save checkpoint

2026-02-11 01:32:14 +02:00
parent 5593212b41
commit cf5b72974f
2316 changed files with 68799 additions and 3808 deletions
--- a/docs/features/checked/signer/ci-cd-keyless-signing-workflow-templates.md
+++ b/docs/features/checked/signer/ci-cd-keyless-signing-workflow-templates.md
@@ -43,3 +43,81 @@ Backend signing services enabling CI/CD keyless signing integration. SigstoreSig
  - SigstoreSigningService test coverage is inherited from keyless signing tests; no dedicated SigstoreSigningService unit tests exist.
  - Feature description updated to reflect actual implementation scope.
 - **Verdict**: PASS (backend services complete; workflow templates are a documentation/DevOps artifact, not application code)
+
+## Recheck (Run-002)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2a live API replay for backend workflow surfaces.
+- **Tests**: PASS (496/496 signer tests pass).
+- **Tier 2 Evidence**: `docs/qa/feature-checks/runs/signer/ci-cd-keyless-signing-workflow-templates/run-002/tier2-api-check.json`
+- **Outcome**: Backend sign/verify API behavior consumed by CI pipelines is confirmed; YAML template caveat remains unchanged.
+
+## Recheck (Run-003)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2 follow-up deterministic replay.
+- **Tests**: PASS (`src/Signer/StellaOps.Signer/StellaOps.Signer.Tests`: 496/496).
+- **Tier 2 Evidence**: `docs/qa/feature-checks/runs/signer/ci-cd-keyless-signing-workflow-templates/run-003/tier2-api-check.json`
+- **Outcome**: Backend API behavior used by CI keyless signing workflows remains stable.
+
+
+## Recheck (Run-004)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2 replay + full Signer suite replay.
+- **Tests**: PASS (`src/Signer/StellaOps.Signer/StellaOps.Signer.Tests`: 496/496).
+- **Tier 2 Evidence**: `docs/qa/feature-checks/runs/signer/ci-cd-keyless-signing-workflow-templates/run-004/tier2-api-check.json`
+- **Outcome**: Backend sign/verify behavior used by CI workflows remains stable.
+
+## Recheck (Run-005)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2 replay validated via Signer suite and endpoint coverage.
+- **Tests**: PASS (src/Signer/StellaOps.Signer/StellaOps.Signer.Tests: 496/496).
+- **Tier 2 Evidence**: docs/qa/feature-checks/runs/signer/ci-cd-keyless-signing-workflow-templates/run-005/tier2-api-check.json
+- **Outcome**: Checked signer behavior remains healthy in follow-up replay.
+
+## Recheck (Run-006)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2 replay (API + integration) with deterministic signer suite verification.
+- **Tests**: PASS (src/Signer/StellaOps.Signer/StellaOps.Signer.Tests: 496/496).
+- **Tier 2 Evidence**: docs/qa/feature-checks/runs/signer/ci-cd-keyless-signing-workflow-templates/run-006/tier2-api-check.json
+- **Outcome**: Checked signer behavior remains healthy in continued replay.
+
+## Recheck (Run-007)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2 replay (API + integration) with deterministic signer suite verification.
+- **Tests**: PASS (src/Signer/StellaOps.Signer/StellaOps.Signer.Tests: 496/496).
+- **Tier 2 Evidence**: docs/qa/feature-checks/runs/signer/ci-cd-keyless-signing-workflow-templates/run-007/tier2-api-check.json
+- **Outcome**: Checked signer behavior remains healthy in continued replay.
+
+## Recheck (Run-008)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2a API replay + deterministic integration suite replay.
+- **Tests**: PASS (src/Signer/StellaOps.Signer/StellaOps.Signer.Tests: 496/496).
+- **Tier 2 Evidence**: docs/qa/feature-checks/runs/signer/ci-cd-keyless-signing-workflow-templates/run-008/tier2-api-check.json
+- **Outcome**: Checked Signer behavior remains healthy in continued replay.
+
+
+## Recheck (Run-009)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2a API replay + deterministic integration suite replay.
+- **Tests**: PASS (src/Signer/StellaOps.Signer/StellaOps.Signer.Tests: 496/496).
+- **Tier 2 Evidence**: docs/qa/feature-checks/runs/signer/ci-cd-keyless-signing-workflow-templates/run-009/tier2-api-check.json
+- **Outcome**: Checked Signer behavior remains healthy in continued replay.
