Auditor CLI

opaque-audit is the tool key holders use. Each holder runs it alone; the holders only ever exchange public values and per-transaction partials.

Commands

opaque-audit keygen                       # alone: prints a secret share and its public share
opaque-audit combine <public>...          # anyone: the joint audit key for the pool
opaque-audit partials <server> [from]     # alone, with AUDIT_SHARE set: one partial per transaction
opaque-audit open <server> <partials>...  # together: opens every transaction all partial files cover

A review

1. Each holder runs partials against the server, producing a file with one partial per transaction, and hands the file to the reviewer.
2. The reviewer runs open with every holder's file. Each transaction that all files cover is printed as a record: the asset, the notes spent, the notes created with their amounts and owners, and the transaction hash.
3. Transactions any file omits stay sealed.

Holders can produce partials for a range of transactions only, so a review can be scoped to a period or to a set of transactions named in a request.

Keeping a share

A secret share is a single number. Keep it offline, back it up, and never enter it anywhere but this tool. A lost share cannot be recovered; the pool's owner rotates to a new key with a new set of holders.