feat(trust): wire Phase 0 signed-catalog verification + pin release-root KAT

lfg2025/archy

Completes the parked trust module and wires it into the live build:
- main.rs: register `mod trust`
- app_catalog::fetch_one: verify the release-root detached signature when
  present (verify against raw JSON so forward-compat fields stay in the
  signed preimage); accept unsigned during the migration window, hard-reject
  a present-but-bad signature so a tampering mirror can't pass altered bytes
- seed: pin release-root Ed25519 known-answer test (priv+pub) for the
  signing ceremony / pinned-anchor / external-verifier cross-check
- signed_doc: drop unused import

20/20 Phase 0 unit tests pass (trust::canonical/did/signed_doc/anchor,
seed release-root, app_catalog). Crate compiles clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

This commit is contained in:

archipelago

2026-06-16 12:40:57 -04:00

co-authored by

Claude Opus 4.8

parent 0fef808671

commit 27f11bf85a

4 changed files with 30 additions and 6 deletions

									
										core/archipelago/src/main.rs
									
		+1
		
												View File
												
				@@ -68,6 +68,7 @@ mod storage_crypto;

				mod streaming;

				mod totp;

				mod transport;

				mod trust;

				mod update;

				mod vpn;

				mod wallet;