From a09536f33242f7146b42d28a7c0ef8a876a1021f Mon Sep 17 00:00:00 2001
From: Jeff Larson <thejefflarson@gmail.com>
Date: Wed, 1 Jul 2026 00:13:05 -0700
Subject: [PATCH] feat(signature): surface an audit-only signing-regression
 finding on drift from the repo baseline (JEF-264)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A repo with an established signed history suddenly serving unsigned/invalid,
or signed by a NEW identity, is the push-access-compromise signal — invisible
until now even with the JEF-263 baseline. This adds a pure, deterministic drift
classifier over (baseline, fresh posture) and surfaces a loud, audit-only
signing-regression finding on drift, still admitting (shadow invariant).

- Classifier (engine/signing_drift.rs): pure Continuous / Regression{Unsigned |
  Invalid | IdentityChange} / NewRepo over (SigningBaseline, SigningPosture),
  reading the baseline's `established` flag for reduced-intensity on cold
  baselines. Never a clock/IO — exhaustively unit-tested.
- Sweep wiring: classify each observed posture against the CURRENT baseline
  BEFORE learning, and record a regression finding onto the same admission log
  (SigningRegression/<repo>, decision `allow` — never denies). No egress; not
  journaled, rebuilt per pass.
- Render: a loud "signing regression" banner on the repo group (breach rail +
  ● glyph + word, lexically distinct from calm "not signed"), stating
  before→after with BOTH identities in FULL. Every untrusted Fulcio SAN escaped
  via maud interpolation only (no PreEscaped, no class= from untrusted text).
- Status-strip honesty: established regressions count toward breach, cold ones
  toward uncertain — both forbid green — wired WITHOUT the reachability
  Decision/Finding pipeline, via SigningRegressionCounts folded into the strip
  on every tab.
- Split props.rs into props/{mod,signing}.rs to stay under the 1,000-line cap.

Tests: classifier (12, pure), sweep detection (6: →unsigned/→invalid/identity/
normal-redeploy-none/cold-start-none/cold-reduced), inventory mapping + counts
(8), regression render + crafted-identity escaping (3), strip honesty (2).

Closes JEF-264

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VtjoJttCvBY4dzCoE4f9vP
---
 engine/examples/dashboard_preview.rs          |  15 ++
 .../src/engine/dashboard/admission_tests.rs   |  84 ++++++
 .../dashboard/components/admission_view.rs    |  88 +++++-
 .../dashboard/components/status_strip.rs      |  18 +-
 engine/src/engine/dashboard/mod.rs            |  23 +-
 .../dashboard/view_model/action/tests.rs      |   2 +
 .../dashboard/view_model/admission/tests.rs   |   2 +
 engine/src/engine/dashboard/view_model/mod.rs |  10 +
 .../view_model/{props.rs => props/mod.rs}     | 176 ++++--------
 .../dashboard/view_model/props/signing.rs     | 217 +++++++++++++++
 .../dashboard/view_model/signing_inventory.rs | 145 +++++++++-
 .../view_model/signing_inventory/tests.rs     | 190 +++++++++++++
 .../src/engine/dashboard/view_model/strip.rs  |  42 +++
 engine/src/engine/mod.rs                      |   5 +
 engine/src/engine/signing_drift.rs            | 160 +++++++++++
 engine/src/engine/signing_drift_tests.rs      | 176 ++++++++++++
 engine/src/engine/signing_sweep.rs            | 251 +++++++++++++++++-
 17 files changed, 1437 insertions(+), 167 deletions(-)
 rename engine/src/engine/dashboard/view_model/{props.rs => props/mod.rs} (82%)
 create mode 100644 engine/src/engine/dashboard/view_model/props/signing.rs
 create mode 100644 engine/src/engine/signing_drift.rs
 create mode 100644 engine/src/engine/signing_drift_tests.rs

diff --git a/engine/examples/dashboard_preview.rs b/engine/examples/dashboard_preview.rs
index f7967b5..92bbb97 100644
--- a/engine/examples/dashboard_preview.rs
+++ b/engine/examples/dashboard_preview.rs
@@ -378,6 +378,21 @@ fn record_signing_inventory(log: &PolicyDecisionLog) {
         "checking",
         "signing posture not yet known (registry/log unreachable)",
     );
+    // A signing-regression finding (JEF-264): the api-gateway repo — with an established signed
+    // history — is now signed by a NEW identity (the push-access-compromise signal). Audit-only:
+    // the image is still admitted; the loud banner surfaces before→after in full.
+    log.record(PolicyDecisionRecord::now(
+        "signing-regression",
+        "allow",
+        "SigningRegression/ghcr.io/acme/api-gateway",
+        "ghcr.io/acme/api-gateway:v1.9.0",
+        "regression-identity-established",
+        "",
+        "",
+        "signed by https://github.com/acme-forks/api-gateway/.github/workflows/build.yaml@refs/heads/main \
+         via https://token.actions.githubusercontent.com | before: \
+         https://github.com/acme/api-gateway/.github/workflows/release.yaml@refs/tags/v1.8.2",
+    ));
 }
 
 /// A representative bake/coverage summary used by the covered scenarios.
diff --git a/engine/src/engine/dashboard/admission_tests.rs b/engine/src/engine/dashboard/admission_tests.rs
index 78c47c8..57224cf 100644
--- a/engine/src/engine/dashboard/admission_tests.rs
+++ b/engine/src/engine/dashboard/admission_tests.rs
@@ -303,6 +303,90 @@ fn signing_inventory_escapes_an_attacker_chosen_identity() {
     assert!(html.contains("&lt;script&gt;"), "the identity is escaped");
 }
 
+// ---- signing-regression banner (JEF-264) render tests --------------------------------------
+
+/// A signing-regression finding row (JEF-264 shape): `SigningRegression/<repo>` subject, the drift
+/// token in `signature`, the before→after prose in `reason`.
+fn regression_rec(repo: &str, image: &str, signature: &str, reason: &str) -> PolicyDecisionRecord {
+    PolicyDecisionRecord::now(
+        "signing-regression",
+        "allow",
+        format!("SigningRegression/{repo}"),
+        image,
+        signature,
+        "",
+        "",
+        reason,
+    )
+}
+
+#[test]
+fn signing_regression_renders_loud_word_and_before_after_in_full() {
+    let rows = vec![regression_rec(
+        "ghcr.io/acme/app",
+        "ghcr.io/acme/app:2",
+        "regression-identity-established",
+        "signed by https://github.com/evil/app/.github/workflows/pwn.yaml@refs/heads/main via \
+         https://token.actions.githubusercontent.com | before: \
+         https://github.com/acme/app/.github/workflows/r.yaml@refs/tags/v1",
+    )];
+    let html = render(&rows);
+    // The loud, lexically-distinct posture word (not the calm "not signed").
+    assert!(
+        html.contains("signing regression"),
+        "the loud regression word is rendered"
+    );
+    // Both identities in FULL — the before (old signer) and the after (new signer).
+    assert!(
+        html.contains("https://github.com/acme/app/.github/workflows/r.yaml@refs/tags/v1"),
+        "the before signer is shown in full"
+    );
+    assert!(
+        html.contains("https://github.com/evil/app/.github/workflows/pwn.yaml@refs/heads/main"),
+        "the after signer is shown in full"
+    );
+}
+
+#[test]
+fn signing_regression_cold_baseline_reads_as_a_weak_lead() {
+    let rows = vec![regression_rec(
+        "ghcr.io/acme/app",
+        "ghcr.io/acme/app:2",
+        "regression-unsigned-cold",
+        "now not signed (was signed) | before: releng@acme.example",
+    )];
+    let html = render(&rows);
+    assert!(html.contains("signing regression"));
+    assert!(
+        html.contains("treat as a lead"),
+        "a cold-baseline regression is honestly flagged a weak lead"
+    );
+}
+
+#[test]
+fn signing_regression_escapes_an_attacker_chosen_identity() {
+    // The before/after signer identities are attacker-influenceable Fulcio SANs — a crafted SAN in a
+    // regression row must not inject markup (maud auto-escape; never PreEscaped).
+    let evil = "<script>alert('pwn')</script>";
+    let rows = vec![regression_rec(
+        "ghcr.io/acme/app",
+        "ghcr.io/acme/app:2",
+        "regression-identity-established",
+        &format!(
+            "signed by {evil} via https://token.actions.githubusercontent.com | before: {evil}"
+        ),
+    )];
+    let html = render(&rows);
+    assert!(
+        !html.contains("<script>alert"),
+        "raw script from either identity must not reach output"
+    );
+    assert!(
+        html.contains("&lt;script&gt;"),
+        "the crafted identity is escaped in the regression banner"
+    );
+}
+
 #[test]
 fn signing_inventory_honest_empty_when_no_images_observed() {
     // Decision rows present, but no signing-sweep observation rows → the inventory is honestly
diff --git a/engine/src/engine/dashboard/components/admission_view.rs b/engine/src/engine/dashboard/components/admission_view.rs
index 9e103a0..fd357f5 100644
--- a/engine/src/engine/dashboard/components/admission_view.rs
+++ b/engine/src/engine/dashboard/components/admission_view.rs
@@ -10,8 +10,8 @@
 use maud::{Markup, html};
 
 use crate::engine::dashboard::view_model::props::{
-    AdmissionViewProps, DecisionRowProps, GateStatus, SigningPosture, SigningRepoProps,
-    SigningRowProps,
+    AdmissionViewProps, DecisionRowProps, GateStatus, SigningPosture, SigningRegressionProps,
+    SigningRepoProps, SigningRowProps,
 };
 
 /// Render the Admission view: the tallies header, then the per-image signing inventory, then the
@@ -87,23 +87,85 @@ fn signing_inventory(v: &AdmissionViewProps) -> Markup {
     }
 }
 
