{
  "_meta": {
    "artifact": "key_rotation_continuity_fixture",
    "source_module": "core/governance/key_registry.py",
    "generated_at_utc": "2026-08-03T12:54:13Z",
    "git_commit": "8c630bbff55632916e3fba70d3c96b8d1cbb6e78",
    "python": "3.12.8",
    "generator": "scripts/generate_verification_artifacts.py",
    "reproduce": "python scripts/generate_verification_artifacts.py",
    "sha256": "309e564d3d86c06c00a3de454b21ed07f085fbac992f701472d9b9cbd18be5f8"
  },
  "description": "Historical-continuity fixture: a decision signed under key A, then a rotation to key B. EVE's key registry keeps old public keys retrievable by key id, so the pre-rotation signature STILL verifies against key A's public key after the rotation, and does NOT verify against key B. Built with the same Ed25519 primitive EVE uses; does not touch the live key store.",
  "key_a": {
    "kid": "kid-b10937f293376304",
    "public_key_pem": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAbsr3y/sK7X/X7739JBTqCnaWhlGKbaSKCUz08edmgJ8=\n-----END PUBLIC KEY-----\n"
  },
  "key_b": {
    "kid": "kid-fe3cd8001e3f9a72",
    "public_key_pem": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAz39BC/xMPILzT/UeMd2TWruy6BJT6zFNSvBtrtTqvmk=\n-----END PUBLIC KEY-----\n"
  },
  "pre_rotation_signature": {
    "content_sha256": "7571d5dfa03444064f587aedbf18edb2cec6ec27d3332ad3184790a14792e4c7",
    "signature_hex": "e387d2eca98953cbbb42befbe41d22d182280289704113989a1730662c723602956a4ce7a058b599772342914f5bec1bb017da32dff626335ffd302d9166070f",
    "signed_by": "kid-b10937f293376304"
  },
  "registry_after_rotation": [
    "kid-b10937f293376304",
    "kid-fe3cd8001e3f9a72"
  ],
  "old_signature_still_verifies_with_key_a": true,
  "new_key_rejects_old_signature": true
}