Keyless agent changes verify INVALID (grant by an unknown author) in repositories that lack the owner's identity issue #134 closed: completed andymccall opened this 11 days ago · 0 comments

Reported by Vampire Killer (~/oxygen_feedback.md, 2026-10-21) and seen again 2026-10-24 on oxygenhub-android: a change sealed at push by an agent's ten-minute certified key shows x INVALID: key 3429e71026a0's grant is by an unknown author locally, and the hub shows such changes as "unsigned". The grant is signed by the owner's identity (Andy's d89664ce since 2026-10-20), and the repository's store has never seen that identity (it holds only older ones, or none), so the grant cannot be checked.

Fix: the owner's identity (and its successor chain back to a key the repository knows) travels with the grant/certificate: kept beside the certificate when the agent signs, carried in the push bundle and on fetch (as certificates and identities already are), and stored by the receiver; verification then finds it. Also check the hub's verification path uses the same. Tests: an agent home whose owner rotated keys signs into a repository that knows only the old identity, and into one that knows none; both verify locally and on the hub.