git.stella-ops.org/docs/airgap/time-anchor-verification-gap.md

Time Anchor Verification Gap (AIRGAP-TIME-57-001 follow-up)

Status (2025-11-20)

• Parser: Roughtime verifier now checks Ed25519 signature; RFC3161 verifier uses SignedCms signature validation and signing time attribute. Still needs final trust root bundle + fixture alignment.
• Staleness: calculator + budgets landed; loader accepts hex fixtures.
• Verification: pipeline (TimeVerificationService) active; awaiting guild-provided trust roots (format + key IDs) for production readiness and to update tests/fixtures.

What’s missing

• Roughtime parser: parse signed responses, extract timestamp, radius, verifier public key; verify signature.
• RFC3161 parser: decode ASN.1 TimeStampToken, verify signer chain against provided trust roots, extract nonce/ts.
• Trust roots: final format (JWK vs PEM) and key IDs to align with TrustRootConfig/Time service.

Proposed plan

1. Receive finalized token format + trust-root bundle from Time Guild.
2. Implement format-specific verifiers with validating tests using provided fixtures.
3. Expose /api/v1/time/status returning anchor metadata + staleness; wire telemetry counters/alerts per sealed diagnostics doc.

Owners

• AirGap Time Guild (format decision + trust roots)
• AirGap Importer Guild (bundle delivery of anchors)
• Observability Guild (telemetry wiring)