opschain admin agent-release revoke
packs:agentspacks:agent-governance
opschain admin agent-release revoke <name>@<version> --reason <text>
Revoke a release and halt the instances running it (v2 AgentReleaseService.RevokeAgentRelease).
Moves the release to revoked and halts every instance running it
through the per-agent halt machinery, each channel closed with the typed
AGENT_RELEASE_REVOKED reason naming the release — the runtime logs
platform: agent release revoked — … and waits. Enrolment and rollover
to the release refuse by name. The halt is the ordinary scalpel: roll
the instance to a current release and lift it with opschain admin agent halt-resume. Attested on the release (with the number of instances
halted), audited as info:agent_release:revoked; signing keys are
untouched (a compromised key is revoked through key-status, which
invalidates every release it signed).
A reason is required: revoking a release is break-glass audited.
Releases move one way: active → retired → revoked, never back.
Flags
| Flag | Meaning |
|---|---|
--reason <text> | Audited revocation reason (required). |
Output
revoked felix@2.1.0: 3 instance(s) halted (resume each with 'opschain admin agent halt-resume' once rolled to a current release)
Exit codes
| Code | Meaning |
|---|---|
| 0 | The release moved. |
| 1 | The server refused or failed the request: an unknown release, a backwards move (agent releases move active to retired to revoked - never back), a rejected credential. |
| 2 | Usage — the release is not named <name>@<version>, or --reason is missing. |
See also
opschain docs cli/admin-agent-release— the command family.opschain docs cli/admin-agent-rollover— moving instances between releases.opschain docs agent-releases— the release lifecycle.