cloud firmware-policies¶

NAME¶

phyware cloud firmware-policies — minimum agent and TPM firmware versions per device class.

SYNOPSIS¶

phyware cloud firmware-policies list
phyware cloud firmware-policies set     --kind KIND --min-version VERSION [--class CLASS] [--action flag|reject]
phyware cloud firmware-policies delete  <DEVICE_CLASS> <KIND>

DESCRIPTION¶

kind is agent (the PhyTrace agent version in signed provenance) or tpm_firmware (from TPM quotes). Older versions are flagged (version_status: below_minimum); with --action reject, agent events from older versions are refused. A class's own policy overrides the all-classes (*) one. Rollbacks to older versions are detected regardless of policy.

OPTIONS¶

Flag	Type	Required	Default	Env
`--url`	string	No	`http://localhost:8000`	`PHYCLOUD_URL`
`--api-key`	string	No	—	`PHYCLOUD_API_KEY`
`--output`	enum	No	`table`	—
`--kind`	enum	Yes (set)	—	—
`--min-version`	string	Yes (set)	—	—
`--class`	string	No	all classes	—
`--action`	enum	No	`flag`	—

ARGUMENTS¶

Name	Required	Description
`DEVICE_CLASS`	Yes	Class, or `*` for all
`KIND`	Yes	`agent` or `tpm_firmware`

EXIT CODES¶

Code	Meaning
`0`	Success
`1`	Generic / connection error
`2`	Authentication / authorisation error
`3`	Resource not found
`4`	Validation error
`5`	Server-side error

EXAMPLES¶

phyware cloud firmware-policies set --kind agent --min-version 0.3.0
phyware cloud firmware-policies set --kind agent --min-version 0.3.0 --class phytau-pi --action reject
phyware cloud firmware-policies set --kind tpm_firmware --min-version 7.85
phyware cloud firmware-policies list
phyware cloud firmware-policies delete '*' agent

AGENT NOTES¶

Needs devices:read / devices:write. Only agent policies can reject; TPM firmware below the minimum marks the device untrusted.

ERRORS¶

Code	Message	Remediation
`NOT_FOUND`	No such policy	Check the class and kind
`VALIDATION`	Invalid policy	kind agent/tpm_firmware, action flag/reject