Define bounded owner renewal delegation #15

Merged

ams-tech merged 2 commits from codex/lan-renewal-delegation into main

2026-09-30 23:59:10 -04:00

ams-tech commented

2026-09-30 22:45:06 -04:00

(Migrated from github.com)

Adds PilotRenewalDelegation 0.6.0-draft.1 for owner-approved thirty-day terms and same-key renewals capped at seven days. Delegations pin exact enrollment instances, retained identity/key/issuer/permission scope, accepted evidence gaps and freshness limits. Revocation is append-only and terminal; automation cannot extend a term or recover membership.

Includes positive/negative examples and semantic transition/scope tests. All 122 contract tests pass locally. This is an additive contract; consumers, trust rollover, live activation and unattended acceptance are separate gates. Existing contract versions and historical pins are unchanged.

Stacked on #14; merge the parent first.

Adds `PilotRenewalDelegation` 0.6.0-draft.1 for owner-approved thirty-day terms and same-key renewals capped at seven days. Delegations pin exact enrollment instances, retained identity/key/issuer/permission scope, accepted evidence gaps and freshness limits. Revocation is append-only and terminal; automation cannot extend a term or recover membership. Includes positive/negative examples and semantic transition/scope tests. All 122 contract tests pass locally. This is an additive contract; consumers, trust rollover, live activation and unattended acceptance are separate gates. Existing contract versions and historical pins are unchanged. Stacked on #14; merge the parent first.