# SIGNET (#218) intake — doyle, 2026-08-24

Operator call (mobile-gw): "proceed to build milestone 218. drive to release publish."
Milestone: releases#218 SIGNET [GREENLIT, kind: MILESTONE]. Sole child: #217 [GREENLIT, ADDITION] —
wax-seal FIDO2 ceremony fast-follow, deferred out of #21 by operator ruling 2026-08-23, sequenced
"picks up the moment WAX-SEAL ships". WAX-SEAL shipped v0.61.0 2026-08-24 11:45Z. Design of record:
CONTEXT.md wax-seal entry (ratified 2026-07-29; FIDO2 clauses re-affirmed at #21 intake ruling 2).

## Greenlit scope (#217 body, verbatim anchors)
1. `spt seal enroll-authenticator` — TOTP-gated enrollment, per node × subnet.
2. Enrollment records in subnet security material (pubkey enrolled, member-verifiable).
3. Per-OS backend seam — ONE seam; Windows Hello backend first (fleet = Windows + one Linux box);
   libfido2 is the named Linux backend later — stub refuses by name this milestone.
4. FIDO2 ceremony: the gated keypair SIGNS the seal payload; record carries ceremony kind +
   signature; remote controllers run the ceremony CLIENT-SIDE, proof up the rc channel
   (rc-paste precedent — contrast the TOTP ceremony, which is daemon-side write-through).
5. `E` enroll-and-submit shortcut on the TOTP overlay iff node×subnet NOT enrolled.
6. Signature-verify path in `spt api seal verify|describe` — verifiable on ANY member node of the
   binding subnet against the enrolled pubkey.

## Wave plan (two waves, both todlando; hertz parallel thin lane)
- **W1 — enrollment substrate + backend seam.** Seam trait (ensure-keypair / sign / availability),
  Windows Hello backend, Linux named-refusal stub; `enroll-authenticator` verb gated by the SHIPPED
  TOTP ceremony; enrollment records in subnet security material riding the same subnet-scoped
  replication family as seal records; public docs. RIDER (IR-52, fires on this wave's docs-gen
  touch): xtask reference-gen descends the FULL command tree — the durable remedy, not per-page
  self-defense; regen + census of self-holding units rides the same lane.
- **W2 — FIDO2 mint ceremony + E shortcut + signature verify.** Ceremony selection (enrolled
  node×subnet offers FIDO2), Hello-gated signing of the seal payload, record carries kind +
  signature, client-side rc ceremony with proof up the channel, `E` on the TOTP overlay,
  verify|describe signature path answering on any member node.
- **hertz parallel lane:** IR-56 pool-claim cwd-identity — refusing form (verb refuses when cwd is
  not inside the tree containing --pool). Rides the SIGNET golden batch as a thin lane.

## REQ mints (registry-first at lane T0, builder-activated in the delivering commit — WAX-SEAL pattern)
W1: REQ-SEAL-ENROLL-VERB · REQ-SEAL-ENROLL-RECORD-SUBNET-MATERIAL · REQ-SEAL-AUTH-BACKEND-SEAM
W2: REQ-SEAL-CEREMONY-FIDO2 · REQ-SEAL-FIDO2-SIG-VERIFY · REQ-SEAL-ENROLL-SHORTCUT-E ·
REQ-SEAL-FIDO2-RC-CLIENT

## Binding constraints for the briefs (hazard/tag grep done at intake)
- KNOWN-HAZARDS 7.5: `seal=` attr is a citation, NEVER an authorization subject — signature verify
  extends `spt api seal verify` only; no consumer branches on attr presence.
- Ledger separation rationale (denial-of-governance): enrollment's TOTP gate throttles on the
  ceremony-gate ledger; do not mint a new ledger without a ruling, do not share the bring-up ledger.
- Minter/enrollment node identity = daemon's own node-key short hex (ADR-0054 spelling), never
  hostname (doyle W2 gate ruling 2026-08-23).
- TOTP ceremony ships the PRESENTED CODE, never a verdict; FIDO2 inverts the locus (signing where
  the authenticator lives) but the daemon still decides admit/refuse — the client ships a PROOF,
  never a verdict.
- Records immutable once minted, no expiry/revocation v1 (intake ruling 6) — enrollment records:
  same immutability posture; re-enrollment shape is the builder's measure-first question, stop-and-
  refer if it wants revocation semantics.
- Refusals by name, verbatim through the CLI (never re-worded).

