feat(signature): surface an audit-only signing-regression finding on drift from the repo baseline (JEF-264)

[thejefflarson]

What

A repo with an established signed history that suddenly serves an unsigned/invalid image — or one signed by a new identity — is the push-access-compromise signal, and was invisible until now even with the JEF-263 baseline. This surfaces a loud, audit-only signing-regression finding on drift from the baseline. Still admits (shadow invariant, ADR-0016); enforcement (JEF-265) and Rekor history (JEF-266) stay out of scope.

Classifier design (engine/src/engine/signing_drift.rs)

Pure, deterministic classify(Option<&SigningBaseline>, &SigningPosture) -> SigningDrift:

• Continuous — signed by a known identity (normal redeploy, even a new digest), or a transient/unknown state with no history to regress against.
• NewRepo — first signed sight of a never-seen repo (TOFU cold start; baseline recorded, no finding).
• Regression { kind, established } — Unsigned / Invalid / IdentityChange{new_identity,new_issuer}. established is read straight from the baseline (JEF-263's 24h flag), so the classifier stays clock-free and exhaustively unit-testable.

Rules honored: signed→unsigned/invalid on an established repo ⇒ regression; new signer ⇒ a distinct regression; known-identity new digest ⇒ no finding; cold-start ⇒ no regression; regression against a cold baseline ⇒ reduced intensity (established:false).

Status-strip honesty model

Regressions feed the strip without the reachability Decision/Finding pipeline. The sweep records each regression onto the admission-decision log (SigningRegression/<repo>, decision allow); DashboardState derives (established, cold) counts from that log and folds them into StatusStripProps on every tab via with_signing_regressions. Established regressions count toward breach (block green and the calm "watching" reading); cold regressions map to uncertain (block green, read as watching). A standing regression can never show green.

Render

A loud signing regression banner on the repo group (breach rail + ● glyph + word, lexically distinct from calm "not signed"), stating before→after with both identities in full. Every untrusted Fulcio SAN is emitted via maud interpolation only — no PreEscaped, no markup concatenation, and data-regression uses the fixed kind token, never identity text.

Tests

• Classifier: 12 pure/deterministic cases (whole rule table).
• Sweep detection: →unsigned, →invalid, identity-change, normal-redeploy (none), cold-start (none), regression-against-cold (reduced).
• Inventory mapping + per-repo counts: 8.
• Regression render + crafted-identity escaping: 3.
• Strip honesty (established→breach, cold→uncertain): 2.

Gates (all green)

cargo fmt · cargo build · cargo build --example dashboard_preview · cargo clippy --all-targets (0 warnings) · cargo test (448 unit + guards, incl. the 1,000-line file-size guard).

Judgment calls / scope notes

• Routing via the PolicyDecisionLog (honored literally): regressions are encoded as self-describing log rows (signature = regression-<kind>-<strength>, reason = <after> | before: <ids>) and parsed back in the view_model — the same string idiom the existing signing-inventory mapper already uses — so no new state handle or baseline access at render time.
• props.rs split: the JEF-264 additions pushed props.rs past the 1,000-line hard cap, so the signing-inventory presentation types were moved into props/signing.rs (re-exported flat). Required by the change, not opportunistic.
• Identity-change on a cold baseline is treated as a reduced-intensity regression too (consistent with the general cold-baseline rule); folding into the baseline set bounds it to fire once per new signer.
• Staleness: like the existing observation rows, a regression row lingers in the bounded ring until re-swept/evicted — consistent with JEF-261/262 semantics.

Closes JEF-264

🤖 Generated with Claude Code