-/// One repo group: the registry/repo header + a real `<table>` of the images observed under it (so
-/// the machine columns align — the keyboard/semantics gate).
+/// One repo group: the registry/repo header + (when the repo's signed history has drifted) a loud
+/// signing-regression banner + a real `<table>` of the images observed under it (so the machine
+/// columns align — the keyboard/semantics gate). The table is omitted when the regressed image has
+/// aged out of the observation window, so a standing regression still surfaces on its own.
 fn signing_repo(g: &SigningRepoProps) -> Markup {
     html! {
         div.signing-repo {
             h4.signing-repo-h.t-data-strong { (g.repo) }
-            table.signing {
-                thead {
-                    tr {
-                        th.t-micro { "image" }
-                        th.t-micro { "signature" }
-                        th.t-micro { "if enforced" }
+            @if let Some(regression) = &g.regression {
+                (signing_regression(regression))
+            }
+            @if !g.images.is_empty() {
+                table.signing {
+                    thead {
+                        tr {
+                            th.t-micro { "image" }
+                            th.t-micro { "signature" }
+                            th.t-micro { "if enforced" }
+                        }
+                    }
+                    tbody {
+                        @for img in &g.images {
+                            (signing_row(img))
+                        }
                     }
                 }
-                tbody {
-                    @for img in &g.images {
-                        (signing_row(img))
+            }
+        }
+    }
+}
+
+/// The loud signing-regression banner (JEF-264, ADR-0020 §3): a repo's signed history drifted —
+/// now unsigned/invalid, or signed by a new identity. The breach-rail channel (glyph + word,
+/// distinct from calm "not signed"), stating before→after with BOTH identities in FULL. An
+/// established baseline reads as the strong signal; a cold baseline is honestly flagged a weak lead.
+///
+/// Security: every identity/issuer is UNTRUSTED Fulcio SAN, emitted ONLY via maud interpolation
+/// `(x)` (auto-escaped) — never `PreEscaped`, never concatenated into markup, and never used to
+/// derive a `class=`/CSS value (the `data-regression` attribute is the fixed low-cardinality kind
+/// token, not identity text).
+fn signing_regression(r: &SigningRegressionProps) -> Markup {
+    let strength = if r.established {
+        "established baseline"
+    } else {
+        "weak baseline \u{2014} treat as a lead"
+    };
+    html! {
+        div.signing-regression.signing-row-attention data-regression=(r.kind.token()) role="alert" {
+            div.signing-regression-head {
+                span.glyph aria-hidden="true" { "\u{25CF}" }
+                span.signing-regression-word.t-data-strong { (r.kind.word()) }
+                span.signing-regression-strength.t-micro.muted { "(" (strength) ")" }
+            }
+            div.signing-regression-detail {
+                p.t-data { "image: " span.mono { (r.image) } }
+                @if r.before_identities.is_empty() {
+                    p.t-data.muted { "before: baseline signer not recorded" }
+                } @else {
+                    p.t-data {
+                        "before \u{2014} baseline signer"
+                        @if r.before_identities.len() != 1 { "s" }
+                        ":"
+                    }
+                    ul.signing-regression-before {
+                        @for identity in &r.before_identities {
+                            li.t-data { span.mono { (identity) } }
+                        }
+                    }
+                }
+                @match &r.after_identity {
+                    Some(identity) => {
+                        p.t-data { "after \u{2014} now signed by:" }
+                        p.t-data { span.mono { (identity) } }
+                        @if let Some(issuer) = &r.after_issuer {
+                            p.t-data.muted { "issuer: " span.mono { (issuer) } }
+                        }
+                    }
+                    None => {
+                        p.t-data { "after \u{2014} " (r.kind.after_word()) }
                     }
                 }
             }
diff --git a/engine/src/engine/dashboard/components/status_strip.rs b/engine/src/engine/dashboard/components/status_strip.rs
index a3d9317..3638b10 100644
--- a/engine/src/engine/dashboard/components/status_strip.rs
+++ b/engine/src/engine/dashboard/components/status_strip.rs
@@ -73,9 +73,10 @@ fn judging_axis(s: &StatusStripProps) -> Markup {
             }
         };
     }
-    // Model up but not finished (awaiting/uncertain still open, or a feed degraded): elevated
-    // "watching" — calm, NOT green. Quiet here is "hasn't finished", not "cleared".
-    if s.watching() {
+    // Model up but not finished (awaiting/uncertain still open, or a feed degraded), OR a standing
+    // signing regression (JEF-264): elevated "watching" — calm, NOT green. A standing regression
+    // must never read as the bare green-dot "model judging"; the loud count sits in the headline.
+    if s.watching() || (s.model_is_up() && s.has_signing_regression()) {
         return html! {
             span.axis.judging.watching {
                 span.glyph { "\u{25CC}" }
@@ -166,6 +167,17 @@ fn headline(s: &StatusStripProps) -> Markup {
                     (s.escalated_count) " escalated since last pass"
                 }
             }
+            @let regressions = s.signing_regression_breach + s.signing_regression_uncertain;
+            @if regressions > 0 {
+                // The signing-regression chip (JEF-264): loud (breach-rail), kept lexically distinct
+                // from the reachability breach count. A standing regression is why the strip is not
+                // green — surface it explicitly.
+                span.count.count-breach.count-regression {
+                    span.glyph aria-hidden="true" { "\u{25CF}" }
+                    (regressions)
+                    @if regressions == 1 { " signing regression" } @else { " signing regressions" }
+                }
+            }
         }
     }
 }
diff --git a/engine/src/engine/dashboard/mod.rs b/engine/src/engine/dashboard/mod.rs
index 151103d..5840be9 100644
--- a/engine/src/engine/dashboard/mod.rs
+++ b/engine/src/engine/dashboard/mod.rs
@@ -92,13 +92,22 @@ impl DashboardState {
         let findings = self.findings.snapshot();
         let judgements = self.judgements.snapshot();
         let readiness = self.readiness();
-        view_model::build_status_strip(
+        let strip = view_model::build_status_strip(
             self.cluster.clone(),
             &findings,
             &judgements,
             &readiness,
             self.findings.last_pass(),
-        )
+        );
+        let (breach, uncertain) = self.signing_regression_counts();
+        strip.with_signing_regressions(breach, uncertain)
+    }
+
+    /// The standing signing-regression counts `(established, cold)` from the admission-decision log
+    /// (JEF-264) — folded into the persistent strip so a standing regression keeps it non-green on
+    /// EVERY tab, without routing through the reachability findings pipeline.
+    fn signing_regression_counts(&self) -> (usize, usize) {
+        view_model::signing_regression_counts(&self.policy_log.snapshot())
     }
 
     /// Build the whole Findings view props from the live state.
@@ -106,13 +115,19 @@ impl DashboardState {
         let findings = self.findings.snapshot();
         let judgements = self.judgements.snapshot();
         let readiness = self.readiness();
-        view_model::build_findings_view(
+        let mut view = view_model::build_findings_view(
             self.cluster.clone(),
             &findings,
             &judgements,
             &readiness,
             self.findings.last_pass(),
-        )
+        );
+        // The findings-derived strip carries no signing regressions of its own; fold in the
+        // admission-decision log's counts so the Findings strip is non-green when a regression
+        // stands too (the honesty invariant holds on every tab).
+        let (breach, uncertain) = self.signing_regression_counts();
+        view.strip = view.strip.with_signing_regressions(breach, uncertain);
+        view
     }
 
     /// Build the Action view props (the merged Trust + Activity story): the persistent strip + the
diff --git a/engine/src/engine/dashboard/view_model/action/tests.rs b/engine/src/engine/dashboard/view_model/action/tests.rs
index 4b05052..f239219 100644
--- a/engine/src/engine/dashboard/view_model/action/tests.rs
+++ b/engine/src/engine/dashboard/view_model/action/tests.rs
@@ -33,6 +33,8 @@ fn strip() -> StatusStripProps {
         uncertain_count: 0,
         cleared_count: 0,
         escalated_count: 0,
+        signing_regression_breach: 0,
+        signing_regression_uncertain: 0,
     }
 }
 
diff --git a/engine/src/engine/dashboard/view_model/admission/tests.rs b/engine/src/engine/dashboard/view_model/admission/tests.rs
index a425cb6..c6d2994 100644
--- a/engine/src/engine/dashboard/view_model/admission/tests.rs
+++ b/engine/src/engine/dashboard/view_model/admission/tests.rs
@@ -21,6 +21,8 @@ fn strip() -> StatusStripProps {
         uncertain_count: 0,
         cleared_count: 0,
         escalated_count: 0,
+        signing_regression_breach: 0,
+        signing_regression_uncertain: 0,
     }
 }
 
diff --git a/engine/src/engine/dashboard/view_model/mod.rs b/engine/src/engine/dashboard/view_model/mod.rs
index 71c416b..4d50dda 100644
--- a/engine/src/engine/dashboard/view_model/mod.rs
+++ b/engine/src/engine/dashboard/view_model/mod.rs
@@ -124,3 +124,13 @@ pub fn build_admission_view(
 ) -> AdmissionViewProps {
     admission::build(strip, rows)
 }
+
+/// The standing signing-regression counts `(established, cold)` derived from the admission-decision
+/// log's regression rows (`SigningRegression/<repo>`, JEF-264) — established-baseline regressions
+/// count toward breach, cold-baseline ones toward uncertain. The caller folds these into the
+/// persistent strip (via [`StatusStripProps::with_signing_regressions`]) so a standing regression
+/// keeps the strip non-green on EVERY tab, WITHOUT routing through the reachability findings
+/// pipeline. Pure given its input.
+pub fn signing_regression_counts(rows: &[PolicyDecisionRecord]) -> (usize, usize) {
+    signing_inventory::counts(rows)
+}
diff --git a/engine/src/engine/dashboard/view_model/props.rs b/engine/src/engine/dashboard/view_model/props/mod.rs
similarity index 82%
rename from engine/src/engine/dashboard/view_model/props.rs
rename to engine/src/engine/dashboard/view_model/props/mod.rs
index c851269..211ab96 100644
--- a/engine/src/engine/dashboard/view_model/props.rs
+++ b/engine/src/engine/dashboard/view_model/props/mod.rs
@@ -303,9 +303,35 @@ pub struct StatusStripProps {
     pub cleared_count: usize,
     /// Newly-escalated since last pass (the Δ headline).
     pub escalated_count: usize,
+    /// Standing signing regressions against an ESTABLISHED repo baseline (JEF-264) — a strong
+    /// supply-chain signal. Counts toward BREACH for the honesty gate: blocks the green all-clear
+    /// AND the calm "watching" reading. Audit-only (never denies); kept SEPARATE from the
+    /// reachability [`breach_count`](Self::breach_count) — a signing regression is not a
+    /// reachability breach the model can isolate.
+    pub signing_regression_breach: usize,
+    /// Standing signing regressions against a COLD / freshly-learned baseline (JEF-264) — a weak
+    /// lead (the baseline itself is weak evidence). Maps to UNCERTAIN: blocks the green all-clear
+    /// but reads as the calmer "watching" register, not a breach.
+    pub signing_regression_uncertain: usize,
 }
 
 impl StatusStripProps {
+    /// Attach the standing signing-regression counts (JEF-264) — an established-baseline regression
+    /// (breach) and a cold-baseline one (uncertain). Builder-style so the strip builders keep their
+    /// minimal signatures and the caller with the admission-decision log (`DashboardState`) wires
+    /// the counts in. Both feed the honesty gate — a standing regression can never read as green.
+    pub fn with_signing_regressions(mut self, breach: usize, uncertain: usize) -> Self {
+        self.signing_regression_breach = breach;
+        self.signing_regression_uncertain = uncertain;
+        self
+    }
+
+    /// Whether any signing regression stands (established or cold) — the honesty side: a standing
+    /// regression forbids the green all-clear (JEF-264 acceptance criterion).
+    pub fn has_signing_regression(&self) -> bool {
+        self.signing_regression_breach > 0 || self.signing_regression_uncertain > 0
+    }
+
     /// Whether the model is up and answering (not warming/blind). This is the floor for a
     /// non-blind render — but it is NOT enough for a green all-clear (see [`Self::all_clear`]).
     pub fn model_is_up(&self) -> bool {
@@ -324,19 +350,30 @@ impl StatusStripProps {
     /// EVERYTHING it is looking at — judging, not warming, fully covered, and zero breaches AND
     /// zero entries still awaiting AND zero uncertain (the tightened honesty gate, invariant #1).
     /// "Quiet because the model affirmatively cleared it" is the ONLY thing that may go green.
+    ///
+    /// A standing signing regression (JEF-264) — established OR cold — also forbids green: an
+    /// un-accepted regression is an open supply-chain question the model has not cleared.
     pub fn all_clear(&self) -> bool {
         self.fully_covered()
             && self.breach_count == 0
             && self.awaiting_count == 0
             && self.uncertain_count == 0
+            && !self.has_signing_regression()
     }
 
