add mosis-portal Go project with package signing and validation

DEV_PORTAL_M01_APP_PACKAGE.md

@@ -1,8 +1,47 @@
 # Milestone 1: App Package Format
 
-**Status**: Planning
+**Status**: Decided
 **Goal**: Define how apps are bundled, signed, and validated.
 
+## Decision
+
+**Signed ZIP (Option C)** with JAR/APK-style signing using Ed25519:
+
+```
+Format:       ZIP archive with .mosis extension
+Signing:      Ed25519 (crypto/ed25519 stdlib)
+Manifest:     META-INF/MANIFEST.MF with SHA-256 hashes
+Validation:   Go package (mosis-portal/pkg/package)
+```
+
+### Rationale
+
+1. **Standard tooling** - ZIP format works with all archive tools
+2. **Proven approach** - JAR/APK signing is battle-tested
+3. **Ed25519** - Fast, secure, small signatures (64 bytes)
+4. **Go stdlib** - crypto/ed25519 and archive/zip in standard library
+5. **Easy inspection** - Developers can unzip and view contents
+
+### Package Structure
+
+```
+com.developer.appname-1.0.0.mosis  (ZIP archive)
+├── manifest.json           # App metadata (JSON)
+├── META-INF/
+│   ├── MANIFEST.MF         # SHA-256 hashes of all files
+│   └── CERT.SIG            # Ed25519 signature of MANIFEST.MF
+├── icons/
+│   ├── icon-32.png
+│   ├── icon-64.png
+│   └── icon-128.png
+└── assets/
+    ├── main.rml            # Entry point
+    ├── styles/
+    │   └── theme.rcss
+    └── scripts/
+        └── app.lua
+```
+
 ---
 
 ## Overview
@@ -331,12 +370,13 @@ SHA-256-Digest: base64encodedHash==
 
 ## Deliverables
 
+- [x] Package format decided (Signed ZIP with .mosis extension)
+- [x] Signing algorithm decided (Ed25519)
 - [ ] JSON Schema for manifest validation
-- [ ] Package format specification document
-- [ ] Reference implementation: package creator (Go/Rust)
-- [ ] Reference implementation: package validator
-- [ ] Reference implementation: signature tools
-- [ ] Integration with mosis-cli
+- [ ] Go package: `pkg/package/manifest.go` (parsing/validation)
+- [ ] Go package: `pkg/package/validator.go` (package validation)
+- [ ] Go package: `pkg/package/signer.go` (Ed25519 signing/verification)
+- [ ] Integration with mosis-cli `build` and `sign` commands
 
 ---
 
@@ -358,10 +398,10 @@ SHA-256-Digest: base64encodedHash==
 
 ## Open Questions
 
-1. Should we support multiple entry points (e.g., widget vs full app)?
-2. Should icons be required or have defaults?
-3. Delta updates in v1 or defer to v2?
-4. Support for app bundles (multiple apps in one package)?
+1. ~~Should we support multiple entry points (e.g., widget vs full app)?~~ → Single entry point for v1
+2. ~~Should icons be required or have defaults?~~ → Required (32, 64, 128 sizes)
+3. ~~Delta updates in v1 or defer to v2?~~ → Defer to v2 (full updates only)
+4. ~~Support for app bundles (multiple apps in one package)?~~ → No, one app per package
 
 ---