const JEKT_SIG_MAX_AGE_SECS: i64 = 300;Expand description
Max age (seconds) a signed jekt’s ts_secs may be from “now” and still
verify (SPEC_JEKT_TRUST_LAYER_COMPLETION_2026_08_13.md §2.2, anti-replay
— reagentx P1 on PR #2565: ts_secs was bound into the signed material
specifically for this purpose per jekt_sign.rs’s own doc comments, but
nothing actually checked it, so a captured valid signature verified
forever). Generous enough for normal host-tier delivery latency and
modest clock skew between the signing agent process and this srv
instance (same machine, but not guaranteed same clock read down to the
second); tight enough to bound replay to a narrow window instead of
indefinite reuse.