brama subscription attribute¶
Record which provider account each pool member of one provider belongs to, read from the address the provider itself signed into that member’s grant.
The pool counts accounts, and an account is not a name. A member’s id, its label and the login row it signs in through are names: one Google login row backs both the Claude Code and the Codex subscription of one person, and a member id is a slug nothing can turn back into an address. A member belongs to an account only where the account is recorded against it — as account_ref on its vault item, which the pool reads through the item’s brama:account: tag and which Weles reads when it signs that account in again.
Every member imported before the account was recorded beside its grant records none, so the pool can attribute only the members this gateway has itself signed in and reports the rest. This command closes that gap from the grants themselves, and the refresh sweep runs the same code on its own pass, so a member imported later is attributed without anybody running anything. A sweep that cannot write the account logs subscription_account_unrecorded with the member and the vault’s error.
Where the account is recorded¶
The account is written into the vault the process running the attribution opens. Weles resolves a sign-in from the fleet vault on the vault owner host, so on a workstation that reads that vault through Skarbiec’s API, a run without a gateway writes the workstation’s own vault program’s file: it answers recorded for every member while the fleet vault still names no account, and every sign-in of those members still stops at subscription_identity_missing before a browser opens, so no second-factor prompt is sent. Name the gateway that holds the credentials and it records them in the vault it serves from, through POST /v1/admin/subscription-pool/attribute.
Invocation¶
brama subscription attribute <PROVIDER> [--gateway <URL> | --gateway-consumer <CONSUMER>] [--bearer-role <ROLE>] [--json]| Input | Required/default | Meaning |
|---|---|---|
<PROVIDER> | required | The provider whose members are attributed: codex, claude-code or kimi. |
--gateway | optional | The gateway that holds the credentials; it records the accounts in its own vault. The console’s bearer is read from stdin. |
--gateway-consumer | optional | Resolve that gateway through Stado’s service directory as this consumer instead of naming its URL. |
--bearer-role | optional, needs a gateway | Read the console’s bearer from the token field of the vault item that plays this role instead of from stdin; no item is named. |
--json | optional | Print the verdict document instead of lines. |
brama subscription attribute claude-code --gateway-consumer operator --bearer-role brama-desktop-model-routerWhat it does¶
Nothing is rotated and no provider is contacted. For each member of that provider the gateway reads what its item already records; when the item records no account, the member’s grant is opened, the address its issuer signed into it is read, and that address is written back beside the unchanged grant — as the item’s account_ref and its brama:account: tag. Claude Code records the address beside the grant; Codex and Kimi sign it into the identity token stored next to the access token.
$ brama subscription attribute codex
1 of 4 member(s) name an account
<member a> -> <address>
<member b>: this member’s grant states no account, so nothing was recorded; record the identity on the subscription item provider:codex:<member b> instead: tag it brama:login:<login item> (stado credentials item retag --host <vault host> provider:codex:<member b> --tags "<its current tags>,brama:login:<login item>"), declare provider codex on its login item, or name the login explicitly with --login-item at sign-inThen brama subscription list states the accounts rather than the rows, naming which accounts it means per provider and which members record none.
Refusals¶
An empty provider is refused with a provider is required, and a provider this deployment holds no member for with this deployment’s pool holds no <provider> member, so there is no grant to read an account from; through a gateway both arrive as the gateway refused to attribute <provider>: HTTP 400: …. A bearer the gateway does not know is refused as HTTP 401 unauthenticated, and a known client that is not the console as HTTP 403. Naming both --gateway and --gateway-consumer, or --bearer-role without a gateway, is refused before anything is sent. A member whose grant cannot be redeemed, or is not UTF-8 JSON, is reported with that reason; a member whose grant states no address is reported with the three ways to record its identity instead; both are left unattributed, and the command exits non-zero whenever any member is left unattributed, because the account count is short by exactly those members.
brama:account: is a registered Skarbiec tag namespace. A vault that refuses it answers claims a namespace that is not registered, which means that host’s Skarbiec predates the registration and has to be delivered before any account can be recorded.
See the command group or the CLI tree.