[kruton]

Successful finalizer completions currently return 403 workflow not eligible, incrementing webhook_dispatch failures and raising alerts despite successful signing. Signer commit a51fe2fa137457fa786236089872e6343e16dcdb returns HTTP 200 with {"ignored":true} for authenticated completions from unrelated workflows in configured repositories. Authentication, repository identity, and eligible signing-request validation remain enforced.

Only signer_revision changes. Version 3, policy revision 7, policy hash, certificates, key identities, full Play lineage, API 33 rotation and allowed workflows remain unchanged. Native policy export confirms the public fields; the existing deployment hash is retained exactly. Pending dynamic TUF work is excluded.

Validation:

• All 14 isolated Rust library tests and 15 Python tests pass.
• The exact commit builds with the pinned Hermit toolchain.
• Read-only QEMU smoke passes: unrelated completion returns 200, enqueues no job and adds no dispatch failure; invalid authentication is rejected and eligible requests fail closed during collector outage.
• Pre-deployment scans report no high-priority findings.
• Image SHA-256: 1dbe168cce00291c3a94ef8a699c3c3f33fed996356169bddbb439b81a46c787.

The tested image is staged in a private pending directory on the signer host. Activation waits for this reviewed source pin to reach main, then rechecks the active image/configuration and empty queue before restarting the VM. No signing configuration, keys or collector deployment changes are required.