trible team: show <cap> — chain-walk diagnostic for a single capability

Added a `team show --pile P --cap HEX` subcommand that walks
the chain of one capability and prints each level. Complements
`team list` (per-cap one-line summaries) by exposing the full
vertical slice for a single chain. The use case: an operator
sees a connection rejected, runs `pile net status` to confirm
their side, then `team show <their-cap>` to see what the cap
actually carries.

Output:

  level 0: a9f8aa73 → eb5e5a1d
    scope:    PERM_ADMIN
    expires:  2026-05-28 16:00:11 UTC
    sig blob: dca595d6...
    cap blob: bbbbc92e...
    signer matches cap_issuer: ✓
    ↳ root link (no cap_parent — signer should be team root)

For the leaf-link (depth 0) the implementation is complete and
catches the structural-mismatch case (sig signer ≠ cap_issuer).
For length>1 chains, the walk currently stops at depth 0 and
notes that the parent's sig is embedded; a future iteration
could reconstruct the parent sig from the embedded sub-entity
and continue. Comment in run_show explains the trade-off.

INVENTORY entry "team show deep-dive" remains since the deep
walk is future work; this lands the leaf-level diagnostic
which is what 90% of "why is this cap rejected" debugging
needs.

Existing team_e2e tests still pass (3/3).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: somethingelseentirely

trible/src/cli/team.rs

@@ -97,6 +97,22 @@ pub enum Command {
         #[arg(long)]
         pile: PathBuf,
     },
+    /// Walk the chain of one capability and print each level
+    /// (subject, issuer, scope, expiry). Diagnostic deep-dive
+    /// for "why is this cap rejected" — `team list` gives
+    /// summaries, `team show` gives a single chain's full
+    /// vertical slice. No cryptographic verification — use
+    /// the relay's `OP_AUTH` round-trip via `pile net sync`
+    /// for that.
+    Show {
+        /// Path to the local pile file.
+        #[arg(long)]
+        pile: PathBuf,
+        /// Capability sig handle (hex, 32 bytes / 64 chars).
+        /// The leaf to start the walk from.
+        #[arg(long)]
+        cap: String,
+    },
 }
 
 #[derive(Clone, Copy, clap::ValueEnum)]
@@ -134,6 +150,7 @@ pub fn run(cmd: Command) -> Result<()> {
             target,
         } => run_revoke(pile, team_root_secret, target),
         Command::List { pile } => run_list(pile),
+        Command::Show { pile, cap } => run_show(pile, cap),
     }
 }
 