     /// Whether the strip should show the elevated **"watching"** state: the model is up but has
     /// NOT yet affirmatively cleared everything — something is still awaiting or uncertain (or a
     /// feed is missing). Calm, but **not** green — the model isn't sure yet. Distinct from a
     /// breach (which is loud) and from blind/warming (model down).
+    ///
+    /// An ESTABLISHED-baseline signing regression (JEF-264) is louder than watching — it counts
+    /// toward breach — so it is excluded here (it falls through to the elevated/loud reading). A
+    /// COLD-baseline regression is a weak lead and reads as this calm, non-green watching register.
     pub fn watching(&self) -> bool {
-        self.model_is_up() && self.breach_count == 0 && !self.all_clear()
+        self.model_is_up()
+            && self.breach_count == 0
+            && self.signing_regression_breach == 0
+            && !self.all_clear()
     }
 }
 
@@ -762,131 +799,12 @@ pub struct AdmissionViewProps {
     pub rows: Vec<DecisionRowProps>,
 }
 
-// ---------------------------------------------------------------------------
-// Signing inventory (JEF-262 / ADR-0020 Stage 1 render) — the observed signing
-// posture of EVERY image, as a dedicated inventory section. Two hard operator
-// rules: the posture is ALWAYS signed / invalid signature / not signed (or the
-// transient checking) — never n/a; and the "if enforced" column is ALWAYS the
-// binary would-admit / would-block — never n/a.
-// ---------------------------------------------------------------------------
-
-/// An image's observed signing posture — the presentation mirror of the domain
-/// `signature::posture::SigningPosture` (mapped at the view_model boundary so components never
-/// import the domain type). NEVER n/a: observation always reaches a posture, and a registry blip
-/// is the explicit transient [`Checking`](Self::Checking), not a fabricated clean. Carried as
-/// colour + glyph + word so meaning never rides on colour alone. [`Invalid`](Self::Invalid) is the
-/// LOUD channel — visually and lexically distinct from a calm [`NotSigned`](Self::NotSigned).
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum SigningPosture {
-    /// A signature is present and verifies (the signer rides [`SigningRowProps::signer`]).
-    Signed,
-    /// A signature artifact is present but does NOT verify — the loud, alarming case. Distinct
-    /// from (and more alarming than) [`NotSigned`](Self::NotSigned).
-    Invalid,
-    /// No signature at all — calm (no baseline yet), never loud, but never a green pass either.
-    NotSigned,
-    /// Transient: the registry / transparency log was unreachable, so the posture is not yet
-    /// known. Never read as clean; resolves into a resting posture on a later pass.
-    Checking,
-}
-
-impl SigningPosture {
-    /// Parse the engine's low-cardinality status word (`SigningPosture::status()`) into the
-    /// presentation enum. An unknown / empty word reads as the transient
-    /// [`Checking`](Self::Checking) rather than a fabricated resting posture — never a false clean.
-    pub fn parse(word: &str) -> SigningPosture {
-        match word {
-            "signed" => SigningPosture::Signed,
-            "invalid-signature" => SigningPosture::Invalid,
-            "not-signed" => SigningPosture::NotSigned,
-            _ => SigningPosture::Checking,
-        }
-    }
-
-    /// The CSS token suffix (`--sign-{kind}`) for this posture.
-    pub fn token(self) -> &'static str {
-        match self {
-            SigningPosture::Signed => "signed",
-            SigningPosture::Invalid => "invalid",
-            SigningPosture::NotSigned => "notsigned",
-            SigningPosture::Checking => "checking",
-        }
-    }
-
-    /// The glyph carrying the posture without colour — each distinct so `invalid` reads apart from
-    /// `not signed` and `signed` even in greyscale.
-    pub fn glyph(self) -> &'static str {
-        match self {
-            SigningPosture::Signed => "\u{2713}",    // ✓ present + verified
-            SigningPosture::Invalid => "\u{2715}",   // ✕ present but broken — the loud channel
-            SigningPosture::NotSigned => "\u{25CB}", // ○ open — nothing there, calm
-            SigningPosture::Checking => "\u{25CC}",  // ◌ dotted — transient
-        }
-    }
-
-    /// The word — always present alongside colour + glyph, and lexically distinct per state.
-    pub fn word(self) -> &'static str {
-        match self {
-            SigningPosture::Signed => "signed",
-            SigningPosture::Invalid => "invalid signature",
-            SigningPosture::NotSigned => "not signed",
-            SigningPosture::Checking => "checking\u{2026}",
-        }
-    }
-
-    /// The binary "if enforced" counterfactual: only a verifying [`Signed`](Self::Signed) image
-    /// would be admitted by a signature gate; every other posture (invalid / not signed / the
-    /// unverifiable transient) would be blocked. Fail-closed — never n/a (operator rule #2).
-    pub fn would_admit(self) -> bool {
-        matches!(self, SigningPosture::Signed)
-    }
-}
-
-/// The signer learned from a verified Fulcio cert (only present when [`SigningPosture::Signed`]).
-/// Both the identity and issuer are UNTRUSTED third-party free-text (an attacker-influenceable cert
-/// subject) — the component escapes them at render (maud auto-escape; NEVER `PreEscaped`).
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct SignerProps {
-    /// A short, scannable label derived from the Fulcio SAN (a GitHub Actions workflow URI →
-    /// `org/repo`; an email kept as-is; otherwise the raw identity, truncated in-row by CSS). Shown
-    /// in the row.
-    pub identity_short: String,
-    /// The full Fulcio SAN — shown in the expand panel and the `title=`, so the truncated in-row
-    /// label never hides the real signer.
-    pub identity_full: String,
-    /// A short issuer badge derived from the OIDC issuer (`github actions` / `google` / `sigstore`
-    /// / the host), or empty when the cert carried no issuer.
-    pub issuer_badge: String,
-    /// The full OIDC issuer URL for the expand panel, or `None` when the cert carried none.
-    pub issuer_full: Option<String>,
-}
-
-/// One image row in the signing inventory (JEF-262). Plain presentation data only — mapped from the
-/// engine `PolicyDecisionRecord` at the view_model boundary. Every string is UNTRUSTED at render.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct SigningRowProps {
-    /// The full image ref (registry/repo + digest/tag), untrusted — shown in the expand panel and
-    /// the `title=`.
-    pub image: String,
-    /// The in-row image label: the digest/tag remainder under the repo group (falls back to the
-    /// full ref when the image carries no tag/digest), untrusted.
-    pub label: String,
-    pub posture: SigningPosture,
-    /// The signer, present only when [`posture`](Self::posture) is [`SigningPosture::Signed`].
-    pub signer: Option<SignerProps>,
-    /// The human-facing posture prose for the expand panel (why invalid / still checking); empty
-    /// for a plain not-signed, which needs no prose. Untrusted.
-    pub detail: String,
-    /// How many times this exact image was observed (the dedup count).
-    pub count: u64,
-}
-
-/// A repo group in the signing inventory: one registry/repo header with the images observed under
-/// it (JEF-262 — the inventory unit is the image, grouped under its repo).
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct SigningRepoProps {
-    /// The registry/repo the images share (the group header), untrusted.
-    pub repo: String,
-    /// The images observed under this repo.
-    pub images: Vec<SigningRowProps>,
-}
+// The per-image signing inventory presentation types (JEF-262 / ADR-0020 Stage 1 render) + the
+// signing-regression banner (JEF-264), split into a focused submodule to keep this file under the
+// repo's 1,000-line cap (CLAUDE.md). Re-exported flat so `props::SigningPosture` etc. resolve
+// unchanged for every consumer.
+mod signing;
+pub use signing::{
+    RegressionKind, SignerProps, SigningPosture, SigningRegressionProps, SigningRepoProps,
+    SigningRowProps,
+};
diff --git a/engine/src/engine/dashboard/view_model/props/signing.rs b/engine/src/engine/dashboard/view_model/props/signing.rs
new file mode 100644
index 0000000..8998f53
--- /dev/null
+++ b/engine/src/engine/dashboard/view_model/props/signing.rs
@@ -0,0 +1,217 @@
+//! Signing-inventory presentation props (JEF-262 / ADR-0020 Stage 1 render) + the
+//! signing-regression banner (JEF-264): the observed signing posture of EVERY image, as a
+//! dedicated inventory section, and — when a repo's signed history drifts — the loud regression
+//! banner over its rows.
+//!
+//! Two hard operator rules for the inventory: the posture is ALWAYS signed / invalid signature /
+//! not signed (or the transient checking) — never n/a; and the "if enforced" column is ALWAYS the
+//! binary would-admit / would-block — never n/a. Every string here is UNTRUSTED at render (a Fulcio
+//! SAN / image ref is attacker-influenceable): the components escape it (maud auto-escape; NEVER
+//! `PreEscaped`). Split out of the parent `props` module to keep both files under the repo's
+//! 1,000-line cap (CLAUDE.md); re-exported flat, so `props::SigningPosture` etc. resolve unchanged.
+
+/// An image's observed signing posture — the presentation mirror of the domain
+/// `signature::posture::SigningPosture` (mapped at the view_model boundary so components never
+/// import the domain type). NEVER n/a: observation always reaches a posture, and a registry blip
+/// is the explicit transient [`Checking`](Self::Checking), not a fabricated clean. Carried as
+/// colour + glyph + word so meaning never rides on colour alone. [`Invalid`](Self::Invalid) is the
+/// LOUD channel — visually and lexically distinct from a calm [`NotSigned`](Self::NotSigned).
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum SigningPosture {
+    /// A signature is present and verifies (the signer rides [`SigningRowProps::signer`]).
+    Signed,
+    /// A signature artifact is present but does NOT verify — the loud, alarming case. Distinct
+    /// from (and more alarming than) [`NotSigned`](Self::NotSigned).
+    Invalid,
+    /// No signature at all — calm (no baseline yet), never loud, but never a green pass either.
+    NotSigned,
+    /// Transient: the registry / transparency log was unreachable, so the posture is not yet
+    /// known. Never read as clean; resolves into a resting posture on a later pass.
+    Checking,
+}
+
+impl SigningPosture {
+    /// Parse the engine's low-cardinality status word (`SigningPosture::status()`) into the
+    /// presentation enum. An unknown / empty word reads as the transient
+    /// [`Checking`](Self::Checking) rather than a fabricated resting posture — never a false clean.
+    pub fn parse(word: &str) -> SigningPosture {
+        match word {
+            "signed" => SigningPosture::Signed,
+            "invalid-signature" => SigningPosture::Invalid,
+            "not-signed" => SigningPosture::NotSigned,
+            _ => SigningPosture::Checking,
+        }
+    }
+
+    /// The CSS token suffix (`--sign-{kind}`) for this posture.
+    pub fn token(self) -> &'static str {
+        match self {
+            SigningPosture::Signed => "signed",
+            SigningPosture::Invalid => "invalid",
+            SigningPosture::NotSigned => "notsigned",
+            SigningPosture::Checking => "checking",
+        }
+    }
+
+    /// The glyph carrying the posture without colour — each distinct so `invalid` reads apart from
+    /// `not signed` and `signed` even in greyscale.
+    pub fn glyph(self) -> &'static str {
+        match self {
+            SigningPosture::Signed => "\u{2713}",    // ✓ present + verified
+            SigningPosture::Invalid => "\u{2715}",   // ✕ present but broken — the loud channel
+            SigningPosture::NotSigned => "\u{25CB}", // ○ open — nothing there, calm
+            SigningPosture::Checking => "\u{25CC}",  // ◌ dotted — transient
+        }
+    }
+
+    /// The word — always present alongside colour + glyph, and lexically distinct per state.
+    pub fn word(self) -> &'static str {
+        match self {
+            SigningPosture::Signed => "signed",
+            SigningPosture::Invalid => "invalid signature",
+            SigningPosture::NotSigned => "not signed",
+            SigningPosture::Checking => "checking\u{2026}",
+        }
+    }
+
+    /// The binary "if enforced" counterfactual: only a verifying [`Signed`](Self::Signed) image
+    /// would be admitted by a signature gate; every other posture (invalid / not signed / the
+    /// unverifiable transient) would be blocked. Fail-closed — never n/a (operator rule #2).
+    pub fn would_admit(self) -> bool {
+        matches!(self, SigningPosture::Signed)
+    }
+}
+
+/// The signer learned from a verified Fulcio cert (only present when [`SigningPosture::Signed`]).
+/// Both the identity and issuer are UNTRUSTED third-party free-text (an attacker-influenceable cert
+/// subject) — the component escapes them at render (maud auto-escape; NEVER `PreEscaped`).
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct SignerProps {
+    /// A short, scannable label derived from the Fulcio SAN (a GitHub Actions workflow URI →
+    /// `org/repo`; an email kept as-is; otherwise the raw identity, truncated in-row by CSS). Shown
+    /// in the row.
+    pub identity_short: String,
+    /// The full Fulcio SAN — shown in the expand panel and the `title=`, so the truncated in-row
+    /// label never hides the real signer.
+    pub identity_full: String,
+    /// A short issuer badge derived from the OIDC issuer (`github actions` / `google` / `sigstore`
+    /// / the host), or empty when the cert carried no issuer.
+    pub issuer_badge: String,
+    /// The full OIDC issuer URL for the expand panel, or `None` when the cert carried none.
+    pub issuer_full: Option<String>,
+}
+
+/// One image row in the signing inventory (JEF-262). Plain presentation data only — mapped from the
+/// engine `PolicyDecisionRecord` at the view_model boundary. Every string is UNTRUSTED at render.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct SigningRowProps {
+    /// The full image ref (registry/repo + digest/tag), untrusted — shown in the expand panel and
+    /// the `title=`.
+    pub image: String,
+    /// The in-row image label: the digest/tag remainder under the repo group (falls back to the
+    /// full ref when the image carries no tag/digest), untrusted.
+    pub label: String,
+    pub posture: SigningPosture,
+    /// The signer, present only when [`posture`](Self::posture) is [`SigningPosture::Signed`].
+    pub signer: Option<SignerProps>,
+    /// The human-facing posture prose for the expand panel (why invalid / still checking); empty
+    /// for a plain not-signed, which needs no prose. Untrusted.
+    pub detail: String,
+    /// How many times this exact image was observed (the dedup count).
+    pub count: u64,
+}
+
+/// A repo group in the signing inventory: one registry/repo header with the images observed under
+/// it (JEF-262 — the inventory unit is the image, grouped under its repo), plus an optional loud
+/// signing-regression banner (JEF-264) when the repo's signed history has drifted.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct SigningRepoProps {
+    /// The registry/repo the images share (the group header), untrusted.
+    pub repo: String,
+    /// The images observed under this repo.
+    pub images: Vec<SigningRowProps>,
+    /// A standing signing regression against this repo's baseline (JEF-264), rendered as the LOUD
+    /// channel above the image rows; `None` when the repo is continuous.
+    pub regression: Option<SigningRegressionProps>,
+}
+
+/// Which kind of signing regression a repo drifted into (JEF-264) — the presentation mirror of the
+/// engine `signing_drift::RegressionKind`. The LOUD channel: visually + lexically distinct from the
+/// calm [`SigningPosture::NotSigned`]. Carried as glyph + word so meaning never rides on colour.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum RegressionKind {
+    /// A repo with signed history now serves an unsigned image.
+    Unsigned,
+    /// A repo with signed history now serves an image whose signature does not verify.
+    Invalid,
+    /// A repo is now signed by an identity never before seen under it (a new signer).
+    IdentityChange,
+}
+
+impl RegressionKind {
+    /// Parse the recorded drift kind word (`unsigned` / `invalid` / `identity`). An unknown word
+    /// reads as [`Unsigned`](Self::Unsigned) — a conservative "signing regression" default rather
+    /// than a fabricated calm state (a regression row exists, so it is never continuous).
+    pub fn parse(word: &str) -> RegressionKind {
+        match word {
+            "invalid" => RegressionKind::Invalid,
+            "identity" => RegressionKind::IdentityChange,
+            _ => RegressionKind::Unsigned,
+        }
+    }
+
+    /// The CSS token suffix (`--regression-{kind}`) for this kind.
+    pub fn token(self) -> &'static str {
+        match self {
+            RegressionKind::Unsigned => "unsigned",
+            RegressionKind::Invalid => "invalid",
+            RegressionKind::IdentityChange => "identity",
+        }
+    }
+
+    /// The loud headline word for the regression banner — always the literal "signing regression"
+    /// prefix (visually + lexically distinct from calm "not signed"), qualified by what drifted.
+    pub fn word(self) -> &'static str {
+        match self {
+            RegressionKind::Unsigned => "signing regression \u{2014} now unsigned",
+            RegressionKind::Invalid => "signing regression \u{2014} now invalid signature",
+            RegressionKind::IdentityChange => "signing regression \u{2014} new signer",
+        }
+    }
+
+    /// The "after" prose for an unsigned/invalid regression (the identity-change case shows the new
+    /// signer instead).
+    pub fn after_word(self) -> &'static str {
+        match self {
+            RegressionKind::Unsigned => "no signature present",
+            RegressionKind::Invalid => "signature present but does not verify",
+            RegressionKind::IdentityChange => "signed by a new identity",
+        }
+    }
+}
+
+/// A standing signing-regression banner for a repo group (JEF-264, ADR-0020 §3): the repo's signed
+/// history drifted — now unsigned/invalid, or signed by a new identity. Audit-only (the image is
+/// still admitted); rendered as the LOUD breach-rail channel with the FULL before→after identities.
+///
+/// Every identity/issuer string is UNTRUSTED Fulcio cert text — the component escapes it via maud
+/// interpolation (NEVER `PreEscaped`, never concatenated into markup, never a `class=`/CSS value).
+/// The full identities are shown deliberately (not the shortened `org/repo` label): the point is to
+/// show the operator EXACTLY what changed.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct SigningRegressionProps {
+    /// What drifted (unsigned / invalid / new signer).
+    pub kind: RegressionKind,
+    /// Whether the baseline was established (a strong breach signal) or cold/freshly-learned (a
+    /// weak lead — reduced intensity, "treat as a lead", maps to uncertain).
+    pub established: bool,
+    /// The baseline signer identities in FULL (the "before"), UNTRUSTED — escaped at render.
+    pub before_identities: Vec<String>,
+    /// The new signer identity in FULL (the "after") for an identity-change; `None` for an
+    /// unsigned/invalid regression. UNTRUSTED — escaped at render.
+    pub after_identity: Option<String>,
+    /// The new signer's issuer in full, if the cert carried one. UNTRUSTED — escaped at render.
+    pub after_issuer: Option<String>,
+    /// The image ref that regressed (the "after" image), UNTRUSTED — escaped at render.
+    pub image: String,
+}
diff --git a/engine/src/engine/dashboard/view_model/signing_inventory.rs b/engine/src/engine/dashboard/view_model/signing_inventory.rs
index eddfefc..4552215 100644
--- a/engine/src/engine/dashboard/view_model/signing_inventory.rs
+++ b/engine/src/engine/dashboard/view_model/signing_inventory.rs
@@ -14,18 +14,46 @@
 
