fix: unify GoodBuddy release signing identity

Use one generic GoodBuddy Ed25519 identity for the Agent bundle, bundled Runtime, outer package, and signed catalog while preserving each layer's existing signature domain.

Rename the production Environment contract to GOODBUDDY_SIGNING_*, register the matching production public key, and keep desktop and branch CI workflows isolated from the private key.

.github/workflows/agent-release.yml

@@ -189,10 +189,10 @@ jobs:
           }
           NODE
 
-      - name: Preflight production Agent signing identity
+      - name: Preflight production GoodBuddy signing identity
         shell: bash
         env:
-          GOODBUDDY_AGENT_SIGNING_KEY_ID: ${{ vars.GOODBUDDY_AGENT_SIGNING_KEY_ID }}
+          GOODBUDDY_SIGNING_KEY_ID: ${{ vars.GOODBUDDY_SIGNING_KEY_ID }}
         run: |
           set -euo pipefail
           node build/agent-bundle.cjs preflight
@@ -202,8 +202,8 @@ jobs:
         env:
           AGENT_ARCH: ${{ matrix.arch }}
           AGENT_VERSION: ${{ needs.authorize.outputs.version }}
-          GOODBUDDY_AGENT_SIGNING_KEY_ID: ${{ vars.GOODBUDDY_AGENT_SIGNING_KEY_ID }}
-          GOODBUDDY_AGENT_SIGNING_PRIVATE_KEY: ${{ secrets.GOODBUDDY_AGENT_SIGNING_PRIVATE_KEY }}
+          GOODBUDDY_SIGNING_KEY_ID: ${{ vars.GOODBUDDY_SIGNING_KEY_ID }}
+          GOODBUDDY_SIGNING_PRIVATE_KEY: ${{ secrets.GOODBUDDY_SIGNING_PRIVATE_KEY }}
           NODE_ARCHIVE: ${{ steps.inputs.outputs.node-archive }}
           OPENCODE_ARCHIVE: ${{ steps.inputs.outputs.opencode-archive }}
         run: |
@@ -344,8 +344,8 @@ jobs:
         env:
           AGENT_VERSION: ${{ needs.authorize.outputs.version }}
           PREVIOUS_ARGUMENTS: ${{ steps.previous.outputs.arguments }}
-          GOODBUDDY_AGENT_SIGNING_KEY_ID: ${{ vars.GOODBUDDY_AGENT_SIGNING_KEY_ID }}
-          GOODBUDDY_AGENT_SIGNING_PRIVATE_KEY: ${{ secrets.GOODBUDDY_AGENT_SIGNING_PRIVATE_KEY }}
+          GOODBUDDY_SIGNING_KEY_ID: ${{ vars.GOODBUDDY_SIGNING_KEY_ID }}
+          GOODBUDDY_SIGNING_PRIVATE_KEY: ${{ secrets.GOODBUDDY_SIGNING_PRIVATE_KEY }}
         run: |
           set -euo pipefail
           generated_at="$(git show -s --format=%cI "$GITHUB_SHA")"

AGENTS.md

@@ -227,12 +227,12 @@ Release note: 修复左上角项目设置与消息通道项目设置不一致的
   the checked-in public key registry.
 - `.github/workflows/agent-release.yml` is the only production compound Agent
   publication path. It requires an annotated immutable Agent tag, the protected
-  `agent-signing` Environment, native x64/arm64 builds, one production Agent
-  signing identity for every layer of the compound package and catalog, a
-  non-Latest GitHub Agent Release, and synchronized immutable Beijing OSS
-  objects plus the final signed latest-catalog pointer.
+  `agent-signing` Environment, native x64/arm64 builds, one production
+  GoodBuddy signing identity for every layer of the compound package and
+  catalog, a non-Latest GitHub Agent Release, and synchronized immutable
+  Beijing OSS objects plus the final signed latest-catalog pointer.
 - `.github/workflows/packages.yml` and `release:package` build only desktop
-  products. Missing Agent packages, remote Runtime inputs, or Agent signing
+  products. Missing Agent packages, remote Runtime inputs, or GoodBuddy signing
   credentials must never block an ordinary desktop package or release.
 - Keep electron-builder invocations on `--publish never`. Main-branch builds
   run validation and build the production bundle without running the native

