blockers 2

docs/airgap/time-anchor-schema.json

@@ -0,0 +1,43 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "StellaOps Time Anchor",
+  "type": "object",
+  "required": ["anchorTime", "source", "format", "tokenDigest"],
+  "properties": {
+    "anchorTime": {
+      "description": "UTC timestamp asserted by the time token (RFC3339/ISO-8601)",
+      "type": "string",
+      "format": "date-time"
+    },
+    "source": {
+      "description": "Logical source of the time token (e.g., roughtime", 
+      "type": "string",
+      "enum": ["roughtime", "rfc3161"]
+    },
+    "format": {
+      "description": "Payload format identifier (e.g., draft-roughtime-v1, rfc3161)",
+      "type": "string"
+    },
+    "tokenDigest": {
+      "description": "SHA-256 of the raw time token bytes, hex-encoded",
+      "type": "string",
+      "pattern": "^[0-9a-fA-F]{64}$"
+    },
+    "signatureFingerprint": {
+      "description": "Fingerprint of the signer key (hex); optional until trust roots finalized",
+      "type": "string",
+      "pattern": "^[0-9a-fA-F]{16,128}$"
+    },
+    "verification": {
+      "description": "Result of local verification (if performed)",
+      "type": "object",
+      "properties": {
+        "status": {"type": "string", "enum": ["unknown", "passed", "failed"]},
+        "reason": {"type": "string"}
+      },
+      "required": ["status"],
+      "additionalProperties": false
+    }
+  },
+  "additionalProperties": false
+}

docs/airgap/time-anchor-schema.md

@@ -0,0 +1,15 @@
+# Time Anchor JSON schema (prep for AIRGAP-TIME-57-001)
+
+Artifact: `docs/airgap/time-anchor-schema.json`
+
+Highlights:
+- Required: `anchorTime` (RFC3339), `source` (`roughtime`|`rfc3161`), `format` string, `tokenDigest` (sha256 hex of token bytes).
+- Optional: `signatureFingerprint` (hex), `verification.status` (`unknown|passed|failed`) + `reason`.
+- No additional properties to keep payload deterministic.
+
+Intended use:
+- AirGap Time Guild can embed this in sealed-mode configs and validation endpoints.
+- Mirror/OCI timelines can cite the digest + source without needing full token parsing.
+
+Notes:
+- Trust roots and final signature fingerprint rules stay TBD; placeholders remain optional to avoid blocking until roots are issued.

docs/airgap/time-anchor-trust-roots.json

@@ -0,0 +1,20 @@
+{
+  "version": 1,
+  "roughtime": [
+    {
+      "name": "stellaops-test-roughtime",
+      "publicKeyBase64": "dGVzdC1yb3VnaHRpbWUtcHViLWtleQ==",
+      "validFrom": "2025-01-01T00:00:00Z",
+      "validTo": "2026-01-01T00:00:00Z"
+    }
+  ],
+  "rfc3161": [
+    {
+      "name": "stellaops-test-tsa",
+      "certificatePem": "-----BEGIN CERTIFICATE-----\nMIIBszCCAVmgAwIBAgIUYPXPLACEHOLDERKEYm7ri5bzsYqvSwwDQYJKoZIhvcNAQELBQAwETEPMA0GA1UEAwwGU3RlbGxhMB4XDTI1MDEwMTAwMDAwMFoXDTI2MDEwMTAwMDAwMFowETEPMA0GA1UEAwwGU3RlbGxhMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEPLACEHOLDERuQjVekA7gQtaQ6UiI4bYbw2bG8xwDthQqLehCDXXWix9TAAEbnII1xF4Zk12Y0wUjiJB82H4x6HTDY0Hes74AUFyi0A39p0Y0ffSZlnzCwzmxrSYzYHbpbb8WZKGa+jUzBRMB0GA1UdDgQWBBSPLACEHOLDERRoKdqaLKv8Bf+FfoUzAfBgNVHSMEGDAWgBSPLACEHOLDERRoKdqaLKv8Bf+FfoUzAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQCPLACEHOLDER\n-----END CERTIFICATE-----",
+      "validFrom": "2025-01-01T00:00:00Z",
+      "validTo": "2026-01-01T00:00:00Z",
+      "fingerprintSha256": "0000000000000000000000000000000000000000000000000000000000000000"
+    }
+  ]
+}

docs/airgap/time-anchor-trust-roots.md

@@ -0,0 +1,43 @@
+# Time Anchor Trust Roots (draft) — for AIRGAP-TIME-57-001
+
+Provides a minimal, deterministic format for distributing trust roots used to validate time tokens (Roughtime and RFC3161) in sealed/offline environments.
+
+## Artefacts
+- JSON schema: `docs/airgap/time-anchor-schema.json`
+- Trust roots bundle (draft): `docs/airgap/time-anchor-trust-roots.json`
+
+## Bundle format (`time-anchor-trust-roots.json`)
+```json
+{
+  "version": 1,
+  "roughtime": [
+    {
+      "name": "stellaops-test-roughtime",
+      "publicKeyBase64": "BASE64_ED25519_PUBLIC_KEY",
+      "validFrom": "2025-01-01T00:00:00Z",
+      "validTo": "2026-01-01T00:00:00Z"
+    }
+  ],
+  "rfc3161": [
+    {
+      "name": "stellaops-test-tsa",
+      "certificatePem": "-----BEGIN CERTIFICATE-----...-----END CERTIFICATE-----",
+      "validFrom": "2025-01-01T00:00:00Z",
+      "validTo": "2026-01-01T00:00:00Z",
+      "fingerprintSha256": "HEX_SHA256"
+    }
+  ]
+}
+```
+- All times are UTC ISO-8601.
+- Fields are deterministic; no optional properties other than multiple entries per list.
+- Consumers must reject expired roots and enforce matching token format (Roughtime vs RFC3161).
+
+## Usage guidance
+- Ship the bundle with the air-gapped deployment alongside the time-anchor schema.
+- Configure AirGap Time service to load roots from a sealed path; do not fetch over network.
+- Rotate by bumping `version`, adding new entries, and setting `validFrom/validTo`; keep prior roots until all deployments roll.
+
+## Next steps
+- Replace placeholder values with production Roughtime public keys and TSA certificates once issued by Security.
+- Add regression tests in `StellaOps.AirGap.Time.Tests` that load this bundle and validate sample tokens once real roots are present.