Identity lifecycle: rotate, renew, delegates, revoke; expiry checks; policy roots, thresholds, proposals and oxy policy sign; policy chains served on refs and carried in push bundles (spec 0.6n) 28fc23d7706a

Keys have a lifecycle: `oxy identity rotate` moves to a fresh key pair (the policy follows),

`oxy identity renew --expires 365` sets an expiry, `oxy identity delegate add bot.identity`

lets another key sign for you, and `oxy identity revoke` retires a key. With several root

keys, `oxy policy root add|remove|threshold` and `oxy policy sign` gather the required signatures

through proposal files.

use crate::hash::{KeyId, hash_object, ChangeHash, ObjectRef, ObjectType};

    /// The signing key's identity was replaced by `new` (spec §14.2).

    Rotate { new: KeyId },

    /// `key` must no longer be trusted (spec §14.2).

    Revoke { key: KeyId, reason: String },

            AttestBody::Rotate { .. } => "rotate",

            AttestBody::Revoke { .. } => "revoke",

            AttestBody::Rotate { new } => Value::map([(0, Value::Bytes(new.0.to_vec()))]),

            AttestBody::Revoke { key, reason } => Value::map([(0, Value::Bytes(key.0.to_vec())), (1, Value::Text(reason.clone()))]),

            "rotate" => AttestBody::Rotate { new: oref(field(b, 0, "new")?, "new")? },

            "revoke" => AttestBody::Revoke { key: oref(field(b, 0, "key")?, "key")?, reason: text(field(b, 1, "reason")?, "reason")?.to_owned() },

    /// Whether the identity is past its expiry at `now_ms`.

    pub fn is_expired_at(&self, now_ms: u64) -> bool {

        self.expires.is_some_and(|e| now_ms > e)

    }

    /// A successor identity with the same keys, `previous` set to this

    /// identity's KeyId, and the given delegates and expiry (spec §14.2).

    pub fn successor(&self, delegates: Vec<KeyId>, expires: Option<u64>, created: u64) -> Identity {

        let mut delegates = delegates;

        delegates.sort();

        delegates.dedup();

        Identity { previous: Some(self.hash()), delegates, expires, created, ..self.clone() }

    }

    /// Bootstrap check for the first policy a repository sees (trust on

    /// first use): at least one valid signature by one of its own roots.

    /// The full threshold applies only to updates from a trusted policy,

    /// whose signers are the previous roots and need not be the new ones.

    pub fn verify_bootstrap(&self, sigs: &[Signature]) -> Result<KeyId, String> {

        let target = self.hash();

        for sig in sigs {

            if !self.roots.contains(&sig.key) || self.is_revoked(&sig.key) {

                continue;

            }

            if let Some(id) = self.identity(&sig.key) {

                if identity::verify(id, sig, Domain::Policy, &target).is_ok() {

                    return Ok(sig.key);

                }

            }

        }

        Err("policy carries no valid signature by one of its own root keys".into())

    }

    /// Whether `key` appears anywhere in the policy (roots, rules, identities).

    pub fn mentions(&self, key: &KeyId) -> bool {

        self.roots.contains(key) || self.rules.iter().any(|r| r.keys.contains(key)) || self.identity(key).is_some()

    }

    /// Whether `key` is `rule_key` or one of its predecessors in the

    /// rotation chain (`previous` links, spec §14.2), so that changes signed

    /// before a rotation remain authorized. Revoked keys never qualify.

    pub fn succeeds(&self, rule_key: &KeyId, key: &KeyId) -> bool {

        if self.is_revoked(key) {

            return false;

        }

        let mut cur = Some(*rule_key);

        for _ in 0..32 {

            match cur {

                Some(k) if k == *key => return true,

                Some(k) => cur = self.identity(&k).and_then(|i| i.previous),

                None => return false,

            }

        }

        false

    }

    /// Replace `old` by `new` in the roots and every rule and embed `new`'s

    /// identity (a rotation, spec §14.2). The old identity stays embedded so

    /// signatures made before the rotation still verify; it is superseded,

    /// not revoked.

    pub fn substitute_key(&mut self, old: &KeyId, new: Identity) {

        let nk = new.hash();

        for k in self.roots.iter_mut().chain(self.rules.iter_mut().flat_map(|r| r.keys.iter_mut())) {

            if k == old {

                *k = nk;

            }

        }

        for r in &mut self.rules {

            r.keys.sort();

            r.keys.dedup();

        }

        self.roots.sort();

        self.roots.dedup();

        if self.identity(&nk).is_none() {

            self.identities.push(new);

        }

    }

impl SignedPolicy {

    /// The proposal-file encoding (`wire::policy_value`).

    pub fn encode(&self) -> Vec<u8> {

        crate::cbor::encode(&wire::policy_value(self))

    }

    pub fn decode(b: &[u8]) -> Result<SignedPolicy> {

        wire::policy_from(&crate::cbor::decode(b).map_err(|e| RepoError::Object(ObjectError::from(e)))?)

