Recovery

Nothing inside the console can mend a broken console, so recovery is three commands run outside it. They need AWS administrator credentials for the account, which Warden never holds. Each is a command you run; none runs on a schedule.

The console is broken: warden refresh

warden refresh

refresh re-applies the effective state through the install gate, the console’s edge included. When the release you adopted fails console health, it rolls back to the previous adopted release, within the release floors, and says so on the owner address. The command reads what your keepers signed. It does not change a setting.

The door is lost: warden door reissue

warden door reissue <e-mail>

The door is the sign-in account that opens the console and nothing else. door reissue sends a new temporary password to a person whose effective record names them: a keeper, an open invitation, or a viewer. A person who has already signed in is not touched. The address you type is not said back.

The door cannot approve, sign or change policy. Approval always takes a passkey.

No console to reach: warden authority sign-offline

The console is required: the first signature and every signed change happen in it. When it cannot be reached, a keeper whose passkey is a key that signs a raw challenge outside a browser, such as a security key with its own tool, can sign a record on a machine of their own. A passkey kept in a password manager signs only on the signing page, so get the console back first with warden refresh. It is never needed for a setting while the console works.

warden authority sign-offline <body> [--assertion <file> --out <file>] [--from <export>]

1. Draft the body as a file.
2. Run sign-offline <body>. It checks the body against the ledger and prints what your key must sign: the challenge, the client data hash, the relying party and your live keys.
3. Have your passkey sign that challenge, then run the command again with --assertion <file> --out <file>. It verifies the key’s answer and writes the signed record.
4. Hand the record to the notary with warden authority submit <record>, using your own operator role.

sign-offline and authority submit refuse the kinds that come after launch (cluster.enrol, cluster.rekey, cluster.unenrol, ember.except, ember.drill, witness.bind, witness.change, witness.ack and chain.acknowledge) with the same sentence the console gives: nothing at launch acts on them.

Reading the ledger without the console

These read the authority ledger with your own AWS read access, or from an export, and need no console.

warden authority verify [--from <export>]
warden authority show [--at <instant>] [--from <export>]
warden authority export [--out <file>]
warden authority sign-offline <body> [--assertion <file> --out <file>] [--from <export>]
warden authority submit <record>

• verify folds the ledger and prints its head, alarms and refusals. It exits 0 only on a clean fold with no critical or high alarm.
• show prints the folded state: keepers, decisions, freezes, policy and license. With --at it shows the state at a UTC instant, judged then.
• export writes every object version as one hashed file that a later verify --from folds without AWS.

Exit codes