Decide: operator commit signing on by default? (ledger 7.1)

[bdelanghe]

Ledger row 7.1 — ⚙️ By design (off) (CLAIMS.md)

Commit/tag signing is disabled at the git seam (git/src/index.ts:135, -c commit.gpgsign=false) on purpose — operator gpg/ssh signing hangs in headless/agent contexts (GH-388/GH-360). Provenance integrity is carried by the separate Ed25519 chain signing, not git's commit signing.

Open question: should we also sign at the operator layer by default (without reintroducing the headless hang)?

Tracks bead prx-e7cl. Part of epic prx-gvtr.

[bdelanghe]

Mechanism landed: git#5 merged. The seam now signs commit/tag/commit-tree with our OWN file-based ed25519 key headlessly (PRX_COMMIT_SIGNING_KEY) — never the 1Password agent — integration-tested with a real ssh-keygen key. Row 7.1 → 🟡 (mechanism enforced). Not closing yet: 'signed by default' needs PRX_COMMIT_SIGNING_KEY provisioned at the project key (github_signing_key) in the keeper/worktree env — the remaining operational step. Bead prx-e7cl stays open for that.

[bdelanghe]

prx#773 merged: prx now OWNS its commit-signing key internally — generate-on-first-use under /prx/signing via ssh-keygen (never host ~/.ssh or a cloud KMS), per the 'internal to prx' directive. The keeper's commit-tree now FAILS CLOSED if signing is configured but the commit is unsigned. Row 7.1 stays 🟡: default-on ✅ still needs (1) the activation wiring into the direct keeper path (deliberately not forced — keeperd/host.ts commit-tree is intentionally keyless, signed in-VM), and (2) one-time registration of the prx public key with GitHub for the Verified badge.

[bdelanghe]

prx#775 merged — activation wired. The DIRECT keeper path (submit/publish.ts) now signs by default with prx's OWN internal ed25519 key (generate-on-first-use under /prx/signing; the keyless remote keeperd/host.ts path is signed in-VM, unchanged). New verb prx provenance commit-pubkey prints the key. Row 7.1 → 🟡 'default-on live'. The ONLY remaining step for ✅ (GitHub Verified + passing 'require signed commits' branch protection): run prx provenance commit-pubkey and register the printed public key on the GitHub account (Settings → SSH and GPG keys → New SSH key, type: Signing Key).