0xkey KeyOps — Manifest Set member

This skill is loaded explicitly by users acting as a Manifest Set member for a 0xkey enclave ceremony. It is deliberately local-only and does not require AWS credentials, kubectl access, kubeconfig, EKS context, VPC details, or Cloudflare details.

Scope

Review the Coordinator's canonical five-service manifest bundle, sign approvals with the member's own secret, and return an approvals bundle to the Coordinator.

The Coordinator-issued alias (and never a self-chosen one) is the source of truth for filenames and approval slots. If the user does not know their alias, ask the Coordinator before proceeding.

Cross-role refusal cheat sheet