feat(identity): recover expired laptop credential

Author: misunders2d

README.md

@@ -221,6 +221,16 @@ harness. The user restarts it explicitly; connection is recorded only after a
 new measured process proves the expected adapter generation and exact enrolled
 harness binding.
 
+If that laptop credential expires while the exact owner-private identity and
+P-256 key remain intact, use `agentnet credential reauthorize-expired`.
+The package proves the expired binding directly, obtains fresh owner WebAuthn
+UV, and creates one same-key successor at epoch +1 without enrollment,
+authority, scope, membership, capability, or harness restart. The first call
+may report `approval_pending` while opening the stable Approval page; rerun the
+identical command after approval. Owner-only state makes response-loss retries
+converge. Revoked, rotated, active, compromised, cross-binding, drifted, or
+ambiguous credentials fail closed and require their own workflow.
+
 Friendly recipient input is not an address or authority claim. The authenticated,
 non-enumerating resolver returns one `ResolvedEndpoint`: exact harness, safe
 display metadata, and current scope ID. Zero, multiple, stale, revoked, or
@@ -441,7 +451,7 @@ always-on deployment—see the [implementation guide](docs/implementation-guide.
 ## Project status
 
 AgentNet is an early public implementation; the latest published package is
-`0.1.45`. Its publication does not promote any requirement or gate.
+`0.1.50`. Its publication does not promote any requirement or gate.
 Published `0.1.29` repaired owner/enrollment OIDC callback parsing after real
 Google owner login exposed rejection of valid unique response extensions;
 published `0.1.30` repaired installed-verifier package custody; published
@@ -543,6 +553,17 @@ addition to the existing installed journey. These are local and CI evidence,
 not production certification, and no requirement or must-not-ship gate is
 promoted.
 
+Candidate `0.1.51` adds one package-owned recovery lane for an expired laptop
+credential when the exact owner-private identity profile and OS- or
+hardware-bound P-256 key remain intact. Dedicated expired-credential DPoP
+routes bind the unchanged domain, principal, harness, key, assurance, and
+profile to fresh owner WebAuthn UV, then atomically retire the expired epoch and
+issue the exact same-key successor at epoch +1. Resumable owner-only CLI state
+preserves the transaction across approval timeout or response loss. The flow
+does not re-enroll, rotate keys, restore revoked actors, grant authority, change
+communication scopes or memberships, or restart the harness. No requirement,
+production claim, or must-not-ship gate is promoted.
+
 Git tag `v0.1.23` reached the staging workflow, but CI stopped before npm
 staging because one hermetic interruption test mocked `/usr/bin/useradd` on a
 runner where that path did not exist. No `0.1.23` package was staged or

