Signed. Stamped. Attested.

What Chamber is

Chamber is the attested signing and attestation service behind the lab's products. When AwLPay or Agent Rider needs to prove a message came from the lab and hasn't been tampered with, Chamber signs it — and stamps the envelope with the custody level of the key that signed it, so the verifier knows exactly how much trust to place in it.

Here is why that matters. A signature without provenance is a claim without a witness: you can verify the math, but you can't tell whether the key lived in a hardened file or a pasted env var. Chamber closes that gap. Signing keys live in 600-permission files on the operator's own machine — the Rider bearer-key pattern, created with python3 -m server.chamber keygen. The old env-var key path is gone. Ephemeral keys exist only for tests, behind CHAMBER_ALLOW_EPHEMERAL=1. Rotation is a file move: the previous key rests at signing.key.prev.

Every envelope carries its custody level, so a verifier can distinguish a production-signed message from a test-signed one without taking anyone's word for it. The suite is 33/33 green.