Module user_key_rotation 

User-key rotation records and the trust history they build (ADR-103 A13).

The user key signs project certificates, anchor records, parent policies and the user chain. Rotating it must not orphan what the old key sealed. A RotationRecord hands the identity from one key to the next and is signed by BOTH (dual-signed handover): the old key proves the owner of the old identity agreed, the new key proves possession. Records are hash-linked (prev is the SHA-256 of the previous record including its signatures) and stored in an append-only file (RotationLog); the user daemon also chains each one (user.key.rotated, source crate::project_identity::SOURCE).

UserKeyHistory folds the records into “which key is current, which keys were retired and when”. A verifier asks UserKeyHistory::accepts: the current key always, a retired key only for material dated at or before its rotation point. The final record must name the key the daemon actually holds, otherwise the history is refused (a record forged with a stolen old key alone names a key nobody holds).

Honest limit: the rotation point is a wall-clock time, compared with the time a record claims (a certificate’s issued_at, an anchor statement’s at). Someone who still holds the OLD private key can backdate such a claim; rotation after a suspected compromise must therefore also revoke or rekey the affected projects. Material sealed after the rotation point with the old key honestly dated is refused.

Structs

RotationLog

The append-only rotation log in a manifest store.

RotationRecord

One dual-signed handover from old_pubkey to new_pubkey.

UserKeyHistory

The current user key plus every key it replaced and when.

Enums

RotationError

Why a rotation record or history is not trusted.

Constants

KIND_ROTATED

Chain event kind appended by the user daemon for every record.

ROTATION_DOMAIN

Domain tag of both signatures of a rotation record.

ROTATION_FILE

Name of the append-only log inside the manifest store.

ROTATION_VERSION

Record format version.