Fixes from Keyhive app demo, expose direct signer

[expede]

No description provided.

[Copilot]

🟡 Changes recommended

The Wasm API’s error-shape contract and runtime safety guarantees are inconsistent across newly touched entry points (missing reason on invalid dohUrl, and an exported &str that can still trap on wrong-typed input).

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR updates the Onomancy specs and implementations to match the Keyhive demo model: namestores are a document’s top-level map (no container), DNS anchoring becomes explicitly “two-direction” (zone → doc + doc → zone via certificate), and Wasm/CLI tooling grows end-to-end issuance + verification paths with clearer, typed JS contracts.

Changes:

• Move certificate semantics to “carried inside the bound document” and propagate the model through specs, design docs, CLI, publish ceremonies, and Wasm bindings.
• Make namestores explicitly “document top-level keys” and standardize .well-known/<owner>/<artifact> for protocol/application entries (absent from matching by value, not by reserved location).
• Expand onomancy_wasm with typed TS shapes + refusal reasons, deterministic clock injection, certificate issuance helpers, and browser/wasm test coverage in CI.

File summaries

File	Description
specs/README.md	Spec index updated to reflect no-version-pinning and in-document certificates.
specs/path-resolution.md	Normative clarifications: top-level namestore map, .well-known/ convention, non-reference values absent from matching (E8).
specs/anchoring/petname-anchor.md	Petname value requirements tightened (Automerge scalar string vs Text).
specs/anchoring/binding-cache.md	Binding-cache derivation clarified re bare refresh candidacy + decision doc key location.
README.md	Repository overview updated for in-document certificate model and expanded onomancer capabilities list.
onomancy_wasm/tests/issue.rs	New wasm-only tests for external-signing issuance path and failure modes.
onomancy_wasm/tests/browser.rs	Browser tests updated to use typed Text args and reflect namestore-as-document semantics.
onomancy_wasm/tests/browser_live.rs	Live browser test updated to new resolve entry point/signature.
onomancy_wasm/src/verify.rs	New Wasm export for certificate and binding verification (including deferral as a grade).
onomancy_wasm/src/text.rs	Introduces Text type to preserve TS string while avoiding wasm-bindgen traps on wrong-typed inputs.
onomancy_wasm/src/shapes.rs	Embeds TS declaration section into the Wasm output for stable consumer contracts.
onomancy_wasm/src/shapes.d.ts	Adds Verdict, Resolution, and RefusalReason unions/interfaces for TS consumers.
onomancy_wasm/src/resolve.rs	Enhances resolveHostname: typed args, deterministic clock, returns chain bytes + window/checkedAt.
onomancy_wasm/src/refusal.rs	Adds structured refusal reasons with drift tests against the published TS union.
onomancy_wasm/src/name.rs	Name constructor switched to Text to avoid runtime traps on non-string inputs.
onomancy_wasm/src/lib.rs	Exports new modules (clock/refusal/shapes/text/issue/verify).
onomancy_wasm/src/issue.rs	New Wasm export for issuance: signableBytes + encodeCertificate.
onomancy_wasm/src/held.rs	Held-doc substrate updated: names are root keys; resolution marks DNS anchoring as zone-only; equivocation detection added.
onomancy_wasm/src/doh.rs	Improves JS error reduction (message-only, no embedded stack) and adds tests for prefix behavior.
onomancy_wasm/src/clock.rs	Centralizes clock handling; refuses milliseconds/non-finite/negative; adds host-testable rules.
onomancy_wasm/README.md	Documents local-only verification model and new API surface (resolve/verify/issue).
onomancy_wasm/package.json	Formatting-only adjustment.
onomancy_wasm/e2e/tests/walks.spec.ts	E2E expectations updated after removing per-document “note” data.
onomancy_wasm/e2e/tests/documents.spec.ts	Replaces “note” test with “non-reference keys don’t become edges” test.
onomancy_wasm/demo/names.html	Demo UI simplified (removes note editing/display).
onomancy_wasm/Cargo.toml	Adjusts deps/features: unconditional ed25519-dalek, adds keyhive/protocol deps, enables idna, adds web-sys Url.
onomancy_publish/tests/ceremonies.rs	Updates ceremony planning to pass an AuthorityVerifier (MemoryAuthority in tests).
onomancy_publish/src/plan.rs	Artifacts clarified as “write into document certificate list (or gossip)”.
onomancy_publish/src/lib.rs	Docs updated: ceremonies carry real carriages; simulation judged via supplied authority verifier.
onomancy_publish/src/ceremony/rotate.rs	plan() now generic over AuthorityVerifier; doc wording updated.
onomancy_publish/src/ceremony/refresh.rs	plan() now takes AuthorityVerifier to validate refreshed evidence against the same authority model.
onomancy_publish/src/ceremony/migrate.rs	plan() now generic over AuthorityVerifier; doc wording updated.
onomancy_publish/src/ceremony/bind.rs	plan() now generic over AuthorityVerifier; doc wording updated.
onomancy_publish/src/ceremony.rs	Simulation takes caller-provided AuthorityVerifier rather than hard-coded permissive authority.
onomancy_publish/README.md	Documentation updated: real carriages + authority seam passed to plan().
onomancy_protocol/src/verifier/verdict.rs	Splits rejection reasons (chain vs signer vs unattested), adds DeferredEvidence payload, updates tests.
onomancy_protocol/src/verifier/state/prune.rs	Fixes dominance strictness and prevents chain-only refreshes from pruning certificate-attested records.
onomancy_protocol/src/verifier/state/memory/authority.rs	Comment updates to reflect revocation semantics.
