Aarkam - SAT (Standalone Tier Primary Substrate) Auth & Triage AM CLI • ARK-CLI-0307

Authentication, Diagnostics & Incident Triage Reference

Authoritative command reference for am auth (Zero-Trust Sessions, DPAPI / POSIX 0600), am doctor, and am diagnose (Incident Root Cause Analysis & Sanitized Dumps).

Last updated: Nov 03, 2026 Classification: Sovereign Tier-4 Enterprise

---
title: "Authentication, Diagnostics & Incident Triage Reference"
description: "Authoritative command reference for am auth (Zero-Trust Sessions, DPAPI / POSIX 0600), am doctor, and am diagnose (Incident Root Cause Analysis & Sanitized Dumps)."
category: "AM CLI"
order: 7
badge: "Auth & Triage"
icon: "activity"
documentId: "ARK-CLI-0307"
status: "Production Standard"
classification: "Sovereign Tier-4 Enterprise"
version: "V-1.0.0-GA (Production Stable)"
readingTime: "5 min read"
audience: "Incident Responders, On-Call SREs & Security Officers"
scope: "Aarkam Standalone (SAT) & Storage Centers (SCT)"
tier: "Aarkam - SAT (Standalone Tier Primary Substrate)"
---

<div class="wiki-spec-card">
  <div class="wiki-spec-grid">
    <div class="wiki-spec-item">
      <span class="wiki-spec-label">Document Identifier</span>
      <span class="wiki-spec-value text-[#10B981]">ARK-CLI-0307</span>
    </div>
    <div class="wiki-spec-item">
      <span class="wiki-spec-label">Standard Status</span>
      <div><span class="status-pill status-normative">Production Standard</span></div>
    </div>
    <div class="wiki-spec-item">
      <span class="wiki-spec-label">Architecture Tier</span>
      <span class="wiki-spec-value text-amber-300">Aarkam - SAT (Storage Substrate)</span>
    </div>
    <div class="wiki-spec-item">
      <span class="wiki-spec-label">Release Version</span>
      <span class="wiki-spec-value text-cyan-300">V-1.0.0-GA (Production Stable)</span>
    </div>
  </div>
</div>

<div class="wiki-alert wiki-alert-note my-4 p-4 rounded-xl border border-emerald-500/20 bg-emerald-500/5 text-xs text-slate-300">
  <strong class="text-emerald-400 block mb-1">Architecture Tier Scope: Aarkam - SAT (Standalone Tier)</strong>
  These commands govern direct zero-trust session authentication with the <strong>Rokka Coordinator MON Quorum</strong> and incident triage tooling. In dark-site and air-gapped environments, <code>am diagnose</code> and <code>am doctor</code> provide self-contained root cause analysis without requiring external cloud monitoring or telemetry egress.
</div>

<p>This reference details operator session authentication, local cryptographic token storage (Windows DPAPI / POSIX 0600), rapid health evaluations, and automated incident bundle generation.</p>

<hr />

<h2 id="am-auth">1. <code>am auth</code> — Zero-Trust Operator Authentication &amp; Sessions</h2>
<p>In the Aarkam Standalone Tier, authentication is enforced directly by the <strong>Rokka Coordinator MON Quorum</strong> using Argon2id password verification and asymmetric JWT bearer tokens. Tokens are auto-injected into outgoing gRPC calls via <code>GrpcAuthClientInterceptor</code>.</p>

<h3 id="auth-login">1.1 Operator Login (<code>am auth login</code>)</h3>
<div class="wiki-code-block relative group my-3 rounded-xl border border-slate-800 bg-[#060a14] overflow-hidden">
  <div class="code-header flex items-center justify-between px-3 py-1.5 bg-slate-900/90 border-b border-slate-800 text-[10px] font-mono text-slate-400">
    <span class="uppercase font-bold text-emerald-400">bash</span>
    <button type="button" onclick="copyCodeSnippet(this)" class="hover:text-white px-2 py-0.5 rounded bg-slate-800 border border-slate-700 transition cursor-pointer print:hidden">Copy</button>
  </div>
  <pre class="p-3.5 overflow-x-auto text-xs font-mono text-slate-200 leading-relaxed m-0"><code class="language-bash"># Interactive login (prompts securely for password without echo)
am auth login --username secadmin

