Surfaced via a conclave council run (synthesize + adversarial passes), 2026-06-07.
Council verdict: DEFER (not merged into cosign #16). A distinct governance layer — role registry, quorum logic, --require-role enforcement — none of which are natural cosign extensions. Collapsing into #16 risks blocking it or shipping a half-baked role model.
Scope (when unblocked)
- Lock schema:
attestations: [{key_id, role, sig, signed_at}], stored outside overall_digest.
pin --approve --role security-review|service-owner appends an attestation without changing overall_digest.check --require-role ... fails closed if required roles are missing.warden attest list <lock> helper.
Effort: M.
Sequencing: after #16 (cosign) and #19 (provenance) — order is 2 → 3 → 4. Docs must steer toward secure key storage or the feature gives false assurance.
Surfaced via a conclave council run (synthesize + adversarial passes), 2026-06-07.
Council verdict: DEFER (not merged into cosign #16). A distinct governance layer — role registry, quorum logic,
--require-roleenforcement — none of which are natural cosign extensions. Collapsing into #16 risks blocking it or shipping a half-baked role model.Scope (when unblocked)
attestations: [{key_id, role, sig, signed_at}], stored outsideoverall_digest.pin --approve --role security-review|service-ownerappends an attestation without changingoverall_digest.check --require-role ...fails closed if required roles are missing.warden attest list <lock>helper.Effort: M.
Sequencing: after #16 (cosign) and #19 (provenance) — order is 2 → 3 → 4. Docs must steer toward secure key storage or the feature gives false assurance.