[echo-fleet-builder]

Problem

CertForge exposes identity digests in status responses, but callers preparing governed production evidence cannot retrieve the exact reconciled TargetIdentity and EnvironmentIdentity through a tenant-scoped metadata endpoint. Reading a protected evidence artifact is not an acceptable substitute, and reconstructing identity fields would break the digest binding.

Changes

• Add GET /v1/certifications/{run_id}/identities, protected by configured subscriber governance, live RUN_READ authorization, and organization-scoped lookup.
• Export only exact stored, reconciled canonical identities after strict shape, tenant, and digest checks. Reject credential-bearing or ambiguous references and unreconciled declared identities.
• Recheck live authorization while committing the metadata-only audit before returning a stable response. The endpoint never reads evidence artifacts or changes a run.
• Define the complete input/output schema for echo.certforge.identities and propose its normal direct-HTTP registration using the existing protected credential reference and certforge.read scope.
• Document canonical serialization and the separate native route, registration, authenticated smoke, and collector admission gates.

Verification

• Published main head cc083d78bf34c894e1d24a695597c552db8012c1: GitHub CI 42784272475 passed 653 tests with no skips, plus P1, P6 deployment enforcement, P7 subscriber governance, and evidence upload.
• Main base 4f7d99e: 652 passed, 1 skipped; P1 acceptance passed.
• Active issuer base d8ad9fd: independently preserved source variant, 703 passed, 1 skipped; P1 acceptance passed.
• The one skip on each base is the real Docker sandbox test because Docker is unavailable in the local environment.
• Negative controls cover tenant isolation, absent/scopeless/revoked credentials, revocation between initial authorization and audit, audit failure, identity/digest mismatches, duplicate JSON keys, declared identities, extra fields, and encoded userinfo/query/fragment/control characters.
• Independent source reviews approved the frozen 13-file change. Remote Git blobs and complete trees match the tested local source exactly.

Release boundary

This draft is a source repair. No issuer deployment, SDK registration, current-run identity export, collector trust write, signature, attestation, or production certification was performed. Canonical reconciliation of an existing run remains unknown until the admitted endpoint exports it.

This PR targets public main only. The active issuer has a different policy/runtime lineage; its separately tested repair is preserved at agent/canonical-identities-active-20261110, commit 8ab9ed6, with exact parent d8ad9fd. Do not replace that active lineage with this main branch.