Close Ed25519 signature-strip attack on Strict verification paths

[IanFrelinger]

Summary

Closes the security gap where production verification paths using CertificationVerifyOptions.Strict did not enforce Ed25519 signatures, leaving them vulnerable to signature-strip attacks (limitation 7). Both Default and Strict are now fail-closed, requiring Ed25519 signatures and trust-loop schema (v2+). This closes limitations 7 (signature strip) and 8 (schema downgrade) documented in docs/certification-evidence.md.

Problem

Prior state (per issue description):

• CertificationVerifyOptions.Default was not fail-closed (contrary to claims in some documentation)
• CertificationVerifyOptions.Strict set MinimumSchemaVersion=2 and required gate/certifier inputs, but did NOT require Ed25519 signatures
• Production admission/load paths (FileCertificationRecordStore, CertifiedBrickHotSwapHost, SelfProducedBrickCertificationPolicy, CompositionConstituentChecker, etc.) rely on these verification options
• Attack: Attacker strips ed25519Signature field from a record, recomputes HMAC (using committed dev key or captured key), and the record verifies on production paths
• Documentation overclaimed limitations 7–9 as CLOSED when limitation 7 (signature strip) remained open on live paths

Changes

• CertificationVerifyOptions.Default: Now fail-closed with RequireEd25519Signature=true and MinimumSchemaVersion=2
• CertificationVerifyOptions.Strict: Added RequireEd25519Signature=true to close production path gap
• CertificationVerifyOptions.Legacy: New option for backward compatibility; allows HMAC-only records for migration scenarios
• XML documentation updates:
  • Fixed CertificationVerifyOptions class remarks (no longer claims "every default reproduces today's behaviour")
  • Fixed MinimumSchemaVersion docs (clarified default only applies to Legacy)
  • Fixed CertificationTrustVerifier.Verify param docs (Default is now fail-closed)
  • Fixed CertificationRecordSigner.Verify param docs (Default is now fail-closed)
  • Updated netstandard2.0 comments (Legacy instead of "default")
• Tests:
  • Added Strict_RejectsRecordWithoutEd25519 proving strip-attack rejection under Strict
  • Added Default_RejectsRecordWithoutEd25519 proving strip-attack rejection under Default
  • Added Legacy_AllowsHmacOnlyRecords for migration path coverage
  • Updated IsStrict_ReflectsConfiguredStrictness (Default is now strict)
  • Updated DefaultOptions_AreFailClosed (was ReproduceTodaysBehaviour, now tests fail-closed behavior)
  • Fixed LegacyRecord_SignsAndVerifies, V2Record_HmacOnly_Verifies, and gate tests to use Legacy where appropriate
• Documentation:
  • Updated docs/certification-evidence.md limitation 7: Now CLOSED as of 2026-09-06
  • Updated limitation 8: Now CLOSED as of 2026-09-06
  • Limitation 9 (CompositionCertificationRecordSigner key discard) status unchanged

Testing

• Added focused tests in SchemaVersionFloorTests.cs proving strip-attack rejection under Default and Strict
• Updated existing tests in TrustLoopRecordSchemaTests.cs to use Legacy where HMAC-only records are intentional
• Tests prove:
  1. Signature-stripped records are rejected with ed25519-signature-required under Default and Strict
  2. Legacy option allows HMAC-only records for migration
  3. Dual-signed records still verify under Default/Strict
  4. Schema floor (MinimumSchemaVersion=2) rejects downgraded records

Testing strategy (blast radius)

Change type	Minimum proof (check what applies)
Infrastructure adapter (small / branchy)	Focused unit or gap test in touched file · coverage gate

• Focused tests added in SchemaVersionFloorTests.cs
• make kernel-coverage-gate (touching src/Ashlar.Certification.Contracts and src/Ashlar.Infrastructure/Certification)

Note: Cannot run tests locally in current environment (dotnet SDK unavailable in cloud agent). Tests follow existing patterns in SchemaVersionFloorTests and TrustLoopRecordSchemaTests; CI will validate.

Checklist

• Documentation updated (certification-evidence.md limitations 7-8 marked CLOSED)
• XML docs corrected (CertificationVerifyOptions, CertificationTrustVerifier, CertificationRecordSigner)
• No new TODO or NotImplementedException
• No breaking changes for code using explicit Legacy (migration path preserved)
• make test passes locally (pending CI — dotnet unavailable in agent environment)

Release

• Not a versioned release — skip

Notes

• This PR makes Default and Strict fail-closed by default. Deployments that need to verify HMAC-only (pre-trust-loop) records during migration must explicitly use CertificationVerifyOptions.Legacy.
• Production paths (FileCertificationRecordStore, CertifiedBrickRegistry, CertifiedBrickHotSwapHost, etc.) call .Verify() with no options, defaulting to Default, so they now reject signature-stripped records.
• Limitation 9 (CompositionCertificationRecordSigner discards explicit keys) remains open and is independent of this fix.