 use crate::engine::policy_log::PolicyDecisionRecord;
 
-use super::props::{SignerProps, SigningPosture, SigningRepoProps, SigningRowProps};
+use super::props::{
+    RegressionKind, SignerProps, SigningPosture, SigningRegressionProps, SigningRepoProps,
+    SigningRowProps,
+};
 
-/// The subject prefix the signing sweep keys its rows under (`Image/<ref>`). A row whose subject
-/// starts with this is an observation row for the inventory, distinct from the webhook's workload
-/// decision rows (`Pod/…`, `Deployment/…`).
+/// The subject prefix the signing sweep keys its posture rows under (`Image/<ref>`). A row whose
+/// subject starts with this is an observation row for the inventory, distinct from the webhook's
+/// workload decision rows (`Pod/…`, `Deployment/…`).
 const IMAGE_SUBJECT_PREFIX: &str = "Image/";
 
-/// Whether a decision-log record is a signing-inventory observation row (vs a webhook decision).
+/// The subject prefix the sweep keys a signing-**regression** finding under (`SigningRegression/
+/// <repo>`, JEF-264) — one row per repo. Also a signing row (not a webhook decision), so it is
+/// partitioned out of the decision tallies and feeds the repo group's regression banner.
+const REGRESSION_SUBJECT_PREFIX: &str = "SigningRegression/";
+
+/// The signature-column prefix marking a regression row's drift token (`regression-<kind>-
+/// <strength>`), written by `engine::signing_sweep::regression_record`.
+const REGRESSION_STATUS_PREFIX: &str = "regression-";
+
+/// The sentinel separating the "after" clause from the baseline "before" signers in a regression
+/// row's reason (`<after> | before: <ids>`).
+const BEFORE_SEP: &str = " | before: ";
+
+/// Whether a record is a signing-inventory row — a posture observation (`Image/<ref>`) OR a
+/// regression finding (`SigningRegression/<repo>`) — as opposed to a webhook workload decision.
+/// Both are partitioned out of the Admission view's decision tallies.
 pub(super) fn is_inventory_row(r: &PolicyDecisionRecord) -> bool {
+    is_observation_row(r) || is_regression_row(r)
+}
+
+/// Whether a record is a per-image posture observation row (`Image/<ref>`).
+fn is_observation_row(r: &PolicyDecisionRecord) -> bool {
     r.subject.starts_with(IMAGE_SUBJECT_PREFIX)
 }
 
+/// Whether a record is a signing-regression finding row (`SigningRegression/<repo>`, JEF-264).
+fn is_regression_row(r: &PolicyDecisionRecord) -> bool {
+    r.subject.starts_with(REGRESSION_SUBJECT_PREFIX)
+}
+
 /// Split an image ref into `(repo, remainder)`: the digest form `repo@sha256:…` splits at the `@`;
 /// the tag form `repo:tag` splits at the `:` in the LAST path segment (so a registry port —
 /// `registry:5000/org/app` — is never mistaken for a tag). A bare ref with neither has an empty
@@ -127,13 +155,97 @@ fn signing_row(r: &PolicyDecisionRecord) -> SigningRowProps {
     }
 }
 
