Let anyone build, sign and certify a Microcosm UK cut

changelog.d/uk-cut-modal.added.md

@@ -0,0 +1 @@
+`tools/modal_uk_cut.py` runs the UK cut runner in a Modal container, with its work directory on a Modal volume so a rerun resumes, for when the build machine is busy or asleep.

changelog.d/uk-cut-pepy-certification.added.md

@@ -0,0 +1 @@
+`tools/certify_uk_cut_in_policyengine_py.py` certifies a published UK cut into policyengine.py on a fresh branch: it refuses when another pull request or branch is already certifying the cut, checks the regional route before writing anything, runs certify-data, the lock, TRO, constant and snapshot regeneration and the strict bundle check, measures the UC floor and runs the tests, then drafts the pull request with every judgment call left as a checklist. An accepted regional model mismatch certifies with policyengine.py's audited input-surface evidence (policyengine.py#699). Its load limit, commit co-authors and pull request footer are the operator's to set.

changelog.d/uk-cut-runner.added.md

@@ -0,0 +1 @@
+`tools/run_uk_cut.py` builds, signs and assembles a Microcosm UK national cut in one resumable command, fetching every input from Hugging Face by the pins the build already enforces (`tools/uk_cut_inputs.json` says only where each input lives; the Chronicle artifact's path follows `chronicle_feed.json`). It resumes a cut only under the key that signed it, chains the certification's Logbook row on the build's own row, and never submits an Orrery publication. `tools/modal_rebuild_uk_chronicle_artifact.py` rebuilds the pinned Chronicle UK consumer artifact on Modal and hosts it privately.

changelog.d/uk-gate-signing-key-registry.added.md

@@ -0,0 +1 @@
+UK gate reports, release-cut certifications and dense gate reports now verify only under a signing key registered in `microcosm.data.gate_signing_keys`, and every UK signer refuses an unregistered or retired key. The national build checks its key before loading any input, instead of failing after the solve. `python -m microcosm.data.gate_signing_keys check` reports whether the key in the environment may sign.

changelog.d/uk-gate-team-signing-key.added.md

@@ -0,0 +1 @@
+Register a second UK gate signing key, `uk-gate-team-2026`, held by Max Ghenis in the agent store on his build Mac, so cuts can be built and signed without the first builder's key. The key that signed every earlier cut stays active.

changelog.d/uk-gate-vahid-signing-key.added.md

@@ -0,0 +1 @@
+Register a third UK gate signing key, `uk-gate-vahid-ahmadi-2026`, held by Vahid Ahmadi in his laptop's login keychain, so he can build and sign a cut.

conftest.py

@@ -130,3 +130,44 @@ def unexpected_start(*args, **options):
     yield emitters
     for emitter in emitters:
         emitter.close()
+
+
+@pytest.fixture(autouse=True)
+def _admit_test_gate_signing_keys(request, monkeypatch):
+    """Let tests sign with their own UK gate keys.
+
+    Production verifies only keys registered in
+    ``microcosm.data.gate_signing_keys``. Tests sign with throwaway keys, so
+    every unregistered key counts as an active test key here, while the
+    committed entries keep their real status. A test marked
+    ``committed_gate_key_registry`` sees the committed registry unchanged.
+    """
+
+    if request.node.get_closest_marker("committed_gate_key_registry"):
+        return
+    try:
+        from microcosm.data import gate_signing_keys
+    except ImportError:
+        return
+    committed = gate_signing_keys._registry
+
+    class _AdmitTestKeys(dict):
+        def __missing__(self, key_sha256):
+            return gate_signing_keys.GateSigningKey(
+                key_sha256=key_sha256,
+                label="test-key",
+                status="active",
+                custodian="the test suite",
+                held_in="the test",
+                registered="test",
+                evidence="admitted by the root conftest",
+            )
+
+        def get(self, key_sha256, default=None):
+            return self[key_sha256]
+
+    def registry(country):
+        entries = committed(country)
+        return None if entries is None else _AdmitTestKeys(entries)
+
+    monkeypatch.setattr(gate_signing_keys, "_registry", registry)

docs/agent-guide.md

@@ -232,7 +232,10 @@ grades every waiver register on the staged frame before the solve; see README
 "Dry-running the release's registers". Publication also refuses a
 release whose build recorded staging telemetry that never reached its repo
 (`--allow-missing-staging` overrides); a build that declared `--no-staging`
-publishes without the flag. Never publish or promote artifacts as a side
+publishes without the flag. A UK national cut runs end to end with
+`tools/run_uk_cut.py` ([uk-cut-anyone.md](uk-cut-anyone.md)): inputs fetched
+by pin, a signing key registered in `microcosm.data.gate_signing_keys`, and
+an inspection-only `--publish`. Never publish or promote artifacts as a side
 effect of another task. A UK rowwise run's **staged** bundle
 (`staged/<run_id>/` in the private repository, written by the build itself)
 is inspection evidence, not a release: it never moves `releases/` or