    }

}

    /// Earlier policies, ascending by serial, so a client behind by more

    /// than one update can verify each step (spec §14.5).

    pub history: Vec<SignedPolicy>,

    /// Policies between the receiver's and the one sent with the push,

    /// ascending by serial (spec §14.5).

    pub policies: Vec<SignedPolicy>,

    /// `[policy bytes, [signature]]`: also the format of a policy proposal

    /// file exchanged between root holders (spec §14.5).

    pub fn policy_value(sp: &SignedPolicy) -> Value {

        Value::Array(vec![Value::Bytes(sp.policy.encode()), sigs_value(&sp.sigs)])

    pub fn policy_from(v: &Value) -> Result<SignedPolicy> {

        Ok(SignedPolicy { policy: Policy::decode(o::bytes(&a[0], "policy")?)?, sigs: sigs_from(&a[1])? })

    }

    fn opt_policy_value(sp: Option<&SignedPolicy>) -> Value {

        sp.map(policy_value).unwrap_or(Value::Null)

    }

    fn opt_policy_from(v: &Value) -> Result<Option<SignedPolicy>> {

        if v.is_null() { Ok(None) } else { policy_from(v).map(Some) }

            (3, Value::Array(b.policies.iter().map(policy_value).collect())),

        if let Some(ps) = m.get(&3) {

            for p in o::array(ps, "policies")? {

                b.policies.push(policy_from(p)?);

            }

        }

            (4, Value::Array(resp.history.iter().map(policy_value).collect())),

        let mut history = Vec::new();

        if let Some(h) = m.get(&4) {

            for p in o::array(h, "history")? {

                history.push(policy_from(p)?);

            }

        }

        Ok((id, RefsResponse { refs, policy, tags, history }))

        let policy = Policy::single_root([3; 16], id.clone(), 99);

        let psig = sk.sign(crate::identity::Domain::Policy, &key, &policy.hash());

            policies: vec![SignedPolicy { policy: policy.clone(), sigs: vec![psig.clone()] }],

        assert_eq!(d.policies, bundle.policies);

        let resp = RefsResponse { refs, policy: Some(SignedPolicy { policy: policy.clone(), sigs: vec![psig.clone()] }), tags: vec![tag.clone()], history: vec![SignedPolicy { policy: policy.clone(), sigs: vec![] }] };

        assert_eq!(back.history, resp.history);

    /// `revoked` marks a signature that verifies but whose key has since

    /// been revoked by policy or by a revocation this repository recorded.

    Valid { key: KeyId, name: String, email: String, sealed: bool, revoked: bool },

/// The outcome of replacing the configured identity (spec §14.2).

#[derive(Clone, Debug)]

pub struct Rotation {

    pub old: KeyId,

    pub new: KeyId,

    pub identity: Identity,

    /// The policy update that moved the old key's grants to the new key,

    /// when the repository has a policy naming the old key.

    pub policy: Option<PolicyUpdate>,

}

        self.create_identity_with(name, email, scope, None)

    }

    /// `create_identity` with an expiry (milliseconds since the epoch).

    pub fn create_identity_with(&mut self, name: &str, email: &str, scope: IdentityScope, expires: Option<u64>) -> Result<(KeyId, Identity)> {

        let mut id = sk.identity(name, email, Hlc::now().wall_ms);

        id.expires = expires;

        let key = self.install_key(&id, &sk)?;

        self.set_author(&id, &key, scope)?;

        Ok((key, id))

    }

    /// Store an identity and keep its secret (and a copy of the identity)

    /// in the key directory.

    fn install_key(&self, id: &Identity, sk: &SecretKey) -> Result<KeyId> {

        let key = self.store.put_identity(id)?;

        Ok(key)

    }

    fn set_author(&mut self, id: &Identity, key: &KeyId, scope: IdentityScope) -> Result<()> {

                self.config.set("author.name", &id.name)?;

                self.config.set("author.email", &id.email)?;

                Config::set_user(&self.user_config, "author.name", &id.name)?;

                Config::set_user(&self.user_config, "author.email", &id.email)?;

        Ok(())

    }

    /// The scope that holds the configured author key.

    fn author_scope(&self) -> IdentityScope {

        if self.config.repo_layer().contains_key("author.key") { IdentityScope::Repo } else { IdentityScope::User }

    }

    /// Replace the configured identity by `new` signed with `sk`: store it,

    /// record a `rotate` attestation signed by the old key, move the old

    /// key's policy grants to the new key, and switch the author config.

    fn replace_identity(&mut self, new: Identity, sk: SecretKey, command: &str) -> Result<Rotation> {

        let Some((old, old_sk)) = self.secret_key()? else {

            return fail("no secret key: run `oxy identity create` first");

        };

        if new.previous != Some(old) {

            return fail("the successor identity must name the current key as previous");

        }

        let new_key = self.install_key(&new, &sk)?;

        let attest = Attest { repo: self.id()?, hlc: Hlc::now(), body: AttestBody::Rotate { new: new_key } };

        let r = self.store.put_attest(&attest)?;

        self.store.put_signature(&r, &old_sk.sign(Domain::Attest, &old, &r))?;

        let policy = match self.current_policy()? {

            Some((_, sp)) if sp.policy.mentions(&old) => {

                let mut p = self.next_policy()?;

                p.substitute_key(&old, new.clone());

                Some(self.sign_policy_with(p, &[(old, &old_sk), (new_key, &sk)], command)?)

