[MakerFlyFly]

Summary

• Validate the primary and all usable signing subkeys using the existing strength rules, and require a usable compliant signer. A strong certify-only primary no longer hides a weak, expired or missing signer.
• Honour GPG validity e on the expiry date: a retired weak subkey does not block a compliant replacement, while an already-expired only signer is blocked. Expired primary keys also stay blocked, and expired records do not receive a non-blocking expiry advisory.
• Keep the ten JSON fields, primary metadata, CLI exit codes and algorithm rules stable. --today affects calendar-date checks/advisories; it does not recompute GPG validity or change its clock. Five added eval cases cover the original gap and the reviewed expiry boundary.

Type of change

• Skill change — deterministic sibling script; eval fixtures updated
• Tool / bridge contract
• Python package
• Groovy reference impl
• Cross-cutting
• Documentation — output specification, eval inventory and affected lifecycle specification
• Project template
• CI / dev loop
• Other: bug fix

Test plan

• Seven F1 regression tests fail on 62322ff4; after the fix, all 61 keys-sync tests pass with no skips. The tests cover expired same-day subkeys, expired primaries, earlier date overrides, advisories and CLI compatibility.
• All nine sibling-script suites: 240 tests pass with no skips, including the 61 keys-sync tests.
• Fresh isolated GPG 2.2.40 generation/import/signing: two profiles across before-expiry, expired-today and next-day instants produce the six expected results. CLI replay agrees with the helper; four direct --key-file/date-override checks pass.
• The original eight real-GPG admission scenarios still pass after F1.
• Both new fixture payloads match the production helper and pass the deterministic fixture grader.
• Both new F1 eval cases pass on GPT-6-luna and on targeted GPT-6.1-sol rechecks after CLI errors.
• Entire model eval is green: this run's GPT-6.1-sol Step 1 suite has 4/8 passes and 4 CLI errors; GPT-6-luna has 7/8 passes, with an existing missing-key case copying the fingerprint short. Raw initial runs and rechecks are retained. Step 0/2 and their earlier failures are outside this follow-up and were not rerun or weakened.
• Ruff check, Ruff format check, strict mypy on the helper and git diff --check pass.
• prek run --all-files passes in the matching Linux Git snapshot with --init; the normal repository checks also pass in the commit hook.
• Magpie pre-first-pr-check: A–E pass, Ready, 0 blocking/advisory items.

RFC-AI-0004 compliance

• HITL — fork-only Draft PR awaiting the owner's audit; release-manager command boundaries remain intact.
• Sandbox — public-key validation retains its temporary keyring; no new runtime network access or signing operation.
• Vendor neutrality — existing framework and fixture conventions retained.
• Conversational + correctable — the mixed-key admission policy and date semantics are explicit for review.
• Write-access discipline — this fix and fork PR update are authorised by the owner; no review or merge is submitted.
• Privacy LLM — eval inputs contain only public repository fixtures and disposable key metadata.

Linked issues

Refs #8.

Notes for reviewers

The F1 follow-up accepts the independently reproduced same-day expiry finding and uses GPG's computed expired status consistently in checking and retirement.
It preserves the advisory for same-day records not marked expired.
An earlier --today cannot reactivate a key marked e; historical replay uses a listing captured at the intended instant.
An additional timestamp engine or GPG clock override is unnecessary for this fix and is not introduced.

The deliberate policy of blocking an active weak signing subkey alongside a compliant signer is retained.
The downstream commands do not pin a compliant subkey, so every usable signer is checked.
This is the helper's conservative admission policy, rather than an explicit ASF mandate for mixed key groups.

Runtime changes stay in the helper and its tests; the follow-up adds two eval scenarios and related specification/count updates.
The original review document is preserved, with a separate local point-by-point disposition and evidence record.
Validation snapshots and model-eval mirrors were verified against this Windows checkout's bytes; no repository hook was bypassed.

AI disclosure: this AI-generated draft and implementation were prepared with OpenAI Codex (GPT-6).
The PR remains Draft for human audit and is not represented as human-reviewed or ready to merge.