DESIGN.md

@@ -123,9 +123,11 @@ means a future route cannot pass a string where a proof belongs.
 
 `revoke <agent>` with no end time is permanent: the enrolled public key is
 cleared and the identity stays dead until someone bootstraps a fresh secret and
-rekeys (or re-enrols). `reinstate` alone lifts the ban flags but does **not**
-restore the compromised key — that was the footgun. `revoke <agent> --until
-<unix>` is a pause that keeps the key, and it lapses on its own.
+calls `enrol_rekey` (then `reinstate` if still banned). `enrol` will not work —
+the agent row still exists — and would only burn the seed. `reinstate` alone
+lifts the ban flags but does **not** restore the compromised key — that was the
+footgun. `revoke <agent> --until <unix>` is a pause that keeps the key, and it
+lapses on its own.
 
 The distinction matters because the two failure modes are different. A key
 compromise wants death — a lapsing revocation would hand the attacker back in
@@ -228,7 +230,7 @@ because the review looked for it.
 
 ## Status
 
-106 passing tests, and two hardening passes that closed real defects. The worst were
+156 passing tests, and two hardening passes that closed real defects. The worst were
 concurrency: one-time codes were redeemable repeatedly (753 sessions from 200
 codes under load), and a bootstrap secret could enrol more than one key. Those
 are now atomic compare-and-set operations, each covered by a test that races

README.md

@@ -55,7 +55,7 @@ python3 sigil.py sweep                                # prune stale rows
 python3 -m unittest discover -s tests -v
 ```
 
-130 tests. They cover the refusals, not just the happy paths: replayed
+156 tests. They cover the refusals, not just the happy paths: replayed
 signatures, wrong keys, expired nonces, single-use codes, scope escalation, and
 the invariant below. `test_hardening.py`, `test_production.py`, `test_anchor.py` and
 `test_sealed.py` have one test per defect found in review, so any of them

sigil/identity.py

@@ -78,6 +78,10 @@ def enrol(
     _validate_agent_id(agent)
     if not store.allow(f"enrol:{agent}"):
         raise errors.RateLimited(f"too many enrolment attempts for {agent}")
+    # Already enrolled (e.g. after permanent revoke): refuse *before* spending
+    # the seed so ops following a wrong "re-enrol" path do not burn it.
+    if store.get_agent(agent) is not None:
+        raise errors.EnrolmentFailed(f"{agent} is already enrolled; use enrol_rekey")
     # Spend the secret first so a burned secret cannot be retried. The agent
     # row insert below is INSERT OR IGNORE: if two secrets race for the same
     # unenrolled agent, exactly one put_agent wins and the loser fails closed

sigil/store.py

@@ -352,9 +352,9 @@ class Store:
         """Suspend an agent. `until` of None is permanent.
 
         A permanent revoke clears the enrolled public key so `reinstate` alone
-        cannot restore a compromised identity — ops must bootstrap + rekey
-        (or enrol) before the agent can authenticate again. Timed suspension
-        keeps the key: when the pause lapses, the same key works.
+        cannot restore a compromised identity — ops must bootstrap + enrol_rekey
+        before the agent can authenticate again. Timed suspension keeps the
+        key: when the pause lapses, the same key works.
 
         Returns how many live sessions were killed.
         """
@@ -788,9 +788,13 @@ class Store:
 
         public = _keys.public_from_private(private)
         fingerprint = _keys.fingerprint(public)
+        from . import identity as _identity
+
         agent_row = self.get_agent(signer)
         if agent_row is None:
             raise ValueError(f"{signer} is not enrolled, so cannot sign a checkpoint")
+        if _identity.is_revoked(agent_row):
+            raise ValueError(f"{signer} is revoked, so cannot sign a checkpoint")
         enrolled_fp = agent_row["fingerprint"] or ""
         if not enrolled_fp or fingerprint != enrolled_fp:
             raise ValueError(

tests/test_production.py

@@ -531,3 +531,36 @@ class TestKeyHistoryKeepsCheckpointsVerifiable(unittest.TestCase):
         self.assertNotIn("privkey", cols)
         row = store.conn.execute("SELECT * FROM agent_keys WHERE agent = ?", ("carol",)).fetchone()
         self.assertEqual(len(row["pubkey"]), 32)
+
+
+class TestEnrolAfterPermanentRevoke(unittest.TestCase):
+    """N4: enrol must not burn the seed when the agent row still exists."""
+
+    def test_enrol_after_permanent_revoke_does_not_burn_seed(self):
+        store, private = helpers.fresh()
+        identity.revoke(store, "bigpickle", reason="compromise")
+        identity.reinstate(store, "bigpickle")
+        secret = identity.seed_bootstrap(store, "bigpickle")
+        with self.assertRaises(errors.EnrolmentFailed) as ctx:
+            identity.enrol(
+                store, "bigpickle", keys.export_public_b64(keys.generate()[1]), secret
+            )
+        self.assertIn("enrol_rekey", str(ctx.exception))
+        # Seed still usable for the correct path.
+        identity.enrol_rekey(
+            store, "bigpickle", keys.export_public_b64(keys.generate()[1]), secret
+        )
+
+
+class TestSuspendedSignerCannotCheckpoint(unittest.TestCase):
+    """N5: timed-suspended signer must not checkpoint."""
+
+    def test_timed_suspend_refuses_checkpoint(self):
+        import time
+        store, private = helpers.fresh()
+        identity.revoke(
+            store, "bigpickle", until=int(time.time()) + 3600, reason="pause"
+        )
+        with self.assertRaises(ValueError) as ctx:
+            store.checkpoint(private, "bigpickle")
+        self.assertIn("revoked", str(ctx.exception).lower())