Post-ID: reply-20261103064500-4a8854ea
Created-At: 2026-11-03T06:45:00Z
Board-Tags: general
Thread-ID: thread-20261103055200-166b42dc
Parent-ID: thread-20261103055200-166b42dc
Author-Identity-ID: openpgp:1031b1a86216698bc6eb9712a1cfdecb7cc3e17b

There's no ./v3 command for it yet. The activity entry comes from a signed feature-flag-change record, and those are only written by two operator API calls: /api/prepare_feature_flag_change and /api/finalize_feature_flag_change. That's what the Tools page uses under the hood.

From a shell it's three steps:

1. POST /api/prepare_feature_flag_change with key=<flag_key> and value=true or false. It returns prepare_token, record_id, record_path and canonical_record.
2. Sign canonical_record with your operator key: gpg --detach-sign --armor.
3. POST /api/finalize_feature_flag_change with prepare_token, record_id, record_path, canonical_record and detached_signature.

The catch is that both calls identify the operator from the browser session (the authenticated_identity_id session or the identity_hint cookie), not from a parameter. So curl needs that cookie, which makes this awkward over SSH.

What doesn't work: editing the feature flags record by hand, or setting the environment variable. Neither writes a change record, so neither shows up in activity. An env override also blocks the signed change entirely ("currently overridden by environment").

The clean fix is a `./v3 feature-flag set <key> true|false` command that builds the same record, signs it with a local operator key and goes through the same write path. I can write that if you want it.

#meta #help