Operate / Security and identity operators

Key custody, rotation, and recovery

Keep identity and release keys recoverable without collapsing device proof, account proof, and signing custody.

identity continuity and signing custodyReceiz ID, Receiz Key, and governance key procedureComplete production checklist

Implementation rail · Receiz ID, Receiz Key, and governance key procedure

Exact execution and operator checks

01
Operator check
Inventory custody
Record each key identifier, public key, custodian, recovery quorum, active or revoked state, and every affected proof binding. Never record private key bytes or passphrases.
Substantive records: /trust/hierarchy · /reference/sdk
Expected: The rotation scope is exact and private material remains in custody.
02
Exact mechanic
Run test:identity-conformance
```
pnpm test:identity-conformance
```
Mechanic
pnpm test:identity-conformance
Authentication and account boundary
Authorized local repository checkout; the command proves only the checked repository boundary.
Exact source
package.json · SHA-256 132f99232dfaf26f7186b73752938d1377042808f42d60d374fe7b2e57c7646b
Expected: Identity proof, replay, binding, and recovery contracts pass.
03
Exact mechanic
Run governance:verify-artifact-signature
```
pnpm governance:verify-artifact-signature
```
Mechanic
pnpm governance:verify-artifact-signature
Authentication and account boundary
Authorized local repository checkout; the command proves only the checked repository boundary.
Exact source
package.json · SHA-256 132f99232dfaf26f7186b73752938d1377042808f42d60d374fe7b2e57c7646b
Expected: Governance artifact signatures verify against registered public material.
04
Operator check
Rotate and recover
Revoke the compromised key, activate the authorized successor, preserve historical signatures, and recover from accepted identity proof. Rotation admits a verified key-status register addition against the exact current key-status head; it never rewrites sealed history.
Substantive records: /operate/identity-continuity · /trust/exceptions
Expected: The successor is active, the predecessor is revoked, and prior proof remains verifiable.

Complete operating anatomy

Every boundary required to ship.

Solved outcome: Keys have named custody, recovery, rotation, revocation, and evidence procedures while existing sealed proof remains independently verifiable.
Prerequisites: Hold the public key inventory, key identifiers, custodians, recovery quorum, active and revoked states, affected proof bindings, and an authorized rotation procedure; never expose private bytes.
Exact primitive: identity continuity and signing custody
Governing law: Key custody, rotation, and recovery is governed by identity-boundary: Binding appends identity continuity. Accepted identity proof remains intact. identity-conformance: A passing execution confirms the checked identity continuity invariants for the exact repository state exercised. governance-signature: A passing result establishes signature validity for the supplied bytes and key.
Source-of-truth order: Receiz law → sealed artifact truth → deterministic proof object state → verified durable local or register truth → authenticated snapshot → server distribution, synchronization, indexing, and publication → database, session, observability, and interface projections.
Expected artifact, receipt, or state: An identity continuity result plus separately recorded rotation or revocation evidence; no new key rewrites historical artifact truth.
Inspection: Inspect the key identifier, public key, custody record, active or revoked status, and affected proof bindings. Inspection exposes structure and receipt fields; inspection never establishes verification.
Independent verification: Independent verification for key-custody-rotation-recovery: pnpm test:identity-conformance && pnpm governance:verify-artifact-signature. This establishes only the identity continuity and signing custody boundary named by the bound sources; The implementation rail remains beneath proof authority: Receiz ID, Receiz Key, and governance key procedure.
Offline behavior: Local Receiz ID and accepted key proof project immediately; global binding synchronizes when online, while revocation admits only as a verified key-status register addition against the exact current head.
Identity and account boundary: Public Record Moment, Seal File, Verify, Export, and public proof reading are account-free. Identity is optional and adds continuity, custody, recovery, and governed private controls after proof admission.
Security boundary: Private keys and passphrases stay in local or authorized custody. Only public identifiers, signatures, and bounded evidence enter receipts.
Conformance command: pnpm test:identity-conformance
Deployment checks: Qualify key storage, signer access, revocation publication, successor activation, recovery quorum, historical signature verification, audit emission, and emergency rotation in the target environment.
Production checklist: Test invalid, expired, revoked, and wrong-key signatures; execute an authorized rotation; prove the predecessor cannot sign new operations; verify historical artifacts; perform recovery without logging passphrases or private keys.
Rollback and containment: Containment for key-custody-rotation-recovery: The key is compromised and new signatures are untrusted. Revoke it, activate the authorized successor, preserve history, and record the incident. The operation is rejected. Restore the active custody chain and repeat as a new operation. Recovery stops without issuing continuity. Obtain the missing accepted proof or invoke the documented institutional recovery path. Preserve every stronger held artifact and admitted state while the named boundary is corrected.

Fail closed

Mutation and failure matrix

A private key or passphrase is exposed.

Effect: The key is compromised and new signatures are untrusted.
Retry: Do not reuse the compromised key.
Recovery: Revoke it, activate the authorized successor, preserve history, and record the incident.

A revoked or wrong key signs a new operation.

Effect: The operation is rejected.
Retry: Never bypass revocation or key-ID checks.
Recovery: Restore the active custody chain and repeat as a new operation.

Recovery quorum or identity proof is incomplete.

Effect: Recovery stops without issuing continuity.
Retry: Do not weaken quorum.
Recovery: Obtain the missing accepted proof or invoke the documented institutional recovery path.

Exact authority

Claim-to-source bindings

Binding appends identity continuity. Accepted identity proof remains intact.
docs/pbi-recovery-receiz-id-binding.mdnormative-doctrine · SHA-256 f6e6e4177f6340924e59042d2f976dd4f6666340d80c0f1cee8b0f4180cea264
A passing execution confirms the checked identity continuity invariants for the exact repository state exercised.
scripts/test_identity_conformance.tsexecutable-conformance · SHA-256 699508b94d317a4d1ff1bae527b49e76e3dfda8f7e085316e9729b9afa23e36f
A passing result establishes signature validity for the supplied bytes and key.
scripts/check_governance_artifact_signature.tssigned-evidence-verifier · SHA-256 a7ba1e04bc27e2106d286f532d4ece159a20974c00df1b41994917531eac7eaf

One complete system

Exact execution and operator checks

Inventory custody

Run test:identity-conformance

Run governance:verify-artifact-signature

Rotate and recover