P1 certificate product: schema v2, public registry, signed audit log, tiers, claim audit

[nrupala]

What this is

P1 follow-up to #10 (P0 hardening, merged). The P0s made the verifier sound; this PR makes the certificate itself sellable per ~/workspace/certification-authority/SPEC.md.

Changes

Certificate schema v2 (core/security.py)

• New fields: serial number (unique, issuer-scoped AXC-<key>-<rand>), validity window (issued_at/expires_at), revocation flag + reason, artifact version pin, tier, builder branding (product/owner/repo-or-website/contact), issuer details, per-file MD5s, QR payload. All covered by the Ed25519 signature.
• validity_status() → active/expired/revoked/not-yet-valid; migrate_v1_to_v2() re-signs with the issuer key or raises (never silently breaks signatures).
• Keystore file version deconflated from certificate schema version.

Public registry (core/registry.py, new) — transparency-log model

• publish (fail-closed: signature must verify, serial required, no duplicates), revoke (public, timestamped, reason required; cert stays visible as revoked), list (active default, --all for full log), export_json (machine-readable, agent-verifiable: signature + verify_key per entry), verify_registry (detects store tampering).

Signed audit log (core/security.py)

• Ed25519-signed entries, signed genesis bound to the issuer key (no rewritable genesis), verify_chain() with precise issues, lifecycle-event schema validation (certificate.issued/certificate.revoked/recertification.skipped).

Tiers (core/tiers.py new + ~/workspace/certification-authority/TIERS.md)

• Precise, testable definitions of scan/verified/certified. run_free_scan() performs static checks and cannot mint a certificate by construction; generate_certificate(..., tier="scan") raises.

Migration (core/versioning.py)

• migrate_v1_to_v2 re-signs with the issuer key when available, otherwise leaves signed certs untouched and reports them (re-issuance required). validate_data_integrity checks keystore vs cert versions independently.

Claim audit — qualified every "proven correct" claim with the honest verification_status distinction (FEATURES.md, README.md, CLI FAQ/help); fixed stale stdlib-only crypto claims.

CLI — new scan and registry (publish/revoke/list/export/check) commands; verify now fails on expired/not-yet-valid/revoked and checks the registry revocation list.

Behavior-test evidence (terminal, not just CI)

• Expired cert → verify fails: "CERTIFICATE EXPIRED — validity window has passed"
• Registry lifecycle via CLI: publish → ACTIVE → revoke → absent from default list, visible as REVOKED under --all; registry check passes
• scan on a sorry/axiom file: reports findings, mints nothing
• Tampered registry file → verify_registry() reports SIGNATURE INVALID
• Rewritten-from-genesis log without the signing key → verify_integrity() False
• v1→v2 migration without issuer key → refused with "re-issuance required"; with key → re-signed, new signature verifies
• Full suite: 197 passed, 3 skipped; ruff check + ruff format --check clean; mypy clean (CI flags)

Out of scope (remain open)

Cert schema: QR rendering (payload field exists; image generation not built); badge embed design; payment path; registry HTTP hosting (module + JSON export are the serving primitives).

[cloudflare-workers-and-pages]

Deploying axiomcode-site with    Cloudflare Pages

Latest commit:	e7223b3
Status:	✅  Deploy successful!
Preview URL:	https://99c2f4df.axiomcode-site.pages.dev
Branch Preview URL:	https://wright-p1-cert-product.axiomcode-site.pages.dev

View logs