sign_action
Sign action envelopes for CI, IaC, or API calls using Ed25519 identity. Returns signed JSON or writes to file.
Instructions
Sign a universal provenance action envelope with the active Ed25519 identity.
Use for CI steps, IaC changes, DB migrations, API calls, contract deploys,
or agent delegation grants. Prefer ``create_envelope`` for Git commits.
Do not use for verification — call ``verify_envelope`` on exported JSON.
Side effects: writes ``save_path`` when set; uses local identity store.
No network unless you later upload the signed artifact yourself.
Returns ``{ok, signed, device_id, mode, path?, error?}``.
Parameters:
action_type: Provenance label (git_commit, ci_step, iac_change, etc.).
payload: JSON object to sign (no top-level signature block).
key_path: Optional MATRIXSCROLL_HOME override for CI ephemeral keys.
save_path: Optional file path to write the signed document.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| payload | Yes | JSON object to sign. Keys are canonicalized before Ed25519 signing per SPEC.md §4. Do not include a top-level signature block. | |
| key_path | No | Optional override for the Matrix Scroll identity store directory (defaults to MATRIXSCROLL_HOME or ~/.matrixscroll). Use for CI ephemeral keys. | |
| save_path | No | Optional file path to write the signed document. When empty, returns JSON only. | |
| action_type | Yes | Provenance action type: git_commit, ci_step, iac_change, db_migration, api_call, contract_deploy, or custom labels for evidence packs. Typed actions validate required payload fields per schemas/action-envelope.v1.json. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||