-/// Build the signing inventory from the admission-decision log's observation rows (those keyed
-/// `Image/<ref>`), grouped under their repo. Repo groups preserve first-seen order (the caller
-/// passes newest-first rows), so a steady inventory renders stably. The webhook's workload decision
-/// rows are ignored here — they drive the decision log, not the inventory.
+/// Parse a signing-regression row (`SigningRegression/<repo>`, JEF-264) into `(repo, props)`, or
+/// `None` when the row isn't a well-formed regression row. The row is self-describing (the sweep
+/// writes the drift token in `signature` and the before→after prose in `reason`); nothing here
+/// reaches the baseline store. Every identity that comes back is UNTRUSTED — escaped at render.
+fn parse_regression(r: &PolicyDecisionRecord) -> Option<(String, SigningRegressionProps)> {
+    let repo = r
+        .subject
+        .strip_prefix(REGRESSION_SUBJECT_PREFIX)?
+        .to_string();
+    // signature = "regression-<kind>-<strength>" (strength ∈ established/cold).
+    let token = r.signature.strip_prefix(REGRESSION_STATUS_PREFIX)?;
+    let (kind_word, strength) = token.rsplit_once('-')?;
+    let established = match strength {
+        "established" => true,
+        "cold" => false,
+        _ => return None,
+    };
+    let kind = RegressionKind::parse(kind_word);
+
+    // reason = "<after clause> | before: <id1>, <id2>, …".
+    let (after_clause, before) = r.reason.split_once(BEFORE_SEP).unwrap_or((&r.reason, ""));
+    let before_identities: Vec<String> = before
+        .split(", ")
+        .map(str::trim)
+        .filter(|s| !s.is_empty())
+        .map(str::to_string)
+        .collect();
+
+    // The "after" identity only exists for an identity-change (its clause reuses the observation
+    // row's `signed by <id>[ via <issuer>]` prose, so the same parser reads it).
+    let (after_identity, after_issuer) = match kind {
+        RegressionKind::IdentityChange => match parse_signer_reason(after_clause) {
+            Some((identity, issuer)) => (Some(identity.to_string()), issuer.map(str::to_string)),
+            None => (None, None),
+        },
+        _ => (None, None),
+    };
+
+    Some((
+        repo,
+        SigningRegressionProps {
+            kind,
+            established,
+            before_identities,
+            after_identity,
+            after_issuer,
+            image: r.image.clone(),
+        },
+    ))
+}
+
+/// The standing regressions, one per repo (newest wins), preserving newest-first order. Shared by
+/// [`build`] (to attach the banner) and [`counts`] (to feed the status-strip honesty model), so the
+/// render and the strip can never disagree about what regressions stand.
+fn regressions_by_repo(rows: &[PolicyDecisionRecord]) -> Vec<(String, SigningRegressionProps)> {
+    let mut out: Vec<(String, SigningRegressionProps)> = Vec::new();
+    for record in rows.iter().filter(|r| is_regression_row(r)) {
+        if let Some((repo, props)) = parse_regression(record)
+            && !out.iter().any(|(existing, _)| *existing == repo)
+        {
+            out.push((repo, props));
+        }
+    }
+    out
+}
+
+/// The standing signing-regression counts for the status strip (JEF-264): `(established, cold)` —
+/// established-baseline regressions count toward breach, cold-baseline ones toward uncertain. Both
+/// forbid the green all-clear. Counted per repo (a repo is one standing regression regardless of how
+/// many bad digests it served).
+pub(super) fn counts(rows: &[PolicyDecisionRecord]) -> (usize, usize) {
+    let mut established = 0;
+    let mut cold = 0;
+    for (_, reg) in regressions_by_repo(rows) {
+        if reg.established {
+            established += 1;
+        } else {
+            cold += 1;
+        }
+    }
+    (established, cold)
+}
+
+/// Build the signing inventory from the admission-decision log rows: the observation rows (`Image/
+/// <ref>`) grouped under their repo (JEF-262), each repo carrying its standing signing-regression
+/// banner (`SigningRegression/<repo>`, JEF-264) when one stands. Repo groups preserve first-seen
+/// order (the caller passes newest-first rows), so a steady inventory renders stably. The webhook's
+/// workload decision rows are ignored — they drive the decision log, not the inventory.
 pub(super) fn build(rows: &[PolicyDecisionRecord]) -> Vec<SigningRepoProps> {
     let mut groups: Vec<SigningRepoProps> = Vec::new();
-    for record in rows.iter().filter(|r| is_inventory_row(r)) {
+    for record in rows.iter().filter(|r| is_observation_row(r)) {
         let (repo, _) = split_ref(&record.image);
         let row = signing_row(record);
         match groups.iter_mut().find(|g| g.repo == repo) {
@@ -141,6 +253,19 @@ pub(super) fn build(rows: &[PolicyDecisionRecord]) -> Vec<SigningRepoProps> {
             None => groups.push(SigningRepoProps {
                 repo: repo.to_string(),
                 images: vec![row],
+                regression: None,
+            }),
+        }
+    }
+    // Attach the standing regression to its repo group, creating the group if the regressed image
+    // has aged out of the observation window (the regression must still surface loudly).
+    for (repo, regression) in regressions_by_repo(rows) {
+        match groups.iter_mut().find(|g| g.repo == repo) {
+            Some(group) => group.regression = Some(regression),
+            None => groups.push(SigningRepoProps {
+                repo,
+                images: Vec::new(),
+                regression: Some(regression),
             }),
         }
     }
diff --git a/engine/src/engine/dashboard/view_model/signing_inventory/tests.rs b/engine/src/engine/dashboard/view_model/signing_inventory/tests.rs
index 903b809..c0c3f28 100644
--- a/engine/src/engine/dashboard/view_model/signing_inventory/tests.rs
+++ b/engine/src/engine/dashboard/view_model/signing_inventory/tests.rs
@@ -224,3 +224,193 @@ fn dedup_count_is_carried() {
     r.count = 7;
     assert_eq!(build(&[r])[0].images[0].count, 7);
 }
+
+// ---- JEF-264 signing-regression rows -----------------------------------------------------------
+
+/// A signing-regression finding row exactly as `engine::signing_sweep::regression_record` writes it:
+/// `SigningRegression/<repo>` subject, the drift token in `signature`, the before→after prose in
+/// `reason`, decision `allow` (audit-only).
+fn regression(repo: &str, image: &str, signature: &str, reason: &str) -> PolicyDecisionRecord {
+    PolicyDecisionRecord::now(
+        "signing-regression",
+        "allow",
+        format!("SigningRegression/{repo}"),
+        image,
+        signature,
+        "",
+        "",
+        reason,
+    )
+}
+
+#[test]
+fn unsigned_regression_parses_before_and_after() {
+    let rows = vec![regression(
+        "ghcr.io/acme/app",
+        "ghcr.io/acme/app:2",
+        "regression-unsigned-established",
+        "now not signed (was signed) | before: https://github.com/acme/app/.github/workflows/r.yaml@refs/tags/v1",
+    )];
+    let group = &build(&rows)[0];
+    let reg = group
+        .regression
+        .as_ref()
+        .expect("the repo carries a regression");
+    assert_eq!(reg.kind, RegressionKind::Unsigned);
+    assert!(
+        reg.established,
+        "an established-baseline regression is the strong signal"
+    );
+    assert_eq!(
+        reg.before_identities,
+        vec!["https://github.com/acme/app/.github/workflows/r.yaml@refs/tags/v1".to_string()],
+        "the before signer is carried in full"
+    );
+    assert!(reg.after_identity.is_none(), "unsigned has no after signer");
+    assert_eq!(reg.image, "ghcr.io/acme/app:2");
+}
+
+#[test]
+fn identity_change_regression_parses_both_identities_in_full() {
+    let rows = vec![regression(
+        "ghcr.io/acme/app",
+        "ghcr.io/acme/app:3",
+        "regression-identity-established",
+        "signed by https://github.com/evil/app/.github/workflows/pwn.yaml@refs/heads/main via \
+         https://token.actions.githubusercontent.com | before: \
+         https://github.com/acme/app/.github/workflows/r.yaml@refs/tags/v1",
+    )];
+    let reg = build(&rows)[0].regression.clone().unwrap();
+    assert_eq!(reg.kind, RegressionKind::IdentityChange);
+    assert_eq!(
+        reg.after_identity.as_deref(),
+        Some("https://github.com/evil/app/.github/workflows/pwn.yaml@refs/heads/main"),
+        "the NEW signer is carried in full"
+    );
+    assert_eq!(
+        reg.after_issuer.as_deref(),
+        Some("https://token.actions.githubusercontent.com")
+    );
+    assert_eq!(
+        reg.before_identities,
+        vec!["https://github.com/acme/app/.github/workflows/r.yaml@refs/tags/v1".to_string()],
+        "the OLD signer is carried in full alongside the new one"
+    );
+}
+
+#[test]
+fn cold_regression_is_flagged_weak() {
+    let rows = vec![regression(
+        "ghcr.io/acme/app",
+        "ghcr.io/acme/app:2",
+        "regression-invalid-cold",
+        "now invalid signature (was signed) | before: releng@acme.example",
+    )];
+    let reg = build(&rows)[0].regression.clone().unwrap();
+    assert_eq!(reg.kind, RegressionKind::Invalid);
+    assert!(!reg.established, "a cold-baseline regression reads as weak");
+}
+
+#[test]
+fn regression_attaches_to_its_repo_group_alongside_the_image_rows() {
+    let rows = vec![
+        observed("ghcr.io/acme/app:2", "not-signed", ""),
+        regression(
+            "ghcr.io/acme/app",
+            "ghcr.io/acme/app:2",
+            "regression-unsigned-established",
+            "now not signed (was signed) | before: releng@acme.example",
+        ),
+    ];
+    let groups = build(&rows);
+    assert_eq!(
+        groups.len(),
+        1,
+        "one repo group carries both the image row and the banner"
+    );
+    assert_eq!(groups[0].images.len(), 1);
+    assert!(groups[0].regression.is_some());
+}
+
+#[test]
+fn regression_for_an_aged_out_image_still_surfaces_its_own_group() {
+    // No observation row for the repo (the bad digest aged out of the window), only the regression.
+    let rows = vec![regression(
+        "ghcr.io/acme/app",
+        "ghcr.io/acme/app:2",
+        "regression-unsigned-established",
+        "now not signed (was signed) | before: releng@acme.example",
+    )];
+    let groups = build(&rows);
+    assert_eq!(groups.len(), 1);
+    assert!(
+        groups[0].images.is_empty(),
+        "no image rows, but the regression still shows"
+    );
+    assert!(groups[0].regression.is_some());
+}
+
+#[test]
+fn regression_rows_are_inventory_rows_not_decisions() {
+    let r = regression(
+        "ghcr.io/acme/app",
+        "ghcr.io/acme/app:2",
+        "regression-unsigned-established",
+        "now not signed (was signed) | before: releng@acme.example",
+    );
+    assert!(
+        is_inventory_row(&r),
+        "a regression row is partitioned out of the webhook decision tallies"
+    );
+}
+
+#[test]
+fn counts_split_established_breach_from_cold_uncertain() {
+    let rows = vec![
+        regression(
+            "ghcr.io/acme/app",
+            "ghcr.io/acme/app:2",
+            "regression-unsigned-established",
+            "now not signed (was signed) | before: a",
+        ),
+        regression(
+            "ghcr.io/acme/other",
+            "ghcr.io/acme/other:2",
+            "regression-identity-cold",
+            "signed by b via c | before: a",
+        ),
+    ];
+    let (established, cold) = counts(&rows);
+    assert_eq!(
+        established, 1,
+        "the established regression counts toward breach"
+    );
+    assert_eq!(cold, 1, "the cold regression counts toward uncertain");
+}
+
+#[test]
+fn counts_are_per_repo_not_per_row() {
+    // Two regression rows for the SAME repo collapse to one standing regression (newest wins).
+    let rows = vec![
+        regression(
+            "ghcr.io/acme/app",
+            "ghcr.io/acme/app:3",
+            "regression-unsigned-established",
+            "now not signed (was signed) | before: a",
+        ),
+        regression(
+            "ghcr.io/acme/app",
+            "ghcr.io/acme/app:2",
+            "regression-invalid-established",
+            "now invalid signature (was signed) | before: a",
+        ),
+    ];
+    assert_eq!(counts(&rows), (1, 0), "one repo, one standing regression");
+    let groups = build(&rows);
+    assert_eq!(groups.len(), 1);
+    // Newest-first: the first row (the unsigned one) wins the banner.
+    assert_eq!(
+        groups[0].regression.as_ref().unwrap().kind,
+        RegressionKind::Unsigned
+    );
+}
diff --git a/engine/src/engine/dashboard/view_model/strip.rs b/engine/src/engine/dashboard/view_model/strip.rs
index e1f386d..4ef2013 100644
--- a/engine/src/engine/dashboard/view_model/strip.rs
+++ b/engine/src/engine/dashboard/view_model/strip.rs
@@ -74,6 +74,11 @@ pub(super) fn status_strip(
         uncertain_count,
         cleared_count,
         escalated_count,
+        // Signing-regression counts (JEF-264) are wired in by the caller that holds the
+        // admission-decision log (`DashboardState::with_signing_regressions`); the findings-derived
+        // strip carries none of its own.
+        signing_regression_breach: 0,
+        signing_regression_uncertain: 0,
     }
 }
 
