feat(cron,gateway): NAS-JWT fire verifier + /api/cron/fire webhook (Chronos)

Phase 4E (E.1 + E.2). The inbound side of Chronos: NAS POSTs the agent when a
one-shot fires; the agent verifies a NAS-minted JWT and runs the job.

E.1 — plugins/cron/chronos/verify.py:
- verify_nas_fire_token(token, expected_audience, jwks_or_key, issuer): verifies
  signature against the NAS JWKS (RS/ES family; symmetric rejected), aud == this
  agent, exp/nbf, iss, and purpose == "cron_fire" (so a general agent JWT can't
  be replayed against the fire endpoint). Returns claims or None; never raises.
  Crypto delegated to PyJWT[crypto] (already a declared dep) — no hand-rolled
  JWT, no new dependency. No key configured → refuse (never unsigned-decode a
  security boundary).
- get_fire_verifier(): pluggable indirection so the DQ-4 escape hatch
  (direct per-job cron-key) can swap in with no handler change.

E.2 — gateway/platforms/api_server.py:
- POST /api/cron/fire (registered only when _CRON_AVAILABLE). Authenticated by
  the NAS-JWT via get_fire_verifier() — NOT API_SERVER_KEY (NAS holds no API
  key; this is the only inbound that triggers remote job execution, so it gets
  its own purpose-scoped check). Verifier args come from cron.chronos.* config.
  401 on bad/missing/forged token. 400 on missing job_id. On success: 202 +
  fire_due runs in the background (so a long agent turn never trips NAS's HTTP
  timeout); the store CAS claim inside fire_due de-dupes a scheduler retry.

Tests:
- test_chronos_verify (11): REAL RS256 signing — valid→claims, wrong-aud,
  missing/wrong purpose, expired, wrong-iss, tampered-signature (attacker key),
  no-key-refuse, empty-token, JWKS-URL key resolution, get_fire_verifier.
- test_cron_fire_webhook (5): valid→202+fire, invalid→401+no-fire, missing
  token→401, missing job_id→400, and fire path does NOT require API_SERVER_KEY.
api_server regression suites (214) green.

E.3 (NAS endpoints) is a separate cross-repo PR; the wire contract lands next
(docs/chronos-managed-cron-contract.md).

