cloud lockers¶

NAME¶

phyware cloud lockers — create, seal, list, get, archive, and manage access grants for Evidence Lockers.

SYNOPSIS¶

phyware cloud lockers create   [OPTIONS] --name <NAME>
phyware cloud lockers seal     [OPTIONS] <LOCKER_ID>
phyware cloud lockers list     [OPTIONS]
phyware cloud lockers get      [OPTIONS] <LOCKER_ID>
phyware cloud lockers archive  [OPTIONS] <LOCKER_ID>
phyware cloud lockers grants issue   [OPTIONS] <LOCKER_ID> --stakeholder-name <NAME> --stakeholder-type <TYPE>
phyware cloud lockers grants list    [OPTIONS] <LOCKER_ID>
phyware cloud lockers grants revoke  [OPTIONS] <LOCKER_ID> <GRANT_ID>
phyware cloud lockers audit-log [OPTIONS] <LOCKER_ID>

DESCRIPTION¶

An Evidence Locker is an immutable, cryptographically-sealed copy of a tenant's telemetry data, scoped for sharing with regulators, insurers, legal counsel, or auditors. See issue #77.

create¶

Creates a new locker (status created). Use seal to copy events and compute the Merkle root.

seal¶

Triggers data copy and Merkle root computation. After sealing the locker is immutable and queryable by stakeholders with valid grant tokens.

list / get / archive¶

CRUD operations on locker metadata. archive retains data per the platform retention policy.

grants issue / list / revoke¶

Manage stakeholder access grants. Issuing a grant returns a one-time access token that the stakeholder uses with phyware cloud evidence ….

audit-log¶

Append-only log of all access and admin actions on the locker.

OPTIONS¶

ARGUMENTS¶

INPUT¶

--scope (create) accepts a JSON object describing the data window:

{
  "time_range": {"start": "2026-02-20", "end": "2026-02-21"},
  "source_ids": ["AGV-042"],
  "source_types": ["agv"],
  "event_types": ["safety_violation"],
  "include_compliance_reports": true,
  "include_raw_payloads": false
}

OUTPUT¶

EXIT CODES¶

EXAMPLES¶

# Create and seal a locker
LK=$(phyware cloud lockers create --name "Incident AGV-042" -o json | jq -r '.locker_id')
phyware cloud lockers seal "$LK"

# Issue a grant to a regulator and capture the token
TOKEN=$(phyware cloud lockers grants issue "$LK" \
  --stakeholder-name "NHTSA Region 5" \
  --stakeholder-type regulator \
  --permissions read_events,read_provenance \
  -o json | jq -r '.access_token')

# List all lockers
phyware cloud lockers list

# View the audit log
phyware cloud lockers audit-log "$LK"

# Revoke a grant
phyware cloud lockers grants revoke "$LK" gr_def456

# Archive the locker
phyware cloud lockers archive "$LK"

AGENT NOTES¶

The access_token returned by grants issue is shown only once — capture it immediately. Operator commands require events:read (read operations) or events:write (write/grant management) scope. Stakeholder queries use phyware cloud evidence … with the grant token, not a tenant API key.

SEE ALSO¶

• cloud evidence
• cloud verify

ERRORS¶