hosted: persist attestation metadata beyond boolean checkbox (P1-1) #32

Problem

docs/PRODUCTION_READINESS.md P1-1: attestation is not authorization — it is a boolean.

Evidence:

• CampaignStartRequest.attestation: bool = False (apps/api/src/mutiny_api/schemas.py)
• supervisor.start_campaign raises if not attestation
• Ingest similarly requires attestation=true (ingest.py)

Bearer auth (M-PR7 / P0-1/P0-4) identifies the single-tenant operator when configured, but campaign records do not store a durable “who attested / when” principal beyond an event payload flag.

Why it matters

For Hosted safe-mode and audits, “checkbox true” is weak. Strengthening toward logged attestation metadata is the contributor-sized step without inventing multi-tenant AuthZ or bringing back customer exec.

Proposed direction

1. Extend start/ingest attestation to accept an optional non-empty attestation_note or require attested_at server-side timestamp always.
2. Persist on campaign config / events: {attestation: true, attested_at, token_fingerprint?} (hash of bearer, never raw token).
3. Document in SECURITY.md that AuthZ remains “holds MUTINY_API_TOKEN” for single-tenant; attestation is operator acknowledgment, now auditable.

Acceptance criteria

• Campaign start stores attestation timestamp (and optional note) in config or events
• Raw API token never logged or stored
• Tests for reject-when-false unchanged; new assert on persisted metadata
• Docs updated (SECURITY / PRODUCTION_READINESS P1-1 status note)
• No multi-tenant redesign; no customer exec_module

Testing expectations

uv run pytest tests/integration/test_api_hosted_auth.py tests/unit/… -q + new cases

Difficulty

M · security / backend