docs: define independent reproducer custody

Author: a19q3

docs/CELLSCRIPT_REGISTRY_PHASE1.md

@@ -295,6 +295,14 @@ rotation cannot rewrite the historical trust boundary. A reproducible artifact
 stays `evidence_required`, and deployment admission fails, until
 `reproduced_build` evidence is accepted.
 
+Distinct policy labels are necessary but cannot prove organizational
+independence. The production operator must obtain each public key from a builder
+under separate administrative control and private-key custody. Creating two
+keys inside the Registry operator's own infrastructure and assigning different
+`trust_domain` strings does not satisfy this model. Readiness proves that the
+policy is well-formed and that its P-256 keys are importable; it does not attest
+who controls those keys.
+
 ## Consuming Other Artifacts
 
 Generic artifacts never pass through `cellc install`. Use the explicit

services/registry-api/README.md

@@ -71,6 +71,14 @@ reproducible artifact until this transition succeeds. Accepted evidence also
 stores the canonical policy SHA-256 and the minimum trust-domain threshold used
 at acceptance time.
 
+Trust-domain independence is an operator-governance fact, not something the API
+can infer from two different strings. Production policy must use builders under
+separate administrative control and separate private-key custody. Two keys
+created or controlled by the same Registry operator must not be labelled as two
+independent trust domains. `/ready` validates policy shape, key importability,
+and configured threshold only; it is not an organizational-independence
+attestation.
+
 ## Endpoints
 
 ```text

services/registry-api/deploy/.env.example

@@ -21,5 +21,7 @@ REGISTRY_ADMIN_TOKEN=replace-with-a-generated-secret
 # CKB_REGISTRY_SCAN_MAX_CELLS=1000
 # CKB_MIN_CONFIRMATIONS=24
 # Signed reproduction promotion remains disabled until this policy names at
-# least two active builders in different trust domains.
+# least two active builders under genuinely separate administrative control and
+# private-key custody. Different labels for keys controlled by one operator are
+# not independent trust domains.
 # REGISTRY_REPRODUCER_POLICY_JSON={"schema":"cellscript-reproducer-policy-v1","minimum_trust_domains":2,"builders":[{"builder_id":"builder-a","trust_domain":"org-a","public_key":"p256-spki:..."},{"builder_id":"builder-b","trust_domain":"org-b","public_key":"p256-spki:..."}]}