witness network: deferred phase-1 items after the soundness + consolidation pass

[bordumb]

Deferred deliberately from the witness-network review implementation (branch witness-network), each with its interim posture stated:

1. KEL-anchored witness sets. verify_finalized recomputes the set's content SAID (self-addressing) and accepts a caller-resolved declared_said, but no KEL seal event exists yet for a principal to anchor its declared set. Until it does, a principal could still show different declared sets to different verifiers without the fork being attributable from the KEL alone. Needs: a witness-set anchoring seal in the delegator KEL (auths-id), and the evidence verifier resolving declared_said from the bundle's embedded delegator KEL.

2. Witness-node image publishing. deploy/witness/Dockerfile builds the real binary, but no CI job publishes ghcr.io/auths-dev/auths-witness-node (compose/Helm reference the image). Needs a release-workflow job (digest-pinned, reproducible-build attested).

3. Full acceptance conformance against a live node. witness-conformance --url covers the black-box transport checks; acceptance vectors require the target node's registry to hold the conformance identity. Needs: a fixture registry bundle the operator can mount, and the driver then asserting cosign/duplicity outcomes end to end.

4. Witness-to-witness gossip. Duplicity detection is currently watcher-pull (AUTHS_WATCH_WITNESSES/AUTHS_WATCH_SEEDS on the monitor). Witnesses do not yet exchange per-seed heads with peers, so detection latency is the watcher's poll interval.

5. Multi-sig party signatures. Anchor party signatures assume any-one-current-key (kt=1); thresholded key states are not yet expressible in ControllerKeys.

🤖 Generated with Claude Code