@@ -149,6 +154,43 @@ mod tests {
         assert!(strip.last_pass.is_none());
     }
 
+    /// JEF-264: an ESTABLISHED-baseline signing regression counts toward breach — it forbids the
+    /// green all-clear AND the calm "watching" reading (it is louder than watching).
+    #[test]
+    fn established_signing_regression_forbids_green_and_watching() {
+        let mut bake = BakeStats::default();
+        bake.signals_by_variant.insert("alert".into(), 1);
+        let r = derive_readiness(&covered(), ModelHealth::Ok, &bake, Some(SystemTime::now()));
+        // Everything else is clear (would be all-clear) — but one established regression stands.
+        let strip = status_strip("prod".into(), &r, Some(SystemTime::now()), 0, 0, 0, 3, 0)
+            .with_signing_regressions(1, 0);
+        assert!(strip.has_signing_regression());
+        assert!(
+            !strip.all_clear(),
+            "a standing regression can never read as green"
+        );
+        assert!(
+            !strip.watching(),
+            "an established regression is louder than the calm watching register"
+        );
+    }
+
+    /// JEF-264: a COLD-baseline signing regression maps to uncertain — it forbids green, but reads
+    /// as the calmer, non-green "watching" register (a weak lead, not a breach).
+    #[test]
+    fn cold_signing_regression_is_watching_not_green() {
+        let mut bake = BakeStats::default();
+        bake.signals_by_variant.insert("alert".into(), 1);
+        let r = derive_readiness(&covered(), ModelHealth::Ok, &bake, Some(SystemTime::now()));
+        let strip = status_strip("prod".into(), &r, Some(SystemTime::now()), 0, 0, 0, 3, 0)
+            .with_signing_regressions(0, 1);
+        assert!(!strip.all_clear(), "a cold regression still forbids green");
+        assert!(
+            strip.watching(),
+            "a cold regression reads as the calm watching register"
+        );
+    }
+
     /// Judging + covered but an entry is still awaiting/uncertain ⇒ NOT all-clear; the elevated
     /// "watching" state (the model hasn't finished — quiet is not clearance). Refinement A.
     #[test]
diff --git a/engine/src/engine/mod.rs b/engine/src/engine/mod.rs
index 1fba018..96507d5 100644
--- a/engine/src/engine/mod.rs
+++ b/engine/src/engine/mod.rs
@@ -964,5 +964,10 @@ pub use run_loop::run_watch;
 // log, complementing the webhook's admit-time observation.
 pub mod signing_sweep;
 
