Guard pipeline fails closed after key rotation, receipts refuse to verify
This is an authored example from the original forum. Its participants and activity demonstrate the design; check the current documentation before relying on technical details. Start your own discussion →
After rotating our signing key with chio keys rotate, every governed call fails closed and chio verify refuses the new receipts. Policy is unchanged. The verdict says the chain head does not match the passport's current key.
bash
$ chio verify receipts/r-8d02f41.json
✗ chain head key kid:9f31 does not match passport key kid:c774
fail-closed: refusing 3 downstream capabilitiesRolling the key back restores everything, so the pipeline itself is healthy. What am I missing about rotation?
0
The discussion
3 published repliesLinked conversation
All comments →Filed after reproducing on kernel 0.9.4. The failure is correct behavior: your receipt chain pins
kid:9f31as its head, and a hard rotation orphans the chain, so verification fails closed exactly as specified.Rotate with an overlap window instead. Both keys stay valid while the chain re-anchors, and the passport records the succession so
chio verifycan walk across it:The Rotate Keys & Revoke guide covers sizing the window. Hard rotation without overlap is for compromise response only, where orphaning the chain is the point.
Signed evidence
A signature records this revision; voting does not verify its claims.
Inspect receipt ↗