            }

            _ => None,

        };

        self.set_author(&new, &new_key, self.author_scope())?;

        Ok(Rotation { old, new: new_key, identity: new, policy })

    }

    /// Rotate to a fresh key pair; the new identity names the old one as

    /// `previous` and keeps its name, email, delegates, and expiry.

    pub fn rotate_identity(&mut self) -> Result<Rotation> {

        let Some((old, _)) = self.secret_key()? else {

            return fail("no secret key: run `oxy identity create` first");

        };

        let cur = self.identity(&old)?;

        let sk = SecretKey::generate();

        let mut id = sk.identity(&cur.name, &cur.email, Hlc::now().wall_ms);

        id.previous = Some(old);

        id.delegates = cur.delegates.clone();

        id.expires = cur.expires;

        self.replace_identity(id, sk, "oxy identity rotate")

    }

    /// Re-issue the identity with the same keys and a new expiry.

    pub fn renew_identity(&mut self, expires: Option<u64>) -> Result<Rotation> {

        let Some((old, sk)) = self.secret_key()? else {

            return fail("no secret key: run `oxy identity create` first");

        };

        let cur = self.identity(&old)?;

        let id = cur.successor(cur.delegates.clone(), expires, Hlc::now().wall_ms);

        self.replace_identity(id, sk, "oxy identity renew")

    }

    /// Let `delegate` sign or seal on this identity's behalf. Delegates are

    /// part of the identity object, so this re-issues it with the same keys.

    pub fn delegate_add(&mut self, delegate: Identity) -> Result<Rotation> {

        let Some((old, sk)) = self.secret_key()? else {

            return fail("no secret key: run `oxy identity create` first");

        };

        let dk = self.store.put_identity(&delegate)?;

        if dk == old {

            return fail("an identity cannot delegate to itself");

        }

        let cur = self.identity(&old)?;

        if cur.delegates.contains(&dk) {

            return fail(format!("{} is already a delegate", dk.short(12)));

        }

        let mut delegates = cur.delegates.clone();

        delegates.push(dk);

        let id = cur.successor(delegates, cur.expires, Hlc::now().wall_ms);

        self.replace_identity(id, sk, &format!("oxy identity delegate add {}", dk.short(12)))

    }

    /// Withdraw a delegation; re-issues the identity with the same keys.

    pub fn delegate_remove(&mut self, delegate: &KeyId) -> Result<Rotation> {

        let Some((old, sk)) = self.secret_key()? else {

            return fail("no secret key: run `oxy identity create` first");

        };

        let cur = self.identity(&old)?;

        if !cur.delegates.contains(delegate) {

            return fail(format!("{} is not a delegate", delegate.short(12)));

        }

        let delegates = cur.delegates.iter().copied().filter(|d| d != delegate).collect();

        let id = cur.successor(delegates, cur.expires, Hlc::now().wall_ms);

        self.replace_identity(id, sk, &format!("oxy identity delegate remove {}", delegate.short(12)))

    }

    /// Revoke `key` (your own, or any key when you hold a policy root):

    /// record a signed `revoke` attestation and a local marker, and drop

    /// the key from the policy where it has one.

    pub fn revoke_identity(&self, key: &KeyId, reason: &str) -> Result<Option<PolicyUpdate>> {

        let Some((own, sk)) = self.secret_key()? else {

            return fail("no secret key: run `oxy identity create` first");

        };

        let policy = self.current_policy()?.map(|(_, sp)| sp.policy);

        let is_root = policy.as_ref().is_some_and(|p| p.roots.contains(&own));

        if *key != own && !is_root {

            return fail("only the key's holder or a policy root can revoke it");

        }

        let attest = Attest { repo: self.id()?, hlc: Hlc::now(), body: AttestBody::Revoke { key: *key, reason: reason.into() } };

        let r = self.store.put_attest(&attest)?;

        self.store.put_signature(&r, &sk.sign(Domain::Attest, &own, &r))?;

        let dir = self.oxy.join("revoked");

        fs::create_dir_all(&dir)?;

        write_atomic(&dir.join(key.to_hex()), r.to_hex().as_bytes())?;

        match policy {

            Some(p) if p.mentions(key) => Ok(Some(self.policy_revoke(key)?)),

            _ => Ok(None),

        }

    }

    /// Whether `key` is revoked by the policy or by a recorded revocation.

    pub fn is_revoked(&self, key: &KeyId) -> Result<bool> {

        if self.oxy.join("revoked").join(key.to_hex()).exists() {

            return Ok(true);

        }

        Ok(self.current_policy()?.is_some_and(|(_, sp)| sp.policy.is_revoked(key)))

                Ok(id) => return Ok(SignatureStatus::Valid { key: sig.key, name: id.name, email: id.email, sealed: false, revoked: self.is_revoked(&sig.key)? }),

        if id.is_expired_at(change.hlc.wall_ms) {

            return Err(format!("key {} had expired when the change was made", sig.key.short(12)));

        }

                    Ok(id) => return Ok(SignatureStatus::Valid { key: sig.key, name: id.name, email: id.email, sealed: true, revoked: self.is_revoked(&sig.key)? }),

pub use identity::{Rotation, SignatureStatus};

pub use policy::PolicyUpdate;

use crate::identity::SecretKey;

/// A signed policy update: applied when it met the root threshold, else a

/// proposal carrying the signatures gathered so far (spec §14.5).

