Bundled mandate-register CLI (ARC-0024): Univocity instance provisioning, onboarding, and BYOK custody-mode operations. Published to public npmjs with SLSA provenance (FOR-360) — no registry token, no GitHub account, no relationship with the mandate operator is required to install or run it.

That is the point: the exit paths documented in FORKING.md and ADR-0005 are only credible if a forker can drive them with tooling the operator cannot gate. This package is that tooling.

Usage (tokenless)

npx @forestrie/mandate-register            # list subcommands
npx @forestrie/mandate-register provision --mode B ...
npx @forestrie/mandate-register onboard request ...

Subcommands:

Command	Purpose
`onboard request` / `status` / `redeem`	Self-service onboard token flow (FOR-173)
`provision`	Full genesis + descriptor emission (FOR-100)
`privy onboard-mode-c`	Mode C Privy wallet onboarding (FOR-112)
`privy revoke-mode-c`	Mode C kill switch — remove mandate as signer (FOR-114)
`privy describe-post-revoke-actions`	Post-revoke KEY_DIRECTORY checklist (FOR-131)
`privy exit-to-mode-b`	Repoint agent signing to a user-operated signer (FOR-311)

Exiting to Mode B

The Mode C→B exit (ADR-0005 operational appendix, FORKING.md §5b) runs entirely through this CLI:

# step 2 — revoke mandate's signer access on the user-owned wallet
npx @forestrie/mandate-register privy revoke-mode-c \
  --wallet-id <id> --mandate-signer-id <quorum-id> ...

# step 3 — repoint the deployed agent at a user-operated signer
npx @forestrie/mandate-register privy exit-to-mode-b \
  --log-id <32-hex> --signer-url https://<your-signer>/v1/sign ...

publicRoot is unchanged by the exit (ARC-0022 I5): the same key keeps signing under a new operator with no re-registration.

Development

Build bundles @mandate/register + @mandate/privy-admin with esbuild:

pnpm --filter @forestrie/mandate-register build
pnpm --filter @forestrie/mandate-register test

Releasing

Tag mandate-register-v<version> (matching package.json) on main; publish-mandate-register.yml publishes to npmjs via OIDC trusted publishing in the npm-publish environment. Cross-repo consumers (e.g. forestrie/system-testing) install via their manifest kits pins.

@forestrie/mandate-register