Production API W1+W2: Ed25519 CA + durable store

[nrupala]

Path (b) production build, workstreams W1+W2 (plan: production-build-plan.md). Replaces the prototype's trust machinery in services/api; REST/MCP contracts unchanged.

W1 — Ed25519 CA (new ca.py)

• Asymmetric signing replaces HMAC: private key PEM 0600 (AXIOMCODE_CA_KEY_FILE), kid = first 16 hex of SHA-256 over the raw public key.
• Certificate v2: prototype fields + version/alg/kid + base64 signature over canonical JSON body. Verification needs only a public key (object, base64, or PEM from the published payload).
• public_keys_payload() is the document for /.well-known/axiomcode-keys.json; verify_api serves it. HMAC certs are rejected by v2 verification; certs.py stays for legacy fixtures.

W2 — Durable store (new store.py)

• sqlite3: certificates, revocations, meter_events, audit_log. Audit chain: SHA-256(prev_hash + canonical payload); verify_chain() reports the first broken seq. Issuance/revocation events are appended by construction in record_cert/revoke.
• revoked.txt / meter.jsonl retired from both servers; billing math untouched (2.25x doctrine), meter/usage route through the store.
• Temp Lean projects under AXIOMCODE_WORK_ROOT, removed in finally.

Tests: 14 in services/api/tests (round-trip, tamper, wrong key, published-payload verification, revocation persistence across reopen, chain tamper detection at the flipped seq, meter aggregation, REST/MCP wiring with the prover stubbed — wiring proof, not Lean proof). Local: pytest 14/14, ruff check + format clean under the repo config.

Review notes (Wright) — hardening items for W3, not blockers here:

• issue() spreads subject fields after the fixed fields; server-built subjects are internal today, but fixed fields should win — enforce in W3.
• verify_certificate does not yet match cert kid against the verifying key (single-key era; enforce when keys rotate).
• record_cert/revoke commit the row and the audit event in two transactions; make atomic in W3.
• Audit chain hashes the payload only (not ts/event_type); consider binding both.

Not deployed anywhere. W3 (API keys, trial enforcement, quotas) builds on this.

[cloudflare-workers-and-pages]

Deploying axiomcode-site with    Cloudflare Pages

Latest commit:	1be30f8
Status:	✅  Deploy successful!
Preview URL:	https://d1594d2b.axiomcode-site.pages.dev
Branch Preview URL:	https://build-production-api-w1w2.axiomcode-site.pages.dev

View logs