## Register sweep (mandate: every intake) — ruled 2026-08-24
- IR-52 → RIDER on W1 (docs-gen touch arms its trigger). Composed above.
- IR-56 → hertz thin lane, rides this batch. Composed above.
- IR-57 → doyle procedure at SIGNET assembly (verify picks line-complete before gating).
- IR-59 part 2 + IR-60 → doyle gate-script discipline this milestone: free-space reading FIRST LINE
  of every leg report, floor preflight in gate scripts, leg exits from FILES never wrapper status.
- IR-9 → check toolchain print on the SIGNET golden run (trigger armed since the lane landed).
- IR-62/IR-51/IR-35 → standing red-triage classes for this box; not riders.
- All other OPEN entries: triggers not armed by this milestone's surfaces. No retires this sweep.

## Drive plan
Wave gates: isolated worktree, targeted suites + compile-gate, IR-59/60 script discipline.
Assembly: IR-57 pick-verification, compile-gate + traceable-reqs check pre-hand-off.
Golden: hand to deployah with greenlit-form parity record on #218; version v0.62.0 (deployah shapes).
Red goldens hand back to me, RCA-first. Publish = deployah's verb; board cascade at accept.

## Board
#218 + #217 → WIP at dispatch (via alchemy-0, never bare gh). DONE 2026-08-24 (cascaded).

## State log (2026-08-24)
- IR-56 thin lane: REFUSED at review (predicate contradicted poolguard's printed remedy), reshaped
  by hertz (--foreign-pool opt-in + remedy strings + verb-admits-remedy int test), re-gated PASS at
  12910d2f. Field-accepted by running the remedy string verbatim on the real main pool. Rides assembly.
- W1: BUILT + gated PASS at 25b953c7 (7 product commits + S1e fixup). Legs: clippy 0, nextest
  2760/2760, treqs 0 (4 REQs activated), xtask check 0 (IR-52 recursive walk drift-clean; 22
  previously-unrendered leaves now published + double-held). NEVER-EXECUTED CELL to pre-declare at
  hand-off: twohost S1e enrollment rung (climbs at golden; W3 S1 precedent).
- W1 T0→delivery REQ amendment (measured, accepted): ENROLL-VERB brief shows pubkey SHA-256
  fingerprint, full hex in the record.
- W2 rulings issued: (1) rsa dep approved verify-only + RUSTSEC-2023-0071 comment; (2) canonical
  signed tuple "spt-seal-fido2-v1\n{content_hash}\n{minter}\n{minted_at}\n", verify recomposes from
  record fields VERBATIM; (3) optional signature_hex additive field, ceremony_kind "fido2", algorithm
  dispatch via enrollment backend_kind; (4) additive FIELDS over new attach variants (N-1 degrades to
  TOTP overlay — measured, supersedes the brief's variant wording); (5) FIDO2-fallback arm: Hello
  cancel / seam refusal → TOTP on same overlay, Esc aborts all; (6) E = both-or-neither under the
  apply lock; (7) v1 SCOPE-NOTE: signer IS the minter node by construction (no signer_node field;
  future cross-node signer = additive-optional field behind a ruling, absent = minter node). Remote
  controllers on other nodes get FIDO2 offer withdrawal → ordinary TOTP, zero error chrome; docs
  state the boundary.
- IR candidate for assembly-time filing: suite-mix sweeps leak job-escaped autostart daemons that
  lock the pool's spt.exe (os error 5); pre-cargo reap-by-path adopted as a rig step by todlando +
  my gate runner. File as IR-63 with the register commit at assembly (kin IR-38/IR-62).
- Disk: 163G free mid-W1-gate; todlando's lane pool is the mover — reaps at release (IR-59 part 1).
- W2: BUILT + gated PASS at ad3347ad (4 rungs; deciding arms read; clippy COLD 0, treqs 0, drift 0;
  full population 2771 witnessed no-fail-fast, four same-sha singleton reds all delta-tested green =
  random-victim family → IR-63 filed). Disk event mid-gate: gate pool 13.7→158G, volume to 18G;
  reaped measured (18→160G), cold rebuild taken — IR-59 fourth face.
- IR-62 lane (hertz, PR #158): reviewed + thin CI green (first run = the floor step's first live
  catch, refused over my 18G window; rerun green). SPT_TEST_EPHEMERAL_ADVISORY_PORTS armed in golden.yml.
- ASSEMBLY: assembly/signet-218 @ feb4049a PUSHED 2026-08-24 (~16:30 local) = main 8c4e6c3c +
  signet-w1 ad3347ad + IR-56 12910d2f + IR-62 33724cfb + register sweep commit. Sentinel
  pick-verification done; head gate clippy/treqs/xtask all 0. Pool claim released.
- HANDED TO DEPLOYAH with parity read, v1 signer boundary note, never-executed cells pre-declared.
  Red hands back to me RCA-first. Next: golden verdict → deployah publish (v0.62.0) → board cascade
  → todlando lane-pool reap → register sweep at next intake.
- DEPLOYAH INTAKE PASS (comment 5403001889 on #218); golden RUNNING: run 32790838399 @ 5a9f9bdc
  (feb4049a + v0.62.0 shape). CORRECTIONS TAKEN: REQ count is 9 (7 SIGNET + 2 riders), NOT 11 —
  my hand-off number was simply wrong; and my 131G free was a battery-START instant quoted as
  headroom (IR-46 at the reporting seam) — real reads were ~77G, lane-pool reap brought forward,
  169.65G free at push. POST-PUBLISH DEBT (mine): amend CONTEXT.md wax-seal entry with the v1
  signer boundary (design-of-record divergence deployah flagged, #211 shape) on advanced main,
  whole-entry audit per the amendment discipline.