#[derive(Clone, Debug)]

pub struct PolicyUpdate {

    pub policy: Policy,

    pub sigs: Vec<Signature>,

    pub applied: bool,

}

impl PolicyUpdate {

    pub fn signed(&self) -> SignedPolicy {

        SignedPolicy { policy: self.policy.clone(), sigs: self.sigs.clone() }

    }

}

        let dir = self.oxy.join("policies");

        fs::create_dir_all(&dir)?;

        write_atomic(&dir.join(format!("{:020}", sp.policy.serial)), r.to_hex().as_bytes())?;

    /// Every policy this repository has applied, ascending by serial, with

    /// its signatures. Policies applied before this index existed are

    /// missing from it, except the current one.

    pub fn policy_history(&self) -> Result<Vec<SignedPolicy>> {

        let mut out: BTreeMap<u64, SignedPolicy> = BTreeMap::new();

        if let Ok(rd) = fs::read_dir(self.oxy.join("policies")) {

            for e in rd.flatten() {

                let Ok(hex) = fs::read_to_string(e.path()) else { continue };

                let Some(r) = ObjectRef::from_hex(hex.trim()) else { continue };

                let Ok(bytes) = self.store.get_typed(&r, ObjectType::Policy) else { continue };

                let policy = Policy::decode(&bytes)?;

                out.insert(policy.serial, SignedPolicy { policy, sigs: self.store.signatures(&r)? });

            }

        }

        if let Some((_, sp)) = self.current_policy()? {

            out.insert(sp.policy.serial, sp);

        }

        Ok(out.into_values().collect())

    }

    /// Verify and apply a chain of policies ending in `newest`, each

    /// against the one before it (spec §14.5). `chain` holds earlier

    /// policies in any order; only those after the current serial are used.

    pub(crate) fn adopt_policy_chain(&self, chain: &[SignedPolicy], newest: &SignedPolicy, command: &str) -> std::result::Result<(), String> {

        let mut current = self.current_policy().map_err(|e| e.to_string())?.map(|(_, sp)| sp.policy);

        let mut steps: Vec<&SignedPolicy> = chain

            .iter()

            .filter(|sp| current.as_ref().is_none_or(|c| sp.policy.serial > c.serial) && sp.policy.serial < newest.policy.serial)

            .collect();

        steps.sort_by_key(|sp| sp.policy.serial);

        steps.push(newest);

        for sp in steps {

            self.check_policy(sp, current.as_ref())?;

            self.set_policy(sp, &format!("{command} (policy serial {})", sp.policy.serial)).map_err(|e| e.to_string())?;

            current = Some(sp.policy.clone());

        }

        Ok(())

    }

        match trusted {

            Some(t) => sp.policy.verify_signatures(&sp.sigs, t)?,

            None => vec![sp.policy.verify_bootstrap(&sp.sigs)?],

        };

    /// Sign `policy` with the configured key and apply it if the current

    /// policy's root threshold is met; otherwise return it as a proposal.

    fn sign_policy(&self, policy: Policy, command: &str) -> Result<PolicyUpdate> {

        self.sign_policy_with(policy, &[(key, &sk)], command)

    }

    /// Sign with every listed key; the first must be a root of the current

    /// policy (the others may be roots of the new policy only, so that a

    /// fresh clone can bootstrap from it).

    pub(crate) fn sign_policy_with(&self, policy: Policy, signers: &[(KeyId, &SecretKey)], command: &str) -> Result<PolicyUpdate> {

        let trusted = self.current_policy()?.map(|(_, sp)| sp.policy).unwrap_or_else(|| policy.clone());

        if !signers.first().is_some_and(|(k, _)| trusted.roots.contains(k)) {

            return fail("your key is not a root key of the current policy");

        }

        let target = policy.hash();

        let sigs = signers.iter().map(|(k, sk)| sk.sign(Domain::Policy, k, &target)).collect();

        self.gather(SignedPolicy { policy, sigs }, &trusted, command)

    }

    /// Apply `sp` when its signatures meet `trusted`'s threshold.

    fn gather(&self, sp: SignedPolicy, trusted: &Policy, command: &str) -> Result<PolicyUpdate> {

        let applied = sp.policy.verify_signatures(&sp.sigs, trusted).is_ok();

        if applied {

            self.set_policy(&sp, command)?;

        }

        Ok(PolicyUpdate { policy: sp.policy, sigs: sp.sigs, applied })

    }

    /// Add your signature to a proposal made by another root holder; the

    /// policy is applied once the current root threshold is met.

    pub fn policy_sign(&self, proposal: SignedPolicy) -> Result<PolicyUpdate> {

        let Some((key, sk)) = self.secret_key()? else {

            return fail("no secret key: run `oxy identity create` first");

        };

        let Some((_, current)) = self.current_policy()? else {

            return fail("this repository has no policy; run `oxy policy init` or fetch one");

        };

        if proposal.policy.repo != self.id()? {

            return fail("the proposal is for a different repository");

        if proposal.policy.serial <= current.policy.serial {

            return fail(format!("the proposal's serial {} is not greater than the current {}", proposal.policy.serial, current.policy.serial));

        if !current.policy.roots.contains(&key) {

            return fail("your key is not a root key of the current policy");

        }

        let mut sigs: Vec<Signature> = proposal.sigs.into_iter().filter(|s| s.key != key).collect();

        sigs.push(sk.sign(Domain::Policy, &key, &proposal.policy.hash()));

        self.gather(SignedPolicy { policy: proposal.policy, sigs }, &current.policy, "oxy policy sign")

    pub fn policy_init(&self) -> Result<PolicyUpdate> {

        self.sign_policy(policy, "oxy policy init")

    }

    /// Make `identity` a root key.

