simplify sigchain http distribution

crates/geth-cli/src/lib.rs

@@ -4183,7 +4183,6 @@ fn print_response(response: ControlResponse, output: OutputMode) -> Result<()> {
             claims,
             receipts,
             bundle_hash,
-            static_http_path,
             note,
         } => {
             println!("input: {}", input.display());
@@ -4194,7 +4193,6 @@ fn print_response(response: ControlResponse, output: OutputMode) -> Result<()> {
             println!("claims: {claims}");
             println!("receipts: {receipts}");
             println!("bundle_hash: {bundle_hash}");
-            println!("static_http_path: {static_http_path}");
             eprintln!("note: {note}");
         }
         ControlResponse::KeychainExplained { subject, lines } => {

crates/geth-control/src/lib.rs

@@ -779,7 +779,6 @@ pub enum ControlResponse {
         claims: usize,
         receipts: usize,
         bundle_hash: String,
-        static_http_path: String,
         note: String,
     },
     KeychainExplained {

crates/geth-keychain/src/lib.rs

@@ -25,9 +25,9 @@ pub use sshsigchain::{
     SshSigchainVerification, SshSigchainVerifier, VerifiedAnchoredHistory, authority_key_id,
     canonical_bundle_hash, decode_canonical_bundle, decode_sshsigchain_jsonl,
     encode_canonical_bundle, encode_sshsigchain_jsonl, key_proof_signing_bytes,
-    profile_payload_commitment, select_anchored_head, static_http_bundle_path,
-    verify_anchor_receipts, verify_anchored_history, verify_canonical_bundle_records,
-    verify_head_claim, verify_sshsigchain,
+    profile_payload_commitment, select_anchored_head, verify_anchor_receipts,
+    verify_anchored_history, verify_canonical_bundle_records, verify_head_claim,
+    verify_sshsigchain,
 };
 
 use geth_types::{

crates/geth-keychain/src/sshsigchain.rs

@@ -15,7 +15,7 @@ pub use bundle::{
     CANONICAL_BUNDLE_EXTENSION, CANONICAL_BUNDLE_MEDIA_TYPE, CanonicalSshSigchainBundle,
     DistributionEndpoint, DistributionError, MAX_CANONICAL_BUNDLE_BYTES, SshSigchainBundleSource,
     canonical_bundle_hash, decode_canonical_bundle, encode_canonical_bundle,
-    static_http_bundle_path, verify_canonical_bundle_records,
+    verify_canonical_bundle_records,
 };
 
 pub const SSH_SIGCHAIN_VERSION: u8 = 1;

crates/geth-keychain/src/sshsigchain/bundle.rs

@@ -28,8 +28,9 @@ pub struct CanonicalSshSigchainBundle {
     pub receipts: Vec<AnchorReceipt>,
 }
 
-/// Locates an untrusted distribution source. It is routing configuration, not
-/// a trust anchor; integrity and authority come from SSHSIGCHAIN verification.
+/// Locates an untrusted distribution source. It is exact routing
+/// configuration, not a discovery mechanism or trust anchor; acceptance comes
+/// from SSHSIGCHAIN verification against the independently pinned trust tuple.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(deny_unknown_fields)]
 pub struct DistributionEndpoint {
@@ -111,14 +112,6 @@ pub enum DistributionError {
     Protocol(#[from] SshSigchainError),
 }
 
-#[must_use]
-pub fn static_http_bundle_path(chain_id: ChainId) -> String {
-    format!(
-        "/.well-known/sshsigchain/v1/{}/chain.{CANONICAL_BUNDLE_EXTENSION}",
-        chain_id.to_hex()
-    )
-}
-
 #[must_use]
 pub fn canonical_bundle_hash(bytes: &[u8]) -> Digest {
     let mut input = Vec::with_capacity(BUNDLE_HASH_DOMAIN.len() + bytes.len());
@@ -740,6 +733,15 @@ fn validate_object_size(bytes: &[u8]) -> Result<(), DistributionError> {
 mod tests {
     use super::*;
 
+    #[test]
+    fn distribution_locator_is_arbitrary_exact_routing_configuration() {
+        let locator = "https://cdn.example.test/custom/latest.bin?channel=stable";
+        let endpoint =
+            DistributionEndpoint::new("primary", "http", locator).expect("distribution endpoint");
+
+        assert_eq!(endpoint.locator, locator);
+    }
+
     const ROOT_KEY: &str = "ssh-ed25519 AQID";
 
     fn signed_genesis() -> SshSigchainRecord {
@@ -778,7 +780,7 @@ mod tests {
         .with_signature(vec![4, 5, 6])
         .expect("claim signature");
         let receipt = AnchorReceipt {
-            backend_id: "static-http".to_owned(),
+            backend_id: "http-primary".to_owned(),
             claim_hash: claim.claim_hash().expect("claim hash"),
             evidence: b"receipt".to_vec(),
         };
@@ -897,7 +899,7 @@ mod tests {
                     required_classes: vec!["http".to_owned()],
                     backend_threshold: 1,
                     backends: vec![AnchorBackendPolicy {
-                        backend_id: "static-http".to_owned(),
+                        backend_id: "http-primary".to_owned(),
                         class: "http".to_owned(),
                         locator: "https://example.test".to_owned(),
                         weight: 1,
@@ -932,18 +934,6 @@ mod tests {
         assert_eq!(decode_canonical_bundle(&bytes).expect("decode"), bundle);
     }
 
-    #[test]
-    fn static_http_path_is_stable_and_contains_only_lowercase_chain_id() {
-        assert_eq!(
-            static_http_bundle_path(ChainId([0xab; 32])),
-            concat!(
-                "/.well-known/sshsigchain/v1/",
-                "abababababababababababababababababababababababababababababababab/",
-                "chain.sscb"
-            )
-        );
-    }
-
     #[test]
     fn canonical_bundle_matches_published_base_vector() {
         let record = SshSigchainRecord::unsigned(

crates/geth-node/src/lib.rs

@@ -6575,7 +6575,6 @@ pub fn handle_request(
                 claims: 0,
                 receipts: 0,
                 bundle_hash: geth_keychain::canonical_bundle_hash(&bytes).to_hex(),
-                static_http_path: geth_keychain::static_http_bundle_path(chain_id),
                 note: "wrote the canonical SSHSIGCHAIN bundle; the root public key remains an out-of-band trust input and is intentionally not embedded".to_owned(),
             })
         }
@@ -6594,7 +6593,6 @@ pub fn handle_request(
                 claims: bundle.claims.len(),
                 receipts: bundle.receipts.len(),
                 bundle_hash: geth_keychain::canonical_bundle_hash(&bytes).to_hex(),
-                static_http_path: geth_keychain::static_http_bundle_path(bundle.chain_id),
                 note: "extracted record JSONL including available disclosures; head claims and anchor receipts remain in the canonical bundle because JSONL carries records only".to_owned(),
             })
         }