[blocksifrdev]

Scope

Closes no deployment gate. Advances #90 with a non-production, source-level synthetic regression fixture that uses the existing BlockSiFr TTP TrustDecay / TrustRoute authority path. No new commercial product, production credentials, external SAML calls, configuration changes, or PR merge.

What changed

• retired-key-assurance.js: read-only assessment of known issuer/key/relying-party edges. Requires host-pinned Ed25519 observer verification, exact issuer/key/run/party scoping, timestamp age, and same-challenge binding for upstream acceptance vs downstream block.
• retired-key-assurance.test.mjs: 9 synthetic cases, including RSA-SHA256 key rollover, stale manually pinned SP accepting retired K1, TTP revoked-path DENY, unknown-edge preservation, forged/stale/wrong-scope observer signatures, an observed unprotected effect, and unrelated challenge block rejected as assurance.
• docs/cfav-retired-saml-signing-key-evidence.md: explicitly separates synthetic evidence from live SAML XML interoperability and enterprise enforcement.

Test evidence

Local Node 22 test run: node --test packages/trust-routing-engine/tests/retired-key-assurance.test.mjs 9 pass / 0 fail. Existing repo-wide CI has not yet been observed, and no live native SP was tested.

Threat / consequence distinction

The expected counterexample is an SP that retains retired K1 and accepts a fresh K1-signed synthetic assertion. Existing TrustRoute rejects a revoked path for a simulated protected effect, but this does not imply native SAML SP rejection, universal coverage, or production authorization hardening.

Review gates / blockers

• Require reviewer signoff for security semantics; keep draft until broad CI and targeted review complete.
• Prove complete trust-edge inventory or retain UNKNOWN.
• Follow CFAV: Prove TrustDecay rejects retired SAML signing keys at relying-party boundary #90 for actual approved SAML XML SP staging, issuer-cert trust snapshots, independent native-effect observation, bypass and distributed revocation tests.
• Do not claim post-quantum readiness, cryptographic break, or production-certified SAML retirement based on this fixture.

Issue: #90.