Let anyone build, sign and certify a Microcosm UK cut

changelog.d/uk-cut-modal.added.md

@@ -0,0 +1 @@
+`tools/modal_uk_cut.py` runs the UK cut runner in a Modal container, with its work directory on a Modal volume so a rerun resumes, for when the build machine is busy or asleep.

changelog.d/uk-cut-pepy-certification.added.md

@@ -0,0 +1 @@
+`tools/certify_uk_cut_in_policyengine_py.py` certifies a published UK cut into policyengine.py on a fresh branch: it refuses when another pull request is already certifying the cut, checks the regional route before writing anything, runs certify-data, the lock, TRO, constant and snapshot regeneration and the strict bundle check, measures the UC floor and runs the tests, then drafts the pull request with every judgment call left as a checklist.

changelog.d/uk-cut-runner.added.md

@@ -0,0 +1 @@
+`tools/run_uk_cut.py` builds, signs and assembles a Microcosm UK national cut in one resumable command, fetching every input from Hugging Face by the pins the build already enforces (`tools/uk_cut_inputs.json` says only where each input lives). `tools/modal_rebuild_uk_chronicle_artifact.py` rebuilds the pinned Chronicle UK consumer artifact on Modal and hosts it privately.

changelog.d/uk-gate-signing-key-registry.added.md

@@ -0,0 +1 @@
+UK gate reports, release-cut certifications and dense gate reports now verify only under a signing key registered in `microcosm.data.gate_signing_keys`, and every UK signer refuses an unregistered or retired key. The national build checks its key before loading any input, instead of failing after the solve. `python -m microcosm.data.gate_signing_keys check` reports whether the key in the environment may sign.

conftest.py

@@ -130,3 +130,44 @@ def unexpected_start(*args, **options):
     yield emitters
     for emitter in emitters:
         emitter.close()
+
+
+@pytest.fixture(autouse=True)
+def _admit_test_gate_signing_keys(request, monkeypatch):
+    """Let tests sign with their own UK gate keys.
+
+    Production verifies only keys registered in
+    ``microcosm.data.gate_signing_keys``. Tests sign with throwaway keys, so
+    every unregistered key counts as an active test key here, while the
+    committed entries keep their real status. A test marked
+    ``committed_gate_key_registry`` sees the committed registry unchanged.
+    """
+
+    if request.node.get_closest_marker("committed_gate_key_registry"):
+        return
+    try:
+        from microcosm.data import gate_signing_keys
+    except ImportError:
+        return
+    committed = gate_signing_keys._registry
+
+    class _AdmitTestKeys(dict):
+        def __missing__(self, key_sha256):
+            return gate_signing_keys.GateSigningKey(
+                key_sha256=key_sha256,
+                label="test-key",
+                status="active",
+                custodian="the test suite",
+                held_in="the test",
+                registered="test",
+                evidence="admitted by the root conftest",
+            )
+
+        def get(self, key_sha256, default=None):
+            return self[key_sha256]
+
+    def registry(country):
+        entries = committed(country)
+        return None if entries is None else _AdmitTestKeys(entries)
+
+    monkeypatch.setattr(gate_signing_keys, "_registry", registry)

docs/agent-guide.md

@@ -224,7 +224,10 @@ grades every waiver register on the staged frame before the solve; see README
 "Dry-running the release's registers". Publication also refuses a
 release whose build recorded staging telemetry that never reached its repo
 (`--allow-missing-staging` overrides); a build that declared `--no-staging`
-publishes without the flag. Never publish or promote artifacts as a side
+publishes without the flag. A UK national cut runs end to end with
+`tools/run_uk_cut.py` ([uk-cut-anyone.md](uk-cut-anyone.md)): inputs fetched
+by pin, a signing key registered in `microcosm.data.gate_signing_keys`, and
+an inspection-only `--publish`. Never publish or promote artifacts as a side
 effect of another task. A UK rowwise run's **staged** bundle
 (`staged/<run_id>/` in the private repository, written by the build itself)
 is inspection evidence, not a release: it never moves `releases/` or

packages/microcosm-build/src/microcosm/build/gate_battery.py

@@ -62,6 +62,7 @@
     weights_audit_gate,
 )
 from microcosm.build.trace import compute_composition_fingerprint
+from microcosm.data.gate_signing_keys import require_registered_gate_signing_key
 from microcosm.frame import Frame
 
