Expand description
seydd enrol --token … — redeem an enrolment token issued by the console.
This is the robot half of the enrolment loop (PLAN.md §2.5, ADR 0007). The robot generates its own Ed25519 key, keeps the private half, and sends only the public half with a one-time token. It never sees a user credential and never talks to the identity provider: a fleet enrols, and keeps running, independently of whoever the humans authenticate against.