R-1280: a signed job's validity window is at most 24 h — the verifier, the root wrapper and felhom-opsign. Red-proved. Commit only, not released.

configs/felhom-os-apply

@@ -187,6 +187,8 @@ BUNDLE_PREV_DIR = "/var/lib/felhom-os-apply/bundle-prev"  # the previous copies
 BUNDLE_KEEP = 3
 BUNDLE_MAX_BYTES = 4 * 1024 * 1024
 BUNDLE_RE = re.compile(r"^bundle-[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.]+)?\.json$")
+# R-1280: the longest validity window a signed job may carry — the agent's authz.MaxWindow, the same 24 h.
+MAX_WINDOW_S = 24 * 3600
 OOB_DIR = "/etc/felhom-sshd"
 # R-982: the host's own sshd drop-in (after_install reloads sshd for it; undo reloads after putting it back).
 SSHD_DROPIN = "/etc/ssh/sshd_config.d/10-felhom-root-key-only.conf"
@@ -661,6 +663,8 @@ class Apply:
             iss = calendar.timegm(time.strptime(op["issued_at"], "%Y-%m-%dT%H:%M:%SZ"))
         except (KeyError, ValueError, TypeError):
             raise Refused("R3", "the signed job has no readable time window")
+        if exp - iss > MAX_WINDOW_S:
+            raise Refused("R3", "the signed job's window is longer than 24 h (R-1280)")
         if now > exp or now < iss - 120:
             raise Refused("R3", "the signed job is expired or not yet valid")
         nonce = op.get("nonce")

configs/test_felhom_os_apply.py

@@ -833,6 +833,14 @@ class DockerLane(unittest.TestCase):
     def test_expired_signed_job_is_refused(self):
         self.refused(docker_fake(signed=signed_job(expires="2026-10-04T11:55:00Z")), "R3")
 
+    def test_a_window_longer_than_24h_is_refused(self):
+        # R-1280. RED-PROOF: drop the MAX_WINDOW_S check → the job (current, signed, 24 h + 1 s) runs.
+        self.refused(docker_fake(signed=signed_job(issued="2026-10-03T11:59:59Z", expires="2026-10-04T12:00:00Z")), "R3")
+
+    def test_a_window_of_24h_is_accepted(self):
+        rc, rep = run(docker_fake(signed=signed_job(issued="2026-10-03T12:30:00Z", expires="2026-10-04T12:30:00Z")))
+        self.assertNotEqual((rep.get("refused") or {}).get("code"), "R3", rep)
+
     def test_replayed_signed_job_is_refused(self):
         f = docker_fake(signed=signed_job())
         f.nonces = {"n1": f.clock + 600}