feat: keep admissions valid until revoked - #29
Merged
Conversation
Treat expires_at null as until-revoked on signer registries, workflow and release admissions, decision receipts, authority/revocation state, manifests, summaries, checkpoints, and feeds. A timestamp still ends the window. Do not cap lifetime at 7 or 30 days. Policy revision 4 sets admission_validity to until_revoked. Support release admissions and 5-minute operational tokens keep their short windows. Revocation remains the kill switch.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A signature does not rot. After this, an admission stays valid until revoked or replaced; a leaked key is forever until revocation is published.
expires_atmay be JSONnull. Validators skip the clock check in that case. A timestamp still works: if someone sets one in the past, the object dies at that instant. We dropped the 7-day and 30-day caps.Policy revision 4 names this
admission_validity: until_revokedand sets both maximum-day fields to null. The retained v1 ledger still uses its historical 30-day bound, because those rows already carry timestamps. Support-release admissions and 5-minute operational tokens keep their short windows.Issuer output follows the same rule. If the bound receipt, registry, and authority/revocation state don't expire, the issued admission's
expires_atstays null. Software and KMS registry-candidate builders accept omitted or null expiry.Tests cover the two edges: null
expires_atverifies later; a past timestamp still fails.Published-package staging is not in this PR.
validate_stagingstill requirestag_ref_state.exists: false. Tag v1.34.0 is already on PyPI, so Production still needs a follow-up that accepts an already-published tag.Opened by an agent session, not the founder.