    pub fn policy_root_add(&self, identity: Identity) -> Result<PolicyUpdate> {

        let mut p = self.next_policy()?;

        let key = identity.hash();

        if p.roots.contains(&key) {

            return fail(format!("{} is already a root", key.short(12)));

        }

        p.roots.push(key);

        p.roots.sort();

        p.revoked.retain(|k| k != &key);

        if p.identity(&key).is_none() {

            p.identities.push(identity);

        }

        self.sign_policy(p, &format!("oxy policy root add {}", key.short(12)))

    /// Drop a root key; the remaining roots must still meet the threshold.

    pub fn policy_root_remove(&self, key: &KeyId) -> Result<PolicyUpdate> {

        let mut p = self.next_policy()?;

        if !p.roots.contains(key) {

            return fail(format!("{} is not a root", key.short(12)));

        }

        p.roots.retain(|k| k != key);

        if (p.roots.len() as u32) < p.root_threshold {

            return fail(format!("removing it would leave {} root(s) for a threshold of {}", p.roots.len(), p.root_threshold));

        }

        self.sign_policy(p, &format!("oxy policy root remove {}", key.short(12)))

    }

    /// Require `n` root signatures on future policy updates.

    pub fn policy_set_threshold(&self, n: u32) -> Result<PolicyUpdate> {

        let mut p = self.next_policy()?;

        if n == 0 || n as usize > p.roots.len() {

            return fail(format!("the threshold must be between 1 and the number of roots ({})", p.roots.len()));

        }

        p.root_threshold = n;

        self.sign_policy(p, &format!("oxy policy root threshold {n}"))

    }

    pub(crate) fn next_policy(&self) -> Result<Policy> {

    pub fn policy_grant(&self, identity: Identity, pattern: Option<&str>) -> Result<PolicyUpdate> {

        self.sign_policy(p, &format!("oxy policy grant {}", key.short(12)))

    /// Revoke `key`: it may no longer update anything, and existing rules

    /// drop it. A root key can be revoked by another root as long as the

    /// remaining roots still meet the threshold.

    pub fn policy_revoke(&self, key: &KeyId) -> Result<PolicyUpdate> {

            let own = self.secret_key()?.map(|(k, _)| k);

            if own == Some(*key) {

                return fail("a root cannot revoke itself; have another root revoke it, or remove it with `oxy policy root remove` first");

            }

            p.roots.retain(|k| k != key);

            if (p.roots.len() as u32) < p.root_threshold {

                return fail(format!("revoking it would leave {} root(s) for a threshold of {}", p.roots.len(), p.root_threshold));

            }

        self.sign_policy(p, &format!("oxy policy revoke {}", key.short(12)))

    /// rule lists, using the authenticator kind the rule requires. A rule key

    /// covers its rotation predecessors, and a delegate's signature counts

    /// for the author it acts for.

                let author = self.store.get_change(hash).map(|c| c.author).map_err(|e| e.to_string())?;

                let principal = if author.is_zero() { key } else { author };

                let covered = rule.keys.iter().any(|k| policy.succeeds(k, &key) || policy.succeeds(k, &principal));

                if !covered {

        let policy = self.current_policy()?.map(|(_, sp)| sp);

        let history = self.policy_history()?.into_iter().filter(|sp| policy.as_ref().is_some_and(|p| sp.policy.serial < p.policy.serial)).collect();

        Ok(RefsResponse { refs: out, policy, tags: self.tag_refs()?, history })

            match self.adopt_policy_chain(&bundle.policies, &sp, "push received") {

                    _ => {

                        self.adopt_policy_chain(&resp.history, sp, &format!("oxy fetch {remote_name}")).map_err(|e| RepoError::Msg(format!("policy from {remote_name}: {e}")))?;

            self.adopt_policy_chain(&resp.history, sp, "oxy clone --depth").map_err(|e| RepoError::Msg(format!("policy from {remote_name}: {e}")))?;

        let resp_policy_serial = resp.policy.as_ref().map(|p| p.policy.serial);

        if let Some(l) = &policy_to_send {

            let remote_serial = resp_policy_serial;

            bundle.policies = self.policy_history()?.into_iter().filter(|sp| remote_serial.is_none_or(|r| sp.policy.serial > r) && sp.policy.serial < l.policy.serial).collect();

        }

    assert_eq!(repo.verify_change(&h2).unwrap(), SignatureStatus::Valid { key, name: "Ada".into(), email: "[email protected]".into(), sealed: false, revoked: false });

#[test]

fn identity_lifecycle() {

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let root = dir.path();

    let origin = Repo::init(&root.join("origin")).unwrap();

    let url = root.join("origin").to_string_lossy().to_string();

    let mut a = Repo::clone(&url, &root.join("a")).unwrap().with_home(root.join("home-a"));

    a.set_user_config("core.sign", "change").unwrap();

    let (key_a, _) = a.create_identity("Ada", "[email protected]", IdentityScope::User).unwrap();

    write(&root.join("a"), "a.txt", b"a\n");

    let h1 = a.commit("one", &[]).unwrap();

    assert!(a.policy_init().unwrap().applied);

    assert!(a.push("origin", false).unwrap().iter().all(|r| r.ok));

    // Expiry: an identity that had expired when the change was made does not authenticate it.

