another issue, revision, verifier, or actor fails its binding. A reversed or

invalidated outcome produces a linked invalidating attestation, and the revoked

claim and signature stay readable. Retiring a key never invalidates the history

it signed, and a private key never enters the database.

it signed, and that is enforced rather than assumed: because the key's active

window is half-open at `retired_at`, a retirement at or before the newest

attestation the key signed is refused with the conflicting attestation time

named, a key that signed nothing retires no earlier than its `activated_at`,

and a `retired_at` beyond a small clock-skew allowance in the future is

refused. There is no override — disowning a signed claim is a linked

revocation, never a rewrite of the key's validity window. A private key never

enters the database.

Disclosure follows repository authority: an attestation is `public` only where

the repository is public or its transparency level admits ledger disclosure

the append-only and uniqueness constraints on `reputation_attestations`, the

per-kind reference constraint on `reputation_subject_claims`,

`OpenAgentsWeb.ReputationController`, `test/openagents/reputation_test.exs`,

`test/openagents/forge/key_rotation_test.exs`,

`test/openagents/reputation/subject_claim_test.exs`,

`test/openagents_web/controllers/reputation_subject_claim_controller_test.exs`,

and `test/openagents_web/controllers/reputation_controller_test.exs`.

| COLLECTIVE-002 | `test/openagents/collective_generalizer_test.exs` |

| COLLECTIVE-003 | `test/openagents/collective_publication_test.exs` |

| COMPENSATION-001 | `test/openagents/compensation_test.exs` |

| REPUTATION-001 | `test/openagents/reputation_test.exs`, `test/openagents_web/controllers/reputation_controller_test.exs` |

| REPUTATION-001 | `test/openagents/reputation_test.exs`, `test/openagents/forge/key_rotation_test.exs`, `test/openagents_web/controllers/reputation_controller_test.exs` |

| SETTLEMENT-001 | `test/openagents/settlement_test.exs` |

| MODULE-001 | `test/openagents/modules/registry_test.exs`, `test/openagents/tool_step_persistence_test.exs` |

| MODULE-002 | `test/openagents/modules/discovery_test.exs`, `test/openagents/modules/lifecycle_test.exs` |

- **The reputation issuer key.** `OpenAgents.Reputation.admit_key/1` admits a

  public key with a validity window. Rotation is issuing under a new key;

  attestations signed by the retired key stay verifiable against the admitted

  public key, which is why the key is admitted rather than assumed.

  public key, which is why the key is admitted rather than assumed. The

  ordering rule is enforced rather than assumed: `retire_key/2` refuses a

  `retired_at` at or before the newest attestation the key signed — the

  refusal names the conflicting attestation time — refuses one earlier than

  the key's `activated_at` when it signed nothing, and refuses one beyond a

  small clock-skew allowance in the future. There is deliberately no

  override: a backdated retirement is exactly the single-`UPDATE` move that

  silently unverifies published signatures (#191), and an issuer who must

  disown a claim publishes a linked revocation instead of rewriting the

  key's validity window.

- **The three hand-rolled vaults.** Each takes its key from the operator's own

  environment, so rotation is an operator action with no separation of duties.

  `docs/forge-operator-independence.md` records that plainly.

    |> Repo.insert()

  end

  @doc "Retires an issuer key. Attestations it already signed keep verifying."

  @doc """

  Retires an issuer key. Attestations it already signed keep verifying.

  That sentence is enforced, not assumed: `active_at?/2`'s window is half-open

  at `retired_at`, so a backdated retirement would flip every attestation at or

  after that instant to unverified while its signature stays valid. The

  changeset refuses a `retired_at` at or before the newest attestation the key

  signed, earlier than the key's `activated_at` when it signed nothing, or more

  than `SigningKey.max_future_skew_seconds/0` in the future. There is no

  override — an operator who wants to disown signed history gets the refusal

  and files a revocation instead (#191).

