A scope’s meaning is fixed at registration and never redefined. A narrowing change requires a new scope, not an edit — because a verifier written against last year’s registry has to keep giving the same answer. Registration is by pull request against this page.
Every kid this issuer has ever used, active or retired, with the date it left service. A verifier holding a cached JWKS can tell from this page whether a key it still trusts has been retired — which is the check nobody builds and everybody needs after an incident.
One key has ever been in service. There is no rotation history because there has been no rotation, and there is no automated schedule — both are on the gap list.
Anyone may propose a scope. The editor accepts it if it is additive, if its meaning cannot be expressed by composing existing scopes, and if a refusal is representable — a scope with no denial state is a label, not a permission. Rejected proposals stay on the page with the reason.
contract.sign is registered and reserved, and no grant in production carries it. Agents propose; a named human signs. If that changes it will change on this page first, dated, before any agent holds it.