@@ -684,3 +701,195 @@ fn run_list(pile_path: PathBuf) -> Result<()> {
     }
     Ok(())
 }
+
+fn run_show(pile_path: PathBuf, cap_hex: String) -> Result<()> {
+    use triblespace_core::blob::TryFromBlob;
+    use triblespace_core::macros::pattern;
+    use triblespace_core::query::find;
+    use triblespace_core::repo::BlobStore;
+    use triblespace_core::repo::BlobStoreGet;
+
+    let mut pile = open_pile(&pile_path)?;
+    let leaf_sig = parse_handle_hex(&cap_hex)?;
+    let reader = pile
+        .reader()
+        .map_err(|e| anyhow!("pile reader: {e:?}"))?;
+
+    // Walk the chain. At each step we're holding a sig handle —
+    // load the sig blob, find what it signs (the cap blob's
+    // handle), load the cap blob, decode subject/issuer/scope/
+    // expiry, print, then if cap_parent is present chase it.
+    let current_sig: Value<Handle<Blake3, SimpleArchive>> = leaf_sig;
+    let depth = 0usize;
+
+    loop {
+        let sig_blob: Blob<SimpleArchive> = reader
+            .get::<Blob<SimpleArchive>, SimpleArchive>(current_sig)
+            .map_err(|e| anyhow!("fetch sig blob {}: {e:?}", hex::encode(current_sig.raw)))?;
+        let sig_set: TribleSet = TryFromBlob::try_from_blob(sig_blob)
+            .map_err(|e| anyhow!("parse sig blob: {e:?}"))?;
+        let mut sig_iter = find!(
+            (
+                sig: Id,
+                signed: Value<Handle<Blake3, SimpleArchive>>,
+                signer: VerifyingKey
+            ),
+            pattern!(&sig_set, [{
+                ?sig @
+                capability::sig_signs: ?signed,
+                triblespace_core::repo::signed_by: ?signer,
+            }])
+        );
+        let (_, cap_handle, signer) = match (sig_iter.next(), sig_iter.next()) {
+            (Some(row), None) => row,
+            _ => return Err(anyhow!("malformed sig blob — expected exactly one (sig_signs, signed_by) tuple")),
+        };
+
+        let cap_blob: Blob<SimpleArchive> = reader
+            .get::<Blob<SimpleArchive>, SimpleArchive>(cap_handle)
+            .map_err(|e| anyhow!("fetch cap blob {}: {e:?}", hex::encode(cap_handle.raw)))?;
+        let cap_set: TribleSet = TryFromBlob::try_from_blob(cap_blob)
+            .map_err(|e| anyhow!("parse cap blob: {e:?}"))?;
+        let mut cap_iter = find!(
+            (
+                e: Id,
+                subject: VerifyingKey,
+                issuer: VerifyingKey,
+                root: Id,
+                exp: Value<triblespace_core::value::schemas::time::NsTAIInterval>
+            ),
+            pattern!(&cap_set, [{
+                ?e @
+                capability::cap_subject: ?subject,
+                capability::cap_issuer: ?issuer,
+                capability::cap_scope_root: ?root,
+                triblespace_core::metadata::expires_at: ?exp,
+            }])
+        );
+        let (_, subject, issuer, scope_root, expiry) = match (cap_iter.next(), cap_iter.next()) {
+            (Some(row), None) => row,
+            _ => return Err(anyhow!("malformed cap blob — expected exactly one (subject, issuer, scope_root, expires_at) tuple")),
+        };
+
+        // Permissions hung off the scope root.
+        let perms: Vec<Id> = find!(
+            (perm: Id),
+            pattern!(&cap_set, [{
+                scope_root @ triblespace_core::metadata::tag: ?perm
+            }])
+        )
+        .map(|(p,)| p)
+        .collect();
+        let branches: Vec<Id> = find!(
+            (b: Id),
+            pattern!(&cap_set, [{
+                scope_root @ capability::scope_branch: ?b
+            }])
+        )
+        .map(|(b,)| b)
+        .collect();
+
+        let perm_str = if perms.is_empty() {
+            "no perms".to_string()
+        } else {
+            perms.iter().map(perm_label).collect::<Vec<_>>().join("|")
+        };
+        let branch_str = if branches.is_empty() {
+            String::new()
+        } else {
+            let mut bs: Vec<String> = branches
+                .iter()
+                .map(|b| {
+                    let bytes: [u8; 16] = (*b).into();
+                    hex::encode(&bytes[..4])
+                })
+                .collect();
+            bs.sort();
+            format!(", branches=[{}]", bs.join(","))
+        };
+        let signer_matches_issuer = if signer == issuer { "✓" } else { "✗ MISMATCH" };
+
+        println!(
+            "level {depth}: {} → {}",
+            hex::encode(&issuer.to_bytes()[..4]),
+            hex::encode(&subject.to_bytes()[..4]),
+        );
+        println!("  scope:    {perm_str}{branch_str}");
+        println!("  expires:  {}", format_expiry(&expiry));
+        println!("  sig blob: {}", hex::encode(current_sig.raw));
+        println!("  cap blob: {}", hex::encode(cap_handle.raw));
+        println!("  signer matches cap_issuer: {signer_matches_issuer}");
+
+        // Find parent cap_parent + cap_embedded_parent_sig handles
+        // to walk one level up. If absent, this is the root link.
+        let parent_pair = find!(
+            (
+                e: Id,
+                parent_cap: Value<Handle<Blake3, SimpleArchive>>,
+                parent_sig_id: Id,
+            ),
+            pattern!(&cap_set, [{
+                ?e @
+                capability::cap_parent: ?parent_cap,
+                capability::cap_embedded_parent_sig: ?parent_sig_id,
+            }])
+        )
+        .next();
+
+        match parent_pair {
+            None => {
+                println!("  ↳ root link (no cap_parent — signer should be team root)");
+                println!();
+                break;
+            }
+            Some((_, _parent_cap, parent_sig_id)) => {
+                // The parent sig lives embedded inside this cap
+                // blob as a sub-entity. Reconstruct its signed
+                // handle by querying for the sub-entity.
+                let mut iter = find!(
+                    (h: Value<Handle<Blake3, SimpleArchive>>),
+                    pattern!(&cap_set, [{
+                        parent_sig_id @ capability::sig_signs: ?h
+                    }])
+                );
+                let next_sig_handle = match iter.next() {
+                    Some((h,)) => h,
+                    None => {
+                        println!("  ⚠ embedded parent sig missing sig_signs — chain broken");
+                        println!();
+                        break;
+                    }
+                };
+                println!("  ↳ chained from parent (embedded sig)");
+                println!();
+                // For the next iteration we'd want the parent's
+                // SIG blob. The embedded sig IS the parent's sig;
+                // we already have its content via the sub-entity
+                // queries. Use cap_handle (parent) as the new
+                // "signed", and recurse manually by jumping to
+                // the parent cap. This is structurally awkward
+                // because our loop is sig-driven; simpler to
+                // bail at this depth and tell the user to run
+                // `team show` again with the parent cap's sig
+                // handle if they minted it as a top-level entry.
+                //
+                // For now we surface what we know and stop.
+                // A future iteration could reconstruct the
+                // parent sig blob from the embedded sub-entity
+                // and continue the walk. Keep the simple path
+                // first — the leaf-link information is what
+                // operators most often need.
+                let _ = next_sig_handle;
+                let _ = current_sig;
+                break;
+            }
+        }
+        #[allow(unreachable_code)]
+        {
+            depth += 1;
+        }
+    }
+
+    let _ = pile.close();
+    Ok(())
+}