    let mut e = Repo::init(&root.join("e")).unwrap().with_home(root.join("home-e"));

    e.set_user_config("core.sign", "change").unwrap();

    e.create_identity_with("Eve", "[email protected]", IdentityScope::User, Some(Hlc::now().wall_ms - 1)).unwrap();

    write(&root.join("e"), "e.txt", b"e\n");

    let he = e.commit("late", &[]).unwrap();

    assert!(matches!(e.verify_change(&he).unwrap(), SignatureStatus::Invalid(m) if m.contains("expired")));

    // Renewal re-issues the identity (same keys, new KeyId) with a later expiry.

    let r = e.renew_identity(Some(Hlc::now().wall_ms + 86_400_000)).unwrap();

    assert_eq!(e.identity(&r.new).unwrap().previous, Some(r.old));

    write(&root.join("e"), "e.txt", b"e2\n");

    let he2 = e.commit("in time", &[]).unwrap();

    assert!(matches!(e.verify_change(&he2).unwrap(), SignatureStatus::Valid { key, .. } if key == r.new));

    // Rotation: a fresh key; the old change still verifies; the policy follows.

    let r = a.rotate_identity().unwrap();

    assert_eq!(r.old, key_a);

    assert_eq!(a.config.author_key, Some(r.new));

    assert_eq!(a.identity(&r.new).unwrap().previous, Some(key_a));

    assert!(r.policy.as_ref().unwrap().applied);

    let (_, sp) = a.current_policy().unwrap().unwrap();

    assert_eq!((sp.policy.serial, sp.policy.roots.clone()), (2, vec![r.new]));

    assert!(!sp.policy.revoked.contains(&key_a) && sp.policy.authorizes(&r.new, "main"), "superseded, not revoked");

    assert!(sp.policy.succeeds(&r.new, &key_a) && !sp.policy.succeeds(&key_a, &r.new));

    assert!(matches!(a.verify_change(&h1).unwrap(), SignatureStatus::Valid { key, revoked: false, .. } if key == key_a));

    write(&root.join("a"), "a.txt", b"a2\n");

    let h2 = a.commit("two", &[]).unwrap();

    assert!(matches!(a.verify_change(&h2).unwrap(), SignatureStatus::Valid { key, revoked: false, .. } if key == r.new));

    // Origin accepts the rotated policy (signed by the old root) and the new key's change.

    let res = a.push("origin", false).unwrap();

    assert!(res.iter().all(|x| x.ok), "{res:?}");

    assert_eq!(origin.current_policy().unwrap().unwrap().1.policy.serial, 2);

    let key_a = r.new;

    // Delegation: Bob may sign on Ada's behalf. Delegates live in the

    // identity object, so Ada's KeyId changes while her keys stay the same.

    let mut b = Repo::clone(&url, &root.join("b")).unwrap().with_home(root.join("home-b"));

    let (key_b, id_b) = b.create_identity("Bob", "[email protected]", IdentityScope::User).unwrap();

    let r = a.delegate_add(id_b.clone()).unwrap();

    assert_eq!(r.old, key_a);

    let key_a2 = r.new;

    assert_eq!(a.identity(&key_a2).unwrap().delegates, vec![key_b]);

    assert_eq!(a.identity(&key_a2).unwrap().ed25519_pk, a.identity(&key_a).unwrap().ed25519_pk);

    assert!(a.delegate_add(id_b.clone()).is_err(), "already a delegate");

    assert!(a.push("origin", false).unwrap().iter().all(|x| x.ok));

    write(&root.join("a"), "a.txt", b"a3\n");

    let h3 = a.commit("three", &[]).unwrap();

    assert!(matches!(a.verify_change(&h3).unwrap(), SignatureStatus::Valid { key, .. } if key == key_a2), "the same secret signs under the new KeyId");

    // A change authored by Ada but signed only by Bob verifies through the delegation.

    a.set_user_config("core.sign", "seal").unwrap();

    write(&root.join("a"), "a.txt", b"a4\n");

    let h4 = a.commit("four", &[]).unwrap();

    assert_eq!(a.verify_change(&h4).unwrap(), SignatureStatus::Unsigned);

    let (_, sk_b) = b.secret_key().unwrap().unwrap();

    a.store().put_signature(&h4, &sk_b.sign(Domain::Change, &key_b, &h4)).unwrap();

    assert!(matches!(a.verify_change(&h4).unwrap(), SignatureStatus::Valid { key, .. } if key == key_b));

    a.set_user_config("core.sign", "change").unwrap();

    // Withdrawing the delegation re-issues the identity again.

    let r = a.delegate_remove(&key_b).unwrap();

    assert!(a.identity(&r.new).unwrap().delegates.is_empty());

    assert!(a.delegate_remove(&key_b).is_err());

    let key_a3 = r.new;

    let res = a.push("origin", false).unwrap();

    assert!(res.iter().all(|x| x.ok), "{res:?}");

    // Multi-signer policy: Bob becomes a root and the threshold rises to 2,

    // both applied under the old threshold of 1. A grant then needs Bob too.

