refactor(core): move subkey_seed into governance, removing a core->a2a edge

`TokenSigner::derived_subkey_seed` reached out of governance and INTO the
A2A plane to call `a2a::sign::subkey_seed`. The function it was reaching
for has no A2A semantics: it is

    SHA-256("busbar/subkey/v1" || secret || domain)

over a caller-supplied domain string. It mentions no plane, and it lived
on one by accident of history. Every other plane that ever asks busbar's
root secret for a subkey would have had to depend on A2A to get one.

So it moves to governance, beside the root secret it derives from. The
direction was already established and correct in the other direction:
`a2a::sign::CardSigner::derived_from` calls the governance method, and
still does. Net effect is one fewer production core->a2a edge.

THE BYTES DO NOT CHANGE, and that is the whole risk of this move. This
derives KEY MATERIAL: if the output shifted for any input, existing
deployments would break their card signatures silently, against what
external callers already pinned. The function body is moved verbatim,
and six known-answer vectors captured from the implementation BEFORE the
move now pin it -- independently reproduced as plain SHA-256 outside this
codebase, so they pin the construction rather than whatever the code
happens to emit. They were confirmed to fail against a mutated context
string before being accepted as green.

Visibility NARROWS rather than widens: the free function was pub(crate)
on the A2A plane and is private here, since its only caller is the method
directly above it. Nothing was widened to accommodate the move.

Author: MattJackson

crates/busbar-core/src/a2a/sign.rs

@@ -55,7 +55,6 @@
 use base64::Engine as _;
 use ed25519_dalek::{Signer, SigningKey};
 use serde_json::{json, Map, Value};
-use sha2::{Digest, Sha256};
 
 use super::canonical::canonicalize;
 use super::card::{signing_payload, CardError};
@@ -180,19 +179,6 @@ impl CardSigner {
     }
 }
 
-/// The domain-separated derivation itself, as a free function so it can be asserted on directly.
-///
-/// `SHA-256(context ‖ secret ‖ domain)`. The secret is a FIXED 32 bytes and sits in the middle, so
-/// the boundary between it and the domain string is unambiguous without a length prefix — two
-/// different domains cannot produce one pre-image by moving the boundary.
-pub(crate) fn subkey_seed(secret: &[u8; 32], domain: &str) -> [u8; 32] {
-    let mut h = Sha256::new();
-    h.update(b"busbar/subkey/v1");
-    h.update(secret);
-    h.update(domain.as_bytes());
-    h.finalize().into()
-}
-
 #[cfg(test)]
 #[path = "tests/sign_tests.rs"]
 mod sign_tests;

crates/busbar-core/src/governance/signing.rs

@@ -23,6 +23,7 @@ use base64::engine::general_purpose::URL_SAFE_NO_PAD;
 use base64::Engine;
 use ed25519_dalek::{Signature, Signer, SigningKey, Verifier, VerifyingKey};
 use serde::{Deserialize, Serialize};
+use sha2::{Digest, Sha256};
 
 /// The token prefix, so a busbar key is visually distinct from an opaque bearer and a quick
 /// structural pre-check can reject an obviously-non-busbar credential before any crypto.
@@ -178,7 +179,7 @@ impl TokenSigner {
     /// The secret NEVER leaves this method: callers get 32 derived bytes, not
     /// [`Self::secret_bytes`].
     pub(crate) fn derived_subkey_seed(&self, domain: &str) -> [u8; 32] {
-        crate::a2a::sign::subkey_seed(&self.key.to_bytes(), domain)
+        subkey_seed(&self.key.to_bytes(), domain)
     }
 
     /// Mint a signed token for `sub` expiring at `exp` (Unix seconds), stamped with the binding
@@ -317,6 +318,26 @@ impl TokenVerifier {
     }
 }
 
+/// The domain-separated derivation itself, as a free function so it can be asserted on directly.
+///
+/// `SHA-256(context ‖ secret ‖ domain)`. The secret is a FIXED 32 bytes and sits in the middle, so
+/// the boundary between it and the domain string is unambiguous without a length prefix — two
+/// different domains cannot produce one pre-image by moving the boundary.
+///
+/// This is generic busbar KEY HYGIENE, not the property of any one plane. It lives here, beside the
+/// root secret it derives from, because the planes that ask for a subkey are its CALLERS: a
+/// derivation that lived on one of them would make every other plane's subkey a dependency on that
+/// plane, for a function whose body mentions none of them. The context string is versioned, so
+/// changing this derivation is a new key rather than a silently different one under the same name —
+/// which is also why the bytes it emits are pinned by known-answer vectors in the tests below.
+fn subkey_seed(secret: &[u8; 32], domain: &str) -> [u8; 32] {
+    let mut h = Sha256::new();
+    h.update(b"busbar/subkey/v1");
+    h.update(secret);
+    h.update(domain.as_bytes());
+    h.finalize().into()
+}
+
 #[cfg(test)]
 #[path = "tests/signing_tests.rs"]
 mod tests;