+// The pure signing-drift classifier (ADR-0020 §3, JEF-264): classifies a fresh posture against
+// the repo's learned baseline into continuous / regression / identity-change / new-repo, so the
+// sweep can surface an audit-only signing-regression finding on drift from the baseline.
+pub mod signing_drift;
+
 #[cfg(test)]
 mod tests;
diff --git a/engine/src/engine/signing_drift.rs b/engine/src/engine/signing_drift.rs
new file mode 100644
index 0000000..5536ad4
--- /dev/null
+++ b/engine/src/engine/signing_drift.rs
@@ -0,0 +1,160 @@
+//! The pure, deterministic signing-**drift** classifier (JEF-264, ADR-0020 §3).
+//!
+//! Observation (JEF-261) reads a *snapshot* — "this image is signed by X right now". The
+//! baseline (JEF-263) remembers a repo's signed *history* — who has signed under it, and whether
+//! that history has matured (`established`). This module joins the two: it classifies a **fresh
+//! posture** against a repo's **learned baseline** into one of four resting drift classes, so the
+//! sweep can surface a signing-**regression** finding when a repo with signed history suddenly
+//! ships unsigned/invalid, or is signed by a *new* identity — the push-access-compromise signal.
+//!
+//! ## Purity
+//!
+//! [`classify`] is a total, side-effect-free function of `(baseline, posture)`: no clock, no I/O,
+//! no hidden state. The wall-clock notion of "established" is already baked into the baseline's
+//! [`SigningBaseline::established`](crate::engine::state::SigningBaseline) flag (JEF-263), so the
+//! classifier just *reads* it — the same `(baseline, posture)` always yields the same class,
+//! which is what makes the classifier exhaustively unit-testable.
+//!
+//! ## Scope (JEF-264)
+//!
+//! Classification only. Recording the regression onto the admission-decision log, rendering it,
+//! and feeding the status-strip honesty model are the sweep / view_model's job (they consume this
+//! enum). Enforcement/blocking (JEF-265) and Rekor history (JEF-266) are later stages — a drift is
+//! **audit-only**: it is surfaced, never acted on (the shadow invariant, ADR-0016).
+//!
+//! ## Rules (audit-only; never a gate)
+//!
+//! Against a repo's baseline (the entry BEFORE this observation is folded in):
+//!   * signed by a **known** identity — even a brand-new digest — ⇒ [`Continuous`] (no finding: a
+//!     normal deploy must never false-positive).
+//!   * signed by an identity **not** in the baseline ⇒ [`Regression`] with
+//!     [`IdentityChange`](RegressionKind::IdentityChange).
+//!   * now **unsigned** / **invalid** ⇒ [`Regression`] with
+//!     [`Unsigned`](RegressionKind::Unsigned) / [`Invalid`](RegressionKind::Invalid).
+//!   * a transient [`Checking`](SigningPosture::Checking) ⇒ [`Continuous`] (a registry blip is
+//!     never a regression; it resolves next pass).
+//!
+//! With NO baseline (a never-seen repo):
+//!   * a first **signed** sight ⇒ [`NewRepo`] (cold-start TOFU; the caller records the baseline) —
+//!     never a regression.
+//!   * anything else ⇒ [`Continuous`] (there is no signed history to regress against).
+//!
+//! Every [`Regression`] carries `established` (from the baseline): an established-baseline
+//! regression is a strong signal; a cold/freshly-learned one is a weak lead. The distinction is
+//! honest — the first observation of a repo is the *weakest* evidence — and drives the reduced
+//! intensity ("weak baseline — treat as a lead") the view surfaces.
+//!
+//! [`Continuous`]: SigningDrift::Continuous
+//! [`NewRepo`]: SigningDrift::NewRepo
+//! [`Regression`]: SigningDrift::Regression
+
+use crate::engine::state::SigningBaseline;
+use crate::policies::signature::SigningPosture;
+
+/// Which kind of regression a fresh posture represents against a repo's baseline (JEF-264). The
+/// identity strings are UNTRUSTED Fulcio cert text — every consumer MUST escape them at render.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum RegressionKind {
+    /// A repo with signed history now serves an **unsigned** image.
+    Unsigned,
+    /// A repo with signed history now serves an image whose signature does **not** verify.
+    Invalid,
+    /// A repo is now signed by an identity **never before seen** under it — a new signer. Carries
+    /// the new identity + issuer (UNTRUSTED) so the finding can state before→after in full.
+    IdentityChange {
+        /// The new signer identity from the Fulcio cert SAN (UNTRUSTED — escape at render).
+        new_identity: String,
+        /// The new signer's OIDC issuer, if the cert carried one (UNTRUSTED — escape at render).
+        new_issuer: Option<String>,
+    },
+}
+
+impl RegressionKind {
+    /// A stable, low-cardinality word for the regression kind — for the recorded row's status
+    /// column and metrics. NOT the identity (that is untrusted text carried separately).
+    pub fn word(&self) -> &'static str {
+        match self {
+            RegressionKind::Unsigned => "unsigned",
+            RegressionKind::Invalid => "invalid",
+            RegressionKind::IdentityChange { .. } => "identity",
+        }
+    }
+}
+
+/// The resting drift classification of a fresh [`SigningPosture`] against a repo's learned
+/// [`SigningBaseline`] (JEF-264). Total: every `(baseline, posture)` maps to exactly one variant.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum SigningDrift {
+    /// No drift: signed by a known identity (a normal redeploy, even to a new digest), or a
+    /// transient/unknown state with no signed history to regress against. Surfaces NO finding.
+    Continuous,
+    /// First observation of a never-seen repo signed — the cold-start TOFU establishing point. The
+    /// caller records the baseline; this is NOT a regression and surfaces NO finding.
+    NewRepo,
+    /// A regression against a repo that already had signed history — the finding this ticket
+    /// surfaces (audit-only, still admitted). Carries the kind + whether the baseline was
+    /// `established` (a strong signal) or cold/freshly-learned (a weak lead).
+    Regression {
+        /// What regressed (unsigned / invalid / new signer).
+        kind: RegressionKind,
+        /// Whether the regressed baseline had matured past the TOFU grace window (JEF-263). An
+        /// established regression is a strong supply-chain signal (maps to breach); a cold one is
+        /// a weak lead (maps to uncertain — "weak baseline, treat as a lead").
+        established: bool,
+    },
+}
+
+impl SigningDrift {
+    /// Whether this drift is a regression that should surface a signing-regression finding.
+    /// [`Continuous`](Self::Continuous)/[`NewRepo`](Self::NewRepo) never do.
+    pub fn is_regression(&self) -> bool {
+        matches!(self, SigningDrift::Regression { .. })
+    }
+}
+
+/// Classify a fresh signing `posture` against the repo's learned `baseline` (JEF-264). PURE +
+/// deterministic — see the module docs for the full rule table.
+///
+/// `baseline` MUST be the repo's entry as it stands BEFORE this observation is folded in, so a new
+/// signer is still visible as *not-yet-in* the identity set; `None` ⇒ a never-seen repo.
+pub fn classify(baseline: Option<&SigningBaseline>, posture: &SigningPosture) -> SigningDrift {
+    let Some(baseline) = baseline else {
+        // No prior history. A first signed sight is the TOFU cold start (the caller records the
+        // baseline); any other posture has nothing to regress against.
+        return match posture {
+            SigningPosture::Signed(_) => SigningDrift::NewRepo,
+            _ => SigningDrift::Continuous,
+        };
+    };
+
+    match posture {
+        // A transient blip is never a regression — it resolves into a resting posture next pass.
+        SigningPosture::Checking => SigningDrift::Continuous,
+        SigningPosture::Signed(signer) => {
+            if baseline.identities.contains(&signer.identity) {
+                // A known signer — a normal redeploy, even to a brand-new digest. No finding.
+                SigningDrift::Continuous
+            } else {
+                SigningDrift::Regression {
+                    kind: RegressionKind::IdentityChange {
+                        new_identity: signer.identity.clone(),
+                        new_issuer: signer.issuer.clone(),
+                    },
+                    established: baseline.established,
+                }
+            }
+        }
+        SigningPosture::NotSigned => SigningDrift::Regression {
+            kind: RegressionKind::Unsigned,
+            established: baseline.established,
+        },
+        SigningPosture::InvalidSignature => SigningDrift::Regression {
+            kind: RegressionKind::Invalid,
+            established: baseline.established,
+        },
+    }
+}
+
+#[cfg(test)]
+#[path = "signing_drift_tests.rs"]
+mod tests;
diff --git a/engine/src/engine/signing_drift_tests.rs b/engine/src/engine/signing_drift_tests.rs
new file mode 100644
index 0000000..94a275f
--- /dev/null
+++ b/engine/src/engine/signing_drift_tests.rs
@@ -0,0 +1,176 @@
+//! Pure, deterministic tests for the signing-drift classifier (JEF-264). Every case is a total
+//! function of `(baseline, posture)` — no clock, no I/O — so the whole rule table is exercised
+//! here without reaching a registry, a journal, or a sweep.
+
+use std::collections::BTreeSet;
+
+use super::*;
+use crate::engine::state::SigningBaseline;
+use crate::policies::signature::Signer;
+
+/// A baseline that has signed under `identities`, with the given `established` maturity. The
+/// timestamps are irrelevant to the classifier (it reads `established`, never the clock), so they
+/// are fixed.
+fn baseline(identities: &[&str], established: bool) -> SigningBaseline {
+    SigningBaseline {
+        identities: identities.iter().map(|s| s.to_string()).collect(),
+        issuers: BTreeSet::new(),
+        first_seen_ms: 0,
+        established,
+        last_updated_ms: 0,
+    }
+}
+
+fn signed(identity: &str) -> SigningPosture {
+    SigningPosture::Signed(Signer {
+        identity: identity.to_string(),
+        issuer: Some("https://token.actions.githubusercontent.com".to_string()),
+    })
+}
+
+const CI: &str = "https://github.com/acme/app/.github/workflows/release.yaml@refs/tags/v1";
+const ATTACKER: &str = "https://github.com/evil/app/.github/workflows/pwn.yaml@refs/heads/main";
+
+#[test]
+fn signed_to_unsigned_on_established_repo_is_a_regression() {
+    let b = baseline(&[CI], true);
+    let drift = classify(Some(&b), &SigningPosture::NotSigned);
+    assert_eq!(
+        drift,
+        SigningDrift::Regression {
+            kind: RegressionKind::Unsigned,
+            established: true,
+        }
+    );
+    assert!(drift.is_regression());
+}
+
+#[test]
+fn signed_to_invalid_on_established_repo_is_a_regression() {
+    let b = baseline(&[CI], true);
+    let drift = classify(Some(&b), &SigningPosture::InvalidSignature);
+    assert_eq!(
+        drift,
+        SigningDrift::Regression {
+            kind: RegressionKind::Invalid,
+            established: true,
+        }
+    );
+}
+
+#[test]
+fn new_signer_on_established_repo_is_a_distinct_identity_change_regression() {
+    let b = baseline(&[CI], true);
+    let drift = classify(Some(&b), &signed(ATTACKER));
+    assert_eq!(
+        drift,
+        SigningDrift::Regression {
+            kind: RegressionKind::IdentityChange {
+                new_identity: ATTACKER.to_string(),
+                new_issuer: Some("https://token.actions.githubusercontent.com".to_string()),
+            },
+            established: true,
+        },
+        "a new signer is a DISTINCT regression from unsigned/invalid, carrying the new identity"
+    );
+}
+
+#[test]
+fn known_identity_new_digest_is_continuous_no_false_positive() {
+    // The normal-redeploy rule: a new digest under a known repo, signed by a KNOWN identity, must
+    // never surface a finding.
+    let b = baseline(&[CI], true);
+    let drift = classify(Some(&b), &signed(CI));
+    assert_eq!(drift, SigningDrift::Continuous);
+    assert!(!drift.is_regression());
+}
+
+#[test]
+fn one_of_several_known_identities_is_continuous() {
+    // A repo with multiple learned signers stays continuous when signed by any one of them.
+    let b = baseline(&[CI, ATTACKER], true);
+    assert_eq!(classify(Some(&b), &signed(CI)), SigningDrift::Continuous);
+    assert_eq!(
+        classify(Some(&b), &signed(ATTACKER)),
+        SigningDrift::Continuous
+    );
+}
+
+#[test]
+fn first_sight_of_a_never_seen_signed_repo_is_new_repo_not_a_regression() {
+    // Cold start is TOFU: the first signed observation establishes trust, it is never drift.
+    let drift = classify(None, &signed(CI));
+    assert_eq!(drift, SigningDrift::NewRepo);
+    assert!(!drift.is_regression());
+}
+
+#[test]
+fn never_seen_unsigned_repo_is_continuous_nothing_to_regress_against() {
+    // An unsigned image under a repo we have never seen signed has no history to regress against.
+    assert_eq!(
+        classify(None, &SigningPosture::NotSigned),
+        SigningDrift::Continuous
+    );
+    assert_eq!(
+        classify(None, &SigningPosture::InvalidSignature),
+        SigningDrift::Continuous
+    );
+}
+
+#[test]
+fn regression_against_a_cold_baseline_is_reduced_not_established() {
+    // The reduced-intensity case: a regression against a freshly-learned (cold) baseline is still
+    // a regression, but flagged `established: false` — the weak-baseline "treat as a lead" signal.
+    let b = baseline(&[CI], false);
+    assert_eq!(
+        classify(Some(&b), &SigningPosture::NotSigned),
+        SigningDrift::Regression {
+            kind: RegressionKind::Unsigned,
+            established: false,
+        }
+    );
+    assert_eq!(
+        classify(Some(&b), &signed(ATTACKER)),
+        SigningDrift::Regression {
+            kind: RegressionKind::IdentityChange {
+                new_identity: ATTACKER.to_string(),
+                new_issuer: Some("https://token.actions.githubusercontent.com".to_string()),
+            },
+            established: false,
+        }
+    );
+}
+
+#[test]
+fn checking_is_never_a_regression_even_against_an_established_baseline() {
+    // A transient registry/log blip must not be read as drift — it resolves next pass.
+    let b = baseline(&[CI], true);
+    assert_eq!(
+        classify(Some(&b), &SigningPosture::Checking),
+        SigningDrift::Continuous
+    );
+}
+
+#[test]
+fn classify_is_deterministic() {
+    // Same inputs, same class — every time (the property that makes it safe to run per-pass).
+    let b = baseline(&[CI], true);
+    let first = classify(Some(&b), &SigningPosture::NotSigned);
+    for _ in 0..8 {
+        assert_eq!(classify(Some(&b), &SigningPosture::NotSigned), first);
+    }
+}
+
+#[test]
+fn regression_kind_words_are_stable_and_distinct() {
+    assert_eq!(RegressionKind::Unsigned.word(), "unsigned");
+    assert_eq!(RegressionKind::Invalid.word(), "invalid");
+    assert_eq!(
+        RegressionKind::IdentityChange {
+            new_identity: ATTACKER.to_string(),
+            new_issuer: None,
+        }
+        .word(),
+        "identity"
+    );
+}
diff --git a/engine/src/engine/signing_sweep.rs b/engine/src/engine/signing_sweep.rs
index d29e01c..5df759c 100644
--- a/engine/src/engine/signing_sweep.rs
+++ b/engine/src/engine/signing_sweep.rs
@@ -8,12 +8,20 @@
 //! [`PolicyDecisionLog`] the webhook writes — so the operator sees one signing inventory
 //! across both admitted and pre-existing workloads.
 //!
-//! Scope (Stage 1): observation + recording only. The posture is recorded as the
-//! low-cardinality status word on an `image-signature` row (the field is free-text, escaped
-//! at render); the signer identity rides the row's reason, also escaped downstream. The
-//! per-repo baseline (JEF-263), drift findings (JEF-264), and the Admission render (JEF-262)
-//! consume this; they are NOT built here. State is the in-memory [`SigningObserver`] cache +
-//! the bounded [`PolicyDecisionLog`] ring — no durable schema.
+//! The posture is recorded as the low-cardinality status word on an `image-signature` row (the
+//! field is free-text, escaped at render); the signer identity rides the row's reason, also escaped
+//! downstream. State is the in-memory [`SigningObserver`] cache + the bounded [`PolicyDecisionLog`]
+//! ring — no durable schema.
+//!
+//! ## Drift findings (JEF-264, ADR-0020 §3)
+//!
+//! After recording each posture, the sweep classifies it against the repo's CURRENT baseline
+//! (JEF-263) via the pure [`signing_drift`](super::signing_drift) classifier and, on a regression
+//! against prior signed history (signed→unsigned/invalid, or a new signer), records a
+//! signing-**regression** finding onto the SAME admission-decision log — keyed
+//! `SigningRegression/<repo>`, decision `allow`. This is **audit-only — still admitted** (the
+//! shadow invariant, ADR-0016): the finding is surfaced, never acted on. Enforcement (JEF-265) and
+//! Rekor history (JEF-266) are later stages and are NOT built here.
 
 use std::sync::Arc;
 use std::time::SystemTime;
@@ -23,8 +31,15 @@ use k8s_openapi::api::core::v1::Pod;
 use super::journal::DecisionJournal;
 use super::observe::Snapshot;
 use super::policy_log::{PolicyDecisionLog, PolicyDecisionRecord};
-use super::state::SigningBaselineStore;
-use crate::policies::signature::{PostureMap, SigningObserver, SigningPosture};
+use super::signing_drift::{RegressionKind, SigningDrift, classify};
+use super::state::{SigningBaseline, SigningBaselineStore};
+use crate::policies::signature::{PostureMap, SigningObserver, SigningPosture, repo_key};
+
+/// The subject prefix a signing-**regression** finding is keyed under (`SigningRegression/<repo>`),
+/// so the row folds one-per-repo and is partitioned OUT of the webhook decision rows (like the
+/// `Image/<ref>` observation rows) by the Admission view_model — a regression is a signing finding,
+/// not a webhook admission decision, and must not inflate the admitted/audited/denied tallies.
+pub const REGRESSION_SUBJECT_PREFIX: &str = "SigningRegression/";
 