BUILD.md

@@ -197,15 +197,15 @@ Linux x64/arm64 复合包。每个 job 从 `agent-runtime-lock.json` 解析官
 发布路径：只接受指向受保护 `main` 历史的 annotated
 `agent-v${agent-runtime-lock.agentVersion}` 标签，在 `agent-signing` Environment 中
 原生构建两种架构，生成并签名累计目录，然后同步到非 Latest 的 GitHub Agent Release
-与北京 OSS。该 Environment 只保护一组 GoodBuddy Agent 发布变量与 Secret：
+与北京 OSS。该 Environment 只保护一组 GoodBuddy 通用发布变量与 Secret：
 
-- `GOODBUDDY_AGENT_SIGNING_KEY_ID` /
-  `GOODBUDDY_AGENT_SIGNING_PRIVATE_KEY`
+- `GOODBUDDY_SIGNING_KEY_ID` /
+  `GOODBUDDY_SIGNING_PRIVATE_KEY`
 
-该身份统一签署内部 Agent、固定 Runtime manifest、外层 `.gbagent` 描述符和累计目录，
-各层通过既有签名域区分用途，不再要求内部 Runtime 单独配置生产身份。私钥只注入签名
-步骤；预检只读取 key ID 并确认公钥已在 `resources/agent-release-keys.json`
-注册为 production 且未撤销。
+该 GoodBuddy 身份统一签署内部 Agent、固定 Runtime manifest、外层 `.gbagent`
+描述符和累计目录，各层通过既有签名域区分用途，不再要求内部 Runtime 单独配置生产
+身份。私钥只注入签名步骤；预检只读取 key ID 并确认公钥已在
+`resources/agent-release-keys.json` 注册为 production 且未撤销。
 
 累计目录使用 `agent-catalog.json` 与 `agent-catalog.sig`。每个条目绑定 Agent 版本、
 最低桌面版本、Agent 协议、远端 OpenCode 版本/digest、架构、文件名、大小、SHA-256

build/agent-bundle.cjs

@@ -47,9 +47,9 @@ const manifestFileName = 'manifest.json'
 const signatureFileName = 'manifest.sig'
 const koffiPackageName = 'koffi'
 const signingPrivateKeyEnvironment =
-  'GOODBUDDY_AGENT_SIGNING_PRIVATE_KEY'
+  'GOODBUDDY_SIGNING_PRIVATE_KEY'
 const signingKeyIdEnvironment =
-  'GOODBUDDY_AGENT_SIGNING_KEY_ID'
+  'GOODBUDDY_SIGNING_KEY_ID'
 const semanticVersionPattern =
   /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+((?:[0-9a-zA-Z-]+)(?:\.[0-9a-zA-Z-]+)*))?$/u
 
@@ -372,7 +372,7 @@ function productionSigningKey(environment = process.env) {
   const privateKey = environment[signingPrivateKeyEnvironment]
   if (!keyId || !privateKey) {
     throw new Error(
-      `${signingKeyIdEnvironment} and ${signingPrivateKeyEnvironment} are required for production Agent signing`
+      `${signingKeyIdEnvironment} and ${signingPrivateKeyEnvironment} are required for production GoodBuddy signing`
     )
   }
   return { keyId, privateKey }
@@ -385,11 +385,11 @@ function preflightProductionSigningKey(options = {}) {
   const registry =
     options.registry ?? readTrustedKeyRegistry(projectRoot)
   return preflightRegisteredProductionKey({
-    component: 'Agent',
+    component: 'GoodBuddy',
     keyId,
     registry,
     missingKeyIdMessage:
-      `${signingKeyIdEnvironment} is not configured; provision the production Agent signing key ID before building a release`
+      `${signingKeyIdEnvironment} is not configured; provision the production GoodBuddy signing key ID before building a release`
   })
 }
 
@@ -427,7 +427,7 @@ function trustedKeyForManifest(
     (candidate) => candidate.keyId === key.keyId
   )
   if (revocation) {
-    throw new Error(`Agent signing key is revoked: ${key.keyId}`)
+    throw new Error(`GoodBuddy signing key is revoked: ${key.keyId}`)
   }
   return key
 }
@@ -814,7 +814,9 @@ function buildAgentBundle(options) {
     publicKeySpkiBase64(signingIdentity.privateKey) !==
     signingRecord.publicKeySpkiBase64
   ) {
-    throw new Error('Agent signing private key does not match the trusted key')
+    throw new Error(
+      'GoodBuddy signing private key does not match the trusted key'
+    )
   }
   if (
     !options.testSigningIdentity &&
@@ -1105,7 +1107,7 @@ function parseArguments(argv) {
   }
   if (command === 'preflight') {
     if (Object.keys(options).length > 0) {
-      throw new Error('Agent signing preflight does not accept arguments')
+      throw new Error('GoodBuddy signing preflight does not accept arguments')
     }
     return { command }
   }
@@ -1118,7 +1120,7 @@ function main(argv = process.argv.slice(2)) {
   if (options.command === 'preflight') {
     const signingRecord = preflightProductionSigningKey()
     console.log(
-      `Production Agent signing registry preflight passed: ${signingRecord.keyId}`
+      `Production GoodBuddy signing registry preflight passed: ${signingRecord.keyId}`
     )
     return
   }

