> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kubox.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# kubox plane verify

Prove the plane's security and operational contracts hold

### Synopsis

ACTIVE, where `plane status` is passive. It asks the world rather than
the plane: is the state reachable, are the two keys two keys, does each
identity hold exactly the authority the design gives it and nothing it does
not, can the plane still assume every connected account.

Both directions, on purpose. An identity that has quietly gained
kms:Decrypt on the artifact key passes every positive check and is caught
only by the negative one -- which is why dx.md §16 exists: "this prevents
another 7/7 healthy while the system is broken".

The plane's own identity is read off the ManagementPlane -- the SVID it
holds, what STS made of it, whether the issuer publishes the signing key --
because the pod is the only place the SVID is. What this command cannot
prove itself is LISTED with what does.

A failure names the violated invariant first: what was required, what was
seen, how much it matters.

```
kubox plane verify [flags]
```

### Options

```
      --artifact-key-provider string   key sealed artifacts are protected by (env: KUBOX_ARTIFACT_KEY_PROVIDER)
      --context string                 context within it
  -f, --file string                    the PlaneDeployment describing this plane
  -h, --help                           help for verify
      --kubeconfig string              path to the plane's kubeconfig
      --stack-key-provider string      key Pulumi state is encrypted with; must be a DIFFERENT key (env: KUBOX_STACK_KEY_PROVIDER)
      --state-backend string           Pulumi state backend (env: PULUMI_BACKEND_URL)
      --tenant stringArray             a tenant this plane builds for: the cloud connection's namespace (kubox-system for Kubox's own); repeatable. Read from the plane's cloud connections when not given
```

### Global options

See [global options](/cli-reference/kubox#global-options).

### SEE ALSO

* [kubox plane](/cli-reference/kubox_plane)	 - Describe and build a management plane from one document