Sign pushes by default and remove the lock feature gate

[samuv]

Note

Stack 2 of RFC THV-0080 — final PR (stack #6128, on top of #6137). Closes #5899 when it lands.

Summary

The last piece: signing on publish, and the feature gate comes out.

• thv skill push signs by default: --key signs the pushed artifact with a cosign private key (the signature manifest is attached at the .sig tag, so project-scoped installs verify it; the flow the signer/verifier PRs round-trip in tests). Pushing unsigned requires an explicit --no-sign, and a failed signing fails the push — an artifact is never silently published unsigned. Threaded through CLI, client, and API.
• TOOLHIVE_SKILLS_LOCK_ENABLED is removed: with verification on consume (installs, sync, upgrade) and signing on publish both in place, the lock file graduates from experimental. The gate, its env var, the "(experimental)" command markers, and every gated test-server setup are gone; the lock file, toolhive.requires materialization, sync, upgrade, and signature verification are now standard behavior for project-scoped skills. This is THE user-facing change of the stack.
• Trust-model docs rewritten (docs/arch/12-skills-system.md): the "drift detection over a repository-editable file" honesty note graduates to the verified model — TOFU semantics with the identity displayed, --allow-unsigned / --allow-signer-change escape hatches, the provisional: git marker, and an explicit list of what deliberately remains trusted on faith (unsigned exceptions, the lock file as reviewable policy, the first-use anchor).

Type of change

• New feature (non-breaking change which adds functionality)

Test plan

• Unit tests pass locally (task test, full suite with -race)
• Linting passes (task lint-fix, 0 issues)
• New unit tests: push requires an explicit signing decision (400 before anything is pushed); push signs with the provided key pinned to the pushed digest; signing failure fails the push. Gate-dependent tests updated: the gated-server E2E blocks merge into the standard suites; the legacy-unmanaged adopt fixture now constructs pre-lock state directly instead of toggling the gate.
• task docs regenerated.

Does this introduce a user-facing change?

Yes. The skills lock file feature is no longer gated: project-scoped installs write toolhive.lock.yaml, verify signatures (unsigned installs need --allow-unsigned), and thv skill sync/upgrade work without TOOLHIVE_SKILLS_LOCK_ENABLED. thv skill push now requires --key or an explicit --no-sign.

Special notes for reviewers

• The signed round-trip interop check (cosign verify --key accepts our attached signature) is covered by the signer package's unit tests plus toolhive-core's key-signed retrieval tests; a manual cosign-CLI check against a real registry is worth doing once before release.
• Follow-ups tracked on Track: Skills lock file + Sigstore signing (RFC THV-0080) #5899 at close: Rekor proof validation for git (removes provisional:), keyless/OIDC signing, catalog-supplied expected identity, and moving pkg/skills/signer to toolhive-core.

Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 96.00000% with 1 line in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (skills-sig/13b-provenance-display@c6569e6). Learn more about missing BASE report.

Files with missing lines	Patch %	Lines
pkg/skills/skillsvc/build.go	93.33%	1 Missing ⚠️

Additional details and impacted files

@@                         Coverage Diff                          @@
##             skills-sig/13b-provenance-display    #6139   +/-   ##
====================================================================
  Coverage                                     ?   72.52%           
====================================================================
  Files                                        ?      735           
  Lines                                        ?    76655           
  Branches                                     ?        0           
====================================================================
  Hits                                         ?    55594           
  Misses                                       ?    17102           
  Partials                                     ?     3959           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.