feat(tmp): Ed25519 request signing + HPKE TMPX exposure tokens

[ohalushchak-exadel]

Summary

Two TMP spec gaps closed end-to-end in the same branch, plus the v3.0.7 schema bump and the security/code-review hardening pass:

1. Request authentication (spec §Request Authentication) — Ed25519 signing on every router→provider fan-out (X-AdCP-Signature / X-AdCP-Key-Id), per-provider binding, daily-epoch replay window. The previous tmproto/signing.go predated the current spec (wrong field set, no provider_endpoint_url binding, no JCS) and the router/reference-agents sent and accepted unsigned requests. The misleading "TMP no longer defines request-level signing" comment in router/router.go is removed.
2. TMPX exposure tokens (spec §TMPX Exposure Tokens) — HPKE mode_base with the spec-fixed cipher suite (DHKEM(X25519, HKDF-SHA256) / HKDF-SHA256 / ChaCha20-Poly1305). Until now IdentityMatchResponse.Tmpx was defined in the schema but no agent in the repo populated it.
3. AdCP schema bundle bumped to v3.0.7 (Sigstore-verified) — types_gen.go is the version-header bump; the wire-level change is in call-adcp-agent skill error-envelope semantics (property_name instead of field inside discriminator, hint / allowedValues reclassified as SDK-side enrichment).

What changed

Protocol layer (tmproto/)

• signing.go — newline-joined signing input for context match; hex(SHA-256(JCS(canonical_object))) for identity match; per-provider URL binding; daily-epoch replay window (current + previous); revocation via revoked_at. Signer.PrivateKey is unexported — derived material flows only through PublicJWK().
• jcs.go — stdlib-only RFC 8785 (JSON Canonicalization Scheme). Object keys sort by UTF-16 code units. Non-integer floats are rejected (Go's strconv.FormatFloat 'g' is not exact ECMA-262; loud failure prevents future drift).
• verify_middleware.go — VerifyContextMatchHandler / VerifyIdentityMatchHandler for reference providers. Decoder runs with DisallowUnknownFields so a future-protocol field can't silently disappear from the recomputed signing input.
• keystore_remote.go — polls the router's /registry/snapshot for signing-key discovery, 5-min TTL. Hardened: https:// required by default (opt-in AllowInsecureScheme for dev), cross-origin redirects denied, body capped at 1 MB, transient empty snapshots retain cached keys, cross-property kid collisions warn-and-keep-first. Lifecycle is Refresh + Run (no double-Start).
• tmpx.go — HPKE mode_base on stdlib (crypto/ecdh, crypto/hkdf, crypto/sha256) + golang.org/x/crypto/chacha20poly1305. No third-party HPKE framework. Binary-plaintext encoder (16-byte header + entries), TMPX type-ID registry, kid.base64url(enc||ct) wire format. labeledExpand validates length ≤ 0xffff.

Router (router/)

• WithTMPSigner option. Signature headers attached on every fan-out, identity-match re-signed per provider.
• New signing.go — (placement_id, provider_endpoint_url, epoch) cache for context-match signatures.
• RegistryProperty.SigningKeys, AttachSigningKey, kid-indexed LookupKey with first-seen-wins on cross-property kid collisions.
• HandleContextMatch calls Artifact.StripAccess() before fan-out (spec MUST — was a TODO before this PR).
• HandleIdentityMatch surfaces json.Marshal failure as 500 with request_id instead of fanning out a stale body.
• Fixed misleading comment at lines 73-74.

