Module overlay_trust 

Trust root, rollback pin and revocation checks of a project kernel. Trust root, rollback pin and revocation checks of a project kernel (ADR-103 D8, package E). Split from overlay_runtime.

Constants

REVOKED_FILE

Marker the user daemon drops in the run dir when it revokes the project; its presence stops boot, reload and update. Defined once in clawft_types::runtime_paths (revoked_marker), shared with the writer and the supervisor. Terminal revocation marker in a child’s run dir. Only the user daemon’s project.revoke writes it and nothing clears it; while it exists the supervisor never starts the project and the child refuses to boot, reload or take policy.

USER_PIN_FILE

File in the user daemon’s run dir (<run>/<id>/user.pub, outside the project tree) pinning the trusted user key as 64 lowercase hex. Written by the supervisor with write_user_pin. When present the child trusts only this key and refuses a certificate issued by another. It assumes whatever runs inside the project (the Phase 4 sandbox) cannot write the run dir; when absent (Phase 2 development) the child falls back to the key in its own certificate and logs a warning.

VERSION_PIN_FILE

File (under <root>/.weftos/state/) holding the newest accepted parent policy version.

Functions

write_user_pin

Write the user-key pin the child reads (supervisor side, package G).