[jeremi]

Why

Render seals declared their assurance per seal (trust: test-only | production), while Evidence declares it once per runtime (assuranceProfile). Two names for the same rule make deployments harder to read and review. This PR gives Render Evidence's member and values, so one runtime-wide setting decides how every seal signs.

Seals are unreleased (they landed after v0.45.0), so this renames the configuration before anyone depends on it.

What changes

• New top-level assuranceProfile: local | production in the Render runtime file. It is required when signing.seals declares a seal; a runtime with no seals loads without it.
• production seals sign only through transit; local seals sign only with a local-jwk key file and are test seals. The other signer is refused per seal as render.runtime.signer-assurance-mismatch at /signing/seals/<id>/signer/type (this replaces render.runtime.seal-signer-assurance-mismatch).
• The per-seal trust member is gone; a leftover one is refused as config.unknown-key. evidence-grade is refused as config.unknown-variant.
• Output is unchanged: signing.testOnly, the X-Registry-Seal-Test-Only header, /ready, the audit and the startup warning still mark test seals, now derived from local. compile --preview-seal test-only|production keeps its values (its value name is now KIND).
• Generated runtime schema, CLI catalog, Render README, PAYLOAD, SECURITY-MATRIX, the unreleased CHANGELOG entry and the operate and configuration pages are updated.

Migration

# before
signing:
  seals:
    ministry:
      signer: { type: local-jwk, ... }
      trust: test-only
# after
assuranceProfile: local
signing:
  seals:
    ministry:
      signer: { type: local-jwk, ... }

Checks

• cargo fmt --check
• cargo clippy -p registry-render --all-targets --features schema -- -D warnings
• cargo test -p registry-render --features schema
• cargo test -p registry-cli-docs
• test_validate_seal.py
• docs site: generate, check:cli-reference, check:evidence-links, check:evidence-anchors, check:relative-links, check:content, check:style, check:openapi, check:config-vocabulary, check:markdown, check:tutorial:render:dry-run, check:tutorial:documents:dry-run

Not run locally: the full docs site build and built-site checks.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-07T12:01:01.158024Z	9a7f578	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a9f854694e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".