tests/plugins/test_chronos_verify.py

@@ -0,0 +1,182 @@
+"""Tests for the Chronos inbound cron-fire JWT verifier (Phase 4E.1).
+
+These exercise REAL RS256 signing/verification (PyJWT[crypto] is a declared
+dependency) against an inline PEM public key — no mocking of the crypto, since
+this is a security boundary. The JWKS-URL path is covered separately by mocking
+PyJWKClient's key resolution.
+"""
+
+import time
+
+import pytest
+
+
+@pytest.fixture(scope="module")
+def rsa_keys():
+    """An RS256 keypair: (private_pem, public_pem)."""
+    from cryptography.hazmat.primitives import serialization
+    from cryptography.hazmat.primitives.asymmetric import rsa
+
+    key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+    priv = key.private_bytes(
+        encoding=serialization.Encoding.PEM,
+        format=serialization.PrivateFormat.PKCS8,
+        encryption_algorithm=serialization.NoEncryption(),
+    ).decode()
+    pub = key.public_key().public_bytes(
+        encoding=serialization.Encoding.PEM,
+        format=serialization.PublicFormat.SubjectPublicKeyInfo,
+    ).decode()
+    return priv, pub
+
+
+def _mint(priv, claims):
+    import jwt
+    return jwt.encode(claims, priv, algorithm="RS256")
+
+
+AUD = "agent:inst-123"
+ISS = "https://portal.nousresearch.com"
+
+
+def _base_claims(**over):
+    now = int(time.time())
+    c = {
+        "aud": AUD,
+        "iss": ISS,
+        "purpose": "cron_fire",
+        "iat": now,
+        "nbf": now - 5,
+        "exp": now + 300,
+    }
+    c.update(over)
+    return c
+
+
+def test_valid_token_returns_claims(rsa_keys):
+    from plugins.cron.chronos.verify import verify_nas_fire_token
+
+    priv, pub = rsa_keys
+    token = _mint(priv, _base_claims())
+    claims = verify_nas_fire_token(token=token, expected_audience=AUD,
+                                   jwks_or_key=pub, issuer=ISS)
+    assert claims is not None
+    assert claims["purpose"] == "cron_fire"
+    assert claims["aud"] == AUD
+
+
+def test_wrong_audience_rejected(rsa_keys):
+    from plugins.cron.chronos.verify import verify_nas_fire_token
+
+    priv, pub = rsa_keys
+    token = _mint(priv, _base_claims(aud="agent:someone-else"))
+    assert verify_nas_fire_token(token=token, expected_audience=AUD,
+                                 jwks_or_key=pub, issuer=ISS) is None
+
+
+def test_missing_purpose_rejected(rsa_keys):
+    """A general agent JWT (no purpose=cron_fire) can't fire jobs."""
+    from plugins.cron.chronos.verify import verify_nas_fire_token
+
+    priv, pub = rsa_keys
+    claims = _base_claims()
+    del claims["purpose"]
+    token = _mint(priv, claims)
+    assert verify_nas_fire_token(token=token, expected_audience=AUD,
+                                 jwks_or_key=pub, issuer=ISS) is None
+
+
+def test_wrong_purpose_rejected(rsa_keys):
+    from plugins.cron.chronos.verify import verify_nas_fire_token
+
+    priv, pub = rsa_keys
+    token = _mint(priv, _base_claims(purpose="inference"))
+    assert verify_nas_fire_token(token=token, expected_audience=AUD,
+                                 jwks_or_key=pub, issuer=ISS) is None
+
+
+def test_expired_token_rejected(rsa_keys):
+    from plugins.cron.chronos.verify import verify_nas_fire_token
+
+    priv, pub = rsa_keys
+    now = int(time.time())
+    token = _mint(priv, _base_claims(iat=now - 1000, nbf=now - 1000, exp=now - 600))
+    assert verify_nas_fire_token(token=token, expected_audience=AUD,
+                                 jwks_or_key=pub, issuer=ISS) is None
+
+
+def test_wrong_issuer_rejected(rsa_keys):
+    from plugins.cron.chronos.verify import verify_nas_fire_token
+
+    priv, pub = rsa_keys
+    token = _mint(priv, _base_claims(iss="https://evil.example"))
+    assert verify_nas_fire_token(token=token, expected_audience=AUD,
+                                 jwks_or_key=pub, issuer=ISS) is None
+
+
+def test_tampered_signature_rejected(rsa_keys):
+    """A token signed by a DIFFERENT key must fail signature verification."""
+    from cryptography.hazmat.primitives import serialization
+    from cryptography.hazmat.primitives.asymmetric import rsa
+    from plugins.cron.chronos.verify import verify_nas_fire_token
+
+    _, pub = rsa_keys
+    attacker = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+    attacker_priv = attacker.private_bytes(
+        encoding=serialization.Encoding.PEM,
+        format=serialization.PrivateFormat.PKCS8,
+        encryption_algorithm=serialization.NoEncryption(),
+    ).decode()
+    token = _mint(attacker_priv, _base_claims())
+    # Verified against the REAL public key → signature mismatch → None.
+    assert verify_nas_fire_token(token=token, expected_audience=AUD,
+                                 jwks_or_key=pub, issuer=ISS) is None
+
+
+def test_no_key_configured_refuses(rsa_keys):
+    """No JWKS/key configured → refuse (never fall back to unsigned decode)."""
+    from plugins.cron.chronos.verify import verify_nas_fire_token
+
+    priv, _ = rsa_keys
+    token = _mint(priv, _base_claims())
+    assert verify_nas_fire_token(token=token, expected_audience=AUD,
+                                 jwks_or_key=None) is None
+
+
+def test_empty_token_refused(rsa_keys):
+    from plugins.cron.chronos.verify import verify_nas_fire_token
+
+    _, pub = rsa_keys
+    assert verify_nas_fire_token(token="", expected_audience=AUD, jwks_or_key=pub) is None
+
+
+def test_jwks_url_path_resolves_key(rsa_keys, monkeypatch):
+    """The JWKS-URL branch resolves the signing key via PyJWKClient."""
+    from plugins.cron.chronos.verify import verify_nas_fire_token
+
+    priv, pub = rsa_keys
+    token = _mint(priv, _base_claims())
+
+    class FakeKey:
+        key = pub
+
+    class FakeJWKClient:
+        def __init__(self, url):
+            assert url == "https://portal.nousresearch.com/.well-known/jwks.json"
+
+        def get_signing_key_from_jwt(self, tok):
+            return FakeKey()
+
+    monkeypatch.setattr("jwt.PyJWKClient", FakeJWKClient)
+    claims = verify_nas_fire_token(
+        token=token, expected_audience=AUD,
+        jwks_or_key="https://portal.nousresearch.com/.well-known/jwks.json",
+        issuer=ISS,
+    )
+    assert claims is not None and claims["purpose"] == "cron_fire"
+
+
+def test_get_fire_verifier_returns_nas_verifier():
+    from plugins.cron.chronos.verify import get_fire_verifier, verify_nas_fire_token
+
+    assert get_fire_verifier() is verify_nas_fire_token