tools(evidence): operator identity keygen helper (EvidenceKeygen)

[amavashev]

What

A self-hosted operator helper for enabling CyclesEvidence — tools/EvidenceKeygen.java. Generates an Ed25519 signing keypair and prints the three env vars that turn evidence on, in the exact formats the reference signer validates.

There is no hosted Cycles and no central signing key — every deployment owns its identity. This turns the runbook's "set these three vars" into "run this, copy the output." It targets the shipped v0.1 raw-hex signer_did path, so it's not gated on the v0.2 did:cycles/JWKS work (cycles-protocol#103).

Files

• tools/EvidenceKeygen.java — single-file JDK source-launch (java tools/EvidenceKeygen.java https://cycles.example.com/v1); no build, no deps. Emits EVIDENCE_SERVER_ID, EVIDENCE_SIGNING_SIGNER_DID, and the secret EVIDENCE_SIGNING_PRIVATE_KEY_HEX.
• tools/README.md — usage, the public/secret placement table, and a verified language-agnostic OpenSSL alternative.
• docs/evidence-identity-enablement.md — new "Generating the identity" section pointing at the helper.
• AUDIT.md — entry.

Correctness / why it can't emit a bad pair

Both values are the raw 32-byte tail of the DER encoding — the same extraction LocalEvidenceSigningKey uses, the same seed/pubkey EnvelopeSigner re-wraps with the fixed Ed25519 DER prefixes. Before printing, the tool reconstructs both keys from the emitted hex through those exact prefixes and runs the worker's sign/verify pair probe — validating the literal bytes it hands over, independent of the generating provider. Verified:

• emitted hex round-trips through EnvelopeSigner's prefix path (sign→verify ✓);
• a mismatched pair is rejected by the probe (✓);
• the OpenSSL recipe yields the same 64-hex (✓).

Safety / scope

• The private key is intentionally printed (it's a keygen); docs mark it secret, scope it to the events worker only, and tell operators to capture it into a secret manager. The secret never enters this repo, a commit, or CI.
• Operator tooling lives outside src/ — not in the Maven reactor or the jacoco bundle. No service/wire/spec change.

Review

Codex-reviewed (read-only): one Medium — the probe originally validated the raw KeyPair objects rather than the emitted hex; tightened to reconstruct-from-emitted-hex via the signer's DER prefixes, and the doc claims aligned. No High/Low.