# Quantum-Sign — Maintainer Playbook (Level-5)

## Policy & trust
- Create `policy.json`:
  ```json
  {"default_alg":"mldsa-87","allow_algs":["mldsa-87"],"m_of_n":[2,2],
   "offline_ok":true,"require_fips_only":true,"require_level5":true,"digest_alg":"sha512"}
  ```
- Generate keys:
  ```bash
  quantum-sign keygen --profile mldsa-87 --secret keys/alice.sk --public keys/alice.pub
  ```
- Import into trust store (derived `KID` is printed):
  ```bash
  quantum-sign trust import --public keys/alice.pub --trustdb ./trust
  ```
  Trust entries live at `trust/<KID>.spki`; the `KID` is the first 16 hex chars of the SPKI hash.

## Release flow (detached `.qsig`)
```bash
# 1) intent + journal
quantum-sign quorum init \
  --artifact dist/app.tar.gz \
  --digest sha512 \
  --policy policy.json \
  --intent rel.qsi

# 2) maintainers cosign (repeat for each signer, using --append for the journal)
quantum-sign quorum cosign \
  --intent rel.qsi \
  --secret keys/alice.sk \
  --public keys/alice.pub \
  --fragment fragments/alice.csf \
  --append rel.qsig.part

# 3) seal
quantum-sign quorum seal \
  --part rel.qsig.part \
  --out dist/app.qsig \
  --trust-dir trust
```

## Policy rotation
- Import the new key with `trust import`.
- Update policy JSON (keep M-of-N satisfied).
- Produce one release signed by both old and new maintainers.
- Remove the retiring key from `trust/` once rollout is complete.

## CI expectations
- `.github/workflows/e2e.yml` runs fmt, clippy, tests, Level-5 end-to-end flows, no-std checks, and fuzz smoke.
- Keep `cargo deny` / `cargo vet` metadata fresh when upgrading dependencies.

