Platform local signing key rotated and authentication reverified

With operator authorization, Platform replaced only the RSA signing key and key ID in its ignored .env.local. The new key is RSA-3072 with public key ID local-rotation-9dff147a-a83c-4783-bf86-e22714eb9f56. No production credentials or configuration were changed. The new private key was not printed in diagnostic output or committed.

Platform restarted through dev:mesh on localhost:3000. The live JWKS contains exactly the new public key; its modulus differs from the prior key and the old public key is absent. Authenticated canonical Person read, operator token issuance, signature verification using live JWKS, expected issuer/audience/subject/organization and 300-second lifetime all pass. Anonymous token issuance returns 401. The proof removed its temporary synthetic operator session. Browser verification found the expected operating surface and sign-in controls with no reported browser errors.

The local rotation blocker in the prior handoff is resolved. Delivery and Revenue must discard prior local bearer tokens and reload any cached local JWKS, preferably by restarting their local services, before requesting a fresh process-only proof bearer. Removal from the current JWKS does not invalidate keys already cached by another running verifier. No sibling service was restarted or edited by Platform. At the final mesh check, Delivery and Revenue were stopped, Platform returned HTTP 200, and the dispatcher worker was stopped.

Fanout and external actions remain disabled; all six configured consumer destinations are localhost. The Sales/Coaching assessment requested in 2026-09-22-platform-local-fanout-containment remains a separate hold. This rotation does not claim incident resolution, Delivery-to-Revenue acceptance, sandbox purchase completion or production enablement.