S00 Trust Ownership Transition
Status: Frozen Date: 2026-02-18 Working directory: docs/modules/ui/v2-rewire Sprint: 20260218_005, task R0-04
Ownership decision
Administration is the sole owner domain for Trust and Signing. This is a final decision (Pack 21 overrides Packs 9, 11, and 20 on ownership).
No other domain may host trust management screens. Trust management includes:
- Key lifecycle (rotate, revoke, generate).
- Issuer/CA registration and trust configuration.
- Certificate lifecycle and renewal.
- Transparency log configuration.
- Trust scoring policy.
Consumer model
Two domains consume trust state without owning it:
Evidence & Audit (consumer)
- Displays trust indicators on proof chain, attestation, and evidence node views.
- Links to Administration > Trust & Signing > [entity] for management actions.
- Read-only trust status display only; no management surface.
- Preserved entity id must be included in all deep links to Administration trust pages.
Security & Risk (consumer)
- Displays issuer/signature confidence as a decision context field in security findings, advisory sources, and approval tabs.
- Links to Administration > Trust & Signing > Issuers > [issuerId] when an issuer is referenced in a finding or advisory.
- Read-only trust confidence display only; no management surface.
Cross-link contract
All trust management deep links from consumer domains must:
- Navigate to the Administration trust screen that is the canonical owner of the referenced entity.
- Preserve the entity identifier as a route parameter or query parameter.
- Return-navigation must allow the user to return to the originating domain context.
| Consumer page | Link target | Preserved context |
|---|---|---|
| Evidence proof chain node (issuer) | /administration/trust-signing/issuers/:issuerId | issuerId |
| Evidence attestation detail (signing key) | /administration/trust-signing/keys/:keyId | keyId |
| Security finding advisory (issuer trust) | /administration/trust-signing/issuers/:issuerId | issuerId |
| Approval detail — trust confidence indicator | /administration/trust-signing (overview) | none required |
| Security advisory source — signature status | /administration/trust-signing/issuers (filtered) | sourceId as query param |
Alias and deprecation behavior by route family
| Legacy path | v2 canonical target | Action | Notes |
|---|---|---|---|
/admin/trust | /administration/trust-signing | redirect | Sprint 007 |
/admin/trust/keys | /administration/trust-signing/keys | redirect | Sprint 007 |
/admin/trust/issuers | /administration/trust-signing/issuers | redirect | Sprint 007 |
/admin/trust/certs | /administration/trust-signing/certificates | redirect | Sprint 007 |
/admin/trust/:page | /administration/trust-signing/:page | redirect (catch-all) | Sprint 007 |
/admin/issuers | /administration/trust-signing/issuers | redirect | Sprint 007 |
/settings/trust | /administration/trust-signing | redirect | Sprint 007 |
/settings/trust/:page | /administration/trust-signing/:page | redirect (catch-all) | Sprint 007 |
/evidence/trust | /administration/trust-signing | redirect | Sprint 015 (if exists) |
Alias window: trust route aliases are removed at sprint 016 cutover. Legacy /admin/trust/* and /settings/trust/* paths must not remain as primary navigation targets after sprint 007.
Auth scope implications
| Action | Required scope | Notes |
|---|---|---|
| View trust overview and key list | trust:read | Read-only access; auditors and security reviewers |
| View issuer list and trust scoring | trust:read | Read access |
| Create or update key, rotate key | trust:write | Restricted to trust admins |
| Revoke key or certificate | trust:admin | Highest privilege; requires explicit MFA re-auth recommendation |
| Register issuer | trust:write | |
| Configure transparency log | trust:admin | |
| View trust state in consumer domains (Evidence, Security) | No additional scope; inherited from existing page access | Consumer pages do not require trust scope to display trust indicators |
Trust scope constants are now implemented in Authority (StellaOpsScopes.TrustRead, StellaOpsScopes.TrustWrite, StellaOpsScopes.TrustAdmin) and mapped in Platform policy wiring. /api/v1/administration/trust-signing now enforces platform.trust.read (trust:read) and contract row S00-T05-ADM-01 remains EXISTS_COMPAT.
Trust-owner backend mutation routes are now implemented under Platform Administration A6:
POST /api/v1/administration/trust-signing/keys(platform.trust.write)POST /api/v1/administration/trust-signing/keys/{keyId}/rotate(platform.trust.write)POST /api/v1/administration/trust-signing/keys/{keyId}/revoke(platform.trust.admin)POST /api/v1/administration/trust-signing/issuers(platform.trust.write)POST /api/v1/administration/trust-signing/certificates(platform.trust.write)POST /api/v1/administration/trust-signing/certificates/{certificateId}/revoke(platform.trust.admin)PUT /api/v1/administration/trust-signing/transparency-log(platform.trust.admin)
Non-allowed regressions
- Evidence & Audit may not host a
Trust Managementsection or own a trust key/issuer editing surface. - Security & Risk may not host issuer or key management; only trust confidence indicators are allowed.
- Legacy route paths (
/admin/trust/*,/settings/trust/*) may not be kept as primary authoritative routes after sprint 007; they must redirect. - Breadcrumbs on all trust pages must show
Administration > Trust & Signing > ..., neverEvidence > TrustorSecurity > Trust.