feat: add auths signers commands piped from auths-sdk -> auths-cli -> python/node SDKs

README.md

@@ -98,10 +98,10 @@ auths device revoke --device-did did:key:z6Mk...
 auths verify attestation.json
 ```
 
-**Export allowed-signers for Git verification**
+**Sync allowed-signers for Git verification**
 
 ```bash
-auths git allowed-signers >> ~/.ssh/allowed_signers
+auths signers sync
 ```
 
 ---
@@ -161,7 +161,9 @@ No central server. No blockchain. Just Git and cryptography.
 | `auths verify` | Verify an attestation |
 | `auths verify-commit` | Verify a signed commit |
 | `auths git setup` | Configure Git for signing |
-| `auths git allowed-signers` | Generate allowed-signers file |
+| `auths signers sync` | Sync allowed-signers from registry |
+| `auths signers list` | List allowed signers |
+| `auths signers add` | Add a manual signer |
 
 Run `auths --help` for full documentation.
 

crates/auths-cli/Cargo.toml

@@ -64,7 +64,8 @@ sha2 = "0.10"
 tempfile = "3"
 thiserror.workspace = true
 zeroize = "1.8"
-reqwest = { version = "0.13.2", features = ["json", "form"] }
+reqwest = { version = "0.13.2", features = ["json", "form", "blocking"] }
+ssh-key = "0.6"
 url = "2.5"
 which = "8.0.0"
 open = "5"

crates/auths-cli/src/bin/verify.rs

@@ -154,7 +154,7 @@ fn verify_file(
         bail!(
             "Allowed signers file not found: {:?}\n\n\
             Create it with:\n  \
-            auths git allowed-signers > {:?}",
+            auths signers sync --output {:?}",
             allowed_signers,
             allowed_signers
         );

crates/auths-cli/src/cli.rs

@@ -24,6 +24,7 @@ use crate::commands::org::OrgCommand;
 use crate::commands::policy::PolicyCommand;
 use crate::commands::scim::ScimCommand;
 use crate::commands::sign::SignCommand;
+use crate::commands::signers::SignersCommand;
 use crate::commands::status::StatusCommand;
 use crate::commands::trust::TrustCommand;
 use crate::commands::unified_verify::UnifiedVerifyCommand;
@@ -92,6 +93,7 @@ pub enum RootCommand {
     Whoami(WhoamiCommand),
     Tutorial(LearnCommand),
     Doctor(DoctorCommand),
+    Signers(SignersCommand),
     Pair(PairCommand),
     #[command(hide = true)]
     Completions(CompletionsCommand),

crates/auths-cli/src/commands/doctor.rs

@@ -180,22 +180,56 @@ fn check_identity_exists() -> Check {
 }
 
 fn check_allowed_signers_file() -> Check {
+    use auths_sdk::workflows::allowed_signers::{AllowedSigners, SignerSource};
+
     let path = crate::factories::storage::read_git_config("gpg.ssh.allowedSignersFile")
         .ok()
         .flatten();
 
     let (passed, detail, suggestion) = match path {
         Some(path_str) => {
-            if std::path::Path::new(&path_str).exists() {
-                (true, format!("Set to: {path_str}"), None)
+            let file_path = std::path::Path::new(&path_str);
+            if file_path.exists() {
+                match AllowedSigners::load(file_path) {
+                    Ok(signers) => {
+                        let entries = signers.list();
+                        let attestation_count = entries
+                            .iter()
+                            .filter(|e| e.source == SignerSource::Attestation)
+                            .count();
+                        let manual_count = entries
+                            .iter()
+                            .filter(|e| e.source == SignerSource::Manual)
+                            .count();
+
+                        let has_markers = std::fs::read_to_string(file_path)
+                            .map(|c| c.contains("# auths:attestation"))
+                            .unwrap_or(false);
+
+                        let mut detail = format!(
+                            "{path_str} ({} attestation, {} manual)",
+                            attestation_count, manual_count
+                        );
+
+                        if !has_markers && !entries.is_empty() {
+                            detail.push_str(
+                                " [no auths markers — run `auths signers sync` to add them]",
+                            );
+                        }
+
+                        (true, detail, None)
+                    }
+                    Err(_) => (
+                        true,
+                        format!("{path_str} (exists, could not parse entries)"),
+                        None,
+                    ),
+                }
             } else {
                 (
                     false,
                     format!("Configured but file not found: {path_str}"),
-                    Some(
-                        "Run: auths init --profile developer  (regenerates allowed_signers)"
-                            .to_string(),
-                    ),
+                    Some("Run: auths signers sync  (regenerates allowed_signers)".to_string()),
                 )
             }
         }