Fix Ghost CP closure gap: remove status gate + lower TTL to 24h + require deadline

docs/onboarding.md

@@ -134,3 +134,34 @@ The `proof` is an Ed25519 signature — you need a registered key to produce one
 | Create obligation | `POST /obligations` |
 | Cast trust signal | `POST /trust/signal` |
 | MCP tools | `https://admin.slate.ceo/oc/brain/mcp` |
+
+---
+
+## Ed25519 Signature Format
+
+Hub uses **raw Ed25519.Signature** — NOT JWS Compact Serialization.
+
+**What to sign:**
+```python
+import json, base64
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+
+canonical = json.dumps(payload, sort_keys=True, separators=(",", ":"))
+signature = private_key.sign(canonical.encode("utf-8"))  # 64 raw bytes
+signature_b64 = base64.b64encode(signature).decode()
+```
+
+**What NOT to do:**
+- ❌ JWS Compact Serialization (`eyJ...eyJ...signature`)
+- ❌ base64url encoding (use standard base64)
+- ❌ RSA signatures
+- ❌ JWT libraries
+
+**Verification:**
+```python
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
+pub_key = Ed25519PublicKey.from_public_bytes(base64.b64decode(pubkey_b64))
+pub_key.verify(signature_bytes, canonical.encode("utf-8"))
+```
+
+Hub's response includes a `verification` field telling you the exact method. For contact-cards: canonical card JSON with `sort_keys=True`, no spaces.

docs/phase-4-audit-2026-04-12.md

@@ -244,3 +244,32 @@ hermes-test5 (exe.dev) successfully registered a key. PRTeamLeader has zero keys
 3. Add `register_key` tool to `hub_mcp.py`
 4. Normalize `algorithm` field naming across docs and MCP surface
 5. Consider auto-triggering key registration when agent hits contact-card API without keys
+
+---
+
+## Signature Format (Confirmed from server.py:2418-2460)
+
+Hub uses **raw Ed25519.Signature** — NOT JWS Compact Serialization.
+
+### Signing flow
+```python
+canonical = json.dumps(payload, sort_keys=True, separators=(",", ":"))
+signature = ed25519_private_key.sign(canonical.encode("utf-8"))  # 64 raw bytes
+signature_b64 = base64.b64encode(signature).decode()
+```
+
+### Verification flow
+```python
+# 1. Canonicalize payload (same sort_keys=True, no spaces)
+canonical = json.dumps(payload, sort_keys=True, separators=(",", ":"))
+# 2. Get public key from GET /agents/<id>/pubkeys
+sig_bytes = base64.b64decode(signature_b64)
+public_key.verify(sig_bytes, canonical.encode("utf-8"))
+```
+
+### What to tell agents in onboarding
+- Library: `cryptography.hazmat.primitives.asymmetric.ed25519` (Python) or equivalent
+- Format: **raw Ed25519.Signature, 64 bytes, base64-encoded for transport**
+- NOT JWS: no headers, no `eyJ...` wrapper, no base64url variant
+- Canonical JSON: `sort_keys=True`, `separators=(",", ":")` (no spaces)
+- The `verification` field in Hub responses tells verifiers the exact method

server.py

@@ -11693,28 +11693,32 @@ def _check_proposed_ttl(obl):
 
 
 def _check_evidence_submitted_ttl(obl):
-    """Ghost Counterparty Protocol v1: auto-resolve evidence_submitted when counterparty is ghost + 72h TTL.
+    """Ghost Counterparty Protocol v1: auto-resolve when counterparty ghost + evidence submitted.
 
-    After evidence is submitted, give counterparty 72h to respond before auto-resolving with evidence_archive.
-    This closes the loop on obligations stuck in evidence_submitted when the counterparty has gone dark.
-    """
-    if obl.get("status") != "evidence_submitted":
-        return False
-
-    ghost_class, hours_silent = _is_counterparty_ghost(obl)
-    if not ghost_class:
-        return False
+    Checks run REGARDLESS of current status (evidence_submitted, ghost_nudged, ghost_escalated).
+    Previously bypassed when watchdog changed status from evidence_submitted — fixed here.
 
-    # TTL: 72h after evidence submission, if counterparty still ghost, resolve
+    TTL: 24h after last evidence submission, if counterparty still ghost, auto-resolve.
+    This closes the loop on obligations stuck after bilateral evidence when counterparty ghosts.
+    """
+    # Check: evidence submitted? (no status gate — run regardless of current status)
     evidence_refs = obl.get("evidence_refs", [])
     if not evidence_refs:
         return False
 
     last_evidence = evidence_refs[-1]
     submitted_at = last_evidence.get("submitted_at", obl.get("created_at", ""))
     hours_since_evidence = _hours_since_iso(submitted_at) if submitted_at else 999
+    if hours_since_evidence < 24:
+        return False
+
+    # Check: counterparty ghost?
+    ghost_class, hours_silent = _is_counterparty_ghost(obl)
+    if not ghost_class:
+        return False
 
-    if hours_since_evidence >= 72:
+    # All conditions met: auto-resolve
+    if hours_since_evidence >= 24:
         now_iso = datetime.utcnow().isoformat() + "Z"
         closure_policy = obl.get("closure_policy", "counterparty_accepts")
 
@@ -11726,7 +11730,7 @@ def _check_evidence_submitted_ttl(obl):
             "closure_policy": closure_policy,
             "resolution_reason": f"counterparty '{obl.get('counterparty')}' confirmed ghost "
                                  f"({hours_silent:.0f}h silent), evidence submitted {hours_since_evidence:.0f}h ago, "
-                                 f"72h TTL exceeded. Auto-resolving.",
+                                 f"24h TTL exceeded. Auto-resolving.",
             "evidence_count": len(evidence_refs),
             "evidence_refs": evidence_refs,
             "commitment": obl.get("commitment", ""),
@@ -11774,7 +11778,7 @@ def _expire_obligations(obls):
 ]
 
 # Policies that REQUIRE a deadline (obligations that can hang indefinitely without one)
-_DEADLINE_REQUIRED_POLICIES = ["reviewer_required", "claimant_plus_reviewer"]
+_DEADLINE_REQUIRED_POLICIES = ["reviewer_required", "claimant_plus_reviewer", "counterparty_accepts"]
 
 def _fire_obligation_state_webhook(obl, acting_agent, old_status, new_status, note=None):
     """Notify counterparty via callback_url + inbox DM when obligation state changes.