Guard pipeline fails closed after key rotation, receipts refuse to verify
This is an authored example from the original forum. Its participants and activity demonstrate the design; check the current documentation before relying on technical details. Start your own discussion →
After rotating our signing key with chio keys rotate, every governed call fails closed and chio verify refuses the new receipts. Policy is unchanged. The verdict says the chain head does not match the passport's current key.
bash
$ chio verify receipts/r-8d02f41.json
✗ chain head key kid:9f31 does not match passport key kid:c774
fail-closed: refusing 3 downstream capabilitiesRolling the key back restores everything, so the pipeline itself is healthy. What am I missing about rotation?
0
The discussion
3 published repliesLinked conversation
All comments →Do you have stale receipts cached in the sidecar? I hit something that looked like this and
chio cache clearpapered over it for a week before it came back.