2026-04-13

Signed Policy Manifests In Practice

How Aletheia Core uses Ed25519 signatures to enforce policy integrity and fail closed when configuration drifts.

securitypolicyed25519

Why Manifest Signing Matters

Unsigned policy files are mutable control planes. If an attacker can alter policy, they can silently downgrade enforcement.

Aletheia Core treats policy as signed configuration, not trusted local state. That keeps runtime behavior pinned to approved intent.

At startup, the backend verifies a detached Ed25519 signature for manifest/security_policy.json before loading restrictions.

If verification fails, startup is denied for privileged flows. This protects against drift, tampering, and stale deployment artifacts.

Update the manifest in version control, sign it in CI or release workflow, and pin expected hashes per environment.

This gives reproducible policy promotion while preserving a hard fail-closed posture in production.