Verify Governance Pack

Signed, replayable evidence a CISO can verify offline.

AgentSmack signs every governance pack with the workspace's Ed25519 key and content-addresses it over the canonical bundle bytes. Download the pack, paste it here with its signature + the public key, and get a verdict with zero trust in us: is the Ed25519 signature authentic, and does the content-addressed packId still match the bytes (so a finding flipped from FAIL→PASS after signing is caught as tamper_detected)? VALID surfaces the bundle digest, packId, and signing key id; INVALID names exactly why. The crypto is deterministic and runs offline — a CI pipeline can POST the same pack to /api/v1/verify-pack and block the deploy unless valid:true. Load a sample signed pack to watch it verify with no live infra.