Sign decision envelopes and close FLEX-WP-0024.

Detached Ed25519 over the canonical envelope with signature omitted.
Unsigned is stated, not implied. Testdata fixtures prove verify and
tamper failure without minting a production key. FLEX-WP-0025 is
finished with the validate check from the previous commit.

Assistant: grok
Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267

workplans/FLEX-WP-0024-decision-envelope-authenticity.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Sign the decision envelope: the response channel is unauthenticated"
 domain: infotech
 repo: flex-auth
-status: active
+status: finished
 owner: claude
 topic_slug: netkingdom
 planning_priority: P1
@@ -15,7 +15,7 @@ related_workplans:
   - FLEX-WP-0019
   - FLEX-WP-0023
 created: "2026-09-06"
-updated: "2026-09-06"
+updated: "2026-09-14"
 state_hub_workstream_id: "90577acd-6910-548d-a13e-1dbfdfb8ed27"
 ---
 
@@ -68,7 +68,7 @@ that does not exist resolves to the same address.
 
 ```task
 id: FLEX-WP-0024-T02
-status: todo
+status: done
 priority: high
 state_hub_task_id: "5482f3cd-36cb-55e0-8c52-0ca2340ed4d7"
 ```
@@ -97,11 +97,17 @@ Owner: `flex-auth`; key custody is **not** ours to invent.
 Gate: the canonical form, the algorithm, and the custody path are written down
 and reviewed before any signing code exists.
 
+**Done 2026-09-14.** Written in `docs/decision-envelope-signature.md`: detached
+Ed25519 over `json.Marshal` of the envelope with `signature` omitted; unsigned
+is `{mode: unsigned}`; production key lives in OpenBao, not this repo
+(proposed catalog id `flex-auth-decision-envelope-signing-key`). Test-only seed
+is documented and is not the custody path.
+
 ## 3. Implement signing and verification
 
 ```task
 id: FLEX-WP-0024-T03
-status: wait
+status: done
 priority: high
 state_hub_task_id: "041612ea-1be4-5997-8c32-49f8bcc50855"
 ```
@@ -125,6 +131,12 @@ Owner: `flex-auth`.
 Gate: an altered envelope fails verification, an unaltered one passes, and a
 consumer can perform both from the fixtures alone.
 
+**Done 2026-09-14.** Additive `signature` on the schema and envelope. Engine
+emits `{mode: unsigned}` when no key is configured. Fixture pair:
+`examples/secrets-engine/replay/decision_rotate_signed.json` verifies,
+`decision_rotate_signed_tampered.json` does not, same `request_digest`. Public
+key in `keys.json`. Tests in `internal/sign`.
+
 ## 4. Report the gap to gate-house
 
 ```task