L03-13i — Sign documents and manage certificates in Quick #240

Outcome

Operators can apply a digital signature and manage the certificate store, replacing the retired signature plugin.

Parent and boundary

Parent: #231. Owner: LoopEditor. This issue owns one bounded slice of Quick Workspace; consume accepted upstream contracts and keep PDF/verdict/publication authority with Core.

Grounding

• docs/product-surface.json keeps signature-plugin as ADVANCED in loop-fix; no handler for actionCertificateManager.
• L03-11 — Show annotations, proof comments, and signature status in review #125 covers showing signature status in review; nothing tracks creating signatures.

Acceptance

• Signing is a governed publication: plan, approval, and Core's writer produce the signed revision, and the receipt records signer identity without key material.
• A signed output verifies through Core's signature handler and an independent validator.
• Private keys and PINs never reach logs, receipts, or settings.
• Failure case: a correction planned after signing reports that it will invalidate the signature before approval.

Required proof

Sign-and-verify fixtures with test certificates only; independent verification run; quick lane. Record the exact source SHA, test command or hosted run, fixture/artifact identity, and any skipped or unavailable lane. Run the repository's mapped proof and check-change gate for a PR.

Handoff

Record changed files, observed result, remaining risk, and a 1–3 sentence anti-slop review. Completion means acceptance evidence, not merely a merged implementation.

Sources

Approved master roadmap · Gap review of docs/loop-shell-actions.json against Quick command handlers, 2026-10-06.