[P1] Replace unsigned credential placeholders with consistent signed action records

[brianorwhatever]

Problem and priority

Verifiable records of who did what are central to boop. Current action credentials contain unsigned JSON, individual and batch completion record different histories, and agent-key writes collapse attribution into the human owner. P1: the implementation does not yet meet its provenance claim.

Evidence

• convex/items.ts:17 and convex/lists.ts:56 store JSON.stringify(fullVc) as proof rather than a signature. An in-memory inspection confirmed the generated credential has no signature.
• convex/items.ts:332 appends a completion credential; convex/items.ts:653 updates batch completion without the corresponding record.
• convex/lib/actor.ts:46 resolves API-key operations to ownerDid without preserving which key acted.
• src/components/ProvenanceInfo.tsx:848 presents these records as Verifiable Credentials.

Required change

• Share one action-recording path across individual and batch transitions, including human and agent writes.
• Preserve authorizing-owner identity separately from authenticated actor/credential identity. Do not infer agent identity solely from an unverified caller-provided DID.
• Define the exact action payload and identity binding that a signature covers, then produce independently verifiable signed records using supported Originals facilities.
• Preserve historical placeholder data as explicitly unsigned records; never fabricate signatures or historical claims during migration.
• Retire duplicate placeholder constructors and misleading verification presentation after the replacement is ready. Keep genuine CEL/WebVH history intact.

What stays / compatibility

Keep durable historical attribution and real cryptographic evidence. Removing the placeholder wrappers loses no signature assurance, but external vcProof/vcProofs consumers may depend on their shape: confirm them before deleting fields or changing responses. Document signing custody and the scope of what verification proves.

Acceptance and verification

• Equivalent individual/batch actions produce equivalent histories.
• Human operations and distinct API-key operations remain distinguishable from their authorizing owner.
• An independent verifier accepts authentic records and rejects altered payloads/signatures or invalid actor bindings.
• Historical unsigned records remain readable and are never shown as verified.
• Existing envelope-tampering and migration tests still pass.
• Exercise create, complete, reopen, batch, and recurring-item flows; report remaining coverage gaps.

Coordination

Depends on the authenticated identity boundary in #236. Related to #206 (receipt export) and #229 (signature commitment semantics). The signing/anchoring assumptions in #206 are not evidence that these foundations already work; this issue establishes action-record foundations without implementing receipt export.

Implementation constraints

Implement this issue in a separate worktree. Keep changes within this issue's scope; other review recommendations require separate selection. Preserve security, existing signed evidence, and supported client/data compatibility. Run relevant tests and key user flows, and report anything still unverified. Do not remove legacy data or entry points until their dependencies are established.

Source references above are from the reviewed local checkout, commit b1810b7393a473d6c6c63e7f722a6807cfbf4040 (not currently published on GitHub). Re-check the target branch before implementation; do not assume these line numbers remain current.

[brianorwhatever]

Starting implementation for coordinator thread 73c6a27c-b6d8-4f6a-9294-6ee92e8f3e46. Assignment boop-237-73c6, branch fix/237-signed-action-records, isolated worktree /tmp/boop-issue-237-73c6. Scope: action recording, authenticated actor attribution, supported Originals signing/independent verification, and provenance presentation/tests/docs. Preserving historical unsigned records and genuine CEL/WebVH evidence. Coordinator owns PR and independent review; no merge/deploy/live backend work.

[brianorwhatever]

boop-237-73c6 update: implementation uncovered a custody decision requiring product approval. Existing asset keys are browser-local; the existing Turnkey adapter requires a Node/network action and cannot sign inside current atomic mutations. Coordinator is obtaining a decision between explicit service attestations and author-held/asynchronous signing; no signing custody or deployment behavior has been changed. Independent work continues on authenticated credential attribution, payload semantics, and truthful historical presentation. Historical CEL/WebVH evidence remains untouched.

