raxit keys

raxit keys init generates the Ed25519 keypair that signs Decision Provenance Records (DPRs) — the individual entries in the audit trail. See Audit & the DPR chain for what signing does and doesn't mean; this page is just the key-management command.

Usage

$ raxit keys init
wrote .raxit/keys/dpr_ed25519
wrote .raxit/keys/dpr_ed25519.pub
signer id: 3f9a7c1e2b8d4f60...

raxit keys init refuses to overwrite an existing key:

$ raxit keys init
raxit keys init: .raxit/keys/dpr_ed25519 already exists (use --force to overwrite)

Flags

• --force — overwrite an existing key.

Where the key lives

• .raxit/keys/dpr_ed25519 — the raw private key, written mode 0600 in a 0700 directory.
• .raxit/keys/dpr_ed25519.pub — the base64-encoded public key.
• The printed signer id is the hex SHA-256 of the public key — the same id that shows up alongside signed records, so you can confirm which key produced a given signature.

raxit serve / raxit dev / raxit ext-authz and raxit audit compact all pick this key up via --sign-key (which defaults to this path) — once it exists, those commands sign every audit record they write instead of leaving them hash-chained-but-unsigned. Nothing else needs to change: run raxit keys init once per project, then start the daemon as usual.

Gotchas

• The key is generated locally with crypto/rand — there's no key-management-service or certificate-chain integration yet. Treat .raxit/keys/dpr_ed25519 as sensitive project state: it isn't backed up, rotated, or escrowed for you.
• Signing is opt-in. Without a key present, raxit serve/raxit dev print a one-time warning that the audit log is unsigned (still hash-chained) rather than failing — raxit keys init is how you turn that warning off. See Audit & the DPR chain for the exact framing of what "signed" guarantees today.