+
+
+## Recheck (Run-010)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2d deterministic integration replay.
+- **Tests**: PASS (src/Signer/StellaOps.Signer/StellaOps.Signer.Tests: 496/496).
+- **Tier 2 Evidence**: docs/qa/feature-checks/runs/signer/ci-cd-keyless-signing-workflow-templates/run-010/tier2-integration-check.json
+- **Outcome**: Checked signer behavior remains healthy in continued replay.
+## Recheck (Run-011)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2d deterministic integration replay.
+- **Tests**: PASS (src/Signer/StellaOps.Signer/StellaOps.Signer.Tests: 496/496).
+- **Tier 2 Evidence**: docs/qa/feature-checks/runs/signer/ci-cd-keyless-signing-workflow-templates/run-011/tier2-integration-check.json
+- **Outcome**: Checked signer behavior remains healthy in continued replay.
+## Recheck (Run-012)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2 replay + deterministic integration suite replay.
+- **Tests**: PASS (src/Signer/StellaOps.Signer/StellaOps.Signer.Tests: 496/496).
+- **Tier 2 Evidence**: docs/qa/feature-checks/runs/signer/ci-cd-keyless-signing-workflow-templates/run-012/tier2-api-check.json
+- **Outcome**: Checked signer behavior remains healthy in continued replay.
--- a/docs/features/checked/signer/dual-control-signing-ceremonies.md
+++ b/docs/features/checked/signer/dual-control-signing-ceremonies.md
@@ -43,3 +43,89 @@ Orchestrator for M-of-N threshold signing ceremonies requiring multiple authoriz
  - CeremonyEndpoints: Full REST API at /api/v1/ceremonies. All endpoints require ceremony:read authorization. CRUD + approve + execute + cancel operations verified with correct HTTP status codes.
  - Tests: CeremonyOrchestratorIntegrationTests (end-to-end flow with in-memory repository), CeremonyStateMachineTests (all state transitions, guards, edge cases).
 - **Verdict**: PASS
+
+## Recheck (Run-002)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2a live API replay + Tier 1 regression suite replay.
+- **Tests**: PASS (496/496 signer tests pass).
+- **Tier 2 Evidence**: `docs/qa/feature-checks/runs/signer/dual-control-signing-ceremonies/run-002/tier2-api-check.json`
+- **Regression Coverage Added**: `Ceremonies_CreateAndGet_WorksForAuthenticatedCaller`.
+- **Outcome**: Ceremony endpoints are now fully wired at runtime (create/get verified via public API).
+
+## Recheck (Run-003)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2 follow-up deterministic replay.
+- **Tests**: PASS (`src/Signer/StellaOps.Signer/StellaOps.Signer.Tests`: 496/496).
+- **Tier 2 Evidence**: `docs/qa/feature-checks/runs/signer/dual-control-signing-ceremonies/run-003/tier2-api-check.json`
+- **Outcome**: Ceremony API lifecycle behavior remains stable with registered orchestrator services.
+
+
+## Recheck (Run-004)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2 replay + full Signer suite replay.
+- **Tests**: PASS (`src/Signer/StellaOps.Signer/StellaOps.Signer.Tests`: 496/496).
+- **Tier 2 Evidence**: `docs/qa/feature-checks/runs/signer/dual-control-signing-ceremonies/run-004/tier2-api-check.json`
+- **Outcome**: Ceremony create/get API behavior remains stable.
+
+## Recheck (Run-005)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2 replay validated via Signer suite and endpoint coverage.
+- **Tests**: PASS (src/Signer/StellaOps.Signer/StellaOps.Signer.Tests: 496/496).
+- **Tier 2 Evidence**: docs/qa/feature-checks/runs/signer/dual-control-signing-ceremonies/run-005/tier2-api-check.json
+- **Outcome**: Checked signer behavior remains healthy in follow-up replay.
+
+## Recheck (Run-006)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2 replay (API + integration) with deterministic signer suite verification.
+- **Tests**: PASS (src/Signer/StellaOps.Signer/StellaOps.Signer.Tests: 496/496).
+- **Tier 2 Evidence**: docs/qa/feature-checks/runs/signer/dual-control-signing-ceremonies/run-006/tier2-api-check.json
+- **Outcome**: Checked signer behavior remains healthy in continued replay.
+
+## Recheck (Run-007)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2 replay (API + integration) with deterministic signer suite verification.
