Restore approved configuration publisher signing identity #729

🤖 Generated by the Agentic Engineer

Description

The normal v12.0.3 configuration publication is correctly refused by the consumer's signature verifier. PR #725 changed the immutable publishing revision while approving only unchanged workflow/helper bytes. The signing revision is also part of the certificate identity; byte equivalence does not approve that identity for consumers. This prevents new organization configuration from reconciling.

Steps to reproduce

1. Inspect the publisher change in fix(ci): accept publisher releases with unchanged approved contents #725, merged as 602159b7e3dd6d96a3aa463ceac4f33c10f5e3f3.
2. Observe the normal v12.0.3 publication and the consumer's verification result.
3. Compare the caller revision with the consumer's reviewed exact signer revisions.

Expected behavior

An update cannot change the configuration publisher's signing identity until consumers approve it. Routine publication through the currently approved identity remains available.

Actual behavior

Publication succeeds, but consumption reports VerificationError. The new revision is absent from the exact approved signer identities. The previous verified artifact remains retained; verification must not be disabled or broadened to recover.

Acceptance criteria

• Restore publication through the already-approved immutable signer revision without weakening any consumer verifier.
• Add a failing control for an unapproved revision with identical publisher bytes, plus explicit-approved-revision and existing content/input refusal coverage.
• Retain the signing, promotion, immutable-version and recovery controls and collect successful exact-head CI and independent review.
• Merge through protection, observe normal tagged publication, and independently verify the new source-bound artifact is accepted and applied.

Completion evidence

#730 merged as 7bf35c4fb0c2ccd8d1c08585e6ec5979a819d18e after full green CI and an exact-head finding-free review. Normal v12.0.4 release, CD, main CI and both main analysis workflows succeeded.

Independent anonymous signature verification bound digest sha256:4d386cdbcad81774308ff517da208f4bea9afc0d57d817cbc660ecbf83793b3c to that exact source, approved publisher, tag, version, run and attempt. Live readback confirmed that same revision accepted and applied, with the complete verifier object unchanged. The platform health check then returned OK. No imperative reconciliation, alias rewrite or trust expansion was used.

Additional context

Root cause: source-content approval and deployed signer-identity approval were treated as interchangeable. Related to #727 and #242. Recovery is producer-local; no trust-policy expansion or imperative cluster changes are proposed.