[TRACE] EAT/JWT signing (ADR-0032, step 2/5)

[imran-siddique]

Summary

Implement TraceClaimSigner: takes a TrustRecord dict, produces a compact EdDSA JWT signed over the JCS-canonical payload with the configured key.

Scope

New file: agent-governance-python/agent-mesh/src/agentmesh/governance/trace_signing.py

Key management:

• Load Ed25519 private key from TRACE_PRIVATE_KEY_PEM env var at startup
• If absent, generate an ephemeral key and emit a startup warning
• Expose public_key_jwk() -> dict for embedding in cnf.jwk

Signing:

• Canonicalize payload with RFC 8785 JCS (json_canonicalize or equivalent)
• Sign with EdDSA (PyJWT + cryptography, algorithm "EdDSA")
• JWT headers: {"alg": "EdDSA", "typ": "JWT"}
• Inject cnf: {"jwk": public_key_jwk()} into payload before signing

Dependencies: PyJWT>=2.8.0, cryptography>=42.0.0, json-canonicalize

Acceptance criteria

• TraceClaimSigner class with sign(record: dict) -> str returning compact JWT
• Startup warning logged when key is ephemeral
• public_key_jwk() returns valid JWK dict (kty: "OKP", crv: "Ed25519")
• Round-trip test: sign a record, decode JWT header/payload without verification, confirm fields intact
• Verification test: sign and verify with public key extracted from cnf.jwk
• Tamper test: modify one byte of the payload after signing, confirm verification fails

References

• ADR-0032
• RFC 8785 (JCS canonicalization)
• Depends on: [TRACE] TRACE model and field mapping (ADR-0032, step 1/5) #3086 (model)
• Next: [TRACE] TRACEAuditSink (ADR-0032, step 3/5) #3088 (TRACEAuditSink)

[imran-siddique]

Addressed by #3099. No TraceClaimSigner class -- signing is sign_record(record, load_signing_key()) from �gentrust-trace>=0.2.0, two lines in TRACEAuditSink.emit().

[imran-siddique]

Closed by #3099. AGT delegates EAT signing to agentrust-trace (sign_record, load_signing_key). Package added to dep-confusion allowlist in the same PR.