[jeffreyaven]

Summary

• Introduce the independently publishable github.com/stackql/stackql-provider-registry/signing module using Go 1.27.3 stdlib crypto/mldsa (FIPS 204 ML-DSA-65).
• Embed strictly framed raw-v1 signatures in provider/service YAML; verify exact original bytes without numeric rounding or YAML rewrites.
• Remove Ed25519/X.509 code, certificate renewal tooling and sidecar generation. Production CI uses MLDSA_SIGNING_SEED; PR packaging uses ephemeral keys.
• Commit only the newly provisioned public key. Verification remains opt-in in the coordinated SDK/runtime changes.

Approved deviations from the issue proposal

• No legacy fallback: explicitly approved by the maintainer.
• Exact-byte payloads instead of RFC 8785: the source audit found 439 documents with aliases, 13 with out-of-safe-range JSON numbers, and one unquoted date. The maintainer approved preserving the existing specifications rather than rewriting/rounding them.
• Nested signing module: the provider tree is ~787 MiB, above Go's 500 MiB module-zip limit.

Validation

• Signed and verified all 1,968 provider YAML documents byte-for-byte with ephemeral keys.
• Signing CLI/package tests and go vet pass.
• Both Python packaging tests pass.
• Dedicated CI repeats the full corpus audit on every PR.

Tagged release and coordination

The migration branch is squashed to one commit, 7736697, tagged signing/v0.1.0-alpha01. Its nested module version is v0.1.0-alpha01. The Go module downloads publicly; signing package/CLI tests and vet pass. Relative to the previous green PR tree, only tag/merge-policy documentation changed.

MERGE METHOD: CREATE A MERGE COMMIT. Do not squash or rebase this PR: retain the exact signing release-tag commit in main history. Verify git merge-base --is-ancestor signing/v0.1.0-alpha01 origin/main succeeds after merging. Published tags must never move.

Merge/release order:

1. add-ml-dsa-signed-provider-checks stackql-provider-tests#2 (squash is fine).
2. verify-ml-dsa-provider-documents any-sdk#155 and verify-ml-dsa-provider-documents stackql-labs/omnisdk#23 in parallel, both with CREATE A MERGE COMMIT to retain their release tags in main.
3. wire-ml-dsa-provider-verification stackql#869 via SQUASH AND MERGE, then publish the StackQL binary. Confirm https://releases.stackql.io/stackql/latest/stackql_linux_amd64.zip delivers the new build to the provider-test downloader.
4. This registry PR LAST, with CREATE A MERGE COMMIT. Core merging alone is not enough: production publication invokes the strict signed-provider checker from the released binary.

Consumers use named published versions, so registry cutover need not happen first. Verification remains opt-in. Legacy artifacts require re-signing/republishing before opting in; this code-only PR does not rewrite deployed artifacts. Archive authentication and freshness/rollback remain out of scope.

Mandatory issue-close step

This repository defaults to dev while this PR targets main, so GitHub will not auto-close #482. Explicitly close #482 immediately after the cutover merge. Native closing links exist for the other three repositories' issues.

Latest semver CI verification

All PR checks passed at tagged commit 7736697, including the 1,968-document signing audit, AOT/regression tests and packaging checks. Signing workflow: https://github.com/stackql/stackql-provider-registry/actions/runs/40050410981. All downstream semver-pinned core checks passed: https://github.com/stackql/stackql/actions/runs/40050605476. No PRs have been merged. Keep this cutover last and use Create a merge commit, not squash/rebase, to retain the signing tag in main history.

Refs #482