Do I need the paid Source of Truth?

No. It works with a knowledge base from the free Source of Truth (Lite) too.

What if there is no knowledge base?

It says so and points to the two skills that build one.

Will it change anything?

Only if it can't find an answer to your question. In this case, it will ask you aloow it to update the `open-questions.md` file. Otherwise, it will only answer questions about your project based on the knowledge base. It never changes code or other documents.

Source of Truth Query

If the token's signature is valid and you passed max_age, it's rejected with SignatureExpired and the message "Signature age -N < 0 seconds". If you didn't pass max_age, it's accepted, because the age check only runs when max_age is given.

The check, step by step

The signature is verified first. The timestamp is protected by the signature, so nobody can change it without the key (architecture.md → Principles; Invariants #3).
If max_age is set, age is the current time minus the token's timestamp, both in whole seconds. age > max_age raises SignatureExpired, and so does age < 0 (architecture.md → Load flow, step 6).
TimedSerializer.loads lets SignatureExpired through right away and doesn't try the fallback signers (architecture.md → Invariants #4).
The exception's date_signed is always set to a UTC datetime (architecture.md → Exceptions).

Why it works this way: the 2.0.0 changelog says a token with a negative age would otherwise "appear valid", which "can happen if the timestamp offset is changed" (decisions.md → #15).

Things to know

Clock skew: if the server that signs the token has a clock ahead of the server that checks it, fresh tokens can fail with `age < 0`. The KB marks this as inferred from the code (architecture.md → Gotchas).

Huge future timestamps: if the signature fails, a timestamp too large to convert becomes BadTimeSignature("Malformed timestamp"). If the signature is valid, the conversion isn't guarded, so a raw ValueError, OSError or OverflowError gets through. The KB rates this Low, since only someone with the real key can make such a token (architecture.md → Gotchas; open-questions.md → Risks).

I checked this against the code: src/itsdangerous/timed.py → TimestampSigner.unsign has the age < 0 check inside if max_age is not None. The test tests/test_itsdangerous/test_timed.py → test_future_age covers it.

Sources: architecture.md → Load flow, Exceptions, Invariants, Gotchas · decisions.md → #15 · open-questions.md → Risks · src/itsdangerous/timed.py → TimestampSigner.unsign

About this skill

Source of Truth Query answers questions about a project from its knowledge base: how something works, where it lives, why a decision was made, what a term means, or what to change for a task. It routes each question to the few documents that cover it, answers in plain words, and cites what it used.

Example (a fictional project)

Where are deleted notes purged?

The knowledge base does not say; the code purges them in the nightly cleanup job.

Sources: src/notes/cleanup → purge_deleted KB gap: not covered by the knowledge base (offer to record it).

Needs

A knowledge base built by Source of Truth or Source of Truth (Lite), by default in knowledge-base/ at the project root. No knowledge base yet? Source of Truth (Lite) builds one for free.

Writes

Nothing, except a row in open-questions.md when you agree to record a gap.

Source of Truth Query