From fe4cf02d0b458e25a0a9fed206d44081b12fd1b8 Mon Sep 17 00:00:00 2001 From: Max Ghenis Date: Thu, 22 Oct 2026 07:40:11 -0400 Subject: [PATCH] =?UTF-8?q?Register=20the=20team=20UK=20gate=20signing=20k?= =?UTF-8?q?ey=20(hold=20for=20Mar=C3=ADa's=20agreement)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adds a second active key, uk-gate-team-2026 (dd31e325...), held in the shared agent store, beside the key that signed every cut on record, which stays active. One key per builder: nobody shares a secret, and a cut is signed, certified and published by one key holder. Co-Authored-By: Claude Opus 5.5 --- changelog.d/uk-gate-team-signing-key.added.md | 1 + .../src/microcosm/data/gate_signing_keys.py | 19 +++++++++++++++++++ 2 files changed, 20 insertions(+) create mode 100644 changelog.d/uk-gate-team-signing-key.added.md diff --git a/changelog.d/uk-gate-team-signing-key.added.md b/changelog.d/uk-gate-team-signing-key.added.md new file mode 100644 index 0000000000..af1ca3f668 --- /dev/null +++ b/changelog.d/uk-gate-team-signing-key.added.md @@ -0,0 +1 @@ +Register a second UK gate signing key, held in the team's shared agent store, so cuts can be built and signed without the first builder's key. The key that signed every earlier cut stays active. diff --git a/packages/microcosm-data/src/microcosm/data/gate_signing_keys.py b/packages/microcosm-data/src/microcosm/data/gate_signing_keys.py index a875c08334..9aa12864b0 100644 --- a/packages/microcosm-data/src/microcosm/data/gate_signing_keys.py +++ b/packages/microcosm-data/src/microcosm/data/gate_signing_keys.py @@ -113,6 +113,25 @@ class GateSigningKey: ), ) ), + "dd31e32563854596d983a71a6519c6b7860a7c1f63ffb80dbe679d5d34c4de8c": ( + GateSigningKey( + key_sha256=( + "dd31e32563854596d983a71a6519c6b7860a7c1f63ffb80dbe679d5d34c4de8c" + ), + label="uk-gate-team-2026", + status="active", + custodian="the PolicyEngine team (Max Ghenis's shared agent store)", + held_in=( + "agent-secret service microcosm/uk-gate-signing-key-team, " + "account maxghenis, on Max's build Mac" + ), + registered="2026-10-22", + evidence=( + "Generated 2026-10-22 for team-built cuts (microcosm#1348); " + "never printed or committed." + ), + ) + ), } )