Smart Contract Package Signing Policy

The package signing policy inspector gives operators one report before registry approval. It checks allowed signers, missing signatures, audit metadata age, package hash mismatches, registry/release mismatches, and the suggested next action.

Policy File

Example package-policy.json:

{
  "requiredSignerIds": ["user-admin", "auditor-1"],
  "allowedSignerTypes": ["user", "auditor"],
  "minSignatures": 2,
  "auditRequired": true,
  "auditExpiresAfterDays": 90,
  "requiredRegistryStatus": "approved",
  "expectedPackageName": "report-store",
  "expectedPackageVersion": "0.2.0"
}

Inspect A Package

npm run noos -- contracts package-policy inspect --package contract-packages/report-store-0.2.0 --policy package-policy.json --out test-results/contracts/package-policy-report.json --json

Registry-aware mode:

$env:NOOS_OPERATOR_TOKEN="<operator-token>"
npm run noos -- contracts package-policy inspect --package contract-packages/report-store-0.2.0 --policy package-policy.json --registry-id release-report-store-0.2.0 --require-registry --json

Read The Result

The report includes:

• allowedSigners
• presentSignatures
• missingSignatures
• package code, manifest, and descriptor hash checks
• audit metadata presence and expiry checks
• registry/release status and hash comparisons
• suggestedNextAction

Use fail as a hold/reject result. Use warning as a launch-room review item. Only pass should proceed to registry approval without extra waiver evidence.