# Accounts, providers and rig environments

Documented against OpenRig 0.5.14. Help text uses "node" where these pages say **seat**, for a seat's position in the running rig.

## What it is for

Seats run on the accounts your harnesses are already logged into. `rig auth` manages named auth profiles for a runtime without ever printing, logging or storing a token. `rig provider` reads which seats are bound to which accounts, what the usage signals say, and whether a seat can be switched to another account without stranding the conversation it is in. `rig env` inspects and controls the services a service-backed rig runs alongside its seats, such as the Vault behind the secrets-manager starter.

## The three commands you will use first

**See the auth state without secrets.**

```
rig auth status
rig auth list --runtime codex
rig auth seats list
```

**Read the provider model, and switch safely.** `precheck` never offers an unsafe switch; `switch` is precheck-gated and orchestrated by the daemon.

```
rig provider status
rig provider signals
rig provider precheck --seat dev-impl@my-rig --account <ref>
```

**Check a service-backed rig's environment.** `env status` is the honest health surface for managed services; `ps` alone is not.

```
rig env status secrets-manager
rig env logs secrets-manager vault
rig env down secrets-manager
```

## The auth, provider and env families

[//]: # (table:start)
| Command | What it does (from help) | Help source |
|---|---|---|
| `rig auth` | Manage agent auth profiles (CLI-local; runtime via --runtime). Tokens are never printed, logged, or stored. | auth.txt |
| `rig auth list` | List saved profiles by name. | auth.list.txt |
| `rig auth save` | Snapshot the active auth state into a named profile (file copy; contents never echoed). | auth.save.txt |
| `rig auth seats` | Seat -> profile registry (metadata only; not proof of a live account). | auth.seats.txt |
| `rig auth seats list` | List seat -> profile mappings. | auth.seats.list.txt |
| `rig auth seats report` | Counts: total / known / unknown / malformed. | auth.seats.report.txt |
| `rig auth seats set` | Upsert a seat -> profile metadata row. | auth.seats.set.txt |
| `rig auth seats show` | Show the registry row for one seat. | auth.seats.show.txt |
| `rig auth status` | Auth-file presence + login state (no secrets). | auth.status.txt |
| `rig auth switch` | Activate a saved profile. | auth.switch.txt |
| `rig auth validate` | Check a profile's file mode + JSON parseability (NOT live-auth). | auth.validate.txt |
| `rig env` | Inspect and control rig environment services for service-backed rigs and managed apps | env.txt |
| `rig env down` |  | env.down.txt |
| `rig env logs` |  | env.logs.txt |
| `rig env status` |  | env.status.txt |
| `rig provider` | Provider accounts, usage signals, and interruption-safe account switching | provider.txt |
| `rig provider accounts` | The accounts block of the provider read model | provider.accounts.txt |
| `rig provider bindings` | The bindings block of the provider read model | provider.bindings.txt |
| `rig provider precheck` | Whether switching a seat to an account is safe (never offers an unsafe switch) | provider.precheck.txt |
| `rig provider signals` | The signals block of the provider read model | provider.signals.txt |
| `rig provider status` | The whole four-block provider read model (accounts, bindings, signals) | provider.status.txt |
| `rig provider switch` | Switch a seat to an account (precheck-gated; the daemon orchestrates the switch) | provider.switch.txt |

[//]: # (table:end)

## What it does not do

- `rig auth validate` checks a profile's file mode and JSON shape, not that the account is live.
- `provider signals` reports anomalies (unbound seats, accounts shared across seats), not a listing.
- `env down --volumes` removes compose volumes; it is a data-loss action, not a stop.

## Where it goes next

- [Lifecycle](/docs/lifecycle): booting a service-backed rig such as secrets-manager.
- [Troubleshooting](/docs/troubleshooting): what to read when a seat's runtime is not logged in.