c 0 121
i 16
miao tribute                                                 # push (entrusted seal, or tribute link)
```

### Selecting who may push: the keeper's seal 印

Instead of (or alongside) the shared `--tribute` link, you can grant push rights to
**chosen people**, each by their own Ed25519 identity:

```
# the collaborator, once per machine:
miao seal                       # cuts a personal seal, prints its 64-hex "seal print"

# you, in your temple:
miao entrust ming <seal print>  # select them
miao entrust                    # list the entrusted
miao entrust --revoke ming      # withdraw (takes effect immediately, even mid-fair)
c 122 1
i 8

From then on `miao tribute` from ming signs the bundle with their seal, and your fair
accepts it **even in read-only mode** — no push secret ever travels or gets shared.
The server verifies the signature over the bundle hash and the temple name, checks the
seal against `.miao/entrusted` live on every request, applies objects hash-verified and
fast-forward-only, and the chronicle records *who* pushed (`tribute-from  ming`).
Private keys never leave the Ling runtime; only a seed sits in `~/.miao-seal`
(override the path with `MIAO_SEAL` to hold several identities).
c 123 87
