iamtoruk c01b7be4b0 fix(plugins): derive keygen keyId identically to sign; pin release-key ids in tests ... Fixes critical bug where keygen() used random keyId but sign() derived it from sha256 of public key PEM. This caused embedded release key (f40248d0) to not match actual derived id (499923ae), breaking plugin verification. Now both keygen and sign derive keyId consistently from sha256(publicKeyPem).slice(0,4).hex. Added tests: - keygen and sign derive identical keyIds from same ephemeral key - RELEASE_PUBLIC_KEYS map keys match their derived keyIds from embedded PEM values End-to-end verified: signing with private key and verifying with embedded public key now works without CODEBURN_PLUGIN_DEV.		2026-08-28 00:35:36 -07:00
..
upgrade-path	merge(main): rematch #1118 after #1116/#1122 — daily cache v29	2026-08-23 21:18:07 +05:30
bundle-litellm.mjs	fix(models): price gpt-5.6-codex and gpt-5.6-codex-max	2026-08-21 14:53:00 -07:00
sign-plugin.mjs	fix(plugins): derive keygen keyId identically to sign; pin release-key ids in tests	2026-08-28 00:35:36 -07:00
smoke-plugin-socket.mjs	feat(plugins): ed25519 release-key verification and plugin add/remove (9b)	2026-08-28 00:30:43 -07:00