@@ -0,0 +1,47 @@
+name: Open VSX signing key
+
+# LevelCode verifies every extension it installs or updates against Open VSX's signing key, and it
+# does not ask the registry for that key: the keys it trusts ship inside the app
+# (modules/extension-signature/keys.json). That is the point of pinning — and its price. The day
+# Open VSX signs with another key, every LevelCode already installed refuses what the new key
+# signs, until a release carries it.
+#
+# This asks the registry once a day, so that day is known the day it comes and not from a user's
+# bug report. It runs scripts/extension-signature.mjs registry: which key do the newest extensions
+# name, and do some of them really verify with the pinned keys?
+#
+# A failed run is the alarm. What to do then: docs/EXTENSION-SIGNATURES.md, "When Open VSX changes
+# its key". GitHub mails a failed scheduled run to whoever last edited this file's schedule, and
+# stops scheduling in a repository with no activity for 60 days.
+
+on:
+  schedule:
+    - cron: "17 6 * * *" # daily, off the hour: scheduled runs queue up at :00
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  registry:
+    name: Open VSX signs with a pinned key
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: "24" # as test.yml
+      - name: Ask the registry
+        # Exit 1 is evidence — a key that is not pinned, or signatures that no longer verify — and
+        # fails at once. Exit 2 is "could not ask": an outage is not news, so it is asked again, and
+        # fails only if the registry cannot be asked three times in ten minutes. That matters too: if
+        # this check has gone blind, a changed key would pass unseen.
+        run: |
+          for attempt in 1 2 3; do
+            code=0
+            node scripts/extension-signature.mjs registry --strict || code=$?
+            if [ "$code" -ne 2 ]; then exit "$code"; fi
+            echo "Could not ask the registry (attempt $attempt of 3)."
+            if [ "$attempt" -lt 3 ]; then sleep 300; fi
+          done
+          exit 2
@@ -41,8 +41,16 @@ jobs:
           node-version: "24"
       - name: Extension unit tests
         # The gate itself lives in a script, so the pull-request workflow (test.yml) runs exactly what
-        # this does. It discovers every extensions/*/test/*.test.js and fails if it finds none.
+        # this does. It discovers every extensions/*/test/*.test.js, modules/*/test/*.test.js and
+        # web/test/unit/*.test.js, and fails if it finds none.
         run: ./scripts/test-extensions.sh
+      - name: Open VSX still signs with a key this release trusts
+        # The app verifies extensions against Open VSX's signing key, and the key is pinned in the app
+        # (modules/extension-signature/keys.json). If the registry has moved to another key, the app
+        # about to be built could not install or update one extension: stop here, an hour early.
+        # Fails only on evidence — a registry that cannot be reached is a warning. What to do when it
+        # fails: docs/EXTENSION-SIGNATURES.md.
+        run: node scripts/extension-signature.mjs registry
 
   build:
     name: Build ${{ matrix.arch }}
@@ -85,6 +93,12 @@ jobs:
           VSCODE_TAG: ${{ github.event.inputs.vscode_tag }}
       - name: Build LevelCode.app (${{ matrix.arch }}, proprietary stripped)
         run: ./scripts/build-macos.sh ${{ matrix.arch }}
+      - name: The built app installs an extension from Open VSX
+        # The one check that asks the app itself. Its own command line installs one four-kilobyte
+        # extension into throwaway folders, and its log must show the signature verified. Every
+        # LevelCode release before this step existed failed it: none could verify an extension.
+        # Fails only on the app's own words; a registry that cannot be reached is a warning.
+        run: node scripts/extension-signature.mjs smoke "VSCode-darwin-${{ matrix.arch }}/LevelCode.app"
       - name: Zip the unsigned app
         run: ditto -c -k --sequesterRsrc --keepParent "VSCode-darwin-${{ matrix.arch }}/LevelCode.app" "UNSIGNED-LevelCode-${{ matrix.arch }}.app.zip"
       - name: Upload app artifact
 
@@ -18,6 +18,7 @@ lives in the tracked repo and is re-applied onto a clean clone:
 | `extensions/levelcode-npp-pack/`, `extensions/levelcode-ai/` | `vscode/extensions/*` | `apply-branding.mjs` (copy) |
 | `branding/product.overlay.json`, `branding/icons/` | `vscode/product.json`, `vscode/resources/...` | `apply-branding.mjs` (merge/copy) |
 | `patches/levelcode-core.patch` | edits to `vscode/src/**`, `vscode/build/**` | `bootstrap.sh` (`git apply`) |
+| `modules/extension-signature/` | the BUILT app's `node_modules/@vscode/vsce-sign` (never `vscode/`) | `extension-signature.mjs install` (from `build-macos.sh`, `make-dmg.sh`) |
 
