docs: design v0.5.0 signed manifests

[marmar9615-cloud]

Summary

Design-first PR for v0.5.0 — Signed Manifests. No runtime
change in this PR; the implementation lands in subsequent v0.5.0
PRs against the same line.

• Design doc: docs/designs/signed-manifests.md
• ADR: docs/adr/0002-signed-manifests.md
• In-tree tracking issue: docs/issues/v0.5.0-signed-manifests.md
• GitHub tracking issue: v0.5.0 — Signed manifests #31

What's in the design

• Inline signature block on the manifest (additive optional
  schema field — additionalProperties: true keeps v0.4.x
  readers compatible).
• Canonical-JSON via RFC 8785 (JCS).
• Default algorithm Ed25519 (alg: "EdDSA") with ES256 also
  permitted.
• Publisher-controlled key set at
  /.well-known/agentbridge-keys.json (no central CA, no
  blockchain).
• signedAt + expiresAt for freshness, bounded clock-skew env
  var.
• Documented rotation and revocation flow.
• Verification failure-mode matrix (12 named failures × default
  vs. --require-signature mode).
• Cross-cuts on schema, SDK, scanner check IDs, MCP server,
  Studio/demo, CLI, OpenAPI converter.
• Migration plan from optional (v0.5.0) to mandatory (v1.0).
• Test plan, including security-critical negative tests.

The design's most important invariant: verification is
additive. A verified manifest still goes through the
confirmation gate, origin pinning, target-origin allowlist,
audit redaction, stdio stdout hygiene, and HTTP transport
auth/origin checks — exactly as today. Verification confirms
publisher; it does not authorize anything.

Docs updated

• docs/roadmap.md — v0.4.0 marked shipped; v0.5.0 marked in
  design with the design/ADR links.
• docs/v1-readiness.md — criterion build(deps): bump next from 15.5.15 to 16.2.4 in the next-react group across 1 directory #7 (signed manifests)
  flipped to "design in progress"; Phase 2: developer tooling — CLI, OpenAPI, spec, MCP hardening, Studio polish #1, Phase 3A: Public Beta Release Hardening #2, build(deps): Bump actions/checkout from 4 to 6 #3 (Trusted
  Publishing / provenance / no long-lived tokens) flipped to
  "yes" since v0.4.0 published.
• docs/threat-model.md — T1 expanded into T1.a (substitution),
  T1.b (stale/replay), T1.c (wrong publisher), T1.d
  (honest-but-mistaken) sub-vectors; v1 target points at the
  v0.5.0 design.
• docs/security-configuration.md — adds a "Signed manifests
  (v0.5.0 — design only, not yet runtime)" section listing the
  proposed env vars without enforcing them.
• docs/production-readiness.md — bottom-line note refers to
  v0.4.0; signed manifests called out as in-design.
• AGENTS.md / CLAUDE.md / README.md — small status notes;
  no bloat.

Current release context

• v0.4.0 (HTTP MCP Transport + Auth) is published on npm
  for all six @marmarlabs/agentbridge-* packages, via Trusted
  Publishing OIDC with SLSA build provenance attestations.
• PR test(sdk): add public API contract coverage #28 (SDK public API contract coverage) is merged on
  main.
• PR docs(release-notes): mark v0.4.0 as published with provenance #30 (post-release docs sweep marking v0.4.0 published)
  is merged on main.

Parallel Codex context

Codex may be working in parallel on scanner regression /
public-API-stability work touching:

• packages/scanner/src/*
• packages/scanner/README.md
• examples/scanner-regression/*
• examples/README.md
• CHANGELOG.md

This PR explicitly avoided those paths. The design names new
scanner check IDs as the contract; the actual scanner test
fixtures land alongside the implementation PR (coordinated with
Codex when that work begins).

What this PR does NOT do

• ❌ No runtime behavior changed.
• ❌ No package versions bumped — verified npm run pack:dry-run
  still reports 0.4.0 for all six packages.
• ❌ No new dependencies added.
• ❌ No package-lock.json change.
• ❌ No npm publish, no git tag, no GitHub release.
• ❌ Dependabot PRs untouched.
• ❌ Unsigned manifests still validate. Safety invariants intact:
  confirmation gate, origin pinning, target-origin allowlist,
  audit redaction, stdio stdout hygiene, HTTP transport
  auth/origin checks.

Commands run

npm run typecheck:clean   # clean
npm test                  # 196 / 196 passed (16 files)
npm run build             # all packages built
npm run pack:dry-run      # all six @marmarlabs/agentbridge-* OK at 0.4.0

Test plan

• CI green on Node 20.x and 22.x.
• No new test failures.
• Doc-only diff — no runtime files modified.
• All package versions remain 0.4.0.

🤖 Generated with Claude Code