+- **Tests**: PASS (src/Signer/StellaOps.Signer/StellaOps.Signer.Tests: 496/496).
+- **Tier 2 Evidence**: docs/qa/feature-checks/runs/signer/dual-control-signing-ceremonies/run-007/tier2-api-check.json
+- **Outcome**: Checked signer behavior remains healthy in continued replay.
+
+## Recheck (Run-008)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2a API replay + deterministic integration suite replay.
+- **Tests**: PASS (src/Signer/StellaOps.Signer/StellaOps.Signer.Tests: 496/496).
+- **Tier 2 Evidence**: docs/qa/feature-checks/runs/signer/dual-control-signing-ceremonies/run-008/tier2-api-check.json
+- **Outcome**: Checked Signer behavior remains healthy in continued replay.
+
+
+## Recheck (Run-009)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2a API replay + deterministic integration suite replay.
+- **Tests**: PASS (src/Signer/StellaOps.Signer/StellaOps.Signer.Tests: 496/496).
+- **Tier 2 Evidence**: docs/qa/feature-checks/runs/signer/dual-control-signing-ceremonies/run-009/tier2-api-check.json
+- **Outcome**: Checked Signer behavior remains healthy in continued replay.
+
+
+## Recheck (Run-010)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2d deterministic integration replay.
+- **Tests**: PASS (src/Signer/StellaOps.Signer/StellaOps.Signer.Tests: 496/496).
+- **Tier 2 Evidence**: docs/qa/feature-checks/runs/signer/dual-control-signing-ceremonies/run-010/tier2-integration-check.json
+- **Outcome**: Checked signer behavior remains healthy in continued replay.
+## Recheck (Run-011)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2d deterministic integration replay.
+- **Tests**: PASS (src/Signer/StellaOps.Signer/StellaOps.Signer.Tests: 496/496).
+- **Tier 2 Evidence**: docs/qa/feature-checks/runs/signer/dual-control-signing-ceremonies/run-011/tier2-integration-check.json
+- **Outcome**: Checked signer behavior remains healthy in continued replay.
+## Recheck (Run-012)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2 replay + deterministic integration suite replay.
+- **Tests**: PASS (src/Signer/StellaOps.Signer/StellaOps.Signer.Tests: 496/496).
+- **Tier 2 Evidence**: docs/qa/feature-checks/runs/signer/dual-control-signing-ceremonies/run-012/tier2-api-check.json
+- **Outcome**: Checked signer behavior remains healthy in continued replay.
+
+## Recheck (Run-013)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2a live API replay on running Signer service (`http://127.0.0.1:10051`) + deterministic suite replay.
+- **Tests**: PASS (src/Signer/StellaOps.Signer/StellaOps.Signer.Tests: 497/497).
+- **Tier 2 Evidence**: docs/qa/feature-checks/runs/signer/dual-control-signing-ceremonies/run-013/tier2-api-check.json
+- **Outcome**: Invalid `operationType` now returns `400 Bad Request` (client validation) instead of `500 Internal Server Error`; live create/get/approve/execute and negative-path semantics are stable.
--- a/docs/features/checked/signer/fulcio-sigstore-keyless-signing-client.md
+++ b/docs/features/checked/signer/fulcio-sigstore-keyless-signing-client.md
@@ -48,3 +48,82 @@ Fulcio-based keyless signing using OIDC tokens from CI runners, ephemeral key pa
  - SigstoreSigningService: End-to-end orchestration of keyless signing + Rekor upload. VerifyKeylessAsync correctly validates signature, certificate chain, and Rekor timestamp within certificate validity window.
  - Tests: KeylessDsseSignerTests (mock-based unit tests), EphemeralKeyGeneratorTests (crypto validation), HttpFulcioClientTests (HTTP interaction tests), CertificateChainValidatorTests (chain validation), KeylessSigningIntegrationTests (end-to-end flow with test doubles).
 - **Verdict**: PASS
+
+## Recheck (Run-002)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2a live API replay + Tier 1 regression suite replay.
+- **Tests**: PASS (496/496 signer tests pass).
+- **Tier 2 Evidence**: `docs/qa/feature-checks/runs/signer/fulcio-sigstore-keyless-signing-client/run-002/tier2-api-check.json`
+- **Regression Coverage Added**: `VerifyDsse_ReturnsVerifiedTrue_ForFreshSignature`, `VerifyDsse_ReturnsVerifiedFalse_WhenPayloadIsTampered`.
