[andersalm]

The custodian signer can now sign a publisher-keys statement under an explicit trusted publisher-keys role. Release manifests are refused in that role; statement manifests are refused by the default release role. Candidate input supplies data only, while the approved policy selects the signing domain, source authority, key and time/version bounds.

This is the first code part of #213. It emits one verified root signature, including a partial root handover, and allows an empty delegate list to revoke all release keys. The legacy release path remains available for the approved first M1/M2 hop in #89. Client admission, dual-signature assembly, publication, installer trust and repeated real M1/M2 are outstanding; the draft activates none of those paths. Freshness values and the client/head contract remain subject to #157 and the design discussion.

Validation: 49 public-data/fake-backend signer tests passed, including refused roles, malformed input, approved-hash mismatch, roots/delegates, version rollback, expiry/future skew, fixed time, held descriptors, links, quotas, cancellation and backend failures. The existing ReleaseSignerInputTest CI entry point passed. Entropy, formatting and diff checks passed. Independent development review: PASS; different-family adversarial review remains a later ready gate.

[andersalm]

Independent development review (Codex): reviewed the current signer-role change and its three files against #213, #157 and #89. VERDICT: PASS.
The trusted policy selects role/domain; strict source and approved-hash admission precede key-backend creation, with a second source check after confirmation. Typed time/version bounds, roots/delegates, held descriptors, quotas and one-signature partial-handover output were checked.
All 49 public-data/fake-backend signer tests and diff checks passed. This covers the partial signer concern; the different-family adversarial verdict, client contract, complete handover and real installed acceptance remain separate gates.

[andersalm]

Independent development review (Codex): PASS for the current candidate. Both custody roles retain channel-specific source admission: canary uses approved develop; stable and jetson-test require the matching main tag. The correction is covered by 50 signer tests, including refusal before backend creation; the basic gate passed. The normal merge inherits PR220 unchanged and is compatible. Current CI is running. This development review is separate from the required different-family adversarial review.

[andersalm]

Moved to After 0.8.0: not in the install/update list for 0.8.0 (#89 Remaining for 0.8.0).