Signing kernel (SPEC-006 v1): canonical JSON + operator key, gate records signed fail-closed

[IanFrelinger]

Signing kernel (SPEC-006 v1): canonical JSON + operator key, gate records signed fail-closed

What this is

The kernel half of SPEC-006 v1: a single local operator Ed25519 keypair, presence-activated
signing, and gate records that verify fail-closed on read. No CLI verb yet — this is the
Ashlar.Manifest.Signing machinery plus its wiring into the admission store, so the next slice
(ashlar keys init and signing on gate admission) has a tested foundation to stand on.

What landed

• Signing/CanonicalJson.cs — the canonical byte form every signature covers: UTF-8 JSON,
  object keys sorted ordinally at every depth, arrays left in order, null-valued properties
  omitted, no insignificant whitespace. Signer and verifier derive bytes through this one method,
  so they agree byte-for-byte regardless of in-memory key order.
• Signing/OperatorKey.cs — Ed25519 keygen / load / fingerprint / sign / verify over NSec.
  Key dir is ASHLAR_KEY_DIR or ~/.ashlar/keys; the seed is owner-only on POSIX; the private
  key never appears in a record, bundle, or output. Rotation retains the old public key under
  trusted/ so old records still verify (revocation is v2). TryLoad returns null when there is
  no key — absence degrades to today's honest unsigned behaviour (S-2).
• Admission/GateStore.cs — GateRecord gains Sig + Signer. A store constructed with a
  signer signs every record it writes; one without a signer writes unsigned (presence-activated,
  never half-signed). ReadRecordAsync verifies fail-closed: a record whose signature does not
  cover its contents is treated as corrupt and refused loudly (S-1) — a forged verdict is
  worse than a missing one. Verification is intrinsic to the record, so a fresh checkout with no
  key still detects tampering.

Rules honoured

• S-1 bad signature = corrupt, throw. S-2 no key = unsigned, never half-on. S-3 the
  renderer never prints a fingerprint for an absent signature (Sig/Signer are nullable and
  independent). Org trust roots, revocation, and HSM are explicitly v2 and are not pretended
  here.

Two bugs an adversarial review caught (fixed, with regression tests)

A four-lens adversarial review (canonicalization / forgery / key-handling / store-integration),
each finding independently refuted before being trusted, confirmed two real defects — the
canonicalization lens was fully refuted (single code path, no nullable fields in the record graph):

1. WriteAsync was asymmetric (HIGH). The keyless write path had no else, so a record read,
   mutated, and rewritten by a store without a key (DecideAsync: Held → Admitted) kept the old
   signature covering the pre-mutation content. The next fail-closed read would then reject a
   legitimate verdict as forged — and because ListAsync throws on it, the whole store
   enumeration (and the budget check that rides on it) would go down. Fixed: the write path is now
   symmetric — always strip to the unsigned form, then sign iff a key is present. Never persist a
   signature not just computed over exactly these bytes.
2. Non-atomic keypair write (HIGH).Generate wrote operator.key then operator.pub as two
   independent writes; a crash mid-rotation (old seed already gone) could strand a new seed beside
   an old pub, and TryLoad trusted the pair blindly — so every record it signed would fail its
   own signature. Fixed two ways: each file is now written crash-safely (temp then rename, owner-
   only perms set on the temp before the move), and SigningIdentity enforces an invariant — it
   derives the public key from the seed and refuses a mismatched pair loudly, turning silent
   store-poisoning into a clear, recoverable error.

Verification

• Kernel suite: 346 / 346 (323 prior + 23 signing, including 3 regression tests pinning the two
  fixes above; zero regressions in the existing race / crash-safety / fuzz / admission tests that
  all exercise GateStore).
• Cert gate: 178 / 178.
• Ashlar.Manifest builds clean on net8.0 + net10.0, 0 warnings under TreatWarningsAsErrors;
  NSec resolves on both TFMs.

All builds and tests run container-side (scripts/handoff/devbox.sh) per the standing setup.