Phase A: 8 security fixes (B2-B4, I1-I6) Phase B: 10 tasks for real device authentication - ed25519 signing keys with git SSH signing - Deploy keys managed via Gitea API - Pre-receive hook for server-side enforcement - WASM API that keeps private keys internal Total: 18 tasks Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>