Commands / kosa8 validate iq

`kosa8 validate iq`

Generate an Installation Qualification record

Usage

kosa8 iq SANDBOX|SNAPSHOT

Records, from the environment itself, what is installed and how it is configured: kosa8's version and build provenance, the FIPS module state, the guest kernel and root filesystem by SHA-256, every image in the sandbox by content digest, each image's installed packages from its own package database, the egress policy the host enforces, host mounts, labels, the snapshot's seal, and doctor --compliance. Each item has an acceptance criterion, the observed value, and PASS or FAIL; each failure is a numbered deviation.

A SNAPSHOT is qualified in a clone restored from it and removed afterwards, so the validated state itself is never booted into. A SANDBOX is queried as it runs (listing packages starts short-lived containers in it).

--baseline takes an earlier, approved IQ: each item's expected value becomes what that record observed, so a re-qualification fails on any change.

Options

Flag	Type	What it does	Default
`--baseline`	string	an earlier IQ record whose observations become this record's expected values	—
`--baseline-key`	string	the public key the baseline must be signed with	—
`--html`	bool	also render RECORD.html	—
`--no-compliance`	bool	leave the host hardening controls (doctor --compliance) out of scope	—
`--no-packages`	bool	do not list installed packages inside the images	—
`-o, --out`	string	record package: .tar for a tar, else a directory (default <RECORD-ID>.tar)	—
`--require-fips`	bool	fail the cryptographic-module item unless the FIPS 140-3 module is in use	—
`--signer`	string	printed name of the package signer	—
`--signer-key`	string	sign the package with this Ed25519 key file instead of the machine's key	—
`--snapshot`	bool	treat the argument as a snapshot even if a sandbox has the same name	—

Example

  kosa8 validate iq stats-validated --out iq-2026-09.tar
  kosa8 validate iq stats-validated --baseline iq-2026-03.tar --baseline-key KEY