From e022b826e62f1ff188ac793a97801a5e6e0fffa5 Mon Sep 17 00:00:00 2001
From: dawn <90008@klbr.net>
Date: Thu, 23 Jul 2026 01:17:21 +0300
Subject: [PATCH] [relay] log sig failures that happen for the first time

---
 src/ingest/relay/context.rs | 20 ++++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

diff --git a/src/ingest/relay/context.rs b/src/ingest/relay/context.rs
index a30c122..e210a93 100644
--- a/src/ingest/relay/context.rs
+++ b/src/ingest/relay/context.rs
@@ -173,7 +173,11 @@ impl WorkerContext<'_> {
                 trace!("skipping replayed commit");
                 return Ok(None);
             }
-            Err(CommitValidationError::SigFailure) => {}
+            // a sig failure may just mean our cached signing key is stale;
+            // refresh the identity doc and retry before treating it as a real failure.
+            Err(CommitValidationError::SigFailure) => {
+                debug!(%did, "commit signature failed, refreshing signing key");
+            }
             Err(e) => {
                 debug!(err = %e, "commit rejected");
                 return Ok(None);
@@ -190,6 +194,10 @@ impl WorkerContext<'_> {
         );
         match validation {
             Ok(v) => Ok(Some(v)),
+            Err(CommitValidationError::SigFailure) => {
+                warn!(%did, "commit signature verification failed after key refresh");
+                Ok(None)
+            }
             Err(e) => {
                 debug!(err = %e, "commit rejected after key refresh");
                 Ok(None)
@@ -212,7 +220,11 @@ impl WorkerContext<'_> {
         );
         match validation {
             Ok(v) => return Ok(Some(v)),
-            Err(SyncValidationError::SigFailure) => {}
+            // a sig failure may just mean our cached signing key is stale;
+            // refresh the identity doc and retry before treating it as a real failure.
+            Err(SyncValidationError::SigFailure) => {
+                debug!(%did, "sync signature failed, refreshing signing key");
+            }
             Err(e) => {
                 debug!(err = %e, "sync rejected");
                 return Ok(None);
@@ -229,6 +241,10 @@ impl WorkerContext<'_> {
         );
         match validation {
             Ok(v) => Ok(Some(v)),
+            Err(SyncValidationError::SigFailure) => {
+                warn!(%did, "sync signature verification failed after key refresh");
+                Ok(None)
+            }
             Err(e) => {
                 debug!(err = %e, "sync rejected after key refresh");
                 Ok(None)
-- 
2.51.2