Roost documentation
Roost is a signing appliance with three voting chips from three manufacturers and a monitor. Applications reach it through a gateway; organizations manage their boxes in the Axowl console and through the API below.
Everything in these docs runs on the simulator as well as on the appliance, with the same policy code. The wire protocol, the receipt format and the error reasons are published here so that you can verify Roost's behaviour yourself.
Quick start
Run the simulator and sign your first message.
How Roost signs
Voters, quorum, counters and receipts.
Keys
Purpose templates, partitions, pieces, encryption, algorithms.
Connect
Java, PKCS#11, OpenSSL, the HTTPS gateway, identities and CI.
Operate
roost check, monitoring and evidence, documents, cloud keys, migration.
Manage boxes
The console: ledger, binding, roles, alerts, export and maintenance.
The console at a glance
AxowlacmeRoostM
Products
Code signing12 signed today · 1 awaiting approval
Documents38 signed today
Certificate authority2 issued this week
Data encryption1,204 unwraps today
TLS keys3 keys · pair OK
AI agents4 agents · 2 limits hit
Sealed receipts89,261 total
App connectionsPKCS#11 · Java · gateway
Cloud keys3 clouds · 11 keys
CI/CD2 runs active · 0 keys left behind
ROOST-26-0001 · ROOST-26-0002 · pair OK · 3/3 voters · armed
Where things are
| Menu | What you do there | Docs |
|---|---|---|
| Products | One tile per product with live counts | The console |
| Access | Roles, auditors, application and agent identities | Roles · Auditors |
| Keys · Partitions · Policies | Purpose templates, versions, rules and record-only mode | Approvals and policies |
| Approvals | Every sensitive action waiting for passkey seals | Approvals and policies |
| Alerts · Records | Thresholds, sealed audit chain, syslog and SNMP export, evidence reports | Alerts · Export |
| Devices · Diagnostics | Boxes, pairs, enrollment, identity, firmware, maintenance, time policy, air-gap, re-arm; roost check results | Device ledger · roost check |
| Cloud keys · CI/CD | Keys held for cloud services; CI runs with temporary partitions | Cloud keys · CI/CD |