From 9b7de2fbe9e9c6d2ee123b6dc49b3b6e0125c37e Mon Sep 17 00:00:00 2001
From: Local Dev <dev@localhost>
Date: Mon, 7 Sep 2026 23:57:47 +0200
Subject: [PATCH] =?UTF-8?q?feat(theseus/addons):=20bake=20operator=20pubke?=
 =?UTF-8?q?y=20=E2=80=94=20signed=20update=20endpoint=20now=20live?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Populates addon-update-pubkeys.js with the Silent Mode ops Ed25519
pubkey generated 2026-09-07. From this build forward, Theseus polls
each installed add-on's updateURL 30 s after boot, verifies the
signed updates.json, and stages any newer version for promotion on
the next launch. The screenshot add-on's addon.json already
advertises https://addons.silentmode.st/screenshot/updates.json;
publishing a signed entry there (via scripts/sign-addon-update.mjs
with the ops private key) is what activates real updates.

No updates.json is published yet, so the client's boot-time fetch
will 404/DNS-fail silently until the operator lands the first signed
entry.
---
 addon-update-pubkeys.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/addon-update-pubkeys.js b/addon-update-pubkeys.js
index c258c89..e8e32ce 100644
--- a/addon-update-pubkeys.js
+++ b/addon-update-pubkeys.js
@@ -16,6 +16,6 @@
 
 module.exports = {
   PUBKEYS_HEX: [
-    // "abcdef…"  // Silent Mode ops key, generated YYYY-MM-DD
+    "732b1263a236b0030383a2376597cfa43c3624b3ca2912a46134f8f2a06e6012", // Silent Mode ops, generated 2026-09-07
   ],
 };