RELEASE_MANIFEST.json

@@ -218,7 +218,7 @@
     "path": "uv.lock",
     "pyproject": {
       "path": "pyproject.toml",
-      "sha256": "95c9effe37951f5ab012aa00743ecc52b44ca0ac0b62ab08eddafa3ab7559e7a"
+      "sha256": "6aebcdea17d2715c3136c2b6b3179a424a3eed990f54d65a4cccbf67c715c5da"
     },
     "resolution": {
       "a2a-sdk": "1.1.0",
@@ -285,7 +285,7 @@
       "webauthn": "3.0.0"
     },
     "revision": 3,
-    "sha256": "afffa3558290939ca4f3efae1b04559db3299084f4a62c0d93ccdd4ab66e69c8"
+    "sha256": "c971fdea8d3782a9d7349b5723f4e036740d314f19f7c3553dc6ba1780c9f84d"
   },
   "external_release_evidence": {
     "installer_lifecycle": {
@@ -529,20 +529,20 @@
   "release": {
     "name": "agentnet",
     "production_ready": false,
-    "profile": "setup_usability_candidate",
-    "reason": "All 19 must-not-ship gates remain non-PASSED; local implementation evidence is partial and required external, privileged, production-topology, or owner evidence remains absent.",
+    "profile": "expired_laptop_credential_reauthorization_candidate",
+    "reason": "All 19 must-not-ship gates remain non-PASSED; local evidence proves the package-owned same-binding expired-laptop credential reauthorization contract, but fresh installed-host, live owner WebAuthn/Core recovery, and required external, privileged, production-topology, and owner evidence remain absent.",
     "ship_eligible": false,
     "status": "BLOCKED",
-    "version": "0.1.50"
+    "version": "0.1.51"
   },
   "release_inputs": {
     "README.md": {
       "path": "README.md",
-      "sha256": "f6839282457daeeb8cad2b76621b384725cb6caac15e92ad3e09f72633fcbbe3"
+      "sha256": "c98f3fa0cce833f8166fb938281e68f1a44134d2d305e97372b0a00968b1fae9"
     },
     "REQUIREMENTS_STATUS.md": {
       "path": "REQUIREMENTS_STATUS.md",
-      "sha256": "59491a96c8697c41c47d29756144768f5b62da0df04c3d75c9579dc762dae0d8"
+      "sha256": "c7a57046e2b352ca4296bc7753fd7b783a0d8dd0f253708d561c1e2c54ce663e"
     },
     "deploy/Dockerfile": {
       "path": "deploy/Dockerfile",
@@ -562,11 +562,11 @@
     },
     "docs/GATE_EVIDENCE.md": {
       "path": "docs/GATE_EVIDENCE.md",
-      "sha256": "1d690b65756169e1954c1a37c0436bc3dc053e903e61dd4a647a0a0f786be6e2"
+      "sha256": "51695ac55e5cbd41be39809b568ac78051eb1a91ac5aafe1b380bffc6af3325c"
     },
     "docs/RELEASE_MANIFEST.md": {
       "path": "docs/RELEASE_MANIFEST.md",
-      "sha256": "99fb7ad44dfb05766c59ac69c1decb1df9e951984c7196acb53c37179d2d99ad"
+      "sha256": "c091bd6ac72357c3d4b923638244913a5b63a1e59c64c9509161b3c4fba4d9dd"
     },
     "evidence/gates/G01/2026-07-13-installed-harnesses/manifest.json": {
       "path": "evidence/gates/G01/2026-07-13-installed-harnesses/manifest.json",
@@ -602,13 +602,13 @@
     },
     "scripts/verify_release.py": {
       "path": "scripts/verify_release.py",
-      "sha256": "b559a98eb5050f54a9d4d222ef83e2b6bda16af5c79860699d0eace2c1661d00"
+      "sha256": "fd3a11fbb1473c5a32d970d8bc102028b211c5ac0ace67412dfb8eac8bfa60a4"
     }
   },
   "release_source_tree": {
     "algorithm": "sha256(path NUL bytes NUL)",
     "path": "src",
-    "sha256": "740adfb28e27641c3ec0bab470036c4690fde2c70a53ab0568fde644aecddb7e"
+    "sha256": "a3c1e64482bb7e0751dcbb3fb1a05d831f1b9d425b6063eca0a4c2a92612901d"
   },
   "runtime": {
     "implementation": "CPython",
@@ -746,5 +746,5 @@
     },
     "version": "1.0"
   },
-  "snapshot_date": "2026-08-07"
+  "snapshot_date": "2026-08-14"
 }

REQUIREMENTS_STATUS.md

@@ -1,6 +1,6 @@
 # Requirements Status
 
-Snapshot: 2026-08-07. This is an implementation/evidence ledger, not a release
+Snapshot: 2026-08-14. This is an implementation/evidence ledger, not a release
 certificate. It contains the exact 85 stable requirement IDs from the preserved
 requirements reference. PD-001 through PD-011 are listed separately because
 they are accountable policy decisions, not additional requirements.
@@ -428,6 +428,29 @@ published and historical release evidence:
   `UX-001`, `UX-002`, `SEC-003`, `SEC-005`, `OPS-003`, and `OPS-006`. No
   requirement or must-not-ship gate is promoted.
 
