SigningService

SigningService runs the client-signing flow of the caller's namespace: a write that a self-owned key of the owner signs, instead of the custodial key. A write that asks for no client signature stays custodial: StagingService.Commit, KitService.Tag and KitService.Remix do not change, and there is no silent fallback between the two.

The flow is prepare, sign, finalize:

• PrepareWrite names the write and the self-owned key. The engine selects the fields of the unsigned object: the tree of the session or of the target, the parents, the message and the time. The control plane freezes them in a prepare record owned by the caller, and answers with them.
• The client rebuilds the object and its signing bytes locally, checks the fields against its own staged content, and signs the bytes with the key.
• FinalizeWrite takes the signature and the key id. The caller must still have write access, the record must be live and matching, the expected head must still hold, and the key must be active. The engine rebuilds the object from the record, verifies the signature against the keyring, and pushes one signed group. Its answer can carry the next frozen group. Each group requires its own signature.

The record binds the owner, the repo and the ref, the expected head, the staged content, the kind and the exact fields, the key, the authority generation and the expiry. A signature that matches no record signs nothing, and a payload that differs from the record is not a retry.

The Uno CLI exposes client signing. HTTP MCP writes remain custodial; this service runs on the Kit control plane.

Conventions and error codes: see common.proto.