M13-02C Status

status: done
task: signer identity, key rotation, revocation and timestamp policy
updated: 2026-08-18 America/New_York
enablingTask: false
parityStateChange: false

Scope

The scripting protocol now has a versioned trust-policy schema for signer identity and key lifecycles. It validates ED25519 public-key identity, publisher ownership, active/revoked status, not-before/not-after windows, revocation timestamps, same-publisher rotation predecessors and acyclic rotation chains. maxClockSkewMs binds policy timestamps to an explicit bounded window. resolveScriptSigner only returns ELIGIBLE with cryptographicVerification=REQUIRED; revoked, expired, not-yet-valid, missing and publisher-confused keys remain structured BLOCKED results. This task does not verify signatures or enable script execution.

Evidence

node --test web/tests/unit/script-trust-policy.test.mjs passed 3/3. It covers valid active rotation, revoked predecessor, invalid/cross-publisher/cyclic rotation, revocation metadata, public-key format and timestamp failures.
WEB_TEST_PORT=5516 npm --prefix web run test:script-trust-policy passed unit 3/3 and production Chromium Worker 1/1.
node tools/web/check-script-trust-policy.mjs passed: script-trust-policy-ok active=key:new revoked=REVOKED crossPublisher=SCRIPT_POLICY_DENIED policyExpired=POLICY_EXPIRED crypto=REQUIRED next=M13-02D.
npm --prefix web run typecheck passed; M13-02A and M13-02B checkers were rerun after the additive protocol change and passed. No parity ledger or execution route changed.

Artifact Hashes

protocol: 6699fc0a19e0736823f164e707a420655803e36019cf0071f7ff9c760d25e9f2
worker: c6e206b29e7cacc3e23e2ac12a3d523a9c0b16ff29759126dab13c8665547421
checker: 0e55ce20d142f2bcbc5ce9c6fb955ef2771d284dff636c79da3f59a33b8b0aeb
unit: 59ac77bcc1086e0a0e914cb77d647db5d34c7160202e7aad52948b7277769551
e2e: 614091bda15367090bc78a6f465fb10d02d0aa08775b5088699b12e2490034d2
report: 0f59f733920edbbe5cb799e5f50ff31d19e55ced98e7a890828f6337a237e4bd
unit: aac3ff0a1c7ae27e35112614bedabc02bb248882ec9b0b52d65f9794d06830d8
parent manifest: 605c656780a206a0d3b81d06b0294108b488a62d2b709e886884a2973c6cb091
manifest: 89745daca88371335f4bd56982791266461082066c6c1345056fbc697bb7e6a2

Next Task

M13-02D: signature only approves declared content and source hash changes invalidate it.

Rollback

Remove the trust-policy schema, parser/resolver, checker, unit/Chromium tests, worker, report, manifest and this status entry; restore M13-02B as the queue tail and move the machine queue back to M13-02C. No parity ledger rollback is required.

2.6 KiB Raw Blame History