fed-sx-m1: Step 6b-sig — pipeline:stage_signature/1,/2 (factory + direct) + 11 tests

next/kernel/pipeline.erl

@@ -2,7 +2,8 @@
 -export([run_stages/2,
          validate_inbound/1, validate_outbound/1,
          inbound_stages/0, outbound_stages/0,
-         stage_envelope/1]).
+         stage_envelope/1,
+         stage_signature/1, stage_signature/2]).
 
 %% Validation pipeline per design §14.
 %%
@@ -47,3 +48,17 @@ outbound_stages() ->
 %% that, so delegation is direct.
 stage_envelope(Activity) ->
     envelope:validate_shape(Activity).
+
+%% stage_signature/2 — direct (Activity, ActorState) check. Wraps
+%% envelope:verify_signature/2 from Step 2c. Useful for tests and
+%% for callers that already have ActorState in scope.
+stage_signature(Activity, ActorState) ->
+    envelope:verify_signature(Activity, ActorState).
+
+%% stage_signature/1 — factory: takes the ActorState and returns a
+%% 1-arity stage fun the pipeline driver can fold. This is how
+%% signature checking gets composed into a stage list at runtime
+%% (the static `inbound_stages/0` list omits it precisely because
+%% ActorState isn't available at static-list build time).
+stage_signature(ActorState) ->
+    fun (Activity) -> envelope:verify_signature(Activity, ActorState) end.