Stories

15 stories, one command each. Every guard ships with the story it protects. messh publishes and verifies; it never grants access itself.

$messh login && messh publish && messh add mukul

Core loop: S-01 → S-03 → S-05.

P1 · SSH identity

MVP · now

ID	Story	Command	Guard
S-01	Claim a username	Google → messh.io/<you>	Reserved names, linked account shown	Screen ›
S-02	Install and log in	messh login	Signed releases, device code	Docs ›
S-03	Publish keys and agents	messh publish --agent claude-code	Proof of possession private keys refused	Screen ›
S-04	Look someone up	messh resolve mukul	`messh verify`; `.keys` needs no CLI	Screen ›
S-05	Grant access core	messh add mukul	Fingerprints and confirm, `--fingerprint` pin	Docs ›
S-06	Remove and sync	messh remove mukul · messh sync	Tagged lines only; keeps cache if messh is down	Docs ›
S-07	Revoke and rotate	messh keys revoke laptop	New-key alerts, propagation shown	Screen ›
S-08	Profile extras optional	x402 · feed	Never shows who added whom	Screen ›

ID	Story	Command	Guard
S-09	messhd and policy	messhd enroll --org acme	Fleet revoke ≤ 60s	Screen ›
S-10	Request and TTL	messh request prod-02 --ttl 1h	Signed request a person approves, `max_ttl`	Screen ›
S-11	Orgs and audit	trust org:acme/*	DNS-verified domain, full log	Screen ›
S-12	Pin host keys	messh ssh deploy@prod-01	No `StrictHostKeyChecking=no`	Screen ›

preview · RFC 9421

ID	Story	Code	Guard
S-13	Agent signs	MesshClient.create({ identity })	Key in keychain or HSM, test vectors	Screen ›
S-14	API verifies	app.use(messhAuth())	Every request cached keys, ±60s and nonce	Screen ›
S-15	API authorizes	can(req.agent, "deploy", env)	Your policy, your call	Screen ›

not on the roadmap

Delegation · scoped short-lived creds · cross-org trust · SSO/SCIM · SSH certificates · x25519 encryption

messh granting access itself · storing private keys · a signing proxy in the request path · consumer browsing · full IAM on day one · custom crypto