https://github.com/mokkunsuzuki-code/stage353
Stage354: Signature Key Rotation Ledger Layer with Stage178 Assumption, Threat Model, and Guarantee Binding. Transparent key lifecycle tracking, signature key status recording, ledger chaining, and PQC migration-aware verification metadata.
https://github.com/mokkunsuzuki-code/stage353
audit cybersecurity evidence-verification fail-closed hash-chain qsp remeda sha256 supply-chain-security transparency-chain transparency-log verification zero-trust
Last synced: 7 days ago
JSON representation
Stage354: Signature Key Rotation Ledger Layer with Stage178 Assumption, Threat Model, and Guarantee Binding. Transparent key lifecycle tracking, signature key status recording, ledger chaining, and PQC migration-aware verification metadata.
- Host: GitHub
- URL: https://github.com/mokkunsuzuki-code/stage353
- Owner: mokkunsuzuki-code
- License: other
- Created: 2026-06-20T07:40:38.000Z (10 days ago)
- Default Branch: main
- Last Pushed: 2026-06-21T05:07:17.000Z (9 days ago)
- Last Synced: 2026-06-21T07:09:39.720Z (9 days ago)
- Topics: audit, cybersecurity, evidence-verification, fail-closed, hash-chain, qsp, remeda, sha256, supply-chain-security, transparency-chain, transparency-log, verification, zero-trust
- Language: Python
- Homepage: https://mokkunsuzuki-code.github.io/stage353/
- Size: 73.2 KB
- Stars: 0
- Watchers: 0
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# Stage353: Verification Transparency Chain Layer
Stage353 extends Stage352 by recording the Stage352 verification result into a transparency chain.
## What Stage353 Adds
- Reads `docs/signatures/stage352_signature_manifest_verification.json`
- Generates a SHA256 hash for the Stage352 verification result
- Creates a transparency entry for the verification result
- Chains entries with `previous_hash` and `entry_hash`
- Carries forward the Stage352 decision
- Fails closed if Stage352 is `reject`, `block`, or unknown
- Does not claim external Rekor registration
- Does not claim Bitcoin anchoring
## Public Evidence
- `docs/transparency/stage353_verification_transparency_result.json`
- `docs/transparency/stage353_verification_transparency_chain.json`
- `docs/transparency/stage353_verification_transparency_summary.txt`
## Decision Model
- `accept`: Stage352 verification result is acceptable and chain link is valid
- `warn`: Stage352 result was warning-level and logged as warning
- `reject`: Stage352 failed, is missing, or the chain is invalid
## Safety Boundary
Stage353 does not publish private keys, raw secrets, fake signature claims, external Rekor claims, or Bitcoin anchor claims.
---
## Stage354: Signature Key Rotation Ledger Layer
Stage354 adds a signature key lifecycle and rotation ledger on top of Stage353.
It records safe public metadata for:
- GPG
- Sigstore OIDC
- Ed25519 witness
- PQC ML-DSA intent
Stage354 also binds the Stage178 framework:
- Assumption
- Threat Model
- Guarantee
### Safety Boundary
Stage354 does not publish:
- private keys
- raw secrets
- seed material
- real PQC private key material
- fake active PQC key claims
- fake external Rekor claims
### Current Decision
```text
accept_policy_initialization
This means the key rotation policy ledger was initialized safely,
but no real production key rotation is being falsely claimed.