[aaltshuler]

Managed clusters need data access that continues during a control API outage without sending control-plane credentials to a graph server. This implements RFC 0053: the server verifies scoped ES256 data credentials against locally enrolled trust, and the CLI caches that separate credential for direct graph requests.

The verifier binds signed authority to the cluster identity, incarnation, storage root, audience, graph, action, and expiry. Signed grants narrow the graph's current Cedar policy. Trust is validated before writable graph startup, and data requests require no control-plane network call. The server resolves the actor from verified claims, preserving one principal across credentials.

cluster token --graph ID --actions read,change --ttl 1h stores data authority in a separate OS-keychain entry and prints metadata only. Managed query and mutate use the cached endpoint and require an explicit graph. Missing or expired credentials, conflicting addressing, and unsupported verbs refuse without legacy fallback; global --direct explicitly retains legacy behavior. HTTP requests refuse redirects, have a 10-second deadline and an 8 MiB response bound, and redact credentials from errors. cluster token --clear forgets the local entry without claiming server revocation.

Validation at integration head f9a77b82, including current main 02d182b6:

• Canonical workspace and failpoint test graph: 3,033 passed, 0 failed, 24 ignored; includes real CLI/server process suites and OpenAPI drift checks. Optional S3/Azure integration environments were not configured locally.
• Strict workspace Clippy on the default and failpoint configurations.
• Formatting, documentation/index checks, action pins, and typos 1.50.1.

Earlier live qualification passed on an existing disposable managed cluster:

• Native CLI WorkOS login, OS-keychain storage, actual KMS issuance, and excessive-scope refusal.
• Policy activation through the real operator's drain and receipt path.
• With the Intent API scaled to zero pods, the CLI inserted and read back one catalog row, then returned data_credential_expired at the credential's 60-second expiry. The API was restored afterward.
• Real KMS-signed server requests returned 200 for valid authority; 401 for expired, wrong-incarnation, and wrong-cluster authority; and 403 for missing read permission, wrong graph, and an actor absent from Cedar policy.

The live proof used server commit 463290a9 and CLI binary SHA-256 prefix cb464cb7, with one adopted cluster and one human principal. The full Linux image and separate just e2e-cli kind regression also passed at that snapshot. See the generated sanitized qualification report. Later CLI error-key redaction was reproduced failing and verified by the seven managed-data regression cases and both strict CLI lint configurations; it changes no successful data operation or server behavior.