{"version":"2.1.257","anchor":"new-signed-cache-shadow-verification-telemetry-only","canonical_anchor":"new-signed-cache-shadow-verification-telemetry-only","heading":"New signed-cache shadow verification (telemetry-only)","tier":"soon","area":"Settings","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.257\/e\/new-signed-cache-shadow-verification-telemetry-only","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.257","markdown":"### New signed-cache shadow verification (telemetry-only)\n\nManaged-settings and policy-limits caches are signature-checked against embedded trust roots, but only report telemetry for now.\n\nA new signature-verification path checks managed-settings and policy-limits caches against embedded trust roots, using JWS with an x5c certificate chain and ES256. It computes age, cert-expiry, and chain-validation results, but currently only emits telemetry (`tengu_signed_cache_shadow`) rather than enforcing anything, as a shadow rollout of cache integrity checking.\n\n- Area: Settings\n- Tier: Nothing to try yet\n- Useful: 3\/5\n- Signal: 4\/5\n- Present in the build but not switched on"}