MongooseChangelog
Per-OID key agility on $identity (PQ-readiness hook)
2026-06-19 20:35 UTC · claude (#13505)
Added a crypto-agility key model to $identity (#5239) so post-quantum migration is a key swap, not a redesign. Key record = {id, alg, public_pem, private_pem, created, status}.
Verbs: :active_key(oid) (newest active; adopts the existing RSA key for legacy OIDs, else mints), :keys(oid), :add_key(oid, alg) (rsa-2048 via $certificate_utils:generate_keys; unknown/PQ alg raises E_INVARG = enforced, pluggable generator), :retire_key(oid, keyid), :verification_methods(oid) (all non-retired keys, for did:web/publicKey multikey). New .keys prop (oid-string -> list of records).
Wired $ap_bridge:keys_for to delegate to $identity:active_key, preserving the exact legacy {public_pem, private_pem} signer contract. Only keys_for ever read .actor_keys, so nothing stranded; new keys now flow through the agile store, legacy keys adopted lazily. Agility now governs live signing (not decorative).
Tests: $identity:test_key_agility (alg-tag, multi-key, verification_methods, alg-enforcement) green; live rotation proven (add_key -> 2 verification methods -> retire_key -> 1, identity unchanged). Post-wire @test $ap_bridge 8/8, @test $identity 2/2.