Skip to content

Other sessions

One session open per machine at a time. Every report lists your signer's sessions: started, sealed, never sealed.

Signer key

  • Made on first use, kept in your config folder (~/.config/kveritas/). Survives kveritas update.
  • Every init is signed with it. The server keeps the key's sessions: start time, run count, sealed or not. No code, data or results.
  • seal adds the history, signed by K-Veritas.
Signer:     key 4f71e1405c09eb7b, first seen 2026-03-02 14:10, history signed by K-Veritas
Sessions:   23 started, 21 sealed, 2 never sealed
  fb6a50c7  started 2026-10-20 14:02, 1 run, never sealed
  • A first session shows: New signer: no earlier history, other attempts cannot be ruled out.
  • Online, verify also shows sessions started after the seal.
  • Each event's hash goes into the ledger.

One session at a time

init (or a first run) refuses while another session is open on this machine:

Error: session fb6a50c7 is still open on this machine (started 2026-10-20T14:02). Seal it, or remove it with: kveritas clean fb6a50c7
  • kveritas seal: finish it.
  • kveritas clean: remove it completely, here and on the server. No report lists it.

Sessions open on your other linked machines are shown, not blocked.

Several machines

kveritas key link            # new machine: prints a code
kveritas key link AB12-CD34-EF56   # machine with your history

One history for both. CI: kveritas key export, stored as the KVERITAS_SIGNER_KEY secret.

Lost or leaked key

kveritas key revoke <fingerprint>   # from another linked machine
kveritas key revoke                  # this machine: new key, same history

A revoked key cannot start or seal sessions.

Offline

init --local: the history is kept on your machine and shown as self-reported, like SELF-ATTESTED.

Limits

Attempts made outside K-Veritas are not counted. A new key escapes the history but shows as a new signer.