# Headless / CI/CD pipeline login reading secret from environment
am auth login --username storage-bot --password-env BOT_SECRET --non-interactive</code></pre>
</div>

<h3 id="auth-status-whoami">1.2 Session Claims &amp; Verification (<code>am auth whoami</code> &amp; <code>am auth status</code>)</h3>
<div class="wiki-code-block relative group my-3 rounded-xl border border-slate-800 bg-[#060a14] overflow-hidden">
  <div class="code-header flex items-center justify-between px-3 py-1.5 bg-slate-900/90 border-b border-slate-800 text-[10px] font-mono text-slate-400">
    <span class="uppercase font-bold text-emerald-400">bash</span>
    <button type="button" onclick="copyCodeSnippet(this)" class="hover:text-white px-2 py-0.5 rounded bg-slate-800 border border-slate-700 transition cursor-pointer print:hidden">Copy</button>
  </div>
  <pre class="p-3.5 overflow-x-auto text-xs font-mono text-slate-200 leading-relaxed m-0"><code class="language-bash"># Display active user identity, tenant namespace, and assigned RBAC roles
am auth whoami

# Check token validity duration, expiration timestamp, and coordinator issuer
am auth status

# Terminate session and purge local DPAPI / POSIX 0600 token cache
am auth logout</code></pre>
</div>

<hr />

<h2 id="am-doctor">2. <code>am doctor</code> — Universal Pre-Flight &amp; Fabric Scanner</h2>
<p>Scans the complete distributed environment in parallel, probing consensus health, storage capacity thresholds, network latency, and CPU instruction acceleration:</p>

<div class="wiki-code-block relative group my-3 rounded-xl border border-slate-800 bg-[#060a14] overflow-hidden">
  <div class="code-header flex items-center justify-between px-3 py-1.5 bg-slate-900/90 border-b border-slate-800 text-[10px] font-mono text-slate-400">
    <span class="uppercase font-bold text-emerald-400">bash</span>
    <button type="button" onclick="copyCodeSnippet(this)" class="hover:text-white px-2 py-0.5 rounded bg-slate-800 border border-slate-700 transition cursor-pointer print:hidden">Copy</button>
  </div>
  <pre class="p-3.5 overflow-x-auto text-xs font-mono text-slate-200 leading-relaxed m-0"><code class="language-bash">am doctor --coordinator http://localhost:7774</code></pre>
</div>

<hr />

<h2 id="am-diagnose">3. <code>am diagnose</code> — Incident Triage &amp; Root Cause Analysis</h2>
<p>Provides emergency triage during storage anomalies, network partitions, or drive faults:</p>

<h3 id="diagnose-cluster-node">3.1 Cluster &amp; Node Triage</h3>
<div class="wiki-code-block relative group my-3 rounded-xl border border-slate-800 bg-[#060a14] overflow-hidden">
  <div class="code-header flex items-center justify-between px-3 py-1.5 bg-slate-900/90 border-b border-slate-800 text-[10px] font-mono text-slate-400">
    <span class="uppercase font-bold text-emerald-400">bash</span>
    <button type="button" onclick="copyCodeSnippet(this)" class="hover:text-white px-2 py-0.5 rounded bg-slate-800 border border-slate-700 transition cursor-pointer print:hidden">Copy</button>
  </div>
  <pre class="p-3.5 overflow-x-auto text-xs font-mono text-slate-200 leading-relaxed m-0"><code class="language-bash"># Run holistic triage scan across all cluster daemons
am diagnose cluster

