autonomy lock fingerprint

Compute or verify the BLAKE3 behavioral fingerprint of a lock file

Synopsis

Reads an autonomy.lock.json from --in and computes its BLAKE3
behavioral fingerprint over canonical bytes (key-sorted JSON, fingerprint excluded).

Without --verify: prints the fingerprint to stdout (format: blake3:<64-hex-chars>).
                  Stores the value inside the file when writing back.
With    --verify: checks the stored behavioral_fingerprint field against the
                  recomputed BLAKE3 value; exits non-zero on mismatch (CI gate mode).

Usage

autonomy lock fingerprint [flags]

Options

      --in string   input lock file path (.json) (default "autonomy.lock.json")
      --verify      verify stored fingerprint instead of computing a new one (CI gate mode)

Options inherited from parent commands

      --require-signed-manifest   Refuse to start if the SHA256SUMS release manifest or its cosign signature is missing/invalid (Tier 2 binary-integrity check; default: build-time compile-in via -ldflags -X, build-hardened artifacts=true, all others=false)

See also