feat(provenance): Phase 2.1 v0.0.16 — Real Ed25519 verification (PROV-4 COMPLETE)

PROV-4 sub-decision COMPLETE end-to-end canonical via ed25519-dalek directly
en pallet. Pattern análogo Slice 3 mock-WASM: no esperar Ergon Cap 42+ sub-crate,
ship real impl con interim SCALE encoding (swap canonical post sub-crate land).

Real verify implementation:
- VerifyingKey::from_bytes(&validator_oit.public_key) — InvalidSignature si reject
- Signature::from_bytes(&attestation.signature) reconstruct
- signing_payload() compute (SCALE encoding interim Option B)
- verify_strict(payload, signature) — InvalidSignature si fail (rejects malleable + zero-key attacks)

4 nuevos tests Ed25519 verify real canonical:
- ed25519_verify_real_valid_signature_canonical — signed attestation verifies
- ed25519_verify_tampered_signature_rejected_canonical — bit-flipped sig rejected
- ed25519_verify_tampered_payload_rejected_canonical — tampered asset_id rejected
- ed25519_zero_signature_fails_verify_canonical — zero sig rejected verify_strict
- Helper signed_attestation() function canonical para test setup

Honest disclosure canonical: mi signing_payload usa SCALE encoding (vendor
copy interim Option B). Ergon arkhe-noesis-attestation-types Cap 42+ usará
postcard encoding canonical per Slice 7.0r spec. Swap canonical será 1-line
change en signing_payload() — zero impact en pallet verify logic.

PROV sub-decisions status v0.0.16: 6/8 COMPLETE (PROV-1+2+3+4+5+6+7 done,
PROV-8 Runtime API verify_provenance = v0.0.17 next slice).

Verification:
- cargo check workspace verde 1.55s
- 6/6 pallet tests pass (4 nuevos Ed25519 real)
- NO REGRESSION runtime/node/chain_spec builder

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -6,6 +6,84 @@ by [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). Versions follow
 
 ## [Unreleased]
 
+## [0.0.16] — 2026-05-24 — Phase 2.1 PROVENANCE pallet Real Ed25519 verification (PROV-4 complete)
+
+**Phase 2.1 v0.0.16** — Real Ed25519 verification implementation completa
+canonical via `ed25519-dalek` directly en pallet. PROV-4 sub-decision COMPLETE
+end-to-end. Pattern análogo Slice 3 mock-WASM (no esperar bloqueador externo,
+ship real impl con interim encoding).
+
+### Deliverables
+
+**Real PROV-4 Ed25519 verify implementation**:
+- `crates/origin-chain-provenance/src/lib.rs` — replace SCAFFOLD placeholder
+- Pattern canonical:
+  1. `VerifyingKey::from_bytes(&validator_oit.public_key)` → `Error::InvalidSignature` si rejected
+  2. `Signature::from_bytes(&attestation.signature)` reconstruct canonical
+  3. `validation_attestation.signing_payload()` compute (SCALE encoding interim Option B)
+  4. `pubkey.verify_strict(&payload, &signature)` → `Error::InvalidSignature` si fail
+- `verify_strict` canonical rejects malleable signatures + zero-keys + other Ed25519 attacks
+- Cuando Ergon `arkhe-noesis-attestation-types` ship Cap 42+, swap encoding canonical SCALE → postcard sin breaking pallet verify call site
+
+**4 nuevos tests Ed25519 verify real canonical**:
+- `ed25519_verify_real_valid_signature_canonical` — signed attestation real verifies correctly
+- `ed25519_verify_tampered_signature_rejected_canonical` — bit-flipped signature rejected
+- `ed25519_verify_tampered_payload_rejected_canonical` — tampered asset_id mismatch rejected (payload re-encode)
+- `ed25519_zero_signature_fails_verify_canonical` — all-zero signature rejected by verify_strict
+- Helper function `signed_attestation()` canonical para test setup con real SigningKey + sign
+
+### Lo que SÍ funciona ahora end-to-end (v0.0.16)
+
+- ✅ PROV-2 storage canonical
+- ✅ PROV-3 dispatchable canonical full flow (6-step)
+- ✅ **PROV-4 Real Ed25519 verify canonical** (NUEVO v0.0.16)
+- ✅ PROV-5 OIT Level >= 3 enforce
+- ✅ PROV-6 is_anchorable check
+- ✅ PROV-7 Events emission
+- ✅ Pallet wired en runtime (Index 7 Provenance)
+- ✅ Real signature verification con tests verde
+
+### Lo que NO funciona aún (v0.0.17 next slice)
+
+- ⏳ **PROV-8 Runtime API `verify_provenance`** — sequential next slice
+- ⏳ **Mock runtime integration tests** — para verify dispatchable end-to-end con storage assertions
+- ⏳ **Ergon arkhe-noesis-attestation-types** swap canonical — encoding swap canonical SCALE → postcard cuando sub-crate land
+
+### Honest disclosure canonical
+
+Mi `signing_payload()` usa SCALE encoding (parity-scale-codec) en mi vendor copy
+interim Option B. Ergon's real `arkhe-noesis-attestation-types` (Cap 42+) usará
+postcard encoding canonical per Slice 7.0r spec. Esto significa que **mi pallet
+verifica correctamente firmas generadas con MI vendor copy**, pero NO verifica
+firmas canonical reales de Ergon Noesis hasta que swap encoding canonical post
+Cap 42+. El swap canonical es 1-line change canonical en signing_payload() —
+zero impact en pallet verify logic (que es agnostic al encoding del payload).
+
+Pattern análogo Slice 3 mock-WASM: la lógica real working, el data layer
+canonical swap canonical cuando upstream land. Avanza Phase 2.1 sin bloqueo.
+
+### Verification end-to-end
+
+- ✅ `cargo check --workspace --all-targets` verde 1.55s
+- ✅ `cargo test -p origin-chain-provenance --lib` — **6/6 tests pass** (4 nuevos Ed25519 verify real)
+- ✅ NO REGRESSION existing tests workspace
+- ✅ NO REGRESSION runtime + node + chain_spec builder
+
+### PROV sub-decisions status canonical v0.0.16
+
+| PROV | Sub-decision | Status v0.0.16 |
+|------|--------------|----------------|
+| PROV-1 | Schema separation Noesis/chain | ✅ |
+| PROV-2 | StorageMap<AssetHash, AssetAttestation> | ✅ wired |
+| PROV-3 | Dispatchable attest_asset | ✅ full flow working |
+| **PROV-4** | **Real Ed25519 verification** | **✅ NUEVO v0.0.16** |
+| PROV-5 | OIT Level >= 3 enforce | ✅ |
+| PROV-6 | is_anchorable check | ✅ |
+| PROV-7 | Events emission | ✅ |
+| PROV-8 | Runtime API verify_provenance | ⏳ v0.0.17 next |
+
+**6/8 PROV sub-decisions COMPLETE canonical post-v0.0.16**.
+
 ## [0.0.15] — 2026-05-24 — Phase 2.1 PROVENANCE pallet wired en runtime + BoundedVec agent_chain
 
 **Phase 2.1 v0.0.15** — pallet-origin-provenance wired en runtime composition.