Inngest signing keys

• Provider documentation inngest/inngest dabb03f: SigningKeyPrefixTest/Branch/Prod constants; self-hosting docs "a valid hexadecimal string with an even number of characters", openssl rand -hex 32 (re-checked 2026-09-28) · observed 2026-09-28 · signkey-prod-, signkey-test- or signkey-branch- + exactly 64 lowercase hex (77 or 79 in all); no checksum
• Reference 1
• Reference 2
• Reference 3
• Reference 4
• Reference 5
• Reference 6
• Reference 7
• Reference 8
• Reference 9
• Reference 10

Arrival evidence (#436, product redact-secret#914; #860 handoff inngest.md, READY). T1: the three environment prefixes are provider code constants (R1); the docs state an even-length hex key and generate it with openssl rand -hex 32 (64 lowercase hex), and every realistic provider SDK fixture is signkey-test- or signkey-prod- + 64 lowercase hex (R5). One family covers the raw key, INNGEST_SIGNING_KEY_FALLBACK and the hashed wire form sent as Bearer, which are lexically identical and each authenticates. Excluded: other environment labels (the SDKs' \w+ admits them, but only three are constants), the self-hosted bare-hex key (unattributable without the prefix), event keys (no shape), an uppercase-hex body (the decoder accepts it, the generator never emits it) and the docs and SDK placeholders. Neither pinned peer has an Inngest rule. Graduated to a registry detector at the 1127bf9 re-pin (redact-secret PR #938).