Adopt signed Registry Stack config bundles with 1Password-backed key custody

[jeremi]

Context

Solmara's Registry Stack v0.15.2 adoption now generates separate public and private-consultation Relay closures for all six authorities. Hosted deployment requires twelve instance-bound, signed Relay bundles at SOLMARA_RELAY_BUNDLE_SEQUENCE=2.

The repository still contains the prior six sequence-1 combined bundles. Their public trust anchors refer to the Ed25519 key solmara-hosted-relay-config-2026-07-25, but no recoverable private JWK location is known. Treat that private key as unavailable rather than attempting to reconstruct or copy it from an unsafe location.

This issue also retains the broader signed-baseline work for Relay and Notary. It stays separate from the v0.15.2 code adoption because it owns signing authority, secret custody, trust-anchor rotation, activation, rollback, and recovery decisions.

Outcome

Rotate to a new hosted configuration-signing key, keep the private JWK in a restricted 1Password vault, publish only public verification material, regenerate and verify all hosted bundles, and complete the signed-baseline workflow without exposing signing material.

Immediate v0.15.2 release gate

• Generate a new Ed25519 private/public JWK pair on a trusted workstation outside the repository.
• Store the private JWK as a restricted 1Password item or document with an explicit owner and minimum required access.
• Record the 1Password vault/item reference, access-recovery owner, and rotation date in private operational documentation, without copying the private JWK into GitHub, CI variables, shell history, or public docs.
• Define a safe local signing procedure. If op CLI materializes the key, use a mode-0600 temporary file, avoid command tracing and stdout, and delete the file immediately after signing.
• Commit only the public JWK/trust anchors and signed artifacts.
• Regenerate all twelve public and consultation Relay bundles at sequence 2 with Registryctl v0.15.2.
• Review the public-versus-consultation closure diff and verify that no private consultation artifact appears in a public bundle.
• Run just hosted-relay-bundles-check, just lint, and the release-candidate image-level verification across all twelve bundles.
• Build the hosted Relay wrapper from the pinned v0.15.2 Relay digest and confirm every embedded bundle verifies at sequence 2.
• Document how an operator retrieves the key for an authorized rotation and how access is revoked or recovered when the custodian changes.

Broader signed-baseline acceptance criteria

• Define the signing authority, trust-anchor distribution, and rotation model for both Relay and Notary.
• Package and sign the Relay and Notary configuration closures for each authority project.
• Verify signatures and immutable bundle identity before hosted activation.
• Run registryctl check and registryctl build with the paired --against and --anchor inputs.
• CI fails closed on a missing, invalid, stale, or mismatched baseline.
• Review output reports verified_signed_bundle and retains semantic change evidence.
• Document rollback and key-rotation procedures, including anti-rollback sequence handling.
• Preserve a safe local development workflow with no committed private keys or raw tokens.

Verification

Exercise one realistic authority end to end first, then expand the same reviewed procedure to all six authorities and run the normal Registry Stack project, runtime reproducibility, security, Compose, live smoke, and hosted-image gates.

[jeremi]

v0.15.2 hosted Relay signing progress

The immediate hosted Relay release gate is complete:

• Rotated to a new Ed25519 Config Bundle signing key held in 1Password.
• Updated the generator to pass an op:// secret reference directly to Registryctl, so routine bundle generation does not create a private-key file in the repository or working tree.
• Generated separate public and consultation bundle streams for all six authorities, twelve bundles total, at sequence 2.
• Reviewed the generated closure: public bundles contain no consultation artifacts; consultation bundles contain the complete compiler output; no private JWK member appears in committed artifacts.
• just hosted-relay-bundles-check passes across all twelve streams.
• Rebuilt the hosted Relay wrapper from the pinned Registry Relay v0.15.2 digest. The wrapper reports registry-relay 0.15.2.
• All twelve embedded bundles pass the release-candidate image-level config verify-bundle check at sequence 2.
• just lint, just test, and just review-release v0.15.2 pass.

Private custody coordinates and the rotation procedure are recorded only in registry-internal. The issue remains open for the broader signed-baseline acceptance criteria, especially signing and verifying the hosted Notary closures.