SmartScreen reputation not accumulating — same Artifact Signing profile rotating between AOC CA 04 and EOC CA 04 across builds

Requesting verification of SmartScreen reputation propagation for our

Azure Artifact Signing identity. Providing the three data points that

Microsoft moderators have requested in related threads, for two builds

from the SAME account, profile, and subject.

Account / profile: navisigning / naviPublicTrust (Public Trust,

Korea Central, krc.codesigning.azure.net). Organization identity

validation completed 2026-09-06.

Subject: CN=Acute, O=Acute, L=Seoul, ST=Seoul, C=KR

Build A (2026-09-06):

1. Signing timestamp: 2026-09-06 15:09:25 UTC (RFC3161 via timestamp.acs.microsoft.com)
2. Intermediate CA: Microsoft ID Verified CS AOC CA 04
3. SHA-256: available on request (superseded build)

Build B (2026-09-10 — current production, frozen):

1. Signing timestamp: 2026-09-10 04:15:42 UTC (RFC3161 via timestamp.acs.microsoft.com)
2. Intermediate CA: Microsoft ID Verified CS EOC CA 04 (leaf serial 330005BB8B5C8413D9D8786BD400000005BB8B)
3. SHA-256: 647c77c6fcd8c8b5c4a3dd6fb3002e2c5ba4175f8b6a1dc6b101e4aefb2bb994 (30,690,112 bytes)

Both builds: signature verifies with 0 errors, timestamp valid, chain

complete, publisher displays as "Acute" in the file's Digital

Signatures tab. Behaviour is unchanged for both: Edge shows "isn't

commonly downloaded" at download and SmartScreen shows "Windows

protected your PC — unrecognized app" at run.

Note the issuing intermediate rotated from AOC CA 04 to EOC CA 04

between builds with no change on our side. This appears potentially

related to the reputation-propagation reports tracked in

https://github.com/Azure/artifact-signing-action/issues/128, though we

cannot distinguish that from ordinary new-publisher reputation buildup

on our end.

Question: can you verify whether SmartScreen reputation propagation is

complete for this signing identity across the rotated intermediates

(AOC CA 04 / EOC CA 04) — i.e., does publisher reputation accrue to

the durable identity EKU across chains, or separately per intermediate?

We have frozen the Build B binary as our long-term production artifact,

so all future download signals will accrue to that single hash.