feat(scanner): add signed manifest checks

[marmar9615-cloud]

Summary

Fourth implementation PR for v0.5.0 signed manifests. Wires
verifyManifestSignature() from PR #39 into the scanner, emitting
stable manifest.signature.* check IDs for every verifier outcome.
Local key-set input only — no remote
/.well-known/agentbridge-keys.json fetch in this PR. Default
scanner behavior is unchanged — unsigned manifests still score the
same and signed manifests trigger no signature check unless callers
opt in via the new signature option.

• Tracking issue: v0.5.0 — Signed manifests #31
• Design: docs/designs/signed-manifests.md §13.5
• Predecessor PRs:
  • feat(core): add signed manifest schemas and canonicalization #35 (core schemas + canonicalization) — 46adc2c
  • feat(sdk): add signed manifest helpers #36 (SDK signing) — c0cd51d
  • feat(core): add signed manifest verifier #39 (core verifier) — 0bf7713

Scanner signature surface

scoreManifest(manifest, options?) and scanUrl(url, options?)
both accept an optional signature block:

import { scanUrl } from "@marmarlabs/agentbridge-scanner";

const keySet = await loadYourKeySetSomehow(); // /.well-known/agentbridge-keys.json

const result = await scanUrl("https://orders.acme.example", {
  signature: {
    keySet,                                        // required to verify
    expectedIssuer: "https://orders.acme.example", // optional strict check
    requireSignature: false,                       // default: missing → info, no deduction
    now: new Date(),                               // optional override for testing
    clockSkewSeconds: 60,                          // forwarded to the verifier
  },
});

result.passed.find((c) => c.id === "manifest.signature.verified");
result.checks.find((c) => c.id === "manifest.signature.invalid");

Local-only (no remote fetch)

The scanner does not fetch the publisher's key set for you. Pass
the key set in via signature.keySet. A runtime helper for
remote fetch lands in a later v0.5.0 PR alongside MCP server
enforcement.

Check IDs added

All under category safety. Stable identifiers — once shipped,
renaming any of them is a major bump per docs/v1-readiness.md §13.

Check	Severity (default)	Severity (requireSignature)	Deduction	When
manifest.signature.verified (passed)	info	info	0	Signature verified
manifest.signature.missing	info	error	0 / 15	No signature block
manifest.signature.unverified-no-key-set	info	info	0	Signature present, no keySet supplied — verification skipped
manifest.signature.malformed	error	error	25	Schema fail (incl. inverted/zero-length time window)
manifest.signature.key-set-malformed	warning	warning	0	Operator-side issue, manifest readiness unaffected
manifest.signature.unsupported-algorithm	error	error	20	Outside EdDSA / ES256
manifest.signature.unknown-kid	error	error	25	kid not in keys[]
manifest.signature.revoked-kid	error	error	30	kid in revokedKids[]
manifest.signature.issuer-mismatch	error	error	25	iss vs keySet.issuer / baseUrl origin / expectedIssuer
manifest.signature.before-signed-at	error	error	20	now < signedAt − skew
manifest.signature.expired	error	error	20	now > expiresAt + skew
manifest.signature.canonicalization-failed	error	error	25	Manifest contains non-canonical values
manifest.signature.invalid	error	error	25	crypto.verify returned false
manifest.signature.key-type-mismatch	error	error	20	Key entry alg / JWK kty/crv mismatch sig alg

Tests added

packages/scanner/src/tests/signature-checks.test.ts — 24 tests:

• Default behavior unchanged (regression).
• requireSignature mode + default mode + signed-without-keySet path.
• Verified Ed25519 + ES256 happy paths.
• Every failure mode mapped (tampered, unknown kid, revoked, expired, issuer mismatch incl. baseUrl binding, malformed key set, malformed signature shape, inverted-window, key-type mismatch).
• Hygiene: scanner output never echoes public-key x/y bytes.
• scanUrl integration: default invocation introduces no signature checks; with keySet runs verifier; with requireSignature emits the missing-signature error.
• Round-trip the eddsa-valid + es256-valid + tampered-manifest vectors from spec/signing/test-vectors.json through the scanner.

Confirmations

• Default unsigned scanner behavior unchanged. Verified by the regression test, by validate:examples, and by the existing packages/scanner/src/tests/scanner.test.ts + scanner-fixtures.test.ts continuing to pass.
• No MCP / CLI enforcement. Scanner emits check IDs; downstream layers branch on them in subsequent PRs.
• No remote key-set fetch. Operator passes the key set in.
• No package versions changed. pack:dry-run confirms all six @marmarlabs/agentbridge-* still at 0.4.0.
• No new dependencies. Pure Node crypto + existing @marmarlabs/agentbridge-core import. package-lock.json untouched.
• No npm publish, no git tag, no GitHub release.
• Dependabot PRs untouched.
• Codex examples / CLI / scripts paths avoided — no edits under packages/cli/*, examples/* (incl. examples/signed-manifest-basic/), scripts/*, apps/mcp-server/*, docs/releases/*, the root README, or CHANGELOG.md.
• Safety invariants intact — confirmation gate, origin pinning, target-origin allowlist, audit redaction, stdio stdout hygiene, HTTP transport auth/origin checks all unchanged.

Browser / computer-use status

Not needed. The scanner is a Node library; no UI / browser
surface changed. The Studio dashboard and demo-app weren't
touched. CLI smoke (validate:examples,
validate:mcp-config-examples) plus the test / build /
pack:dry-run pipeline are the appropriate smoke for this
surface.

Commands run

npm run typecheck:clean                                          # clean
npx vitest run packages/scanner/src/tests/signature-checks.test.ts  # 24/24
npx vitest run packages/scanner/src/tests                        # 44/44 (20 existing + 24 new)
npm test                                                         # 409/409 across 25 files (+24 vs 385 on main)
npm run build                                                    # all packages built
npm run pack:dry-run                                             # all six @marmarlabs/agentbridge-* OK at 0.4.0
npm run validate:examples                                        # ✅ all examples validate
npm run validate:mcp-config-examples                             # ✅ all client-config examples validate

Test plan

• CI green on Node 20.x and 22.x.
• All package versions remain 0.4.0.
• +24 net new tests.

🤖 Generated with Claude Code