A governed playbook is signed. Before the agent runs it, KCP verifies the detached ed25519 signature over the exact published bytes. If the body was tampered with after signing, the signature no longer matches and the playbook is refused — fail-closed, always fatal. Under --require-signature (strict), an unsigned playbook is refused too. The verdict below is the real verifyManifestText status + the real follow() gate decision, with verbatim reason wording.
Pick a signature state, optionally require signatures, then press ▶ Load playbook. A tampered body never loads; an unsigned playbook loads only when strict mode is off.
Station 02 of 11. Signature verification = the real verifyManifestText (kcp-agent/src/verify.ts): a present-but-wrong signature is invalid; a missing one is unsigned. Gate = the real follow() decision (src/follow.ts): invalid is always fatal; under --require-signature anything not verified is refused. A browser cannot hold the project's keys, so the signature state is modelled — the status, gate decision, and reason wording are verbatim.