIONS] <COMMAND>

• chio passport oid4vp create Create a replay-safe verifier request on the running trust-control service.
• chio passport oid4vp respond Build one holder response from a verifier request or launch URL.
• chio passport oid4vp submit Submit a previously created OID4VP response JWT.
• chio passport oid4vp metadata Fetch and display the public verifier metadata document.

chio passport oid4vp create

Create a replay-safe verifier request on the running trust-control service.

chio passport oid4vp create [OPTIONS]

• --output <OUTPUT> Optional output path for the verifier request JSON.
• --claim <DISCLOSURE_CLAIMS> Requested selective-disclosure claims. Repeat to request multiple claims.
• --issuer <ISSUER_ALLOWLIST> Optional issuer allowlist. Repeat to allow multiple issuers.
• --ttl-secs <TTL_SECS> Optional request lifetime in seconds.
• --identity-subject <IDENTITY_SUBJECT> Optional continuity subject to embed in the bounded identity assertion lane.
• --identity-continuity-id <IDENTITY_CONTINUITY_ID> Optional continuity ID to embed in the bounded identity assertion lane.
• --identity-provider <IDENTITY_PROVIDER> Optional upstream provider label for the bounded identity assertion lane.
• --identity-session-hint <IDENTITY_SESSION_HINT> Optional session hint for the bounded identity assertion lane.
• --identity-ttl-secs <IDENTITY_TTL_SECS> Optional identity-assertion lifetime in seconds. Defaults to the request TTL.

chio passport oid4vp respond

Build one holder response from a verifier request or launch URL.

chio passport oid4vp respond [OPTIONS] --input <INPUT> --holder-seed-file <HOLDER_SEED_FILE>

• --input <INPUT> Input portable SD-JWT VC credential file. Required.
• --request-url <REQUEST_URL> Direct verifier request URI.
• --same-device-url <SAME_DEVICE_URL> Same-device openid4vp://authorize?... launch URL.
• --cross-device-url <CROSS_DEVICE_URL> Cross-device HTTPS launch URL.
• --holder-seed-file <HOLDER_SEED_FILE> Existing seed file for the portable credential subject key. Required.
• --output <OUTPUT> Optional output path for the signed response JWT.
• --submit Submit to the verifier’s response URI after building the response.
• --submit-url <SUBMIT_URL> Override submit URL instead of using the request’s response_uri.
• --at <AT> Response timestamp override in Unix seconds. Defaults to now.

chio passport oid4vp submit

Submit a previously created OID4VP response JWT.

chio passport oid4vp submit [OPTIONS] --input <INPUT> --submit-url <SUBMIT_URL>

• --input <INPUT> Input response JWT file. Required.
• --submit-url <SUBMIT_URL> Public verifier response URL. Required.

chio passport oid4vp metadata

Fetch and display the public verifier metadata document.

chio passport oid4vp metadata [OPTIONS] --verifier-url <VERIFIER_URL>

• --verifier-url <VERIFIER_URL> Base verifier URL, for example https://verifier.example.com. Required.