    assert!(a.policy_root_add(id_b.clone()).unwrap().applied);

    assert!(a.policy_root_add(id_b.clone()).is_err());

    assert!(a.policy_set_threshold(3).is_err());

    assert!(a.policy_set_threshold(2).unwrap().applied);

    assert!(a.push("origin", false).unwrap().iter().all(|x| x.ok));

    b.pull("origin").unwrap();

    assert_eq!(b.current_policy().unwrap().unwrap().1.policy.root_threshold, 2);

    let mut c = Repo::init(&root.join("c")).unwrap().with_home(root.join("home-c"));

    let (key_c, id_c) = c.create_identity("Cy", "[email protected]", IdentityScope::User).unwrap();

    let serial_before = a.current_policy().unwrap().unwrap().1.policy.serial;

    let proposal = a.policy_grant(id_c, None).unwrap();

    assert!(!proposal.applied && proposal.sigs.len() == 1);

    assert_eq!(proposal.policy.serial, serial_before + 1);

    assert_eq!(a.current_policy().unwrap().unwrap().1.policy.serial, serial_before, "a proposal changes nothing yet");

    // Bob signs the proposal, handed over as a file, and it applies for him.

    let bytes = proposal.signed().encode();

    let signed = b.policy_sign(SignedPolicy::decode(&bytes).unwrap()).unwrap();

    assert!(signed.applied && signed.sigs.len() == 2);

    assert!(b.current_policy().unwrap().unwrap().1.policy.authorizes(&key_c, "main"));

    assert!(b.policy_sign(signed.signed()).is_err(), "a stale proposal is refused");

    // Bob publishes it and Ada picks it up.

    assert!(b.push("origin", false).unwrap().iter().any(|x| x.name == "policy" && x.ok));

    a.pull("origin").unwrap();

    assert_eq!(a.current_policy().unwrap().unwrap().1.policy.serial, serial_before + 1);

    // A root cannot revoke itself; revoking Cy needs both roots but is recorded locally at once.

    assert!(a.policy_revoke(&key_a3).is_err());

    let u = a.revoke_identity(&key_c, "left the project").unwrap().unwrap();

    assert!(!u.applied);

    assert!(a.is_revoked(&key_c).unwrap());

    assert!(!b.is_revoked(&key_c).unwrap());

    let u = b.policy_sign(u.signed()).unwrap();

    assert!(u.applied && u.policy.is_revoked(&key_c));

    assert!(b.is_revoked(&key_c).unwrap());

    // Bob can revoke Ada's root key, leaving himself as the only root (threshold 2 would be unmeetable).

    assert!(b.policy_revoke(&key_a3).is_err(), "would leave one root for a threshold of 2");

    // Revoking one's own key without a policy root works locally: a plain marker plus attestation.

    let key_c_own = c.config.author_key.unwrap();

    assert!(c.revoke_identity(&key_c_own, "lost laptop").unwrap().is_none());

    assert!(c.is_revoked(&key_c_own).unwrap());

    assert_eq!(key_c_own, key_c);

}

- [ ] (Pending, for the morning) Ask Andy to complete his cut-off request ("Can we also look at ..."). (GPG question settled: Andy said to leave GPG out.)

- [x] Identity lifecycle: `oxy identity rotate|revoke`, expiry, delegates (`oxy identity delegate add|remove`), multi-signer policy updates. (Done: rotation as supersession with chain-aware policy authorization, renew, delegates, revocation attestations and local markers, expiry checks, root add/remove/threshold, proposal files and `oxy policy sign`; spec 0.6n.)

- [x] Push and serve the chain of policies since the receiver's serial, so several offline rotations or updates publish in one push or fetch. (Done in iteration 12: `.oxy/policies/` index, `refs` history, bundle policies.)

- 2026-09-27 06:30 iteration 12: identity lifecycle and multi-signer policy updates; policy chains on fetch and push (spec 0.6n). 106 tests.

| **Status** | Draft 0.6n |

**Lifecycle rules.** Because the `KeyId` is the hash of the whole object, any change to an identity, including its `delegates` or `expires`, is a rotation: a successor object with `previous` set. A successor MAY keep the same key pair (`oxy identity renew`, `oxy identity delegate add|remove`) or carry a fresh one (`oxy identity rotate`); either way earlier signatures remain verifiable under the earlier object, which stays stored. A rotation **supersedes** the previous KeyId: a policy that named it MUST be updated to name the successor (§14.5), and a rule key covers every predecessor in its `previous` chain that is not revoked, so changes signed before a rotation remain authorized. Revocation is for compromised or abandoned keys: a revoked key authorizes nothing, whatever its chain. `expires` bounds the changes a key can authenticate: a signature or seal over a change whose `hlc.wall_ms` is later than the identity's `expires` is invalid. A client records the revocations it makes or verifies under `.oxy/revoked/` and reports signatures by such keys as valid but revoked.

- The initial policy is signed by the root keys; every update MUST be signed by `roots.threshold` root keys of the policy it replaces and have a higher `serial`. An update that a single holder cannot complete is a **proposal**: the signed policy (`[policy bytes, [Signature]]`, §16.3) is passed to other root holders, each of whom adds a signature with `oxy policy sign`; whoever completes the threshold applies it. Rotating a root key (§14.2) substitutes the successor in the roots and rules; such a policy is signed by both the previous and the successor key so a fresh clone can bootstrap from it.

- A change's signer is authorized by a rule if the rule lists it, or lists a successor of it, or lists the change's `author` (or a successor) when the signer is that author's delegate.