+- **Outcome**: DSSE verification endpoint now validates signed envelopes and returns deterministic verified/unverified results.
+
+## Recheck (Run-003)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2 follow-up deterministic replay.
+- **Tests**: PASS (`src/Signer/StellaOps.Signer/StellaOps.Signer.Tests`: 496/496).
+- **Tier 2 Evidence**: `docs/qa/feature-checks/runs/signer/fulcio-sigstore-keyless-signing-client/run-003/tier2-api-check.json`
+- **Outcome**: DSSE sign/verify API boundary behavior remains stable.
+
+
+## Recheck (Run-004)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2 replay + full Signer suite replay.
+- **Tests**: PASS (`src/Signer/StellaOps.Signer/StellaOps.Signer.Tests`: 496/496).
+- **Tier 2 Evidence**: `docs/qa/feature-checks/runs/signer/fulcio-sigstore-keyless-signing-client/run-004/tier2-api-check.json`
+- **Outcome**: Keyless sign/verify API behavior remains stable.
+
+## Recheck (Run-005)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2 replay validated via Signer suite and endpoint coverage.
+- **Tests**: PASS (src/Signer/StellaOps.Signer/StellaOps.Signer.Tests: 496/496).
+- **Tier 2 Evidence**: docs/qa/feature-checks/runs/signer/fulcio-sigstore-keyless-signing-client/run-005/tier2-api-check.json
+- **Outcome**: Checked signer behavior remains healthy in follow-up replay.
+
+## Recheck (Run-006)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2 replay (API + integration) with deterministic signer suite verification.
+- **Tests**: PASS (src/Signer/StellaOps.Signer/StellaOps.Signer.Tests: 496/496).
+- **Tier 2 Evidence**: docs/qa/feature-checks/runs/signer/fulcio-sigstore-keyless-signing-client/run-006/tier2-api-check.json
+- **Outcome**: Checked signer behavior remains healthy in continued replay.
+
+## Recheck (Run-007)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2 replay (API + integration) with deterministic signer suite verification.
+- **Tests**: PASS (src/Signer/StellaOps.Signer/StellaOps.Signer.Tests: 496/496).
+- **Tier 2 Evidence**: docs/qa/feature-checks/runs/signer/fulcio-sigstore-keyless-signing-client/run-007/tier2-api-check.json
+- **Outcome**: Checked signer behavior remains healthy in continued replay.
+
+## Recheck (Run-008)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2a API replay + deterministic integration suite replay.
+- **Tests**: PASS (src/Signer/StellaOps.Signer/StellaOps.Signer.Tests: 496/496).
+- **Tier 2 Evidence**: docs/qa/feature-checks/runs/signer/fulcio-sigstore-keyless-signing-client/run-008/tier2-api-check.json
+- **Outcome**: Checked Signer behavior remains healthy in continued replay.
+
+
+## Recheck (Run-009)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2a API replay + deterministic integration suite replay.
+- **Tests**: PASS (src/Signer/StellaOps.Signer/StellaOps.Signer.Tests: 496/496).
+- **Tier 2 Evidence**: docs/qa/feature-checks/runs/signer/fulcio-sigstore-keyless-signing-client/run-009/tier2-api-check.json
+- **Outcome**: Checked Signer behavior remains healthy in continued replay.
+
+
+## Recheck (Run-010)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2d deterministic integration replay.
+- **Tests**: PASS (src/Signer/StellaOps.Signer/StellaOps.Signer.Tests: 496/496).
+- **Tier 2 Evidence**: docs/qa/feature-checks/runs/signer/fulcio-sigstore-keyless-signing-client/run-010/tier2-integration-check.json
+- **Outcome**: Checked signer behavior remains healthy in continued replay.
+## Recheck (Run-011)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2d deterministic integration replay.
+- **Tests**: PASS (src/Signer/StellaOps.Signer/StellaOps.Signer.Tests: 496/496).
+- **Tier 2 Evidence**: docs/qa/feature-checks/runs/signer/fulcio-sigstore-keyless-signing-client/run-011/tier2-integration-check.json
+- **Outcome**: Checked signer behavior remains healthy in continued replay.
+## Recheck (Run-012)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2 replay + deterministic integration suite replay.
+- **Tests**: PASS (src/Signer/StellaOps.Signer/StellaOps.Signer.Tests: 496/496).