  """

  @spec retire_key(SigningKey.t(), DateTime.t()) :: {:ok, SigningKey.t()} | {:error, term()}

  def retire_key(%SigningKey{} = key, retired_at \\ DateTime.utc_now()) do

    key |> SigningKey.retire_changeset(retired_at) |> Repo.update()

    key

    |> SigningKey.retire_changeset(retired_at, latest_attested_at: latest_attested_at(key))

    |> Repo.update()

  end

  defp latest_attested_at(%SigningKey{key_id: key_id}) do

    Repo.one(

      from attestation in Attestation,

        where: attestation.issuer_key_id == ^key_id,

        select: max(attestation.attested_at)

    )

  end

  @doc "Every admitted issuer key, for independent verification."

  @timestamps_opts [type: :utc_datetime_usec, updated_at: false]

  @algorithms ~w(ed25519)

  @max_future_skew_seconds 300

  schema "reputation_signing_keys" do

    field :key_id, :string

  def algorithms, do: @algorithms

  @doc "How far into the future a `retired_at` may sit, to absorb clock skew."

  def max_future_skew_seconds, do: @max_future_skew_seconds

  def changeset(record, attributes) do

    record

    |> cast(attributes, ~w(key_id algorithm public_key issuer activated_at retired_at)a)

    |> unique_constraint(:public_key)

  end

  def retire_changeset(record, retired_at) do

  @doc """

  Retires the key at `retired_at`, refusing a timestamp that would rewrite

  history.

  `active_at?/2` reads the half-open window `[activated_at, retired_at)`, so

  a `retired_at` at or before an attestation's `attested_at` flips that

  already-signed attestation to unverified without touching its row. The

  changeset therefore refuses a `retired_at`:

    * at or before the newest attestation the key signed

      (`:latest_attested_at`, queried by the caller), naming the conflicting

      attestation time in the error;

    * earlier than the key's own `activated_at` when it signed nothing —

      `activated_at` rather than `inserted_at`, because `activated_at` is the

      required field that opens the window `active_at?/2` reads, while

      `inserted_at` is only the row's insertion time;

    * more than #{@max_future_skew_seconds} seconds in the future, so a

      retirement records when the key actually stopped rather than a claim

      about a time that has not happened.

  There is deliberately no override: an operator who needs an earlier

  boundary is asking to unverify signatures that were already published as

  valid, and #191 exists because that must be a refusal, not an option.

  """

  def retire_changeset(record, retired_at, opts \\ []) do

    record

    |> cast(%{retired_at: retired_at}, ~w(retired_at)a)

    |> validate_required(~w(retired_at)a)

    |> validate_not_future()

    |> validate_after_signed_history(Keyword.get(opts, :latest_attested_at))

  end

  defp validate_not_future(changeset) do

    horizon = DateTime.add(DateTime.utc_now(), @max_future_skew_seconds, :second)

    validate_change(changeset, :retired_at, fn :retired_at, retired_at ->

      if DateTime.compare(retired_at, horizon) == :gt do

        [

          retired_at: "cannot sit more than #{@max_future_skew_seconds} seconds in the future"

        ]

      else

        []

      end

    end)

  end

  defp validate_after_signed_history(changeset, %DateTime{} = latest_attested_at) do

    validate_change(changeset, :retired_at, fn :retired_at, retired_at ->

      if DateTime.compare(retired_at, latest_attested_at) == :gt do

        []

      else

        [

          retired_at:

            "cannot be at or before the newest attestation this key signed " <>

              "(attested at #{DateTime.to_iso8601(latest_attested_at)})"

        ]

      end

    end)

  end

  defp validate_after_signed_history(changeset, nil) do

    activated_at = changeset.data.activated_at

    validate_change(changeset, :retired_at, fn :retired_at, retired_at ->

      if is_nil(activated_at) or DateTime.compare(retired_at, activated_at) != :lt do

        []

      else

        [

          retired_at:

            "cannot be earlier than the key's activation " <>

              "(activated at #{DateTime.to_iso8601(activated_at)})"

        ]

      end

    end)

  end

  @doc "Whether the key was admitted and not yet retired at `instant`."

  rotation performed in the wrong order is refused rather than silently

  invalidating history.

  The first holds everywhere. The second holds in one of the four families,

  and the two places it does not are pinned here with the issues that carry

  them, so a fix turns a test red instead of passing unnoticed. A rehearsal

  that recorded only the half that works would be the kind of claim `EXIT-006`

  exists to prevent.

