From ae27a42b18c7ce54490185c684246b5d9df3496e Mon Sep 17 00:00:00 2001
From: codex <codex@local>
Date: Sat, 5 Sep 2026 17:58:01 +0200
Subject: [PATCH] Require signature rejection in predecessor acceptance

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883
---
 scripts/state_hub_signing_acceptance.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/state_hub_signing_acceptance.py b/scripts/state_hub_signing_acceptance.py
index f13ffcc..4a832ea 100644
--- a/scripts/state_hub_signing_acceptance.py
+++ b/scripts/state_hub_signing_acceptance.py
@@ -27,7 +27,7 @@ if token:
 old_rejected=None
 if x.get('old_token'):
  try: _verify_preflight_token(x['old_token'])
- except RenamePreconditionFailed: old_rejected=True
+ except RenamePreconditionFailed as e: old_rejected=str(e)=='Invalid repository rename preflight token'
  else: old_rejected=False
 print(json.dumps({'key_matches':hmac.compare_digest(settings.repository_rename_preflight_secret or '',x['key']), 'signed_preflight_valid':valid, 'old_token_rejected':old_rejected, 'blockers':[b.get('code') for b in report['blockers']], 'token':token, 'health':health.get('instance_role')=='primary' and health.get('instance_label')=='railiance01'}))
 '''