# CLI Attest Guide (DOCS-ATTEST-74-004)

How to verify and inspect attestations via CLI.

## Verify DSSE
```bash
stella attest verify --envelope bundle.dsse.json --policy policy.json \
  --root keys/root.pem --transparency-checkpoint checkpoints/rekor.json
```
- Offline verification uses bundled roots and checkpoints; transparency optional.

## List attestations
```bash
stella attest list --tenant default --issuer dev-kms --format table
```

## Show attestation
```bash
stella attest show --id a1b2c3 --output json
```

## Notes
- No network access required in sealed mode.
- All commands emit deterministic JSON; timestamps in UTC.
- Exit codes: 0 success, 2 verification failed, 4 input error.