 /// Collect every distinct container image a running Pod references — regular, init, and
 /// ephemeral containers — across the snapshot. Deduping is left to the observer's sweep (it
@@ -99,6 +114,82 @@ fn record_postures(log: &PolicyDecisionLog, map: &PostureMap) {
     }
 }
 
+/// Encode a signing-regression finding as an admission-decision-log row (JEF-264, ADR-0020 §3).
+///
+/// Routing: the regression rides the SAME admission-decision log as the posture observation rows
+/// (the admission-finding path), NOT the reachability breach/LLM pipeline. It is keyed
+/// `SigningRegression/<repo>` so it folds one-per-repo and the Admission view_model partitions it
+/// out of the webhook decision tallies. The decision word stays `allow`: a drift is **audit-only —
+/// still admitted** (the shadow invariant, ADR-0016); nothing here ever denies.
+///
+/// The row is self-describing so the render needs no baseline handle:
+///   * `signature` carries the low-cardinality drift token `regression-<kind>-<strength>` (kind ∈
+///     unsigned/invalid/identity, strength ∈ established/cold) — the render parses it back.
+///   * `reason` carries the before→after prose: the fresh posture clause, then `| before: <ids>`
+///     (the baseline signers, comma-joined). Both the before signers and any after signer are
+///     UNTRUSTED Fulcio cert text — carried verbatim here and escaped wherever rendered.
+fn regression_record(
+    repo: &str,
+    image: &str,
+    kind: &RegressionKind,
+    established: bool,
+    baseline: Option<&SigningBaseline>,
+) -> PolicyDecisionRecord {
+    let strength = if established { "established" } else { "cold" };
+    let signature = format!("regression-{}-{}", kind.word(), strength);
+    let after_clause = match kind {
+        RegressionKind::Unsigned => "now not signed (was signed)".to_string(),
+        RegressionKind::Invalid => "now invalid signature (was signed)".to_string(),
+        // Reuse the observation-row signer prose (`signed by <id>[ via <issuer>]`) so the view_model
+        // parses the "after" identity with the exact same helper it already uses for observed rows.
+        RegressionKind::IdentityChange {
+            new_identity,
+            new_issuer,
+        } => match new_issuer.as_deref() {
+            Some(issuer) => format!("signed by {new_identity} via {issuer}"),
+            None => format!("signed by {new_identity}"),
+        },
+    };
+    // The baseline signers (the "before"), comma-joined. Fulcio SANs (workflow URIs / emails) don't
+    // contain ", ", so the join round-trips; the render escapes each identity regardless.
+    let before = baseline
+        .map(|b| b.identities.iter().cloned().collect::<Vec<_>>().join(", "))
+        .filter(|s| !s.is_empty())
+        .unwrap_or_else(|| "unknown".to_string());
+    let reason = format!("{after_clause} | before: {before}");
+    PolicyDecisionRecord::now(
+        "signing-regression",
+        "allow",
+        format!("{REGRESSION_SUBJECT_PREFIX}{repo}"),
+        image,
+        signature,
+        "",
+        "",
+        reason,
+    )
+}
+
+/// Classify each observed posture against the repo's CURRENT baseline (JEF-264) and record a
+/// signing-regression finding for any drift against prior signed history. Runs BEFORE
+/// [`learn_baselines`] so a new signer is still visible as not-yet-in the identity set (learning
+/// would fold it in and hide the change). Pure classification + append-only recording — never a
+/// gate; the store is read, not mutated.
+fn detect_regressions(store: &SigningBaselineStore, log: &PolicyDecisionLog, map: &PostureMap) {
+    for (image, posture) in map.entries() {
+        let repo = repo_key(image);
+        let baseline = store.get(&repo);
+        if let SigningDrift::Regression { kind, established } = classify(baseline, posture) {
+            log.record(regression_record(
+                &repo,
+                image,
+                &kind,
+                established,
+                baseline,
+            ));
+        }
+    }
+}
+
 /// Fold this pass's observed postures into the durable per-repo signing baseline (JEF-263),
 /// then compact the whole store back to the journal so a live repo's baseline stays inside
 /// the rotation window (never aged out). Only `Signed` postures learn a baseline; the store
@@ -146,6 +237,9 @@ pub async fn sweep(
     let map = observer.sweep(images).await;
     record_postures(log, &map);
     if let Some(store) = baseline {
+        // Classify against the baseline as it stands BEFORE this pass's learning, then learn — so
+        // a regression / new signer is detected before the observation folds into the baseline.
+        detect_regressions(store, log, &map);
         learn_baselines(store, journal, &map);
     }
 }
@@ -403,4 +497,145 @@ mod tests {
         .await;
         assert!(baseline.is_empty(), "an unsigned image learns no baseline");
     }
+
+    // ---- JEF-264 signing-regression detection over the sweep -------------------------------
+
+    const DAY_MS: u64 = 24 * 60 * 60 * 1000;
+    const CI: &str = "https://github.com/org/app/.github/workflows/release.yaml@refs/tags/v1";
+    const ATTACKER: &str = "https://github.com/evil/app/.github/workflows/pwn.yaml@refs/heads/main";
+
+    /// A store carrying an ESTABLISHED signed baseline for `ghcr.io/org/app` (signer `CI`). Seeded
+    /// by observing at t=0 (first_seen), then again well past the 24h grace window so the baseline
+    /// matures — exactly the JEF-263 establishment path, without a real clock.
+    fn established_store() -> SigningBaselineStore {
+        let mut store = SigningBaselineStore::new();
+        let signed = SigningPosture::Signed(Signer {
+            identity: CI.to_string(),
+            issuer: Some("https://token.actions.githubusercontent.com".to_string()),
+        });
+        store.observe("ghcr.io/org/app@sha256:seed", &signed, 0);
+        store.observe("ghcr.io/org/app@sha256:seed", &signed, 3 * DAY_MS);
+        assert!(
+            store.get("ghcr.io/org/app").unwrap().established,
+            "the seeded baseline is established"
+        );
+        store
+    }
+
+    /// The regression row recorded for `repo`, if any.
+    fn regression_row(log: &PolicyDecisionLog, repo: &str) -> Option<PolicyDecisionRecord> {
+        log.snapshot()
+            .into_iter()
+            .find(|r| r.subject == format!("{REGRESSION_SUBJECT_PREFIX}{repo}"))
+    }
+
+    async fn run_sweep(
+        obs: &SigningObserver,
+        image: &str,
+        store: &mut SigningBaselineStore,
+    ) -> Arc<PolicyDecisionLog> {
+        let snapshot = Snapshot {
+            pods: vec![pod(&[image], &[])],
+            ..Default::default()
+        };
+        let log = Arc::new(PolicyDecisionLog::new());
+        sweep(
+            Some(obs),
+            &snapshot,
+            &log,
+            Some(store),
+            &DecisionJournal::disabled(),
+        )
+        .await;
+        log
+    }
+
+    #[tokio::test]
+    async fn signed_to_unsigned_on_established_repo_records_a_regression() {
+        let (obs, _c) = observer(vec![]); // unknown image ⇒ NotSigned
+        let mut store = established_store();
+        let log = run_sweep(&obs, "ghcr.io/org/app:2", &mut store).await;
+        let row = regression_row(&log, "ghcr.io/org/app").expect("a regression is recorded");
+        assert_eq!(row.signature, "regression-unsigned-established");
+        assert_eq!(
+            row.decision, "allow",
+            "audit-only — the image is still admitted"
+        );
+        assert!(row.reason.contains("now not signed"));
+        assert!(row.reason.contains(&format!("before: {CI}")));
+    }
+
+    #[tokio::test]
+    async fn signed_to_invalid_on_established_repo_records_a_regression() {
+        let (obs, _c) = observer(vec![(
+            "ghcr.io/org/app:2",
+            SigningPosture::InvalidSignature,
+        )]);
+        let mut store = established_store();
+        let log = run_sweep(&obs, "ghcr.io/org/app:2", &mut store).await;
+        let row = regression_row(&log, "ghcr.io/org/app").expect("a regression is recorded");
+        assert_eq!(row.signature, "regression-invalid-established");
+        assert_eq!(row.decision, "allow");
+    }
+
+    #[tokio::test]
+    async fn new_signer_on_established_repo_records_an_identity_change() {
+        let (obs, _c) = observer(vec![("ghcr.io/org/app:2", signed(ATTACKER))]);
+        let mut store = established_store();
+        let log = run_sweep(&obs, "ghcr.io/org/app:2", &mut store).await;
+        let row = regression_row(&log, "ghcr.io/org/app").expect("a regression is recorded");
+        assert_eq!(row.signature, "regression-identity-established");
+        assert!(row.reason.contains(&format!("signed by {ATTACKER}")));
+        assert!(
+            row.reason.contains(&format!("before: {CI}")),
+            "the before signer is stated in full"
+        );
+    }
+
+    #[tokio::test]
+    async fn normal_redeploy_by_a_known_signer_records_no_regression() {
+        // A new digest under a known repo, signed by the KNOWN identity ⇒ no false positive.
+        let (obs, _c) = observer(vec![("ghcr.io/org/app:2", signed(CI))]);
+        let mut store = established_store();
+        let log = run_sweep(&obs, "ghcr.io/org/app:2", &mut store).await;
+        assert!(
+            regression_row(&log, "ghcr.io/org/app").is_none(),
+            "a known signer to a new digest is continuous — no finding"
+        );
+    }
+
+    #[tokio::test]
+    async fn cold_start_first_signed_sight_records_no_regression() {
+        // First observation of a never-seen repo is TOFU cold start — never a regression.
+        let (obs, _c) = observer(vec![("ghcr.io/new/app:1", signed(CI))]);
+        let mut store = SigningBaselineStore::new();
+        let log = run_sweep(&obs, "ghcr.io/new/app:1", &mut store).await;
+        assert!(
+            regression_row(&log, "ghcr.io/new/app").is_none(),
+            "cold start is TOFU, not drift"
+        );
+        assert!(
+            store.get("ghcr.io/new/app").is_some(),
+            "the baseline is still recorded on first sight"
+        );
+    }
+
+    #[tokio::test]
+    async fn regression_against_a_cold_baseline_is_reduced() {
+        // A freshly-learned (cold) baseline that then regresses is flagged reduced-intensity.
+        let mut store = SigningBaselineStore::new();
+        store.observe(
+            "ghcr.io/org/app@sha256:seed",
+            &signed(CI),
+            0, // first sight ⇒ cold (not established)
+        );
+        assert!(!store.get("ghcr.io/org/app").unwrap().established);
+        let (obs, _c) = observer(vec![]); // ⇒ NotSigned
+        let log = run_sweep(&obs, "ghcr.io/org/app:2", &mut store).await;
+        let row = regression_row(&log, "ghcr.io/org/app").expect("a regression is recorded");
+        assert_eq!(
+            row.signature, "regression-unsigned-cold",
+            "a cold-baseline regression is flagged weak (reduced intensity)"
+        );
+    }
 }