Function create_link_signed 

pub fn create_link_signed(
    conn: &Connection,
    source_id: &str,
    target_id: &str,
    relation: &str,
    keypair: Option<&AgentKeypair>,
) -> Result<&'static str>

v0.7 H2 — link write that optionally signs with the active agent’s Ed25519 keypair.

When keypair carries a private key, the six signable fields (src_id, dst_id, relation, observed_by, valid_from, valid_until) are encoded to deterministic CBOR per RFC 8949 §4.2.1, signed, and the 64-byte signature is persisted in the existing signature BLOB column with attest_level = "self_signed".

When keypair is None or carries only a public key, the row is written with signature = NULL and attest_level = "unsigned" — preserving v0.6.4 behaviour for callers that haven’t generated a keypair yet.

observed_by on the signed payload is set to the keypair’s agent_id when a keypair is present (the writer is, by definition, the observer). The observed_by column itself is intentionally left at the v0.6.3 default (NULL on this insert path) so existing KG queries that join on observed_by keep their current shape; H4’s memory_verify will surface the signing identity from the keypair

• signature, not from this column.

Returns the chosen attest level so callers (HTTP/MCP wrappers) can surface it in the wire response without re-querying the row.