+- **Tier 2 Evidence**: docs/qa/feature-checks/runs/signer/fulcio-sigstore-keyless-signing-client/run-012/tier2-api-check.json
+- **Outcome**: Checked signer behavior remains healthy in continued replay.
--- a/docs/features/checked/signer/key-rotation-service-with-temporal-validity.md
+++ b/docs/features/checked/signer/key-rotation-service-with-temporal-validity.md
@@ -44,3 +44,82 @@ Automated key rotation service with temporal key validity windows, key history t
  - TrustAnchorManager: PURL pattern matching verified -- glob-to-regex conversion, specificity scoring (segments*10 - wildcards*5), most-specific-match-wins semantics. VerifySignatureAuthorizationAsync correctly combines temporal key validity with predicate type authorization.
  - Tests: KeyRotationServiceTests (add/revoke/validity checks), TemporalKeyVerificationTests (boundary conditions for temporal validation), TrustAnchorManagerTests (PURL matching, specificity scoring), KeyRotationWorkflowIntegrationTests (end-to-end rotation workflows with EF Core InMemory provider).
 - **Verdict**: PASS
+
+## Recheck (Run-002)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2a live API replay + Tier 1 regression suite replay.
+- **Tests**: PASS (496/496 signer tests pass).
+- **Tier 2 Evidence**: `docs/qa/feature-checks/runs/signer/key-rotation-service-with-temporal-validity/run-002/tier2-api-check.json`
+- **Regression Coverage Added**: `KeyValidity_ReturnsNotFound_ForUnknownAnchorOrKey`.
+- **Outcome**: Unknown key validity lookups now return `404 Not Found` instead of `200 Unknown`.
+
+## Recheck (Run-003)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2 follow-up deterministic replay.
+- **Tests**: PASS (`src/Signer/StellaOps.Signer/StellaOps.Signer.Tests`: 496/496).
+- **Tier 2 Evidence**: `docs/qa/feature-checks/runs/signer/key-rotation-service-with-temporal-validity/run-003/tier2-api-check.json`
+- **Outcome**: Key-validity and temporal semantics remain stable, including unknown-key 404 handling.
+
+
+## Recheck (Run-004)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2 replay + full Signer suite replay.
+- **Tests**: PASS (`src/Signer/StellaOps.Signer/StellaOps.Signer.Tests`: 496/496).
+- **Tier 2 Evidence**: `docs/qa/feature-checks/runs/signer/key-rotation-service-with-temporal-validity/run-004/tier2-api-check.json`
+- **Outcome**: Key-validity API behavior (including unknown-key semantics) remains stable.
+
+## Recheck (Run-005)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2 replay validated via Signer suite and endpoint coverage.
+- **Tests**: PASS (src/Signer/StellaOps.Signer/StellaOps.Signer.Tests: 496/496).
+- **Tier 2 Evidence**: docs/qa/feature-checks/runs/signer/key-rotation-service-with-temporal-validity/run-005/tier2-api-check.json
+- **Outcome**: Checked signer behavior remains healthy in follow-up replay.
+
+## Recheck (Run-006)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2 replay (API + integration) with deterministic signer suite verification.
+- **Tests**: PASS (src/Signer/StellaOps.Signer/StellaOps.Signer.Tests: 496/496).
+- **Tier 2 Evidence**: docs/qa/feature-checks/runs/signer/key-rotation-service-with-temporal-validity/run-006/tier2-api-check.json
+- **Outcome**: Checked signer behavior remains healthy in continued replay.
+
+## Recheck (Run-007)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2 replay (API + integration) with deterministic signer suite verification.
+- **Tests**: PASS (src/Signer/StellaOps.Signer/StellaOps.Signer.Tests: 496/496).
+- **Tier 2 Evidence**: docs/qa/feature-checks/runs/signer/key-rotation-service-with-temporal-validity/run-007/tier2-api-check.json
+- **Outcome**: Checked signer behavior remains healthy in continued replay.
+
+## Recheck (Run-008)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2a API replay + deterministic integration suite replay.
+- **Tests**: PASS (src/Signer/StellaOps.Signer/StellaOps.Signer.Tests: 496/496).
+- **Tier 2 Evidence**: docs/qa/feature-checks/runs/signer/key-rotation-service-with-temporal-validity/run-008/tier2-api-check.json
+- **Outcome**: Checked Signer behavior remains healthy in continued replay.