# Deep dive into an individual node (disk I/O wait, kernel memory, socket pools)
am diagnose node storage-02

# Inspect latency mesh between coordinators and storage daemons
am diagnose latency</code></pre>
</div>

<h3 id="diagnose-dump">3.2 Sanitized Support Dump (<code>am diagnose dump</code>)</h3>
<p>Generates an offline, cryptographically sanitized diagnostic archive for support review. Masks sensitive IP addresses and removes all cryptographic keys:</p>
<div class="wiki-code-block relative group my-3 rounded-xl border border-slate-800 bg-[#060a14] overflow-hidden">
  <div class="code-header flex items-center justify-between px-3 py-1.5 bg-slate-900/90 border-b border-slate-800 text-[10px] font-mono text-slate-400">
    <span class="uppercase font-bold text-emerald-400">bash</span>
    <button type="button" onclick="copyCodeSnippet(this)" class="hover:text-white px-2 py-0.5 rounded bg-slate-800 border border-slate-700 transition cursor-pointer print:hidden">Copy</button>
  </div>
  <pre class="p-3.5 overflow-x-auto text-xs font-mono text-slate-200 leading-relaxed m-0"><code class="language-bash">am diagnose dump --output /tmp/aarkam-incident-dump.tar.gz</code></pre>
</div>

Document Identifier ARK-CLI-0307

Standard Status

Production Standard

Architecture Tier Aarkam - SAT (Storage Substrate)

Release Version V-1.0.0-GA (Production Stable)

Architecture Tier Scope: Aarkam - SAT (Standalone Tier) These commands govern direct zero-trust session authentication with the Rokka Coordinator MON Quorum and incident triage tooling. In dark-site and air-gapped environments, am diagnose and am doctor provide self-contained root cause analysis without requiring external cloud monitoring or telemetry egress.

This reference details operator session authentication, local cryptographic token storage (Windows DPAPI / POSIX 0600), rapid health evaluations, and automated incident bundle generation.

1. `am auth` — Zero-Trust Operator Authentication & Sessions

In the Aarkam Standalone Tier, authentication is enforced directly by the Rokka Coordinator MON Quorum using Argon2id password verification and asymmetric JWT bearer tokens. Tokens are auto-injected into outgoing gRPC calls via GrpcAuthClientInterceptor.

1.1 Operator Login (`am auth login`)

bash

# Interactive login (prompts securely for password without echo)
am auth login --username secadmin

# Headless / CI/CD pipeline login reading secret from environment
am auth login --username storage-bot --password-env BOT_SECRET --non-interactive

1.2 Session Claims & Verification (`am auth whoami` & `am auth status`)

bash

# Display active user identity, tenant namespace, and assigned RBAC roles
am auth whoami

# Check token validity duration, expiration timestamp, and coordinator issuer
am auth status

# Terminate session and purge local DPAPI / POSIX 0600 token cache
am auth logout

2. `am doctor` — Universal Pre-Flight & Fabric Scanner

Scans the complete distributed environment in parallel, probing consensus health, storage capacity thresholds, network latency, and CPU instruction acceleration:

bash

am doctor --coordinator http://localhost:7774

3. `am diagnose` — Incident Triage & Root Cause Analysis

Provides emergency triage during storage anomalies, network partitions, or drive faults:

3.1 Cluster & Node Triage

bash

# Run holistic triage scan across all cluster daemons
am diagnose cluster

# Deep dive into an individual node (disk I/O wait, kernel memory, socket pools)
am diagnose node storage-02

# Inspect latency mesh between coordinators and storage daemons
am diagnose latency

3.2 Sanitized Support Dump (`am diagnose dump`)

Generates an offline, cryptographically sanitized diagnostic archive for support review. Masks sensitive IP addresses and removes all cryptographic keys:

bash

am diagnose dump --output /tmp/aarkam-incident-dump.tar.gz

← Previous Article

Operations, Maintenance & Disaster Recovery Reference

Zero-Knowledge Envelope Encryption

Authentication, Diagnostics & Incident Triage Reference

1. am auth — Zero-Trust Operator Authentication & Sessions

1.1 Operator Login (am auth login)

1.2 Session Claims & Verification (am auth whoami & am auth status)

2. am doctor — Universal Pre-Flight & Fabric Scanner

3. am diagnose — Incident Triage & Root Cause Analysis

3.1 Cluster & Node Triage

3.2 Sanitized Support Dump (am diagnose dump)

1. `am auth` — Zero-Trust Operator Authentication & Sessions

1.1 Operator Login (`am auth login`)

1.2 Session Claims & Verification (`am auth whoami` & `am auth status`)

2. `am doctor` — Universal Pre-Flight & Fabric Scanner

3. `am diagnose` — Incident Triage & Root Cause Analysis

3.2 Sanitized Support Dump (`am diagnose dump`)