Tags made before a key rotation verify again e5d9b0513f3e

    /// A lasting attestation (a tag) signed by a key the policy has since

    /// rotated away from (spec §14.2) is authorized as the key that

    /// succeeded it: a key the rule lists reaches the signer through

    /// `previous` links, and the attestation is dated (`at_ms`) before the

    /// signer's successor was made, so a superseded key makes nothing new.

    /// Revoked keys authorize nothing.

    pub(crate) fn predecessor_authorized(

        &self,

        p: &crate::policy::Policy,

        signer: &KeyId,

        reference: &str,

        at_ms: u64,

    ) -> bool {

        if p.is_revoked(signer) {

            return false;

        }

        let Some(rule) = p.rule_for(reference) else {

            return false;

        };

        let identity = |k: &KeyId| {

            p.identity(k)

                .cloned()

                .or_else(|| self.store.get_identity(k).ok())

        };

        rule.keys.iter().any(|k| {

            if p.is_revoked(k) {

                return false;

            }

            let mut cur = identity(k);

            for _ in 0..32 {

                let Some(id) = cur else {

                    return false;

                };

                match id.previous {

                    Some(prev) if prev == *signer => return at_ms < id.created,

                    Some(prev) if !p.is_revoked(&prev) => cur = identity(&prev),

                    _ => return false,

                }

            }

            false

        })

    }

                let at = sa.attest.hlc.wall_ms;

                    && !self.delegate_authorized(p, &sig.key, &reference, at)

                    && !self.predecessor_authorized(p, &sig.key, &reference, at)

    // After a rotation the policy names only the new key, yet a fresh clone

    // still takes the tags the old key made before it; the old key makes

    // nothing new.

    let rot = a.rotate_identity().unwrap();

    let r = a.push("origin", false).unwrap();

    assert!(r.iter().all(|x| x.ok), "{r:?}");

    let c = Repo::clone(&url, &root.join("c"))

        .unwrap()

        .with_home(root.join("home-c"));

    assert_eq!(c.tag_heads("v3").unwrap(), Some(vec![h2]));

    let (_, sp) = c.current_policy().unwrap().unwrap();

    assert!(!sp.policy.authorizes(&key_a, "tags/v9"));

    let made = c.identity(&rot.new).unwrap().created;

    assert!(c.predecessor_authorized(&sp.policy, &key_a, "tags/v9", made - 1));

    assert!(!c.predecessor_authorized(&sp.policy, &key_a, "tags/v9", made));

    assert!(!c.predecessor_authorized(&sp.policy, &rot.new, "tags/v9", 0));

**Lifecycle rules.** Because the `KeyId` is the hash of the whole object, any change to an identity, including its `delegates` or `expires`, is a rotation: a successor object with `previous` set. A successor MAY keep the same key pair (`oxy identity renew`, `oxy identity delegate add|remove`) or carry a fresh one (`oxy identity rotate`); either way earlier signatures remain verifiable under the earlier object, which stays stored. A rotation **supersedes** the previous KeyId: a policy that named it MUST be updated to name the successor (§14.5), and a rule key covers every predecessor in its `previous` chain that is not revoked, so changes signed before a rotation remain authorized. A tag's attestation (§10) signed by such a predecessor is authorized only when its `hlc.wall_ms` is earlier than the `created` of the identity that succeeded the signer, so tags made before a rotation stay valid and a superseded key makes no new ones. Revocation is for compromised or abandoned keys: a revoked key authorizes nothing, whatever its chain. `expires` bounds the changes a key can authenticate: a signature or seal over a change whose `hlc.wall_ms` is later than the identity's `expires` is invalid. A client records the revocations it makes or verifies under `.oxy/revoked/` and reports signatures by such keys as valid but revoked.