{
  "_meta": {
    "artifact": "key_rotation_continuity_fixture",
    "source_module": "core/governance/key_registry.py",
    "generated_at_utc": "2026-08-21T21:28:38Z",
    "git_commit": "d3c65c65a95c6897a0ad32da51eece9c51e3e2d8",
    "python": "3.12.8",
    "generator": "scripts/generate_verification_artifacts.py",
    "reproduce": "python scripts/generate_verification_artifacts.py",
    "sha256": "c110590e3615fa6299bc2613a72f41024e4ff6415cd7fcb5c527b9a2d06cb488"
  },
  "description": "Historical-continuity fixture: a decision signed under key A, then a rotation to key B. EVE's key registry keeps old public keys retrievable by key id, so the pre-rotation signature STILL verifies against key A's public key after the rotation, and does NOT verify against key B. Built with the same Ed25519 primitive EVE uses; does not touch the live key store.",
  "key_a": {
    "kid": "kid-82565770579221e0",
    "public_key_pem": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEApVpt4PynYKmr1YWev3vfnkilk0dOn8gj/7xgP5naTeQ=\n-----END PUBLIC KEY-----\n"
  },
  "key_b": {
    "kid": "kid-12201fcf52974714",
    "public_key_pem": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAirM2z145lOp55e/XzaXqcko8CNMow8z67wcCQRkVnQ0=\n-----END PUBLIC KEY-----\n"
  },
  "pre_rotation_signature": {
    "content_sha256": "7571d5dfa03444064f587aedbf18edb2cec6ec27d3332ad3184790a14792e4c7",
    "signature_hex": "98046c93e94d46f0f9516e0ff557f03e7d3a5a992906a1d766427cda11cf69519986818bffafecc8dde1bde8684eee8facb8d41656f967769f8334df2a9a1403",
    "signed_by": "kid-82565770579221e0"
  },
  "registry_after_rotation": [
    "kid-82565770579221e0",
    "kid-12201fcf52974714"
  ],
  "old_signature_still_verifies_with_key_a": true,
  "new_key_rejects_old_signature": true
}