  The first holds everywhere. The second now holds in two of the four

  families, and the places it does not are pinned here with the issues that

  carry them, so a fix turns a test red instead of passing unnoticed. A

  rehearsal that recorded only the half that works would be the kind of claim

  `EXIT-006` exists to prevent.

  | Family | Rotation loses nothing | Wrong order refused |

  | --- | --- | --- |

  | Forge operator token | yes — the principal is a literal, not a derivation | not applicable; there is no order |

  | Account `oa_pat_` tokens | yes — digest-only, no key under them | not applicable |

  | Reputation issuer key | forward, yes | **no** — #191 |

  | Reputation issuer key | yes | yes — #191 made the backdate a refusal |

  | GitHub token vault | yes — key id in the envelope, keyring for the old ones | yes |

  | Machine pairing vault | **no** — #192 | no |

  | Voice recording vault | **no** — no key id, no keyring | no |

  alias OpenAgents.Forge.{Verification, WAL}

  alias OpenAgents.Machines.TokenVault, as: MachineVault

  alias OpenAgents.Reputation

  alias OpenAgents.Reputation.Claim

  alias OpenAgents.Reputation.{Claim, SigningKey}

  alias OpenAgents.Voice.RecordingVault

  describe "forge receipts depend on no key, so no rotation can invalidate one" do

      assert {:error, :signing_key_retired} = issue(context)

    end

    test "retiring backward silently unverifies what the key already signed (#191)", context do

    test "retiring backward is refused, naming what it would have unverified (#191)", context do

      assert {:ok, attestation} = issue(context)

      assert Reputation.verify(attestation)["verified"]

      backdated = DateTime.add(attestation.attested_at, -1, :second)

      assert {:ok, _retired} = Reputation.retire_key(context.key, backdated)

      # `active_at?/2`'s window is half-open at `retired_at`, so at-or-before

      # the attestation's own instant is the whole rewriting range: both edges

      # must be refused, and the refusal names the attestation time so the

      # operator sees exactly which history the backdate collided with.

      for retired_at <- [

            DateTime.add(attestation.attested_at, -1, :second),

            attestation.attested_at

          ] do

        assert {:error, %Ecto.Changeset{} = changeset} =

                 Reputation.retire_key(context.key, retired_at)

        assert [message] = errors_on(changeset).retired_at

        assert message =~ "at or before the newest attestation"

        assert message =~ DateTime.to_iso8601(attestation.attested_at)

      end

      # A refusal leaves no residue: the key is still active, the attestation

      # still verified, and the next attestation still issues.

      report = Reputation.verify(attestation)

      assert report["verified"]

      assert report["signature"]["key_status"] == "active"

      assert {:ok, _next} = issue(context)

    end

      # The signature is still valid over an unaltered claim. Only the window

      # moved, and it moved because one UPDATE against a row the operator

      # controls said so. Nothing refused it and nothing recorded it.

      assert report["digest_match"]

      assert report["signature"]["valid"]

      refute report["signature"]["key_active_at_attestation"]

      refute report["verified"]

    test "a key that signed nothing is bounded by its own activation", context do

      before_activation = DateTime.add(context.key.activated_at, -1, :second)

      assert {:error, %Ecto.Changeset{} = changeset} =

               Reputation.retire_key(context.key, before_activation)

      assert [message] = errors_on(changeset).retired_at

      assert message =~ "earlier than the key's activation"

      assert message =~ DateTime.to_iso8601(context.key.activated_at)

      # Retiring at exactly `activated_at` leaves an empty window, which

      # invalidates nothing because nothing was signed inside it.

      assert {:ok, retired} = Reputation.retire_key(context.key, context.key.activated_at)

      assert retired.retired_at == context.key.activated_at

    end

    test "a future-dated retirement beyond clock skew is refused", context do

      future =

        DateTime.add(DateTime.utc_now(), SigningKey.max_future_skew_seconds() + 60, :second)

      assert {:error, %Ecto.Changeset{} = changeset} =

               Reputation.retire_key(context.key, future)

      assert [message] = errors_on(changeset).retired_at

      assert message =~ "in the future"

      within_skew = DateTime.add(DateTime.utc_now(), 30, :second)

      assert {:ok, _retired} = Reputation.retire_key(context.key, within_skew)

    end

    test "the forward edge is the one that is guarded", context do