up

docs/modules/cli/guides/attest.md

@@ -0,0 +1,25 @@
+# CLI Attest Guide (DOCS-ATTEST-74-004)
+
+How to verify and inspect attestations via CLI.
+
+## Verify DSSE
+```bash
+stella attest verify --envelope bundle.dsse.json --policy policy.json \
+  --root keys/root.pem --transparency-checkpoint checkpoints/rekor.json
+```
+- Offline verification uses bundled roots and checkpoints; transparency optional.
+
+## List attestations
+```bash
+stella attest list --tenant default --issuer dev-kms --format table
+```
+
+## Show attestation
+```bash
+stella attest show --id a1b2c3 --output json
+```
+
+## Notes
+- No network access required in sealed mode.
+- All commands emit deterministic JSON; timestamps in UTC.
+- Exit codes: 0 success, 2 verification failed, 4 input error.