Repository navigation
id: implement Issuer key rotation and compromise recovery (design #2804) #5526
Description
Implementation of an ID design that has not landed yet (zero implementation as of the 2026-11-04 inventory).
Design issue: #2804
Design doc: doc/2026-11-01_design_id2804.md (in developing-today/code)
Acceptance, in brief: issuer key rotation and compromise recovery flows per the design, with tests.
Current state: no issuer-key rotation or compromise-recovery machinery exists.
The design documents govern. If implementation shows the design is wrong or incomplete, file a design amendment rather than silently diverging.
Scope: pkgs/id and its tests. Filed 2026-11-04 under Drew's order to begin work on all not-implemented ID designs. Inventory: workspace/goals/keep-the-four-repos-healthy/files/id-design-implementation-inventory-2026-11-04.md (in the fleet workspace).
Activity
developing-today commentedon Nov 4, 2026
CODE-1353
dezren39 commentedon Nov 4, 2026
🤖 Agent note · picked up
fix(id): carry the rotation in the signed extension; recovery resolve…
fix(id): a rotation never installs the key it replaces (#5526)
feat(id): issuer key rotation and compromise recovery — protocol core (…
dezren39 commentedon Nov 4, 2026
🤖 Agent note · done
pkgs/id/src/issuer_rotation.rs— theIssuerRotationrecord carried in the signed header extension (ChainExt::rotation, gated to kindissuer.rotation, per design §3.2's storage rule), domain-separated successor proof, consecutive predecessor-linked generations, compromise recovery validated only against the definition's committed recovery-key hash (a compromised minting key cannot author its own recovery, and no commitment means no authoritative recovery),fold_rotation_chain(deterministic, order-independent; duplicate-predecessor forks stayConflictedunless a single committed-key recovery resolves the head, with rivals recorded asvoided_transitions; a transition never installs the key it replaces), and the successor causal-link rule (references_rotation).cargo check --all-targetsandcargo fmtclean.fold_authorisationtakes the expected issuer.