onomancy_protocol/src/verifier/state/diff.rs	Doc strings updated to remove obsolete spec tag references.
onomancy_protocol/src/verifier/state/binding_state.rs	Doc strings updated to remove obsolete spec tag references; clarifies use-time prompt gating.
onomancy_protocol/src/resolve/resolution.rs	Clarifies partial-walk reasons; removes stale “E1/E2” inline references.
onomancy_protocol/src/resolve/namestore/memory.rs	Doc string updated to remove obsolete “E6” inline reference.
onomancy_protocol/src/resolve/namestore.rs	Clarifies non-reference values are not edges; updates doc wording.
onomancy_protocol/src/ladder.rs	Test comments updated to remove obsolete spec tag references.
onomancy_keyhive/tests/authority.rs	Adds nested delegation topology test; pins known “sanctioned is direct-membership only” gap as ignored.
onomancy_keyhive/src/mint.rs	Doc wording updated to reflect “generation-path proof” terminology.
onomancy_keyhive/src/authority.rs	Clarifies KeyhiveAuthority as the single real authority model; fixes signing bar to >= Admin; adds tripwire test.
onomancy_dnssec/tests/real_world.rs	Updates comments now that delegation verification is no longer “pending” in this repo.
onomancy_dnssec/src/wire/rrsig.rs	Comment clarified about wildcard proof being out of protocol scope.
onomancy_dnssec/src/wire/digest_type.rs	Comment wording updated (unsupported-is-invalid phrasing).
onomancy_dnssec/src/wire/algorithm.rs	Comment wording updated (unsupported-is-invalid phrasing).
onomancy_dnssec/src/wire.rs	Comment updated (removes “D13 supported-set” phrasing).
onomancy_dnssec/src/validator.rs	Clarifies parse rejection is per-record, not RRset-wide.
onomancy_dnssec/src/txt/record.rs	Refactors regression tests module and updates comments; removes stale “D5” references.
onomancy_dnssec/src/test_utils.rs	Comment wording updated.
onomancy_dnssec/src/statement/successor.rs	Makes Signed::sign failure unreachable explicitly after signature-invariant changes.
onomancy_dnssec/src/statement/rotation.rs	Makes Signed::sign failure unreachable explicitly after signature-invariant changes.
onomancy_dnssec/src/dns_name.rs	Replaces “IpLiteral” with “AllDigitTld” rule; adds tests for non-IP all-digit TLD rejection.
onomancy_dnssec/src/crypto/ds_digest.rs	Comment wording updated (unsupported-is-invalid phrasing).
onomancy_dnssec/src/crypto.rs	Comment wording updated (removes “D13” labels while keeping behavior).
onomancy_dnssec/src/chain_proof.rs	Comment wording updated (removes “D5” labels while keeping behavior).
onomancy_dnssec/src/certificate.rs	Adds external-signing support (signable_bytes, from_parts, AssembleError) and hardens signature invariants.
onomancy_core/src/signed.rs	Makes Signed::sign fallible and routes through verification; adds external assembly and signable-region helper.
onomancy_automerge/tests/walk.rs	Updates tests for “names are root keys” (no reserved container).
onomancy_automerge/src/petname.rs	Switches to root-key storage; refuses empty path writes; updates error types/tests.
onomancy_automerge/src/lib.rs	Exports new certificates module.
onomancy_automerge/src/decisions.rs	Moves decision doc key to .well-known/onomancy/decisions and updates schema access.
onomancy_automerge/src/certificates.rs	New module to read/write in-document certificate lists with optional one-hop indirection.
onomancy_automerge/README.md	Updates Automerge data model docs: names + certificates + decisions as top-level keys.
onomancy_automerge/examples/namestore_doc.rs	Updates example to write names as root keys and removes note support.
onomancer/src/rotate.rs	Ceremony planning now passes KeyhiveAuthority.
onomancer/src/resolve.rs	Updates resolve docs to reflect KeyhiveAuthority as the authority model.
onomancer/src/refresh.rs	Refresh ceremony planning now passes KeyhiveAuthority.
onomancer/src/record.rs	Mints real generation carriages; refuses unprovable third-party signer; adds error variant.
onomancer/src/plan_io.rs	Output text updated to reflect writing artifacts into .well-known/onomancy/certificates.
onomancer/src/name.rs	Adds explicit zone equivocation detection (highest-serial tie) rather than using RRset order.
onomancer/src/migrate.rs	Ceremony planning now passes KeyhiveAuthority.
onomancer/src/bind.rs	Ceremony planning now passes KeyhiveAuthority.
onomancer/README.md	Updates caveats: delegation is now verified; documents remaining gaps explicitly.
flake.nix	CI improvements: wasm tests compile-checked; ci-all prints what did not run.
design/security.md	Updates threat model to “malicious source” and adds note about publisher serial discipline.
design/README.md	Updates design overview and fetch flow to in-document certificate + sync peer model.
design/keyhive-coordination.md	Updates status: keyhive authority replay runs today; coordination asks reframed.
design/dns-binding.md	Updates design doc from HTTP cert endpoint to sync peer + in-document certificate.
design/certificate.md	Replaces HTTP retrieval with in-document certificate storage and optional one-hop indirection.
design/assumptions.md	Updates assumption from “onomancer server honest” to “source of bytes honest”.
design/anchors.md	Updates server-trust wording to “any source is a keyless courier”.
deny.toml	Allows wildcard path dev-deps while keeping registry wildcards denied.
Cargo.lock	Adds onomancy_keyhive dependency to onomancy_wasm build graph.
.github/workflows/ci.yml	Adds ci-browser to matrix as the only job executing wasm-target tests.

Review details

• Files reviewed: 92/97 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.