[brianorwhatever]

Partial handoff — boop-237-73c6, coordinator thread 73c6a27c-b6d8-4f6a-9294-6ee92e8f3e46. Pushed df716e4 on fix/237-signed-action-records for coordinator review/PR; this does NOT close #237. Changes retain trusted session/API-key row identity separately from authorizing account identity, label known historical JSON placeholders unsigned and unknown genuine evidence unverified, preserve existing CEL/WebVH handling and vcProof wire/storage compatibility, and add backend plus rendered UI regressions. No unused payload contract or custody-dependent writer was included. Verification: full bun test 622 pass/0 fail, final focused tests 4 pass, frontend/backend tsc, focused ESLint, direct Vite build and diff check pass. Native/live, E2E and Lighthouse flows unverified. Remaining blocker: user decision on signing custody (explicit service attestation versus author-held/asynchronous signing), issuer trust/rotation and availability policy. Remaining implementation includes shared single/batch/recurring recording, immutable exact signed payload/actor bindings and independent verifier; current writers still produce placeholders. Documentation: docs/action-records.md. No PR created by this assignment; no merge/deploy/live backend changes.

[brianorwhatever]

Partial PR opened: #273 at 4a41722. It preserves authenticated credential identity separately from owner identity and corrects unsigned/unverified historical presentation, including an unsupported ownership claim found in independent review. Seventeen focused actor/UI/Originals/migration tests pass; CI and follow-up review are underway. This does not close #237: custody selection, issuer trust/rotation and availability behavior remain blocked on product choice; actual shared signed-record writer and independent verifier are not implemented. No live signing configuration changed.

[brianorwhatever]

Handoff: #273 is ready for review for its explicitly partial scope at db8cfc1. Latest CI is green (unit/browser suites, web/Android/unsigned iOS builds, Lighthouse), independent review findings were fixed, and GitHub reports no conflicts. The PR corrects unsigned/unverified provenance claims and retains authenticated credential identity; it does NOT implement signed action writers. Remaining blocker: decide service-attestation versus author-held/asynchronous custody, issuer trust/rotation and signing failure policy. Full #237 implementation is stopped pending that decision; no agent is still claiming active implementation. #271 is the included prerequisite and should merge first. No merge or manual deployment performed.

[brianorwhatever]

Starting badge follow-up for coordinator thread 73c6a27c-b6d8-4f6a-9294-6ee92e8f3e46, task boop-237-badge-followup-73c6, PR #273. Checked current issue assignees/comments and PR feedback: no competing active implementation is recorded. Working only in /tmp/boop-issue-237-73c6 on fix/237-signed-action-records at db8cfc1 to address remaining unsupported header/public verification and ownership claims from pullfrog review 5408554080, with rendered regressions and evidence-boundary documentation. Preserving genuine anchor/CEL verification; no signing/custody/writer changes or live calls. Will commit locally; coordinator owns integration and push.

[brianorwhatever]

Badge follow-up completed and handed off in #273 at ab52182. Remaining header/public verification claims now label DID presence as unverified metadata; neutral icons, malformed-document handling and rendered regressions preserve the separate anchor/CEL evidence paths. Independent delegated review and automated review found no remaining actionable issues. Latest CI is green: 645 unit tests, complete browser suite, web/Android/unsigned iOS builds and Lighthouse; GitHub reports no conflict. Both follow-up tasks are complete; no implementation remains active. Full #237 is still blocked on signing custody, trust/rotation and failure policy, and no signed writer is claimed. No merge or manual deployment was performed.

[brianorwhatever]

Starting implementation of the remaining #237 scope (coordinator thread ea22397e-aba9-4f31-be9e-a0dae2a4a8a6, branch fix/237-turnkey-signed-action-records).

Custody decision (from the product owner): author-held keys at Turnkey. New action records are signed by the authorizing owner's Turnkey sub-org Ed25519 key. Because the Turnkey adapter is Node/network-only, signing happens asynchronously: the mutation stores the exact canonical payload as a pending record, and a scheduled action signs it with retries and a truthful pending/signed/failed/unsigned status.

Scope:

• One shared action-recording path for item create, complete, reopen, batch, and recurring flows, and for list create/rename.
• The payload binds the authorizing owner DID separately from the authenticated credential (session or API-key row).
• An independent verifier that rejects altered payloads, bad signatures, or a mismatched actor/key binding.
• Provenance UI shows the new statuses. Historical placeholders stay readable and labeled unsigned.
• Tests and docs.

Genuine CEL/WebVH evidence and vcProof/vcProofs compatibility are preserved. No merge, deploy, or live-key changes.

[brianorwhatever]

PR opened: #277. It signs action records with the owner's Turnkey key (asynchronously, with an explicit pending/signed/failed/unsigned status), routes every action through one shared recording path, and adds an independent verifier. Known limitation: the Turnkey key is not yet published in users' did:webvh documents, so verifiers must pin the key themselves (documented in the PR). Independent review and CI are in progress.