+
+
+## Recheck (Run-009)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2a API replay + deterministic integration suite replay.
+- **Tests**: PASS (src/Signer/StellaOps.Signer/StellaOps.Signer.Tests: 496/496).
+- **Tier 2 Evidence**: docs/qa/feature-checks/runs/signer/key-rotation-service-with-temporal-validity/run-009/tier2-api-check.json
+- **Outcome**: Checked Signer behavior remains healthy in continued replay.
+
+
+## Recheck (Run-010)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2d deterministic integration replay.
+- **Tests**: PASS (src/Signer/StellaOps.Signer/StellaOps.Signer.Tests: 496/496).
+- **Tier 2 Evidence**: docs/qa/feature-checks/runs/signer/key-rotation-service-with-temporal-validity/run-010/tier2-integration-check.json
+- **Outcome**: Checked signer behavior remains healthy in continued replay.
+## Recheck (Run-011)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2d deterministic integration replay.
+- **Tests**: PASS (src/Signer/StellaOps.Signer/StellaOps.Signer.Tests: 496/496).
+- **Tier 2 Evidence**: docs/qa/feature-checks/runs/signer/key-rotation-service-with-temporal-validity/run-011/tier2-integration-check.json
+- **Outcome**: Checked signer behavior remains healthy in continued replay.
+## Recheck (Run-012)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2 replay + deterministic integration suite replay.
+- **Tests**: PASS (src/Signer/StellaOps.Signer/StellaOps.Signer.Tests: 496/496).
+- **Tier 2 Evidence**: docs/qa/feature-checks/runs/signer/key-rotation-service-with-temporal-validity/run-012/tier2-api-check.json
+- **Outcome**: Checked signer behavior remains healthy in continued replay.
--- a/docs/features/checked/signer/shamir-secret-sharing-key-escrow.md
+++ b/docs/features/checked/signer/shamir-secret-sharing-key-escrow.md
@@ -43,3 +43,81 @@ Key escrow system using Shamir's Secret Sharing over GF(256) to split signing ke
  - KeyEscrowService: Full lifecycle verified. EscrowKeyAsync splits with ShamirSecretSharing, encrypts each share with AES-256-GCM using per-agent key, stores via IEscrowAgentStore, computes SHA-256 checksums. RecoverKeyAsync validates threshold count, dual-control enforcement, checksum verification, Lagrange reconstruction. All operations audit-logged.
  - Tests: ShamirSecretSharingTests (split/combine round-trip, threshold enforcement, edge cases), KeyEscrowRecoveryIntegrationTests (full escrow/recovery flow with mocked stores).
 - **Verdict**: PASS
+
+## Recheck (Run-002)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2d deterministic integration replay.
+- **Tests**: PASS (496/496 signer tests pass).
+- **Tier 2 Evidence**: `docs/qa/feature-checks/runs/signer/shamir-secret-sharing-key-escrow/run-002/tier2-integration-check.json`
+- **Outcome**: No end-user regressions observed for escrow-adjacent behavior during Signer suite replay.
+
+## Recheck (Run-003)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2 follow-up deterministic replay.
+- **Tests**: PASS (`src/Signer/StellaOps.Signer/StellaOps.Signer.Tests`: 496/496).
+- **Tier 2 Evidence**: `docs/qa/feature-checks/runs/signer/shamir-secret-sharing-key-escrow/run-003/tier2-integration-check.json`
+- **Outcome**: Shamir escrow split/recovery behavior remains stable under deterministic replay.
+
+
+## Recheck (Run-004)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2 replay + full Signer suite replay.
+- **Tests**: PASS (`src/Signer/StellaOps.Signer/StellaOps.Signer.Tests`: 496/496).
+- **Tier 2 Evidence**: `docs/qa/feature-checks/runs/signer/shamir-secret-sharing-key-escrow/run-004/tier2-integration-check.json`
+- **Outcome**: Escrow/recovery integration behavior remains deterministic and stable.
+
+## Recheck (Run-005)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2 replay validated via Signer suite and endpoint coverage.
+- **Tests**: PASS (src/Signer/StellaOps.Signer/StellaOps.Signer.Tests: 496/496).
+- **Tier 2 Evidence**: docs/qa/feature-checks/runs/signer/shamir-secret-sharing-key-escrow/run-005/tier2-integration-check.json
+- **Outcome**: Checked signer behavior remains healthy in follow-up replay.
