52 lines
2.6 KiB
Markdown
52 lines
2.6 KiB
Markdown
# M13-02C Status
|
|
|
|
status: done
|
|
task: signer identity, key rotation, revocation and timestamp policy
|
|
updated: 2026-08-18 America/New_York
|
|
enablingTask: false
|
|
parityStateChange: false
|
|
|
|
## Scope
|
|
|
|
The scripting protocol now has a versioned trust-policy schema for signer identity and key
|
|
lifecycles. It validates ED25519 public-key identity, publisher ownership, active/revoked status,
|
|
not-before/not-after windows, revocation timestamps, same-publisher rotation predecessors and
|
|
acyclic rotation chains. `maxClockSkewMs` binds policy timestamps to an explicit bounded window.
|
|
`resolveScriptSigner` only returns `ELIGIBLE` with `cryptographicVerification=REQUIRED`; revoked,
|
|
expired, not-yet-valid, missing and publisher-confused keys remain structured `BLOCKED` results.
|
|
This task does not verify signatures or enable script execution.
|
|
|
|
## Evidence
|
|
|
|
- `node --test web/tests/unit/script-trust-policy.test.mjs` passed 3/3. It covers valid active
|
|
rotation, revoked predecessor, invalid/cross-publisher/cyclic rotation, revocation metadata,
|
|
public-key format and timestamp failures.
|
|
- `WEB_TEST_PORT=5516 npm --prefix web run test:script-trust-policy` passed unit 3/3 and production
|
|
Chromium Worker 1/1.
|
|
- `node tools/web/check-script-trust-policy.mjs` passed:
|
|
`script-trust-policy-ok active=key:new revoked=REVOKED crossPublisher=SCRIPT_POLICY_DENIED policyExpired=POLICY_EXPIRED crypto=REQUIRED next=M13-02D`.
|
|
- `npm --prefix web run typecheck` passed; M13-02A and M13-02B checkers were rerun after the
|
|
additive protocol change and passed. No parity ledger or execution route changed.
|
|
|
|
## Artifact Hashes
|
|
|
|
- protocol: `6699fc0a19e0736823f164e707a420655803e36019cf0071f7ff9c760d25e9f2`
|
|
- worker: `c6e206b29e7cacc3e23e2ac12a3d523a9c0b16ff29759126dab13c8665547421`
|
|
- checker: `0e55ce20d142f2bcbc5ce9c6fb955ef2771d284dff636c79da3f59a33b8b0aeb`
|
|
- unit: `59ac77bcc1086e0a0e914cb77d647db5d34c7160202e7aad52948b7277769551`
|
|
- e2e: `614091bda15367090bc78a6f465fb10d02d0aa08775b5088699b12e2490034d2`
|
|
- report: `0f59f733920edbbe5cb799e5f50ff31d19e55ced98e7a890828f6337a237e4bd`
|
|
- unit: `aac3ff0a1c7ae27e35112614bedabc02bb248882ec9b0b52d65f9794d06830d8`
|
|
- parent manifest: `605c656780a206a0d3b81d06b0294108b488a62d2b709e886884a2973c6cb091`
|
|
- manifest: `89745daca88371335f4bd56982791266461082066c6c1345056fbc697bb7e6a2`
|
|
|
|
## Next Task
|
|
|
|
`M13-02D`: signature only approves declared content and source hash changes invalidate it.
|
|
|
|
## Rollback
|
|
|
|
Remove the trust-policy schema, parser/resolver, checker, unit/Chromium tests, worker, report,
|
|
manifest and this status entry; restore M13-02B as the queue tail and move the machine queue back to
|
|
M13-02C. No parity ledger rollback is required.
|