Diagnostics: roost check

One command walks the connection from the network up to the appliance and stops at the first thing that is wrong, with what to fix.

$ roost check

1 network      roost-a.example:443 reachable                  ok
2 trust        box identity ROOST-26-0001 verified            ok
3 partition    prod visible to this client                    ok
4 login        client identity acme/orders-api accepted       ok
5 box          3/3 voters · tamper armed · time NTS 8 ms      ok
6 sign         test seal on partition prod                    ok

All checks passed.

What each step checks

Step	Symptom when it fails	Likely cause	What roost check tells you
1 network	Server unreachable	Firewall, DNS, proxy	The address, the port (always 443) and the hop that dropped
2 trust	Identity mismatch	Wrong box, replaced box, man in the middle	The identity the box presented and the one you pinned
3 partition	No keys listed	Client not assigned to the partition	Which partitions this client may see
4 login	Login failed	Expired or wrong client identity	When the credential expires and how to renew it
5 box	Signing refused for every key	Degraded quorum, tamper, time drift	The box status report in one line
6 sign	One key refuses	Policy: approval, limit, purpose	The rule that refused and what would allow it

axowl.com/dashboard/acme/roost/diagnostics

AxowlacmeRoostM

Diagnostics · roost check from orders-api host

#	Step	Result
1	Network	roost-a.example:443 reachable	ok
2	Trust	box identity ROOST-26-0001 verified · attestation match	ok
3	Partition	prod visible	ok
4	Login	acme/orders-api · credential renews in 12 min	ok
5	Box	3/3 voters · armed · NTS 8 ms	ok
6	Sign	test seal on prod	ok

Evidence bundle Measure (bench)

Diagnostics: one command walks from the network to the box and stops at the first problem.

Evidence bundle

roost check --bundle support-2026-11-02.zip
# one file: correlation ids, error codes, module version, box status, the last 50 refusals with reasons. Never a secret.

Measure

roost check --bench
# sign / wrap / unwrap per second and p99 latency against this box, with the quorum on

Refusals carry a reason

Interface	Code	Reason example
PKCS#11	`CKR_FUNCTION_REJECTED`	approval required: 1 of 2 seals present
PKCS#11	`CKR_KEY_FUNCTION_NOT_PERMITTED`	purpose code-signing cannot decrypt
Gateway	`403 POLICY_REFUSED`	rule 3: limit 200/h reached for agent ledger-bot
Gateway	`503 QUORUM_NOT_MET`	1 of 3 voters answered; box ROOST-26-0001 degraded