 So: **edit extensions in `extensions/…`, not `vscode/extensions/…`.** After editing, run
 `./scripts/run-dev.sh` (it syncs canonical → checkout first) to test.
@@ -39,8 +40,9 @@ extensions/levelcode-themes/     signature One Dark / One Light themes (JSON, de
 extensions/levelcode-hackability/ user init script + Atom/NPP keymap presets + package generator & hot-reload dev loader
 extensions/levelcode-sync/       'levelcode' auth provider that lights up the built-in Settings Sync (LevelCode Sync, S0)
 extensions/levelcode-updater/    notify-only update checker (polls the update feed; never auto-applies)
+modules/extension-signature/     Open VSX signature verifier the built app loads as @vscode/vsce-sign, + the signing keys it trusts
 patches/levelcode-core.patch     our core source edits, applied on bootstrap
-scripts/                    bootstrap.sh, apply-branding.mjs, run-dev.sh, editor-identity.mjs, build-macos.sh, make-dmg.sh, make-icon.sh, build-web.mjs; atom (CLI launcher) + install-level.sh
+scripts/                    bootstrap.sh, apply-branding.mjs, run-dev.sh, editor-identity.mjs, extension-signature.mjs, build-macos.sh, make-dmg.sh, make-icon.sh, build-web.mjs; atom (CLI launcher) + install-level.sh
 tools/                      dependency-free reference servers: sync-server (/v1 Settings-Sync), update-server (/api/update feed)
 web/                        LevelCode in a browser tab: page entry + callback, scratch-workspace extension, layout, themes + chat skin, browser build of levelcode-ai, dev server, tests (docs/WEB.md)
 vscode/                     GITIGNORED upstream Code-OSS checkout (generated)
@@ -83,6 +85,33 @@ To macOS a run from source and the installed LevelCode used to be ONE app — sa
 - A LaunchServices handler must live outside temp folders — a bundle under `/tmp` is registered but
   never chosen. Tests therefore run on fixtures and do not register anything (`test/editorIdentity.test.js`).
 
+## Extensions are verified (keep it that way)
+
+Every release up to 1.3.1 refused every signed extension from Open VSX — "Signature verification was
+not executed" — and silently never updated one. The editor verifies through `import('@vscode/vsce-sign')`,
+a Microsoft-only module no open-source build contains. `modules/extension-signature` is LevelCode's
+module for that slot. Full account + runbooks: `docs/EXTENSION-SIGNATURES.md`.
+
+- **What it checks:** Open VSX's Ed25519 signature over the `.vsix` bytes. A repository signature —
+  "this is what Open VSX published" — not the publisher's, and not a statement about safety.
+- **The key is pinned, never fetched:** `modules/extension-signature/keys.json`. Adding or removing a
+  key is a security decision; the doc says how a key is checked first. The module may `require` only
+  `node:crypto`/`fs`/`path`/`zlib`, and its suite runs it with every socket refused.
+- **No core patch.** `extension-signature.mjs install` copies three files into the BUILT app (like
+  `strip-proprietary.mjs`). `check` then fails the build unless the built editor still asks for that
+  name, the name resolves to our module from the bundles that ask, and the module — imported the way
+  the editor imports it — accepts a real package and refuses a changed one.
+- **`smoke <LevelCode.app>`** asks the app itself (its command line installs one tiny extension into
+  temp folders). It is the check that would have caught the original bug; CI runs it after each build.
+- **`registry`** watches for Open VSX changing its key (daily workflow + release gate). Exit 1 means
+  evidence, and every shipped build is refusing extensions until a release carries the new key.
+  It asks the registry and the one host the registry redirects downloads to (`CONTENT_ORIGINS`),
+  following redirects by hand; a redirect anywhere else is not followed, and it says so.
+- **Do not "fix" a refusal by turning verification off** (`extensions.verifySignature`, a patch like
+  VSCodium's). And a run from source proves nothing here: the editor only enforces on a built app.
+- Its tests live in `modules/extension-signature/test/` — outside `extensions/`, whose `test/` folders
+  ship in the app. `scripts/test-extensions.sh` discovers `modules/*/test/*.test.js` too.
+
 ## LevelCode in a tab (`web/`) — read `docs/WEB.md` first
 
 The same `extensions/levelcode-ai` source runs in a browser tab (web-worker extension host). Rules that keep
@@ -260,7 +289,7 @@ big-file mode badge. Files: extension.js + fileOps/lineOps/columnOps/encodingEol
   is not in the editor until you load it: `./scripts/run-dev.sh --extensionDevelopmentPath=<worktree>/extensions/levelcode-ai`
   (from the main checkout; the dev extension replaces the built-in one). Uncommitted work is not "on the branch" —
   checking the branch out somewhere else gets none of it. Run it in the editor before telling anyone to try it.
-- Commit `extensions/`, `patches/`, `branding/`, `scripts/`, `web/`, `docs/`, `PLAN.md`, `CLAUDE.md`. Never commit `vscode/` or `dist-web/`.
+- Commit `extensions/`, `modules/`, `patches/`, `branding/`, `scripts/`, `web/`, `docs/`, `PLAN.md`, `CLAUDE.md`. Never commit `vscode/` or `dist-web/`.
 - `extensions/levelcode-ai/diagram/` modules listed in `bundle.FILES` are pasted INTO a script block in `chat.html`.
   They must never contain the text of a script tag or an HTML comment opener — not even in a comment — or the block
   ends early; `bundle.js` refuses to build if one does. Keep them dependency-free and free of `require('vscode')`/`fs`.
 
