[prk-Jr]

Summary

• Define publisher attestation so a consumer can distinguish a fresh publisher declaration from an independent, time-bounded deployment assessment and choose which verifiers to trust.
• Specify runtime keys, exact host/deployment bindings, enrollment, registry operations and consumer verification, with a separate qualification gate before any official Fastly executable claim.
• Keep this PR in draft for spec approval. Implementation will be added to this same branch and PR after spec approval, following an implementation plan; the current revision contains documentation, schemas and public fixtures only.

Changes

File	Change
docs/superpowers/specs/2026-11-04-publisher-attestation-design.md	Publisher endpoint, common wire rules, runtime/store integration, privacy, delivery phases and acceptance tests. P1 includes Fastly evidence and public production/staging Axum declarations with real authorization.
docs/superpowers/specs/2026-11-04-publisher-attestation-registry-design.md	Enrollment/operator authorization, assessments, expiry-only consumer acceptance, optional live status, collection, withdrawal/recovery, governance and key history.
docs/superpowers/specs/2026-11-04-publisher-attestation-fastly-qualification-design.md	Evidence and adversarial experiments required to bind a provider deployment to authenticated official executable bytes. Strong assurance stays disabled until qualification succeeds.
docs/superpowers/specs/schemas/publisher-attestation-v1.schema.json	Closed structural schemas, strict message types and contextual fingerprint constraints.
docs/superpowers/specs/fixtures/publisher-attestation-v1-vectors.json	Public signed interoperability and rejection vectors; synthetic fixtures do not establish live provider qualification.

V1 defaults to assessments expiring within 15 minutes of the oldest observation. Live registry status is optional, and identity projection consistency remains publisher-declared rather than a full-config audit. Ordinary deploys can have a temporary endorsement gap until reassessment. Auction/bid attestation is outside this PR.

Closes

Closes #161

Related: #1427. Binary-attestation dependencies: #1235, #1435 and #1449.

The issue-closing target is the completed implementation. This draft must not be merged as a spec-only closure of independent deployment verification. Recheck Layer 1 availability before implementation; this PR does not assume an unmerged release-evidence capability is shipped.

Spec

• Publisher endpoint and common wire contract
• Registry protocol and operations
• Fastly executable-binding qualification

Multiple independent review rounds are recorded in the specifications. The latest pass checked security/lifecycle, source-level runtime feasibility and protocol/schema interoperability. Live provider qualification and runtime implementation remain future gates.

Test plan

Local checks use Rust 1.98.1 and Node 24.20.0.

• All five adapter test aliases: Fastly, reusable Fastly, Axum, Cloudflare and Spin.
• All eight target-matched Clippy aliases and cargo fmt --all -- --check.
• Integration parity (28 tests), native template build-digest tests (10) and lint, and WASM clock lint.
• JS build and Vitest (75 files, 1,839 tests), JS formatting, and Markdown formatting outside docs.
• Documentation lint, formatting and VitePress build; docs-proposal shellcheck, 20 Node tests and shell suite.
• CI Node pin tests (30) and guard; changed-lines URL-host lint against origin/main.
• Public fixture validation: 11 signed objects, six unsigned objects, 24 cases and five negative encodings; independent Node/Rust signature checks.
• Three Mermaid diagrams, fenced JSON examples and 16 local file/heading links.
• Fastly deadline network fixture (5 tests), Cloudflare deadline fixture build/lint/runtime (4 cases), and Spin deadline fixture build/lint/runtime (5 cases), using pinned runtimes.
• Attestation runtime behavior and live provider qualification: future implementation/qualification gates, not claims made by this documentation revision.

Existing ignored JS build output was refreshed before the successful full Vitest rerun. Local network tests passed after allowing the sandbox-required local listeners/certificate access. No publisher service or provider account was changed.

Checklist

• Feature spec linked above, with two or more independent review rounds and technical review logs.
• Current changes follow AGENTS.md conventions and contain no credentials or signing private keys.
• Proposed publisher keys remain separate from release, request-signing, verifier and future auction keys.
• Public fixtures distinguish declaration, contextual fingerprint and qualification-gated official assurance.
• Spec approval recorded before implementation planning proceeds.
• Implementation plan prepared and Layer 1 dependency state rechecked before implementation.
• Runtime implementation, adapter regression tests and required provider qualification completed before ready-for-review/merge.

Production Rust logging/error-handling and regression-test requirements apply when implementation is added. The current revision adds no production Rust code or configuration-parser behavior.