Wiring

• cmd/router/main.go — fail-closed unless TMP_ROUTER_SIGNING_DISABLED=true. Attaches public JWK to authorized property RIDs in the registry so providers can fetch it via /registry/snapshot.
• Reference identity-agent: --registry-url, --allow-unsigned (default off — verification is required), --own-endpoint-url. TMPX flags --tmpx-kid, --tmpx-pubkey-path, --tmpx-country plus required ack TMP_IDENTITY_TMPX_REFERENCE_STUB_ACK=1 (the SHA-512 binary-token stub is non-interoperable with real buyer masters and operators must acknowledge before the agent will start).
• Reference context-agent: same flag set, same default-on signature verification.
• Both agents honor flag > env > default precedence (was env-can-set-but-not-clear before).
• RemoteKeyStore.Run is driven by a process-lifetime context; previous double-Start race fixed.

Docs

• docs/network-surface.md:
  • Ed25519 section: X-AdCP-* header names, signed-input shapes, JCS for identity, per-provider binding, revocation grace (~24h via the previous-epoch window made explicit).
  • TMPX section: cipher suite, wire format, plaintext layout, env vars, the reference-impl stub callout.
  • Crypto agility note: one suite at a time; upgrade requires editing constants and dispatching by kid prefix or JWK fields.
  • Keystore hardening (HTTPS-default, redirect denial, body cap, kid-collision policy).

Decisions

• Replaced tmproto/signing.go API rather than versioning. Only callers were the context-agent benchmarks; updated in this PR.
• Hand-rolled HPKE rather than pull a framework. Spec fixes one cipher suite; the implementation is ~250 lines, stdlib-only beyond chacha20poly1305. Validated against the RFC 9180 §A.3 test vector byte-exact at every KDF stage (enc, shared_secret, secret, key, base_nonce, ciphertext).
• Registry-based key distribution per spec direction. Router publishes its public JWK on the property records it's authorized to sign for; agents fetch via the existing /registry/snapshot endpoint with a 5-minute TTL.
• Reference agents default to fail-closed on signature verification. --allow-unsigned is the explicit opt-out for migration windows. The TEE-bound reference impl shouldn't normalize "no auth" as the path of least resistance.
• TMPX SHA-512 stub gated behind TMP_IDENTITY_TMPX_REFERENCE_STUB_ACK=1. Real buyer deployments decode UID2 / RampID / MAID per the source graph's encoding; the stub produces tokens no buyer master can decode. Acknowledgment env var prevents accidental production wiring with zero buyer match-rate.
• No sample-rate verification — verifier runs at 100% in v1. Spec says SHOULD; revisit if perf demands.

Test plan

• go test ./... clean across tmproto, router, cmd/router, reference/context-agent, reference/identity-agent, e2e, adcp, bench, targeting/*.
• RFC 9180 §A.3 vector validated byte-exact at every KDF stage.
• HPKE Seal/Open roundtrip across many random plaintexts.
• Signing roundtrip: signer → middleware verifier across context match and identity match.
• Wrong provider_endpoint_url rejected (per-provider binding).
• Stale epoch rejected (>1 day).
• Revoked key rejected.
• Identity dedup + sort produce deterministic signing inputs regardless of input order.
• Identity-match signatures differ across providers (per-provider re-signing).
• Context-match signature cache reuses across requests in the same epoch.
• TMPX plaintext header layout (version, ts, country, nonce, count) verified at the byte level.
• TMPX type-ID registry sizes (32 / 48 / 16 bytes) match spec.
• Unknown TMPX type IDs rejected at encode time; unmappable uid_type values dropped at the agent (forward-compat).
• Artifact.StripAccess runs before context-match fan-out — bearer tokens never reach providers (test asserts on the forwarded bytes).
• RemoteKeyStore rejects non-HTTPS URLs by default, denies cross-origin redirects, retains cached keys on transient empty snapshots.
• Cross-property kid collisions warn and keep first-seen entry in both the registry index and the remote keystore parser.
• Run returns context.Canceled when its context is canceled (no goroutine leak).
• JCS rejects non-integer floats (test asserts on 1.5); accepts integer floats.
• Lint clean across tmproto, router, cmd/router, reference/{identity,context}-agent, e2e.

🤖 Generated with Claude Code