Block upgrades that change the signer identity

[samuv]

Note

Stack 2 of RFC THV-0080 (tracking issue #5899) — part of stack #6128: #6091 ← #6121 ← #6129 ← #6131 ← this.

Summary

An upgrade re-resolves a mutable source — exactly the moment a compromised or transferred publisher could slip a differently-signed artifact into the pinned trust chain. This PR closes that gap:

• Plan-time signer probe: when a lock entry records a signer identity, planUpgrade verifies the candidate artifact (chain-of-trust only, no install — preview stays install-free) and compares the observed identity against the recorded one. OCI candidates verify directly; git candidates are re-resolved at the pinned commit for their signature material.
• signer-change-blocked status: a differing identity — or an unsigned candidate against a signed entry — blocks the plan with no pinned reference, mirroring ref-change-blocked exactly: preview reports it, --fail-on-changes counts it as a change (exit 2), and a plain upgrade exits with the policy-rejection code (exit 4) pointing at the escape hatch. The blocked outcome carries new_signer_identity so the user sees who signed the candidate.
• --allow-signer-change (CLI, client, API): the explicit override verifies the candidate chain-of-trust-only and re-records the new identity in the lock entry — a deliberate, diff-visible trust rotation rather than a silent one. This is also the recovery path the install-time signer-mismatch error now points at.
• Entries without recorded provenance (unsigned/legacy) are unaffected — no probe, no behavior change.

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Refactoring (no functional changes)
• Test improvements
• CI/CD or build system changes

Test plan

• Unit tests pass locally
• Linting passes (task lint-fix, 0 issues)
• New unit tests: signer-change blocked with the new identity reported and the lock untouched; unsigned candidate blocked against a signed entry; --allow-signer-change upgrades and re-records the new identity; preview parity (same block reported, nothing installed or rewritten); exit-code matrix rows (policy rejection, preview-informational, fail-on-changes interaction).
• task docs regenerated (new flag + API field).

Does this introduce a user-facing change?

Yes, behind the experimental gate: thv skill upgrade refuses to move a skill to an artifact signed by a different identity (or unsigned) unless --allow-signer-change is passed.

Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 54.71698% with 24 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (skills-sig/12-sync-reverify@3a2f05e). Learn more about missing BASE report.

Files with missing lines	Patch %	Lines
pkg/skills/skillsvc/upgrade.go	57.14%	11 Missing and 4 partials ⚠️
pkg/skills/client/client.go	0.00%	7 Missing ⚠️
pkg/skills/skillsvc/verify.go	50.00%	2 Missing ⚠️

Additional details and impacted files

@@                      Coverage Diff                       @@
##             skills-sig/12-sync-reverify    #6132   +/-   ##
==============================================================
  Coverage                               ?   72.47%           
==============================================================
  Files                                  ?      740           
  Lines                                  ?    76358           
  Branches                               ?        0           
==============================================================
  Hits                                   ?    55344           
  Misses                                 ?    17083           
  Partials                               ?     3931           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.