+
+## Recheck (Run-006)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2 replay (API + integration) with deterministic signer suite verification.
+- **Tests**: PASS (src/Signer/StellaOps.Signer/StellaOps.Signer.Tests: 496/496).
+- **Tier 2 Evidence**: docs/qa/feature-checks/runs/signer/shamir-secret-sharing-key-escrow/run-006/tier2-integration-check.json
+- **Outcome**: Checked signer behavior remains healthy in continued replay.
+
+## Recheck (Run-007)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2 replay (API + integration) with deterministic signer suite verification.
+- **Tests**: PASS (src/Signer/StellaOps.Signer/StellaOps.Signer.Tests: 496/496).
+- **Tier 2 Evidence**: docs/qa/feature-checks/runs/signer/shamir-secret-sharing-key-escrow/run-007/tier2-integration-check.json
+- **Outcome**: Checked signer behavior remains healthy in continued replay.
+
+## Recheck (Run-008)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2a API replay + deterministic integration suite replay.
+- **Tests**: PASS (src/Signer/StellaOps.Signer/StellaOps.Signer.Tests: 496/496).
+- **Tier 2 Evidence**: docs/qa/feature-checks/runs/signer/shamir-secret-sharing-key-escrow/run-008/tier2-api-check.json
+- **Outcome**: Checked Signer behavior remains healthy in continued replay.
+
+
+## Recheck (Run-009)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2a API replay + deterministic integration suite replay.
+- **Tests**: PASS (src/Signer/StellaOps.Signer/StellaOps.Signer.Tests: 496/496).
+- **Tier 2 Evidence**: docs/qa/feature-checks/runs/signer/shamir-secret-sharing-key-escrow/run-009/tier2-api-check.json
+- **Outcome**: Checked Signer behavior remains healthy in continued replay.
+
+
+## Recheck (Run-010)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2d deterministic integration replay.
+- **Tests**: PASS (src/Signer/StellaOps.Signer/StellaOps.Signer.Tests: 496/496).
+- **Tier 2 Evidence**: docs/qa/feature-checks/runs/signer/shamir-secret-sharing-key-escrow/run-010/tier2-integration-check.json
+- **Outcome**: Checked signer behavior remains healthy in continued replay.
+## Recheck (Run-011)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2d deterministic integration replay.
+- **Tests**: PASS (src/Signer/StellaOps.Signer/StellaOps.Signer.Tests: 496/496).
+- **Tier 2 Evidence**: docs/qa/feature-checks/runs/signer/shamir-secret-sharing-key-escrow/run-011/tier2-integration-check.json
+- **Outcome**: Checked signer behavior remains healthy in continued replay.
+## Recheck (Run-012)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2 replay + deterministic integration suite replay.
+- **Tests**: PASS (src/Signer/StellaOps.Signer/StellaOps.Signer.Tests: 496/496).
+- **Tier 2 Evidence**: docs/qa/feature-checks/runs/signer/shamir-secret-sharing-key-escrow/run-012/tier2-integration-check.json
+- **Outcome**: Checked signer behavior remains healthy in continued replay.
--- a/docs/features/checked/signer/tuf-client-for-trust-root-management.md
+++ b/docs/features/checked/signer/tuf-client-for-trust-root-management.md
@@ -44,3 +44,81 @@ Trust anchor management system with PURL-based pattern matching for artifact-to-
  - This is not a TUF (The Update Framework) protocol client. It does not implement TUF specification concepts (root.json, targets.json, snapshot.json, timestamp.json, delegations). The feature title has been updated to reflect the actual implementation.
  - The implementation is a custom trust anchor management system designed for Stella Ops' attestation model. It provides equivalent trust root management functionality through PURL-based pattern matching rather than TUF's hierarchical metadata model.
 - **Verdict**: PASS (solid trust anchor management implementation; title corrected from "TUF Client" to "Trust Root Management")
+
+## Recheck (Run-002)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2d deterministic integration replay + key-validity API contract check.
+- **Tests**: PASS (496/496 signer tests pass).
+- **Tier 2 Evidence**: `docs/qa/feature-checks/runs/signer/tuf-client-for-trust-root-management/run-002/tier2-integration-check.json`
+- **Outcome**: Trust-anchor behavior remains stable; missing-key lookups now align to not-found semantics.
+
+## Recheck (Run-003)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2 follow-up deterministic replay.
