Last updated Jun 14, 2026

Rekor offline recovery (SEV2)

Triggered by: Rekor (Sigstore) anchor cron fails to write for ≥ 1 hour. Per P0.C4 + the local-cosigning fallback, audit operations continue via the secondary witness key.

Stop-the-bleed

1. Verify Rekor is genuinely offline (their status page + independent probes).
2. Verify local-cosign fallback engaged automatically:

   matter ops anchor-status

   Should show fallback=cosign_local.

Diagnose

Operations continue under the local witness. The audit chain still anchors per-day. The accumulated unanchored window must be backfilled to Rekor on recovery.

matter ops anchor-pending-count

Returns the count of audit-chain segments awaiting Rekor backfill.

Recover (when Rekor returns)

matter ops anchor-backfill --since <incident_start>

Walks the pending segments in commit-time order, anchors each to Rekor, updates the per-segment Rekor reference.

Validate

matter ops verify-anchor-state

Expected:

• Every audit-chain segment since <incident_start> has a Rekor reference.
• The customer-facing verifier path (P0.C4) returns the canonical Rekor proof.

Communicate

• Status page if Rekor outage extends > 4 hours (customers may notice slower verification).
• No customer email if the fallback held without breakage.

Post-recovery

1. Document the outage in apps/docs/security/threat-model.mdx.
2. If the fallback witness key was ever the only anchor for > 24 hours, rotate that witness post-recovery.