 __all__ = [
@@ -155,7 +156,9 @@ def _signing_key(country: str) -> bytes:
         raise RuntimeError(f"{env} must be valid base64.") from exc
     if len(key) != 32:
         raise RuntimeError(f"{env} must decode to exactly 32 bytes.")
-    return key
+    # A key the committed registry does not let sign would produce reports
+    # no verifier accepts; refuse it here so the report says why.
+    return require_registered_gate_signing_key(country, key, purpose="sign")
 
 
 def _json_safe(value: object) -> object:

packages/microcosm-build/src/microcosm/build/uk_runtime/calibration_run.py

@@ -51,6 +51,7 @@
     uk_time_period,
 )
 from microcosm.calibrate import TargetRegistry
+from microcosm.data.gate_signing_keys import require_registered_gate_signing_key
 from microcosm.frame import Frame
 
 _REPOSITORY = Path(__file__).resolve().parents[6]
@@ -992,6 +993,7 @@ def resign_uk_gate_report(payload: dict[str, object]) -> None:
         raise RuntimeError(f"{env} must be valid base64.") from exc
     if len(key) != 32:
         raise RuntimeError(f"{env} must decode to exactly 32 bytes.")
+    require_registered_gate_signing_key("uk", key, purpose="sign")
     attestation.pop("signing_error", None)
     attestation["signing_key_sha256"] = hashlib.sha256(key).hexdigest()
     attestation["signature"] = None

packages/microcosm-build/src/microcosm/build/uk_runtime/full_build_cli.py

@@ -3604,6 +3604,7 @@ def _national_attempt(
         # These checks must precede input loading. The emitter is already
         # running so a refusal is visible as a failed attempt.
         refuse_occupied_national_output(args)
+        national_role.require_signing_key()
         preflight_staged_dataset(args)
         predecessor = resolve_predecessor(args.logbook_prev_row_digest)
         telemetry = create_staging_run_bundle(args, build_id=state.build_id)

packages/microcosm-build/src/microcosm/build/uk_runtime/national_role.py

@@ -28,6 +28,7 @@
 import numpy as np
 import pandas as pd
 
+from microcosm.build.gate_battery import _signing_key
 from microcosm.build.logbook_adoption import atomic_write_json
 from microcosm.build.staging_dataset import (
     SHA256SUMS_FILENAME,
@@ -62,6 +63,7 @@
     "national_dry_run",
     "national_manifest",
     "require_bound_input",
+    "require_signing_key",
 ]
 
 
@@ -126,6 +128,24 @@ def require_bound_input(args: argparse.Namespace) -> None:
 _require_bound_input = require_bound_input
 
 
+def require_signing_key() -> None:
+    """Refuse a national build whose gate reports could not be signed.
+
+    The seam signs its terminal report only after the solve, so a missing,
+    malformed or unregistered key used to surface 25-40 minutes in, as
+    "unsigned full-scale calibration runs refuse to stage". Check it before
+    any input is read.
+    """
+
+    try:
+        _signing_key("uk")
+    except RuntimeError as error:
+        raise ValueError(
+            "--release-role national signs its gate reports and needs a "
+            f"registered UK gate signing key: {error}"
+        ) from error
+
+
 def national_dry_run(
     args: argparse.Namespace,
     *,

packages/microcosm-build/src/microcosm/build/uk_runtime/release_certification.py

@@ -61,6 +61,10 @@
     uk_cgt_projection_read_from_engine,
 )
 from microcosm.build.uk_runtime.terminal_gates import uk_export_candidate_columns
+from microcosm.data.gate_signing_keys import (
+    GateSigningKeyError,
+    require_registered_gate_signing_key,
+)
 
 __all__ = [
     "UK_RELEASE_CERTIFICATION_KIND",
@@ -594,7 +598,12 @@ def _require_signing_key() -> bytes:
         raise UKReleaseCertificationError(
             f"{env_name} must decode to exactly 32 bytes."
         )
-    return key
+    # The certifier verifies every part and signs the certification with
+    # this one key, so it must be a registered key that may still sign.
+    try:
+        return require_registered_gate_signing_key("uk", key, purpose="sign")
+    except GateSigningKeyError as exc:
+        raise UKReleaseCertificationError(f"{env_name}: {exc}") from exc
 
 
 def _verify_part(