build/remote-runtime-bundle.cjs

@@ -44,9 +44,9 @@ const supportedArchitectures = Object.freeze(['x64', 'arm64'])
 const manifestFileName = 'manifest.json'
 const signatureFileName = 'manifest.sig'
 const signingPrivateKeyEnvironment =
-  'GOODBUDDY_AGENT_SIGNING_PRIVATE_KEY'
+  'GOODBUDDY_SIGNING_PRIVATE_KEY'
 const signingKeyIdEnvironment =
-  'GOODBUDDY_AGENT_SIGNING_KEY_ID'
+  'GOODBUDDY_SIGNING_KEY_ID'
 const signatureDomain = Buffer.from(
   'GoodBuddy Remote Runtime Bundle Manifest Signature v1\0',
   'utf8'
@@ -318,11 +318,11 @@ function preflightProductionSigningKey(options = {}) {
   const registry =
     options.registry ?? readTrustedKeyRegistry(projectRoot)
   return preflightRegisteredProductionKey({
-    component: 'Agent',
+    component: 'GoodBuddy',
     keyId,
     registry,
     missingKeyIdMessage:
-      `${signingKeyIdEnvironment} is not configured; provision the production Agent signing key ID before building a release`
+      `${signingKeyIdEnvironment} is not configured; provision the production GoodBuddy signing key ID before building a release`
   })
 }
 
@@ -1051,7 +1051,7 @@ function main(argv = process.argv.slice(2)) {
   if (options.command === 'preflight') {
     const record = preflightProductionSigningKey()
     console.log(
-      `Production Agent signing preflight passed for bundled Runtime: ${record.keyId}`
+      `Production GoodBuddy signing preflight passed for bundled Runtime: ${record.keyId}`
     )
     return
   }

docs/architecture/remote-host-and-goodbuddy-agent-design.md

@@ -216,7 +216,7 @@ Renderer 暴露固定方法名、数字 RPC code 和有界 service code，不转
   `.remote-runtime-resources` 或任何可安装 Linux 远端 payload。
 - `build/agent-package.cjs` 在对应原生 Linux 架构组装确定性 `.gbagent`，外层签名覆盖
   描述符和每个内部文件身份；内部 Agent 与 Runtime 仍分别使用既有签名 manifest 和 lock
-  校验，但所有 production 层统一使用一组 GoodBuddy Agent 发布身份并通过签名域区分用途，
+  校验，但所有 production 层统一使用一组 GoodBuddy 通用发布身份并通过签名域区分用途，
   不要求内部 Runtime 单独配置密钥。`build/agent-catalog.cjs` 为双架构包生成签名累计目录，
   拒绝同一版本/架构改变字节。
 - `.github/workflows/agents.yml` 只使用进程内临时测试 key 做分支/PR 原生验证，不发布。

resources/agent-release-keys.json

@@ -2,23 +2,8 @@
   "formatVersion": 1,
   "keys": [
     {
-      "keyId": "e2e-20260823-020914-ce95d6f6",
-      "publicKeySpkiBase64": "MCowBQYDK2VwAyEA8w12MNcxOrU18MArvcuJmVkGKzJsa/r93q14HGX7DUU=",
-      "environment": "production"
-    },
-    {
-      "keyId": "goodbuddy-e2e-agent-8b0b39d2e63d7cf163c23bb7",
-      "publicKeySpkiBase64": "MCowBQYDK2VwAyEAx5lS8/stctKe/ri3kSNLR3nmkTV1eTpS0c1TYtJuHoM=",
-      "environment": "production"
-    },
-    {
-      "keyId": "goodbuddy-e2e-v8-de8355f998071143411bc075",
-      "publicKeySpkiBase64": "MCowBQYDK2VwAyEAY7rOjqPT3FAw2+F5roTqyssz4Zzzx0iJhk6tGhCVivc=",
-      "environment": "production"
-    },
-    {
-      "keyId": "goodbuddy-e2e-v12-b5adef071b79b4fdec57ea98",
-      "publicKeySpkiBase64": "MCowBQYDK2VwAyEATKD9wXjCeC35SMDrczzpou5PusRkxqSgNb5Se/jYOFU=",
+      "keyId": "goodbuddy-signing-2026-08",
+      "publicKeySpkiBase64": "MCowBQYDK2VwAyEAfUkXqa3WYwb1QevpHW/XWNhGo59dETJYjrJONx6SKEQ=",
       "environment": "production"
     }
   ],

