opschain admin agent-release key-status
packs:agentspacks:agent-governance
opschain admin agent-release key-status <key id> --status <active|retired|revoked>
Moves a signing key's lifecycle state: an active key
verifies and signs; a retired key keeps signatures of releases created
before the retirement acceptable (historical releases stay verifiable)
but signs nothing new; a revoked key verifies nothing at any date — a
release signed by it refuses enrolment and promotion immediately. The move
is audited (info:agent_release:key_status_changed).
Flags
| Flag | Meaning |
|---|---|
--status <state> | Target state: active, retired or revoked. |
--note <text> | Optional audited note for the move. |