feat(signature): persist a durable per-repo TOFU signing baseline (JEF-263)

[thejefflarson]

Closes JEF-263

What this ships

Observation (JEF-261) is a snapshot — it can't catch a change in a repo's signing posture over time, which is the actual supply-chain attack. This adds the learned, restart-surviving history ADR-0020 §2 calls for.

• Journal variant — new tagged journal::Decision::SigningBaseline { repo, identities, issuers, first_seen_ms, established }. Full-state JSON line, #[serde(default)] on every field for forward-compat. SAME journal file (PROTECTOR_ENGINE_JOURNAL_PATH), no second store/env var.
• state::SigningBaselineStore (new module engine/src/engine/state/signing_baseline.rs) — learns per registry/repo from Signed postures only, persists to and boot-replays from the durable journal, bounded with defined eviction. Exposed for JEF-264 to consume.
• Boot replay — restored in run_watch alongside the admission-log restore, folding SigningBaseline lines last-write-wins (compaction semantics). This is how TOFU survives a restart.
• Compaction, not rotation-aging — each baseline line is full state; the store re-appends every live repo per pass, so rotation never ages out a live established baseline and silently re-arms cold-start trust. A negative-control test proves a single un-recompacted line does age out.
• Feeding — wired into the existing running-Pod sweep (signing_sweep::sweep), additive; existing callers pass None + a disabled journal.
• repo_key — reuses policies/signature's registry-host canonicalization, then strips :tag/@digest (preserving a host:port).

Acceptance criteria

• Observing a signed image updates the repo baseline (identities/issuers, established) keyed by registry/repo — observing_a_signed_image_creates_a_repo_keyed_baseline, sweep_teaches_the_repo_baseline_from_a_signed_image.
• A new digest/tag under a repo with an existing baseline does NOT create a new baseline and is not drift — a_new_tag_or_digest_under_a_known_repo_is_not_a_new_baseline.
• Survives restart (write + boot-replay), round-trip test — baseline_survives_an_engine_restart_round_trip.
• Fresh vs established distinguishable (established: bool + first_seen) — a_freshly_learned_baseline_is_distinguishable_from_an_established_one.
• Rotation never drops a live established baseline (compaction test) — compaction_keeps_a_live_established_baseline_across_rotation.
• Bounded state + defined eviction; never leaves the cluster — the_store_is_bounded_and_evicts_non_established_before_established.

ADR-0020 addenda (decisions recorded)

1. Eviction. Durability-wise, eviction is compaction-in-journal (rotation-safe re-append). In-memory, the store is bounded by DEFAULT_MAX_REPOS (4096, a safety cap — real clusters stay far below) and evicts a non-established entry (cheap to re-learn) before an established one, least-recently-updated first, so a matured baseline is never dropped for churn.
2. established = wall-clock age (24h since first_seen), not digest-count. The first observation is the weakest evidence (could be the attacker's first signed push), so trust should mature over time. A digest counter is gameable (burst of digests) and needs extra durable state; age can't be gamed and reuses the first_seen_ms we already persist. This matches ADR-0020's framing that "a freshly-learned … baseline is surfaced as weaker evidence than an aged … one." Both established + first_seen are exposed for JEF-262/JEF-264 to render/weigh; a digest-count/distinct-day refinement is a documented future option.

Scope

Persistence + in-memory store + boot replay only. Drift findings (JEF-264), enforcement (JEF-265), the dashboard render (JEF-262 — untouched), and Rekor (JEF-266) consume this; not built here. Degraded mode is honest: a disabled journal ⇒ in-memory only, resets on restart, re-learns from observation.

Invariants

Shadow-only (pure learning, never gates); zero-egress (writes the local journal mount, no new outbound path); presentation-is-a-view (the sweep still records allow); untrusted Fulcio identities/issuers carried verbatim and documented as escape-at-render for the consumer.

Testing

cargo fmt · cargo build · cargo clippy --all-targets (zero warnings) · cargo test — 402 lib tests pass (15 new baseline + 2 new sweep), file-size guard green.

Risk note

Per-pass full compaction shares one journal with breach/admission decisions; a very large repo count could shorten their rotation window. Bounded by DEFAULT_MAX_REPOS and small in practice; flagged for the architect if a split-journal or change-only-compaction refinement is wanted.

🤖 Generated with Claude Code