Version: v5.7.0

opschain admin transport-providers

packs:rpc

Manage the TransportProvider catalog — the records brokered remote-host access resolves through. A provider is a first-class record beside identity, secrets and model providers: a kind (ssh-static, or ssh-ca for short-lived CA-signed session certificates), a kind-specific config of connection facts (username, auth method, port, timeouts — never credential material) and a credential reference, with the same lifecycle treatment: audited writes and admin-plane authorization on every verb.

For an ssh-ca provider the referenced credential is the CA signing key: it never leaves the platform. Each admitted session mints an ephemeral keypair and a short-lived certificate signed by that key (principals and validity from the config), so no standing key rests on any host path.

The custody posture is reference-first: the record stores credential_ref, a secret-vault:// address, never a key or password value. Supply a reference with --credential-ref — it is resolved when it is set, so a record can never point at a reference that does not resolve — or supply an inline credential via --credential-env / --credential-prompt (never on the command line) and the server holds it encrypted at rest on the record itself (never in a vault; credential_ref stays empty and credential_set reports it). A provider-qualified reference (secret-vault://<provider>@<path>/<key>) keeps the host key in a bound customer vault, so it never rests in OpsChain at all. No read, audit row or error ever returns credential material.

Creating or enabling a provider requires the packs:rpc entitlement (the same pack the rpc YAML actions ship under; a packs:infrastructure grant satisfies the same gate, since that pack bundles the rpc engine); on lapse, stored providers keep serving and only new registrations and enabling writes refuse (the polite-lapse posture).

At dispatch, a step that consumes the transport session resolves its provider from the step's target — the explicit rpc.provider_ref property, else the deepest-wins scope binding, else the single enabled provider. A step bound to a host_ref input re-points that whole resolution at the referenced infrastructure host node: the host's own rpc.provider_ref, else the binding at the host's path, and the caller's transport grant must cover the host node's path. An unknown, destroyed or non-host reference, and a host with no resolvable provider, each fail the step by name (opschain docs entitlements covers the pack gate; opschain docs cli/infrastructure the host records).

Subcommand	Purpose
`list`	Every provider: kind, credential reference, enabled state, health.
`show <code-or-id>`	One provider's record.
`create <code>`	Register a provider (reference pinned, or inline credential vaulted).
`update <code-or-id>`	Change fields; a supplied credential or reference re-pins.
`delete <code-or-id>`	Remove a provider (vault values stay with the secrets plane).
`test <code-or-id>`	Validate the record without dialling any host.
`bindings`	Scope bindings: which provider serves a subtree (`opschain docs cli/admin-transport-providers-bindings`).

Every verb rides the v2 TransportProviderService, which authenticates user tokens only: the caller's own opschain login session is the primary credential. An explicit --auth-token wins, and OPSCHAIN_ADMIN_TOKEN / the opschain admin login token remain the fallback for automation; the server still requires the /admin updatable determination.

Exit codes: 0 on success, 1 when a call fails or the token is rejected, 2 for usage errors.

See also​

See also