behalf

Overview ¶

`behalf demo` is the live-demo driver (ENG-25): the commands that put a machine into a known state before a scenario and the small amount of stage machinery the scenarios need.

The audience for this file is one person typing on a Zoom call. That constrains it more than the rest of the CLI:

• Reset must be one command, idempotent, and it must say what it did. The second scenario on a call otherwise runs against the wreckage of the first, and the failure shows up in front of a customer.
• The demo state lives at one default path and the commands find it without --dir, so the operator types `behalf why rec_c71e:31` rather than a line with a directory in it. One exported variable (BEHALF_HOME) is the whole of the configuration, and `setup` prints it.
• Nothing here reaches the network or needs a key. The recording is the deterministic one (cmd/behalf-record), driven through the real MCP proxy against the in-repo desk server.
• Detection is never done by this file. `demo tamper` performs an edit — that is the attacker's half — and the shipped tooling (`behalf-verify`, `behalf-log rehydrate`) finds it. A demo where the demo command both breaks and diagnoses proves nothing.

This is not `npx onbehalf demo` (self-serve, separate) and not the CI dry run. It is the thing that must not fall over live.

Command behalf is the product CLI.

behalf login  --issuer URL --client-id ID [--no-browser] [--dir DIR]
behalf whoami [--dir DIR]
behalf why    <run>:<step> [--dir LOGDIR]
behalf runs   [--dir LOGDIR]
behalf diff   <runA> <runB> [--dir LOGDIR] [--all]
behalf export --run ID [--run ID2] --html FILE [--dir LOGDIR] [--state DIR]

login runs the OIDC PKCE flow that mints the verified identity root (D5): a fresh device Ed25519 key whose RFC 7638 thumbprint rides the OIDC nonce into the IdP-signed ID token. whoami re-runs the three-check root predicate offline and prints the result.

why reads one receipt out of the log and renders the delegation chain behind it, hop by hop, in the three verification states (Q12); runs lists the indexed runs with their attribution rollups (Q82, Q86); diff aligns two runs and names the first step that diverged (Q85); export writes the same evidence as one self-contained HTML file, which is what actually gets attached to a ticket. All four are read-only over the log dir.