+- **Tests**: PASS (`src/Signer/StellaOps.Signer/StellaOps.Signer.Tests`: 496/496).
+- **Tier 2 Evidence**: `docs/qa/feature-checks/runs/signer/tuf-client-for-trust-root-management/run-003/tier2-integration-check.json`
+- **Outcome**: Trust-anchor management behavior remains stable in follow-up replay.
+
+
+## Recheck (Run-004)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2 replay + full Signer suite replay.
+- **Tests**: PASS (`src/Signer/StellaOps.Signer/StellaOps.Signer.Tests`: 496/496).
+- **Tier 2 Evidence**: `docs/qa/feature-checks/runs/signer/tuf-client-for-trust-root-management/run-004/tier2-integration-check.json`
+- **Outcome**: Trust-anchor and key-validity integration behavior remains stable.
+
+## Recheck (Run-005)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2 replay validated via Signer suite and endpoint coverage.
+- **Tests**: PASS (src/Signer/StellaOps.Signer/StellaOps.Signer.Tests: 496/496).
+- **Tier 2 Evidence**: docs/qa/feature-checks/runs/signer/tuf-client-for-trust-root-management/run-005/tier2-integration-check.json
+- **Outcome**: Checked signer behavior remains healthy in follow-up replay.
+
+## Recheck (Run-006)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2 replay (API + integration) with deterministic signer suite verification.
+- **Tests**: PASS (src/Signer/StellaOps.Signer/StellaOps.Signer.Tests: 496/496).
+- **Tier 2 Evidence**: docs/qa/feature-checks/runs/signer/tuf-client-for-trust-root-management/run-006/tier2-integration-check.json
+- **Outcome**: Checked signer behavior remains healthy in continued replay.
+
+## Recheck (Run-007)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2 replay (API + integration) with deterministic signer suite verification.
+- **Tests**: PASS (src/Signer/StellaOps.Signer/StellaOps.Signer.Tests: 496/496).
+- **Tier 2 Evidence**: docs/qa/feature-checks/runs/signer/tuf-client-for-trust-root-management/run-007/tier2-integration-check.json
+- **Outcome**: Checked signer behavior remains healthy in continued replay.
+
+## Recheck (Run-008)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2a API replay + deterministic integration suite replay.
+- **Tests**: PASS (src/Signer/StellaOps.Signer/StellaOps.Signer.Tests: 496/496).
+- **Tier 2 Evidence**: docs/qa/feature-checks/runs/signer/tuf-client-for-trust-root-management/run-008/tier2-api-check.json
+- **Outcome**: Checked Signer behavior remains healthy in continued replay.
+
+
+## Recheck (Run-009)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2a API replay + deterministic integration suite replay.
+- **Tests**: PASS (src/Signer/StellaOps.Signer/StellaOps.Signer.Tests: 496/496).
+- **Tier 2 Evidence**: docs/qa/feature-checks/runs/signer/tuf-client-for-trust-root-management/run-009/tier2-api-check.json
+- **Outcome**: Checked Signer behavior remains healthy in continued replay.
+
+
+## Recheck (Run-010)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2d deterministic integration replay.
+- **Tests**: PASS (src/Signer/StellaOps.Signer/StellaOps.Signer.Tests: 496/496).
+- **Tier 2 Evidence**: docs/qa/feature-checks/runs/signer/tuf-client-for-trust-root-management/run-010/tier2-integration-check.json
+- **Outcome**: Checked signer behavior remains healthy in continued replay.
+## Recheck (Run-011)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2d deterministic integration replay.
+- **Tests**: PASS (src/Signer/StellaOps.Signer/StellaOps.Signer.Tests: 496/496).
+- **Tier 2 Evidence**: docs/qa/feature-checks/runs/signer/tuf-client-for-trust-root-management/run-011/tier2-integration-check.json
+- **Outcome**: Checked signer behavior remains healthy in continued replay.
+## Recheck (Run-012)
+- **Verified**: 2026-02-10
+- **Method**: Tier 2 replay + deterministic integration suite replay.
+- **Tests**: PASS (src/Signer/StellaOps.Signer/StellaOps.Signer.Tests: 496/496).
+- **Tier 2 Evidence**: docs/qa/feature-checks/runs/signer/tuf-client-for-trust-root-management/run-012/tier2-integration-check.json
+- **Outcome**: Checked signer behavior remains healthy in continued replay.