## Fixup gate — 12ab4a7a (fix/signet-w1-cfg-gate), 2026-08-24 ~18:0x local
R1 golden 32790838399 @5a9f9bdc: ONE red, Linux clippy, dead const authseam.rs:45 (cfg asymmetry
vs KEY_NAME:56; e4761f26). Triple-confirmed (todlando, deployah, doyle). Twohost S1e harvested
GREEN at r1 before respin (deployah's sequencing call). Doc-links caveat RETIRED by measurement:
no gate runs rustdoc (xtask cargo calls are build-only; docs_bundle excludes rustdoc by design).
| leg | where | verdict (first-hand exit-FILE read) |
|---|---|---|
| diff shape | my gate worktree .worktrees/gate-signet-fixup | ruled shape exactly; blob 26224fc9 |
| traceable-reqs check | gate worktree | 830/830 complete, 0 findings, EXIT=0 |
| clippy -D warnings, cold | hfenduleam, todlando fresh pool | W_clippy.exit=0; 337 Checking, 0 warn/err, 2m28s |
| clippy -D warnings | kitsubito personal checkout | L_clippy.exit=0; 326 Checking (all 11 ws crates), 0 warn/err, 48.24s; head/tree/blob hashes match |
Linux "cold" qualification accepted: pool held 3.5G build artifacts @32b0d2e9, but all 326 crates
emitted Checking lines = complete fresh lint pass (the property cold was FOR), measured not argued.
Crate-level second-defect question CLOSED: r1 aborted lint at spt bin; this head linted the whole
workspace on both OSes, zero warnings. PASS handed to deployah: ff release/v0.62.0-shape onto
12ab4a7a, fire golden/signet-218-r2 (fresh ref per concurrency-key rationale).
EVIDENCE RELOCATED (2026-08-24 ~19:00): .worktrees/signet-w1-fixup removed by todlando after r2
green; Windows arm files preserved SHA256-verified to project root as SIGNETFIX_W_clippy.{exit,raw}
+ SIGNETFIX_W_claim.{exit,raw}. Linux arm files unchanged on kitsubito. r2 = run 32796133406,
9/9 green at 12ab4a7a, verified job-level by all three of us independently.