+- Candidate `0.1.51` adds a dedicated, package-owned reauthorization workflow
+  for an expired ordinary laptop credential. It preserves the exact
+  domain/principal/harness binding, OS- or hardware-bound public key, authority,
+  scopes, memberships, capabilities, and credential-supersession history;
+  requires fresh independent WebAuthn user verification; rejects active,
+  revoked, mismatched, non-laptop, stale, replayed, expired-transaction, and
+  conflicting bindings before key use or mutation; and commits exactly one
+  same-key successor epoch with idempotent response-loss recovery. It grants no
+  authority and performs no enrollment, generic renewal, key replacement, or
+  service restart. Current evidence is hermetic only: the focused lane reports
+  **698 passed and 5 expected dedicated-PostgreSQL skips**, the broad
+  releasable-source lane reports **2197 passed and 21 expected
+  platform/dedicated-PostgreSQL skips**, two independent release builds are
+  byte-identical, and source plus two recursive packed generations each report
+  **2224 passed and 21 expected platform/dedicated-PostgreSQL skips**. The
+  packaged exact-endpoint routing gate, packaged `0.1.45` user journey, and
+  separate-process communication/obligation roundtrip pass. Fresh
+  installed-host, live owner WebAuthn/Core recovery, same-commit CI, and
+  production-topology evidence remain pending. Affected IDs are `ID-006`,
+  `ID-007`, `ID-009`, `AUTH-001`, `AUTH-002`, `AUTH-004`, `AUTH-007`,
+  `SEC-003`, `SEC-005`, `SEC-007`, `OPS-003`, and `OPS-006`. No requirement or
+  must-not-ship gate is promoted.
+
 
