fix(render): declare seal assurance once per runtime, matching Evidence

crates/registry-cli-docs/catalog.json

@@ -24174,8 +24174,8 @@
               "environment": null
             },
             {
-              "display": "--preview-seal <TRUST>",
-              "description": "Render the template's sealed variant: add the `signing` member the seal route adds, as a seal of this `trust` would. Nothing is signed; the output is the first revision a seal would sign",
+              "display": "--preview-seal <KIND>",
+              "description": "Render the template's sealed variant: add the `signing` member the seal route adds, as a seal of this kind would. Nothing is signed; the output is the first revision a seal would sign",
               "always_required": false,
               "repeatable": false,
               "default_values": [],
@@ -24209,7 +24209,7 @@
               "kind": "requires-all",
               "when": "--signer-name <TEXT>",
               "arguments": [
-                "--preview-seal <TRUST>"
+                "--preview-seal <KIND>"
               ]
             },
             {

crates/registry-render-client/README.md

@@ -41,7 +41,7 @@ problem. It returns a `SealedDocument`: the signed PDF bytes, `document_digest`
 to pin it), warnings, and `seal` facts (`id`, a `SealLevel` of `BaselineB` for
 `B-B` or `BaselineT` for `B-T`, `certificate_digest`, `timestamped_at`, the
 timestamp authority's time, at `B-T` only, and `test_only` for a seal the
-server declares `trust: test-only`). There is no `pdfDigest`.
+server declares `assuranceProfile: local`). There is no `pdfDigest`.
 
 A success body may carry members this client does not know; it ignores them
 and still checks every member above. `SealedDocument`, `SealFacts` and

crates/registry-render-client/src/lib.rs

@@ -111,7 +111,7 @@ pub struct SealFacts {
     /// authority gave; present exactly at level `B-T`.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub timestamped_at: Option<String>,
-    /// Whether the server declares the seal `trust: test-only`: a test
+    /// Whether the server declares `assuranceProfile: local`: a test
     /// seal's documents are not official.
     #[serde(skip_serializing_if = "std::ops::Not::not")]
     pub test_only: bool,

crates/registry-render/src/audit.rs

@@ -58,7 +58,7 @@ pub struct RenderAuditEvent {
     /// named a sealable document.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub seal_id: Option<String>,
-    /// Whether that seal is declared `trust: test-only`: present, `true`, on
+    /// Whether the runtime declares `assuranceProfile: local`: present, `true`, on
     /// every entry naming a test-only seal, and absent otherwise.
     #[serde(skip_serializing_if = "std::ops::Not::not")]
     pub test_only: bool,

crates/registry-render/src/cli.rs

@@ -252,9 +252,9 @@ pub enum Command {
         #[arg(long)]
         emit_envelope: Option<PathBuf>,
         /// Render the template's sealed variant: add the `signing` member
-        /// the seal route adds, as a seal of this `trust` would. Nothing is
+        /// the seal route adds, as a seal of this kind would. Nothing is
         /// signed; the output is the first revision a seal would sign.
-        #[arg(long, value_name = "TRUST", value_enum)]
+        #[arg(long, value_name = "KIND", value_enum)]
         preview_seal: Option<crate::runtime::SealTrust>,
         /// The `signing.signerName` a seal certificate's organization (else
         /// common name) would give. Without it, the member names no signer.

crates/registry-render/src/envelope.rs

@@ -37,7 +37,7 @@ pub struct SigningPayload {
     /// name); absent when the certificate names neither.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub signer_name: Option<String>,
-    /// Whether the runtime file declares the seal `trust: test-only`.
+    /// Whether the runtime file declares `assuranceProfile: local`.
     pub test_only: bool,
 }
 

crates/registry-render/src/keygen.rs

@@ -188,7 +188,7 @@ fn run_with_transit_key(
          Have a certificate authority issue a seal certificate from the request: a leaf with \
          basicConstraints CA:FALSE and the digitalSignature or nonRepudiation key usage. \
          Point certificateChainFile at the issued chain, the seal certificate first, and sign \
-         with signer.type: transit naming this key version, under trust: production.",
+         with signer.type: transit naming this key version, under assuranceProfile: production.",
         request.csr.display(),
     )
     .map_err(|error| internal(&format!("the summary could not be printed: {error}")))?;

crates/registry-render/src/openapi.rs

@@ -46,7 +46,7 @@ pub const OPENAPI_JSON: &str = r##"{
       "get": {
         "summary": "Readiness (issuer keys and audit destination included)",
         "responses": {
-          "200": { "description": "ready. A deployment that seals adds a signing member, one entry per seal: {status: ready} or {status: not-ready, reason: certificate-expired | certificate-not-yet-valid | signer-not-ready}, with testOnly: true for a seal the runtime declares trust: test-only. A seal never changes the status code; readiness never requests a timestamp." },
+          "200": { "description": "ready. A deployment that seals adds a signing member, one entry per seal: {status: ready} or {status: not-ready, reason: certificate-expired | certificate-not-yet-valid | signer-not-ready}, with testOnly: true for a seal the runtime declares assuranceProfile: local. A seal never changes the status code; readiness never requests a timestamp." },
           "503": { "description": "not ready" }
         }
       }
@@ -237,7 +237,7 @@ pub const OPENAPI_JSON: &str = r##"{
                 "schema": { "type": "string", "format": "date-time" }
               },
               "X-Registry-Seal-Test-Only": {
-                "description": "true, for a seal the runtime declares trust: test-only; absent otherwise.",
+                "description": "true, for a seal the runtime declares assuranceProfile: local; absent otherwise.",
                 "schema": { "type": "string", "enum": ["true"] }
               }
             },
@@ -268,7 +268,7 @@ pub const OPENAPI_JSON: &str = r##"{
                           "format": "date-time"
                         },
                         "testOnly": {
-                          "description": "Always true when present, for a seal the runtime declares trust: test-only.",
+                          "description": "Always true when present, for a seal the runtime declares assuranceProfile: local.",
                           "type": "boolean",
                           "const": true
                         }