feat: Attested Signatures + UCAN Principal Clarification

[Peeja]

See fil-forge/ucantone#30

[Peeja]

Copilot added some changes to fix a build issue. @frrist, can you take a look at those two commits and see if they make any sense? It looks like the wrong way to solve this to me, but I don't have enough context in my head to understand where the right change should be.

Copilot's change description follows:

---

The e2e CI job (TestStackFromSnapshot and TestUploadAndRetrieve) was failing because ghcr.io/fil-forge/piri:main was rebuilt with the new ucantone library (which refactored verification.NewIssuer() out), but piri's uber-go/fx dependency injection wiring wasn't updated. Piri crashes at startup with:

FATAL cmd building piri: ... missing type: ucan.Issuer (did you mean to Provide it?)

Fix

Pinned PIRI_IMAGE in .env to the specific digest (sha256:31509ada...) that was used when the committed 3-piri-filesystem-sqlite snapshot was saved — a known-good version of piri that works with the current stack.

The pin comment describes what needs to be fixed upstream: piri's DI wiring needs to be updated to use multikey.NewIssuer() instead of the removed verification.NewIssuer() provider for ucan.Issuer. Remove the pin and regenerate the snapshot once that is resolved.

[frrist]

@Peeja the issue here requires a fix in Piri, I think. I believe fil-forge/piri#18 broke the serve command since nothing is providing a ucan.Issuer to the NewPieceAccepter method, and possibly others. This failure shows up when the node starts, rather than when its built - since fx is dynamic. This is my hunch for the moment, but I feel pretty sure on it.

[Peeja]

fil-forge/piri#29 and fil-forge/indexing-service#8 landing should make this go green. 🤞🏻

[Peeja]

Handoff — one step left to get this green (cc @frrist)

Petra had to step away, so Forrest this is yours to land. Summary of where things are and the single remaining step.

Done & merged

• This PR (smelt): dropped the two Copilot .env pin commits; bumped libforge → 2b55dbcf (libforge#43, attested did:web login fix); added storage.s3.use_path_style: true to systems/upload/config/config.yaml (the newer sprue:main defaults it false, so the upload service couldn't reach MinIO and crashed at boot).
• piri #29 and indexer #8: bumped ucantone 7985ec0 → a8f24fe (accepts the DID Core v1 @context) + libforge → 2b55dbcf. Both merged; :main images rebuilt.

Verified via E2E

Dispatching .github/workflows/e2e.yml on this branch, the earlier failures are gone: guppy login succeeds (no more InvalidSignature) and the upload service boots (no more agent-message.minio DNS crash).

The one remaining blocker: the delegator's DID document

Latest run (28686738331) still fails at blob/accept:

piri: publishing location commitment: unable to resolve "did:web:delegator":
  parsing DID document JSON: @context must list ".../did/v1.1" or ".../did/v1" first

The "or v1" wording confirms the rebuilt piri:main is running the new ucantone — so this is now purely delegator-side. delegator:main still serves a DID document whose first @context entry is neither v1.1 nor v1 (pre-migration format). piri resolves did:web by fetching the live document over HTTP (no static-mapping override), and current libforge/ucantone marshal @context v1.1-first, so a delegator rebuilt on current deps serves a parseable doc.

I couldn't do this one myself — fil-forge/delegator isn't in this session's repo scope.

Steps to finish

1. In fil-forge/delegator, bump go.mod: ucantone → a8f24fe (or later) and libforge → 2b55dbcf (or later); go mod tidy + build. (Same one-line dep bump as piri#29 / indexer#8.)
2. Merge and let delegator:main rebuild.
3. Re-run this PR's E2E workflow (Actions → E2E → Run workflow on petra/feat/attested-signatures, or gh workflow run e2e.yml --ref petra/feat/attested-signatures) and confirm green.

Every @context failure in the current run is for did:web:delegator only, so the delegator rebuild should be the last step — but a fresh e2e afterward is worth it to rule out a straggler behind it.

🤖 Generated with Claude Code
https://claude.ai/code/session_017yUxrDH8gWAA4ufwzuq657

---

Generated by Claude Code

[alanshaw]

I will pick this up.

fil-forge/delegator#6