From 1131609c777aecbde7ced7e60e9dff5f7c5237c9 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 30 Oct 2026 02:17:25 +0000 Subject: [PATCH] docs(platform-objects): sys_trusted_key docblock names install's verifier and the shipped boot-time loader `os plugin install` verifies with `verifyPublisherSignature` (which `verifyPluginArtifact` wraps), and ADR-0025 M1's boot-time loader is built: name it and what it reads from the table. Comment only. Claude-Session: https://claude.ai/code/session_01L6bhgUCizoYWQVJWjhdR6F Co-authored-by: Claude --- .../src/system/sys-trusted-key.object.ts | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/packages/platform-objects/src/system/sys-trusted-key.object.ts b/packages/platform-objects/src/system/sys-trusted-key.object.ts index cbd1b7b98dd..2f375c23092 100644 --- a/packages/platform-objects/src/system/sys-trusted-key.object.ts +++ b/packages/platform-objects/src/system/sys-trusted-key.object.ts @@ -9,7 +9,8 @@ import { ObjectSchema, Field } from '@objectstack/spec/data'; * One row per publisher key this environment accepts a plugin signature from. * `os plugin install ./x.osplugin` reads the `keyId` out of the artifact's * `ed25519:KEYID:SIG` sidecar, resolves it here and verifies the artifact bytes - * with that row's `public_key` (`verifyPluginArtifact`, `@objectstack/core`). + * with that row's `public_key` (`verifyPublisherSignature`, `@objectstack/core`; + * `verifyPluginArtifact` wraps it and adds the platform counter-signature chain). * A key id with no row, or whose row is `revoked`, is refused by name. * * ## Public keys only @@ -36,10 +37,15 @@ import { ObjectSchema, Field } from '@objectstack/spec/data'; * deleted or re-activated: its key id stays refused, so a revoked key cannot * come back under the same handle. * - * Registered by `PlatformObjectsPlugin` (`../plugin.ts`) beside `sys_secret`: - * its readers span domains — the CLI's install command today, and ADR-0025 - * M1's boot-time loader in the runtime once it is built — and no capability - * plugin owns plugin distribution (ADR-0029 D1/D2). + * Registered by `PlatformObjectsPlugin` (`../plugin.ts`) beside `sys_secret`, + * because its readers span domains and no capability plugin owns plugin + * distribution (ADR-0029 D1/D2). The readers are the CLI's install command and + * ADR-0025 M1's boot-time loader, `packages/runtime/src/installed-plugin-loader.ts` + * (run by `os serve` before the kernel bootstraps). The loader re-checks every + * signed install at each boot: the row for its key id must be `active` and + * carry the `fingerprint` the install recorded, and its `public_key` must + * verify the kept bytes (`verifyPluginArtifact`, publisher chain only). So a + * key revoked after install refuses that plugin at its next boot. * * @namespace sys */