feat: Phase 2 signed audit trail — hash chaining, sig verification, verify_chain

[TadMSTR]

Summary

• append_event: Added threading.Lock + prev_hash SHA-256 chaining (each event records SHA-256 of the previous JSONL line)
• log_event: ed25519 signature verification against COMMS_DIR/agent-keys.json registry; AGENT_BUS_VERIFY_SIGNATURES=warn (default) or enforce mode
• verify_chain tool: Walks a JSONL log file and validates hash chain + signatures; returns {total, verified, chain_breaks, sig_failures, unsigned_events} per file
• get_status: Now includes signing.registered_agents and verify_mode fields
• requirements.txt: Added cryptography>=41.0

Key registry format

~/.claude/comms/agent-keys.json:

{
  "research": {"pubkey": "<base64 pubkey>", "fingerprint": "abc12345", "added": "2026-XX-XX"},
  "dev": {"pubkey": "<base64 pubkey>", "fingerprint": "def67890", "added": "2026-XX-XX"}
}

Rollout notes

• Default mode is warn — signature failures are logged but events are accepted
• Unknown sources (no key registered) are always accepted (backwards compatible)
• Flip to enforce via AGENT_BUS_VERIFY_SIGNATURES=enforce after all agents migrated
• Forge ops: generate keypairs, load into Vault, register pubkeys in agent-keys.json

Test plan

• Manual: start server, log_event, verify prev_hash written
• Manual: verify_chain on today's log
• CI not configured for agent-bus (FastMCP server, no test suite yet)

🤖 Generated with Claude Code