tests/agent-bundle.test.ts

@@ -512,7 +512,7 @@ describe('Agent production input handling', () => {
   it('requires CI-only production key variables and redacts them', () => {
     expect(() =>
       agentBundle.productionSigningKey({})
-    ).toThrow('required for production Agent signing')
+    ).toThrow('required for production GoodBuddy signing')
 
     const secret = [
       '-----BEGIN PRIVATE KEY-----',
@@ -521,8 +521,8 @@ describe('Agent production input handling', () => {
     ].join('\n')
     const error = `signing_key=${secret} key id prod-secret-id`
     const redacted = agentBundle.redactSecrets(error, {
-      GOODBUDDY_AGENT_SIGNING_PRIVATE_KEY: secret,
-      GOODBUDDY_AGENT_SIGNING_KEY_ID: 'prod-secret-id'
+      GOODBUDDY_SIGNING_PRIVATE_KEY: secret,
+      GOODBUDDY_SIGNING_KEY_ID: 'prod-secret-id'
     })
     expect(redacted).not.toContain('fixture-secret-material')
     expect(redacted).not.toContain('prod-secret-id')
@@ -536,7 +536,7 @@ describe('Agent production input handling', () => {
         registry
       })
     ).toThrow(
-      'Production Agent public signing key ID "production-release-key" is absent from resources/agent-release-keys.json'
+      'Production GoodBuddy public signing key ID "production-release-key" is absent from resources/agent-release-keys.json'
     )
   })
 

tests/agent-release-workflow.test.ts

@@ -97,7 +97,7 @@ describe('independent Agent release workflow', () => {
     )
     expect(buildScripts).toContain('--ignore-scripts')
     expect(build).toContain(
-      'GOODBUDDY_AGENT_SIGNING_PRIVATE_KEY'
+      'GOODBUDDY_SIGNING_PRIVATE_KEY'
     )
     expect(workflow).not.toContain(
       'GOODBUDDY_REMOTE_RUNTIME_SIGNING_'
@@ -169,7 +169,7 @@ describe('independent Agent release workflow', () => {
   it('keeps private keys out of authorization and public publication jobs', () => {
     expect(serializedJob('authorize')).not.toContain('secrets.')
     expect(serializedJob('publish')).not.toContain(
-      'GOODBUDDY_AGENT_SIGNING_PRIVATE_KEY'
+      'GOODBUDDY_SIGNING_PRIVATE_KEY'
     )
   })
 })

tests/agents-workflow.test.ts

@@ -162,7 +162,7 @@ describe('GoodBuddy Agents workflow', () => {
     )
     expect(workflow).not.toContain('secrets.')
     expect(workflow).not.toContain(
-      'GOODBUDDY_AGENT_SIGNING_PRIVATE_KEY'
+      'GOODBUDDY_SIGNING_PRIVATE_KEY'
     )
     expect(ciBundleSource).toContain(
       "generateKeyPairSync('ed25519')"

tests/packages-workflow.test.ts

@@ -76,7 +76,7 @@ describe('desktop packages workflow', () => {
     expect(workflow).not.toContain('agent-signing:')
     expect(workflow).not.toContain('remote-runtime-signing:')
     expect(workflow).not.toContain(
-      'GOODBUDDY_AGENT_SIGNING_PRIVATE_KEY'
+      'GOODBUDDY_SIGNING_PRIVATE_KEY'
     )
   })
 

tests/remote-runtime-bundle.test.ts

@@ -315,7 +315,7 @@ describe('Remote Runtime bundle tooling', () => {
       runtimeBundle.preflightProductionSigningKey({
         projectRoot: process.cwd(),
         environment: {
-          GOODBUDDY_AGENT_SIGNING_KEY_ID:
+          GOODBUDDY_SIGNING_KEY_ID:
             'runtime-fixture'
         },
         registry: productionRegistry
@@ -326,7 +326,7 @@ describe('Remote Runtime bundle tooling', () => {
     })
   })
 
-  it('signs the bundled Runtime with the shared Agent identity', () => {
+  it('signs the bundled Runtime with the shared GoodBuddy identity', () => {
     const productionRegistry: AgentReleaseKeyRegistry = {
       ...registry,
       keys: registry.keys.map((key) => ({