 
 - S5/S6 directly exercise `ID-006`, `AUTH-001`, `AUTH-002`, `AUTH-003`,
@@ -509,7 +532,7 @@ stable requirement's status or remaining external/owner boundary.
 | ID-006 — human and exact harness identities remain distinct | partial-external | `src/agentnet/identity/actors.py`; `src/agentnet/identity/context.py`; `src/agentnet/identity/workload.py`; `src/agentnet/bindings/composition.py` | Actor-union, sibling, workload, current-epoch local binding, and measured IPC child negatives: `tests/identity/test_actor_union.py`; `tests/identity/test_workload_identity.py`; `tests/security/test_ipc_capability.py`; `tests/bindings/test_local_binding_composition.py` | Privileged target-host same-UID/PID-reuse attribution and exact installed-harness evidence remain external. |
 | ID-007 — revoke one harness without revoking siblings | partial-external | `src/agentnet/identity/revocation.py`; `src/agentnet/identity_admin_http.py`; `src/agentnet/identity/context.py` | Revocation, wrong approval, concurrent lifecycle, and admin HTTP: `tests/identity/test_revocation.py`; `tests/integration/test_identity_admin_http.py` | Real device-loss/offboarding drill and full cross-resource revocation matrix are absent. |
 | ID-008 — identity is scoped to an exact trust domain | partial-external | `src/agentnet/identity/domains.py`; `src/agentnet/identity/context.py`; `src/agentnet/federation/service.py` | Cross-domain proof, pairwise guest, bilateral trust, and revocation negatives: `tests/identity/test_context.py`; `tests/federation/test_bilateral_guest.py`; `tests/federation/test_http_composition.py` | Independently administered partner-domain evidence is absent. |
-| ID-009 — issuance, rotation, expiry, recovery, compromise, and offboarding | owner-blocked | `src/agentnet/identity/credentials.py`; `src/agentnet/identity/recovery.py`; `src/agentnet/identity/revocation.py`; `src/agentnet/approval/webauthn_uv.py` | Rotation/recovery/revocation positives, substitutions, replay, races, plus approval credential/request/challenge/receipt expiry and revocation: `tests/identity/test_credential_rotation.py`; `tests/identity/test_recovery.py`; `tests/identity/test_revocation.py`; `tests/approval/test_webauthn_service.py` | Real custody/recovery administrators, approval signer/authenticator rotation drill, and signed PD-005/009 lifecycle choices are absent. |
+| ID-009 — issuance, rotation, expiry, recovery, compromise, and offboarding | owner-blocked | `src/agentnet/identity/credentials.py`; `src/agentnet/identity/recovery.py`; `src/agentnet/identity/revocation.py`; `src/agentnet/identity/context.py`; `src/agentnet/http_auth.py`; `src/agentnet/core/app.py`; `src/agentnet/product_http.py`; `src/agentnet/client.py`; `src/agentnet/cli.py`; `src/agentnet/approval/webauthn_uv.py`; `src/agentnet/approval/transaction_summary.py`; `src/agentnet/security/signatures.py` | Rotation/recovery/revocation positives, substitutions, replay, races, approval credential/request/challenge/receipt expiry and revocation, and same-binding expired laptop reauthorization: `tests/identity/test_credential_rotation.py`; `tests/identity/test_recovery.py`; `tests/identity/test_revocation.py`; `tests/identity/test_laptop_credential_reauthorization.py`; `tests/cli/test_laptop_credential_reauthorization_cli.py`; `tests/approval/test_webauthn_service.py`; `tests/approval/test_transaction_summary.py` | Real custody/recovery administrators, approval signer/authenticator rotation drill, and signed PD-005/009 lifecycle choices are absent. |
 | AUTH-001 — every protected operation resolves a verified caller | partial-external | `src/agentnet/identity/context.py`; `src/agentnet/identity/workload.py`; `src/agentnet/authorization/policy.py` | Human, guest, workload, and forged-workload cases: `tests/identity/test_context.py`; `tests/identity/test_workload_identity.py`; `tests/federation/test_bilateral_guest.py`; `tests/delivery/test_mailbox.py` | Privileged transport identity evidence for deployed workloads is absent. |
 | AUTH-002 — authorization consumes proof-derived identity | local-tested | `src/agentnet/security/dpop.py`; `src/agentnet/identity/context.py`; `src/agentnet/client.py`; `src/agentnet/approval/internal_broker.py`; `src/agentnet/approval/http.py` | Canonical target/body/audience/replay and client-origin negatives plus exact Core→Approval method/path/body/audience/purpose/key proof cases: `tests/security/test_signatures_and_replay.py`; `tests/security/test_signed_client.py`; `tests/identity/test_context.py`; `tests/approval/test_internal_broker.py`; `tests/approval/test_approval_http.py` | Local proof contracts are executable and fail-closed; deployed workload/TLS assurance remains external. |
 | AUTH-003 — positive permissions attach to the human principal | owner-blocked | `src/agentnet/authorization/policy.py`; `src/agentnet/authorization/evidence.py`; `src/agentnet/identity_admin_http.py` | Human-only authority, signed issue/revoke, replay, and stale revision: `tests/authorization/test_policy.py`; `tests/integration/test_identity_admin_http.py`; `tests/authorization/test_authority_bootstrap.py` | Signed PD-001/003 principal and attenuation policy is absent. |

docs/ARCHITECTURE.md

@@ -100,6 +100,19 @@ expired/revoked/rotated binding cannot renew or satisfy readiness. These labels
 and server capability limits can only narrow process eligibility; protected
 operations still derive and authorize their exact caller independently.
 
+An expired laptop credential is not reconstructed as a `VerifiedActor`. Two
+purpose-limited routes authenticate only expired-old-credential DPoP for the
+same exact laptop binding; a retry may use only its exact retired predecessor.
+The transaction binds domain, principal, harness, credential and epoch, expiry,
+unchanged key and public-PEM digest, assurance/profile digest, and fresh
+WebAuthn-UV Approval. One atomic commit retires the old credential without
+extension and creates exactly one same-key successor at epoch +1. It changes no
+authority, scope, membership, capability, identity, or harness process. Stable
+pending state and the committed result make response-loss retry idempotent.
+This package-owned user-level flow is separate from fresh enrollment, active
+renewal, generic recovery or key replacement, and managed-server
+reauthorization below.
+
 The current candidate narrows recovery for an expired, still-possessed
 managed-server key in the communication-only topology. Before first C0,
 immutable terminal C0 evidence is the provenance root. After C0, every