Sign bundled plugins during release with drift guard - #1298

Open

chr1syy wants to merge 10 commits into

RunMaestro:rcfrom

chr1syy:fix/a1-agent-flow-signing

Commits on Jul 25, 2026

MAESTRO: sign bundled plugins during release build

chr1syy
and
claude
committed
0deda98
MAESTRO: add anchor/secret drift guard to bundled-plugin signing

chr1syy
and
claude
committed
6f5aff0
MAESTRO: gitignore bundled-plugin signature artifact + document dev signing workflow

chr1syy
and
claude
committed
a3df994
MAESTRO: test resolveTrustedKeys trust-anchor round trip

chr1syy
and
claude
committed
95de155
MAESTRO: validation fixes for A1
chr1syy
committed
4074854

Commits on Jul 26, 2026

MAESTRO: address review on A1 bundled-plugin signing

chr1syy
and
claude
committed
3dee561
MAESTRO: make A1 signing safe while the publisher anchor is empty

chr1syy
and
claude
committed
27d2c27

Commits on Aug 7, 2026

MAESTRO: bake Maestro publisher public key as the bundled-plugin trust anchor
chr1syy
committed
714b306

Commits on Aug 10, 2026