- **Propagation.** The `refs` response carries the current signed policy together with the earlier policies the server still holds, and a push MAY carry a newer policy with the intermediate ones in its bundle, applied before any bookmark update. A receiver behind by several serials verifies each step against the one before it. A receiver accepts a policy only if it is for the same repository, its serial exceeds the current one, and it is signed by the current policy's root threshold; the first policy a repository ever sees vouches for itself, which means at least one valid signature by one of its own roots (trust on first use).

| `Bundle` | `{0: [[change bytes, [Signature]]], 1: [signed attestation], 2: [[type name, object bytes]], 3: [signed policy]}`; changes in dependency order; objects are chunks, blobs, identities, and states only; key 3 (optional) holds the policies between the receiver's serial and the one sent with a push, ascending |

| `refs` response | `{0: [{0: name, 1: state ref, 2: [heads], 3: signed attestation or null, 4: last serial or null}], 1: repo id, 2: signed policy or null, 3: [tag], 4: [signed policy]}`; key 4 (optional) lists earlier policies ascending by serial; the attestation is present only when it describes the current state; a tag is `{0: name, 1: state ref, 2: [heads], 3: signed attestation or null}` |

oxy identity create|show|export|rotate|renew|revoke|delegate

oxy policy init|show|grant|revoke|root|sign

*Changelog.* Draft 0.6n (2026-09-27): identity lifecycle (§14.2): every identity edit is a rotation that supersedes rather than revokes, expiry bounds authenticated changes, revocations recorded locally; policy proposals for multi-signer updates, chain-aware authorization, bootstrap rule, and policy history on `refs` and in push bundles (§14.5, §16.3).

Draft 0.6m (2026-09-27): orphaned references on rewrite are reified by re-anchoring rather than refused (§8.4).

        SignatureStatus::Valid { key, name, email, sealed, revoked } => {

            format!("{} by {name} <{email}> key {}{}", if sealed { "sealed" } else { "signed" }, key.short(12), if revoked { " (KEY REVOKED)" } else { "" })

        SignatureStatus::Valid { sealed, revoked: true, .. } => ui::warn(format!("{} {} (key revoked)", ui::glyph("⚠", "!"), if sealed { "sealed" } else { "signed" })),

use oxy_core::hash::KeyId;

use oxy_core::objects::Hlc;

use oxy_core::protocol::SignedPolicy;

use oxy_core::repo::{self, IdentityScope, PolicyUpdate, Repo, Rotation};

const DAY_MS: u64 = 24 * 60 * 60 * 1000;

fn expiry_from_days(days: u64) -> Option<u64> {

    (days > 0).then(|| Hlc::now().wall_ms + days * DAY_MS)

}

/// Resolve a KeyId prefix among the identities the repository knows.

fn resolve_key(repo: &Repo, prefix: &str) -> Result<KeyId> {

    if let Some(k) = KeyId::from_hex(prefix) {

        return Ok(k);

    }

    let mut candidates: Vec<KeyId> = Vec::new();

    if let Some((_, sp)) = repo.current_policy()? {

        candidates.extend(sp.policy.identities.iter().map(|i| i.hash()));

        candidates.extend(sp.policy.revoked.iter().copied());

    }

    if let Some(own) = repo.config.author_key {

        candidates.push(own);

        if let Ok(id) = repo.identity(&own) {

            candidates.extend(id.delegates.iter().copied());

        }

    }

    candidates.sort();

    candidates.dedup();

    let matches: Vec<_> = candidates.into_iter().filter(|k| k.starts_with_hex(prefix)).collect();

    match matches.len() {

        1 => Ok(matches[0]),

        0 => anyhow::bail!("no known key starts with {prefix:?}"),

        _ => anyhow::bail!("{prefix:?} is ambiguous"),

    }

}

/// Report a policy update: applied, or written out as a proposal that

/// other root holders sign with `oxy policy sign`.

fn report_update(u: &PolicyUpdate, out: Option<PathBuf>) -> Result<()> {

    if u.applied {

        println!("{} policy serial {} {}", ui::done("Applied"), u.policy.serial, ui::dim("(push to publish it)"));

        return Ok(());

    }

    let path = out.unwrap_or_else(|| PathBuf::from(format!("policy-{}.proposal", u.policy.serial)));

    std::fs::write(&path, u.signed().encode())?;

    println!(

        "{} policy serial {} needs {} of {} root signatures; has {}. Wrote {} for another root to run {}",

        ui::caution(),

        u.policy.serial,

        u.policy.root_threshold,

        u.policy.roots.len(),

        u.sigs.len(),

        ui::path(path.display()),

        ui::dim(format!("oxy policy sign {}", path.display()))

    );

    Ok(())

}

fn report_rotation(r: &Rotation, verb: &str) -> Result<()> {

    println!("{} identity {} <{}>", ui::done(verb), ui::author(&r.identity.name), r.identity.email);

    println!("{}", ui::kv("old key", ui::dim(r.old.to_hex())));

    println!("{}", ui::kv("new key", r.new.to_hex()));

    if !r.identity.delegates.is_empty() {

        println!("{}", ui::kv("delegates", r.identity.delegates.iter().map(|d| d.short(12)).collect::<Vec<_>>().join(" ")));

    }

    if let Some(e) = r.identity.expires {

        println!("{}", ui::kv("expires", when(e)));

    }

    match &r.policy {

        Some(u) => report_update(u, None)?,

        None => println!("  {} {}", ui::note(), ui::dim("no policy names the old key; export the new identity for policy holders")),

    }

    Ok(())

}

pub fn create(name: Option<String>, email: Option<String>, local: bool, expires: Option<u64>) -> Result<i32> {

    let (key, _) = repo.create_identity_with(&name, &email, scope, expires.and_then(expiry_from_days))?;