feat(signing): enforce client-only artifact signing across every hosted surface

[mnemonik-dev]

Goal

Make client-side signing a repository-wide invariant for every user-owned artifact. The hosted MCP may canonicalize, relay, store, anchor, and verify, but it must never impersonate the user or agent that authored the artifact.

This issue owns roadmap workstream 1. Payment-specific signing remains covered by #203 and #204.

Scope

• Inventory every artifact-producing path in MCP, webapp, SDK, CLI, extension, plugins, bridges, seed jobs, and experimental trajectory tools.
• Classify each path as user-owned or operator-owned.
• Route all user-owned paths through one canonical client-signing contract.
• Restrict the operator key to explicitly typed operator-owned artifacts.
• Reject callback payloads when OAuth subject, artifact producer, COSE signer, correlation ID, or canonical bytes disagree.
• Remove hosted fallback behavior that silently signs with a server key.
• Remove misleading public documentation and response language that implies Mnemonic signs user artifacts.
• Add shared byte-parity and negative fixtures for browser, SDK, CLI, plugins, and experimental schemas.

Required contract

For the same canonical artifact input, every supported client must produce identical canonical CBOR and a valid COSE_Sign1 attributed to its own identity. The server validates and stores that signature; it does not replace it.

Typed errors must distinguish:

• signing required;
• signer/subject mismatch;
• callback/operation mismatch;
• canonical bundle mismatch;
• expired signing request; and
• operator-owned artifact required.

Acceptance criteria

• A path inventory lists every production and feature-gated artifact writer and its signing owner.
• No hosted user-memory path succeeds without a client signature.
• Operator signing is allowed only for explicitly typed operator-owned service artifacts.
• Browser, SDK, CLI, extension, plugin, bridge, and trajectory fixtures verify against one canonical contract.
• Cross-user, cross-operation, altered-content, and replayed callbacks are rejected.
• Server-key removal or rotation cannot invalidate or prevent verification of user-authored artifacts.
• Public docs, tool descriptions, agent prompts, and receipts describe signing ownership accurately.
• CI fails when a new artifact-producing path lacks a declared signing owner and conformance fixture.

Related

• feat(payments): ship seamless paid anchoring sessions with optional one-time x402 #203 — paid anchoring journey
• feat(payments): integrate Universal Paywall sessions and optional pay-once x402 #204 — Universal Paywall integration
• Agent-facing guide
• MCP skill sources