DENY/policy-bundle
Policy bundle invalid or expired
The signed policy bundle failed integrity or freshness checks; the gate fails closed.
What it means
Aarmos verifies the active policy bundle before every decision. If the signature does not verify, the issuer is unknown, or the bundle has expired, all mutating calls are denied until a valid bundle is loaded.
Common causes
- Bundle expired past its `notAfter` timestamp.
- Signature does not verify against the pinned issuer key.
- Bundle was edited by hand after signing.
How to fix
- Re-mint the bundle: `aarmos policy sign` (or your GitOps job).
- Verify locally: `aarmos policy verify ./policy.aarmos.toml`.
- Confirm the issuer key on the device matches the one that signed the bundle.
CLI
aarmos policy verify
aarmos policy sign