S1: Keys for the witness #48

New issue

Open

opened 2026-08-12 16:15:45 +00:00 by agent.teyla · 0 comments

agent.teyla commented

2026-08-12 16:15:45 +00:00

Contributor

M1 frontier

In scope

The estate's PKI shape, used as it is: epochal roots minted for Bao on a regular cadence, with issuance delegated to the host's Bao agent, which mints short-lived signing leaves locally. Keys are born and die on the host that witnesses; custody via systemd credentials, the hook-secret pattern.
Root epochs align with sealing windows: root_ttl ≥ sealing_window + margin, declared and eval-checked — the fourth coupling. Every sealed segment verifies under one root, two at most across a handover.
Succession is a record. The outgoing root cross-signs its successor before expiry, and the succession statement enters the chain as a signed record. A steward finding nags the deadline: epoch ending, no successor recorded. A missed window breaks continuity with no cryptographic repair — only a human re-attestation — so succession is a ceremony with a due date.
Checkpoints embed the certificate chain used at signing (leaf, delegated intermediate, epoch root fingerprint), so a sealed segment is self-contained: segment plus succession chain plus the genesis fingerprint committed at the first seal verifies with no live Bao, no revocation fetch, no network.
Validity is judged at signing time, never at verification time: evidence outlives its certificates and its roots by design, and a record's position between signed checkpoints bounds when it was created without trusting a self-asserted clock.

Out of scope

Any non-jostoph emitter (S5 generalizes).

Boundary

A signature authenticates the emitter, not the truth: a compromised host mints and signs lies fluently. With delegated short-lived leaves, revocation is mostly non-renewal and the compromise window is the TTL — declare the TTL as the security parameter it is.
No key is the anchor. The tag annotation carries the epoch root's fingerprint beside the checkpoint hash, so the curator's signature vouches for which root governed the cycle: tags vouch for roots, roots vouch for records, and each tag descends from the last. The trust anchor is the ceremony's continuity — law 2's shape, extended to trust itself. Root succession is an owner's act, never an agent's.

Acceptance

Leaves rotate without service interruption; records verify across a rotation boundary; segments verify across a root handover.
A sealed segment from a retired epoch verifies offline against only the succession chain and the genesis fingerprint, after every leaf and root in it has expired.
A record signed outside its leaf's validity interval fails; a succession record missing before epoch expiry raises the steward's finding while repair is still cryptographic.

Source: JOSTOPH-BACKLOG.md, Epic 1.2.

`M1` `frontier` **In scope** - The estate's PKI shape, used as it is: **epochal roots** minted for Bao on a regular cadence, with issuance delegated to the host's Bao agent, which mints short-lived signing leaves locally. Keys are born and die on the host that witnesses; custody via systemd credentials, the hook-secret pattern. - Root epochs align with sealing windows: `root_ttl ≥ sealing_window + margin`, declared and eval-checked — the fourth coupling. Every sealed segment verifies under one root, two at most across a handover. - **Succession is a record.** The outgoing root cross-signs its successor before expiry, and the succession statement enters the chain as a signed record. A steward finding nags the deadline: epoch ending, no successor recorded. A missed window breaks continuity with no cryptographic repair — only a human re-attestation — so succession is a ceremony with a due date. - Checkpoints embed the certificate chain used at signing (leaf, delegated intermediate, epoch root fingerprint), so a sealed segment is self-contained: segment plus succession chain plus the genesis fingerprint committed at the first seal verifies with no live Bao, no revocation fetch, no network. - Validity is judged **at signing time**, never at verification time: evidence outlives its certificates and its roots by design, and a record's position between signed checkpoints bounds when it was created without trusting a self-asserted clock. **Out of scope** - Any non-jostoph emitter (S5 generalizes). **Boundary** - A signature authenticates the *emitter*, not the truth: a compromised host mints and signs lies fluently. With delegated short-lived leaves, revocation is mostly non-renewal and the compromise window is the TTL — declare the TTL as the security parameter it is. - No key is the anchor. The tag annotation carries the epoch root's fingerprint beside the checkpoint hash, so the curator's signature vouches for which root governed the cycle: tags vouch for roots, roots vouch for records, and each tag descends from the last. The trust anchor is the ceremony's continuity — law 2's shape, extended to trust itself. Root succession is an owner's act, never an agent's. **Acceptance** - Leaves rotate without service interruption; records verify across a rotation boundary; segments verify across a root handover. - A sealed segment from a retired epoch verifies offline against only the succession chain and the genesis fingerprint, after every leaf and root in it has expired. - A record signed outside its leaf's validity interval fails; a succession record missing before epoch expiry raises the steward's finding while repair is still cryptographic. Source: JOSTOPH-BACKLOG.md, Epic 1.2.