The reviewer and semantic-tier principals were fixed demo keys ([0xAE], [0x5e]).
They are now persistent joule-code-identity keyfiles: the structural reviewer
loads/creates .joule/reviewer.key (or JOULE_REVIEWER_IDENTITY), the semantic
tier .joule/semantic-reviewer.key (or JOULE_REVIEW_SEMANTIC_IDENTITY). Each is
a distinct, traced agent principal that stays the same across runs — the same
reviewer signs across sessions, attributable by its did:key, rather than an
anonymous per-run seed.
Separation of duties is unchanged and now identity-backed: author, structural
reviewer, and semantic reviewer are three distinct persistent principals; an
op authored by the reviewer's own identity is still skipped (self-review). The
self-review integration test now exercises the real path — write a reviewer
keyfile, author an op as that principal, confirm the binary skips it.
(joule-code-identity needs ed25519-dalek's rand_core feature for key
generation; enabled on that crate.) 17 tests; clippy clean.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
4132daa233