A keyless agent's grant survives its owner's key rotation (closes #135) 45a6f5ec85cf

- **A keyless agent's grant survives its owner's key rotation (#135).** Every delegation an owner adds or removes renews their identity, and a repository that names the newest key as `author.key` read every change their agent sealed as INVALID ("key … is neither the author nor a delegate"), and its pushes were refused, because the agent's grant was signed by the owner's earlier key. A grant by a key the author's identity was rotated or renewed from now counts when it was made before that rotation; one an old key made after it does not.

- **A tag can be withdrawn, by a signed withdrawal (oxygenhub#301).** There was no way to remove a tag anywhere: a mistaken release tag stayed for good. `oxy tag delete NAME [-r REASON]` records an `untag` attestation naming the tag's state, signed like a tag (a ten-minute keyless key too), and the next `oxy push` sends it to a remote that still has the tag; `oxy push --delete tags/NAME` does both at once. A receiver under a policy accepts it only from a key that may create the tag, keeps it beside the tag's creation, and lists withdrawn tags in its refs answer (key 8), so a `fetch` withdraws the tag there too (`tag v1 was withdrawn on origin, and here`). A withdrawn name is never used again, so a tag name never names two states. `oxy-server`'s `Backend` gains `vet_tag_withdrawal` (OxygenHub refuses while a release uses the tag), and `Repo::host_tag_create` and `host_tag_withdrawal` let a host make or withdraw a tag for a signed-in user. The wire change is additive, but an older server refuses a withdrawal (wrong attestation kind), and an older client keeps a withdrawn tag.

        // A grant by an earlier key of the author's identity counts while

        // it was made before that key was rotated away (oxygen#135).

        if g.grant.grantor != *author && !self.granted_before_rotation(author, &g.grant) {

            .identity(&g.grant.grantor)

    }

    /// Whether `grant` is by a key `author`'s identity was rotated from,

    /// made before that rotation (oxygen#135). An owner rotates with every

    /// delegation, and a repository may name the newest key as the author

    /// while the agent's grant is by an older one; the grant stays good, as

    /// a policy keeps a predecessor's signatures from before the rotation

    /// (spec §14.5), but a key rotated away grants nothing new.

    fn granted_before_rotation(&self, author: &KeyId, grant: &crate::cert::Grant) -> bool {

        let mut cur = self.identity(author).ok();

        for _ in 0..32 {

            let Some(id) = cur else {

                return false;

            };

            match id.previous {

                Some(prev) if prev == grant.grantor => return grant.not_before < id.created,

                Some(prev) => cur = self.identity(&prev).ok(),

                None => return false,

            }

        }

        false

/// oxygen#135: an owner renews or rotates with every delegation, and a

/// repository may name the newest key as the author; the agent's grant by

/// the earlier key still counts, but not one that key made after.

fn a_grant_outlives_its_owner_s_rotation() {

    use crate::cert::{Certificate, Grant, SignedCertificate, SignedGrant};

    use crate::identity::Scope;

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let root = dir.path();

    let mut a = Repo::init(&root.join("a"))

        .unwrap()

        .with_home(root.join("home-a"));

    let (old, _) = a

        .create_identity("Ada", "[email protected]", IdentityScope::User)

        .unwrap();

    let (_, old_sk) = a.secret_key().unwrap().unwrap();

    let old_id = a.identity(&old).unwrap();

    let hub_sk = SecretKey::generate();

    let hub = hub_sk.identity("hub", "[email protected]", 1);

    let now = Hlc::now().wall_ms;

    let grant = |from: u64| {

        SignedGrant::sign(

            Grant {

                grantor: old,

                subject: "agent:claude@ada".into(),

                issuer: hub.hash(),

                scope: Scope::CHANGES | Scope::SEAL,

                not_before: from,

                expires: now + 86_400_000,

            },

            &old_id,

            &old_sk,

        )

    };

    let before = grant(now - 60_000);

    let after = grant(now + 60_000);

    let rot = a.renew_identity(None).unwrap();

    assert_ne!(rot.new, old);

    let agent = |name: &str, g: SignedGrant| {

        let mut r = Repo::init(&root.join(name))

            .unwrap()

            .with_home(root.join(format!("home-{name}")));

        let (key, id) = r

            .create_identity(name, "[email protected]", IdentityScope::User)

            .unwrap();

        for i in [&old_id, &rot.identity, &hub] {

            r.store().put_identity(i).unwrap();

        }

        r.set_user_config("author.key", &rot.new.to_hex()).unwrap();

        r.set_user_config("author.signer", &key.to_hex()).unwrap();

        let cert = SignedCertificate::sign(

            Certificate {

                key: id,

                issuer: hub.hash(),

                subject: "agent:claude@ada".into(),

                claims: vec![],

                scope: Scope::CHANGES | Scope::REFS | Scope::SEAL,

                not_before: now - 60_000,

                expires: now + 600_000,

                grant: Some(g),

            },

            &hub,

            &hub_sk,

        );

        r.store().put_certificate(&cert).unwrap();

        write(&root.join(name), "work.txt", b"agent work\n");

        let h = r.commit("work", &[]).unwrap();

        assert_eq!(r.store().get_change_meta(&h).unwrap().author, rot.new);

        r.seal(&[h]).unwrap();

        (r, h)

    };

    let (r, h) = agent("kept", before);

    assert!(

        matches!(

            r.authenticate_change(&h).unwrap(),

            SignatureStatus::Valid { .. }

        ),

        "{:?}",

        r.authenticate_change(&h).unwrap()

    );

    let (r, h) = agent("late", after);

    assert!(

        matches!(r.authenticate_change(&h).unwrap(), SignatureStatus::Invalid(e) if e.contains("neither")),

        "a grant the old key made after the rotation: {:?}",

        r.authenticate_change(&h).unwrap()

    );

}

#[test]

A signed grant is `[grant bytes, Signature]`: the grantor's composite signature, in domain `grant`, over the grant's ObjectRef (type `grant`). It needs no maximum lifetime: it gives nothing until an issuer certifies a key under it, and the grantor revokes it by asking the issuer to stop. The issuer puts it in each certificate it issues under it (field 8), so it travels with the certificate and a verifier needs nothing else. A signature by a key that is neither a change's author nor its delegate (§14.4) still satisfies the author-or-delegate rule when the key's certificate verifies with its issuer and carries a grant that verifies with the change's author (or with a key the author's identity was rotated or renewed from, by its `previous` chain, when the grant's `not_before` is before that step's `created`: an owner's rotation keeps the grants they made, but a key rotated away grants nothing new; oxygen#135), names the certificate's subject and issuer, gives the scope needed (`changes` for a change signature, `seal` for a seal) in both the grant and the certificate, and covers the change's `hlc.wall_ms`, as a delegation does. Whether the certificate covered the time the key signed is the policy's check (§14.5), at a time the signer did not choose.