crates/busbar-core/src/governance/tests/signing_tests.rs

@@ -206,3 +206,86 @@ fn signer_debug_redacts_key() {
     assert!(dbg.contains("redacted"));
     assert!(!dbg.contains(&hex::encode([7u8; 32])));
 }
+
+// ── THE SUBKEY DERIVATION: KNOWN-ANSWER VECTORS ──────────────────────────────────────────────────
+
+/// THE BYTES ARE FROZEN. `subkey_seed` derives KEY MATERIAL, so a change to it is not a refactor
+/// with a test to update — it silently rotates every subkey in every existing deployment, and the
+/// symptom is signatures that stop verifying against what external callers already pinned. No
+/// property test can catch that (a different-but-still-deterministic, still-domain-separated
+/// derivation passes every property the neighbouring tests assert), so the bytes themselves are
+/// pinned here.
+///
+/// These vectors were captured from the implementation as it stood BEFORE the function moved out of
+/// the A2A plane into governance, and independently reproduced as
+/// `SHA-256("busbar/subkey/v1" ‖ secret ‖ domain)` outside this codebase — so they pin the
+/// construction, not merely whatever the current code happens to emit.
+///
+/// If one of these fails, do NOT re-baseline it. The context string is versioned precisely so that
+/// an intended change to the derivation is spelled as a new version, leaving these vectors intact.
+#[test]
+fn subkey_seed_derives_the_exact_pinned_bytes() {
+    for (secret, domain, expected) in [
+        (
+            [0u8; 32],
+            "",
+            "0b1c0a2d5c88dd84043ada4280656292b0b97260f89b9c099deebdae4dc24a6b",
+        ),
+        (
+            [0u8; 32],
+            "a2a/agent-card-signing/v1",
+            "0bf68ad180162cd1cef2d93c0714a0bbc8584f6039fb39a4690589d11e82ecb5",
+        ),
+        (
+            [7u8; 32],
+            "a2a/agent-card-signing/v1",
+            "9e3cc179e80446fc289701e3f0996a2305eedf7747bc082053f417f22bfbc14b",
+        ),
+        (
+            [7u8; 32],
+            "some/other/purpose/v1",
+            "c7e527e9bd89ac13380f2853fbebf85eed87f4bba9f8d76302d91268abd68fec",
+        ),
+        (
+            [0xffu8; 32],
+            "",
+            "77bf96146778130445d006dea40df5f2e76e92ed2f78df2b7d7ea167f7be51b1",
+        ),
+    ] {
+        assert_eq!(
+            hex::encode(subkey_seed(&secret, domain)),
+            expected,
+            "the derived subkey seed CHANGED for domain {domain:?} — every deployment's subkeys \
+             just rotated silently"
+        );
+    }
+
+    // A non-ASCII domain, pinned so the UTF-8 encoding of the domain string is part of the frozen
+    // construction rather than an implementation detail free to change under it.
+    let mut counting = [0u8; 32];
+    for (i, b) in counting.iter_mut().enumerate() {
+        *b = i as u8;
+    }
+    assert_eq!(
+        hex::encode(subkey_seed(&counting, "dømain/✓/v1")),
+        "a8d12c9765387d05e5147563df692d7b66b582e26d8879be61a74db65cad6bd2"
+    );
+}
+
+/// The method on the signer is the free function over the signer's own secret — the seam the A2A
+/// plane's `CardSigner` actually calls. Pinned end-to-end so the move cannot have changed what a
+/// caller holding a TokenSigner gets, only where the code lives.
+#[test]
+fn derived_subkey_seed_is_the_free_function_over_the_root_secret() {
+    let s = signer(); // secret [7u8; 32]
+    assert_eq!(
+        hex::encode(s.derived_subkey_seed("a2a/agent-card-signing/v1")),
+        "9e3cc179e80446fc289701e3f0996a2305eedf7747bc082053f417f22bfbc14b",
+        "the A2A card key derived off this signer must be byte-identical across the move"
+    );
+    assert_eq!(
+        s.derived_subkey_seed("a2a/agent-card-signing/v1"),
+        subkey_seed(&s.secret_bytes(), "a2a/agent-card-signing/v1"),
+        "the method must be exactly the free function over the root secret, with no second path"
+    );
+}