@@ -12,3 +12,10 @@ LevelCode is not produced by, endorsed by, or affiliated with Microsoft.
 "Visual Studio Code" and related marks are trademarks of Microsoft.
 The upstream Code-OSS source is fetched at build time and is not redistributed
 in this repository.
+
+modules/extension-signature/test/fixtures/ holds two extension packages as
+published on Open VSX (https://open-vsx.org), unmodified, used only as test
+data and not shipped in the app:
+  - git-rebase-syntax 0.0.1, MIT License, Copyright (c) 2020 Jérome Perrin
+  - systemd-unit-file 1.0.6, MIT License, Copyright (c) 2018 Takashi Oguma
+Each package carries its own licence text; see the README in that folder.
@@ -34,6 +34,7 @@ LevelCode is a **clean overlay on top of Code-OSS**, not a vendored copy of the
 
 - `extensions/` — the first-party extensions (native AI, Notepad++ pack, themes, hackability, sync, updater), plain JS with no build step.
 - `branding/` — the LevelCode identity (`product.overlay.json`) + icons, deep-merged onto upstream `product.json`; the extension gallery wired to **Open VSX**.
+- `modules/` — what ships in the app outside an extension: the Open VSX signature verifier and the signing keys it trusts.
 - `patches/` — the small set of core source patches (each tagged `// [LevelCode]`).
 - `scripts/` — bootstrap / run-dev / build / dmg / icon, and `build-web.mjs` (LevelCode in a browser tab).
 - `web/` — LevelCode in your browser: the same workbench and AI extension as a static site you can host; sign in with a LevelCode account or use your own key. See [`docs/WEB.md`](docs/WEB.md).
@@ -60,7 +61,7 @@ Actively built, macOS-first. Working today: the Notepad++ power-editing pack; th
 
 ## Why a fork
 
-Code-OSS is MIT-licensed and free to fork, modify, and ship. LevelCode honors the constraints every forker must: the **Microsoft Extension Marketplace is Microsoft-products-only**, so LevelCode points its gallery at **Open VSX** (the Eclipse-run open marketplace); and LevelCode ships its own name, icon, and identity. It is **not** produced by, endorsed by, or affiliated with Microsoft, and the upstream Code-OSS source is fetched at build time — never redistributed in this repository.
+Code-OSS is MIT-licensed and free to fork, modify, and ship. LevelCode honors the constraints every forker must: the **Microsoft Extension Marketplace is Microsoft-products-only**, so LevelCode points its gallery at **Open VSX** (the Eclipse-run open marketplace) — and checks every extension it installs or updates against Open VSX's signature, with the signing key pinned in the app rather than fetched ([how, and what that does and does not prove](./docs/EXTENSION-SIGNATURES.md)); and LevelCode ships its own name, icon, and identity. It is **not** produced by, endorsed by, or affiliated with Microsoft, and the upstream Code-OSS source is fetched at build time — never redistributed in this repository.
 
 ## License
 
 
@@ -12,6 +12,11 @@ LevelCode is built to keep your code and your credentials on your machine.
   your API key over plaintext `http://` to a non-local host (https, or an explicit localhost, only).
 - **Readable.** The AI layer is plain, dependency-free JS — you can see exactly what is sent to a
   provider. Transparency is a design goal, not an afterthought.
+- **Extensions are checked on the way in.** Every extension installed or updated from Open VSX is
+  verified against the registry's signature, with the signing key pinned in the app rather than fetched
+  from the server being checked. That proves the package is the one Open VSX published. It does not
+  prove the extension is safe, and it is not the publisher's own signature. See
+  [`docs/EXTENSION-SIGNATURES.md`](./docs/EXTENSION-SIGNATURES.md).
 
 ## Reporting a vulnerability
 
@@ -25,6 +30,7 @@ you posted through the fix.
 
 ## Scope
 
-- **In scope:** the LevelCode first-party extensions and the build / branding kit in this repository.
+- **In scope:** the LevelCode first-party extensions, the extension signature verifier
+  (`modules/extension-signature`), and the build / branding kit in this repository.
 - **Out of scope:** upstream Code-OSS / VS Code itself (report those to Microsoft), and third-party
   extensions you install from Open VSX.