Function inject_jekt_signing_keys_into_mcp_json 

pub fn inject_jekt_signing_keys_into_mcp_json(
    content: &str,
    mstore: &Store,
    agent_slug: &str,
) -> Option<String>

Best-effort: mint-or-reuse agent_slug’s jekt/LAN signing keys (SPEC_JEKT_TRUST_LAYER_COMPLETION_2026_08_13.md §2.2, SPEC_JEKT_LAN_TIER_SIGNING_2026_08_15.md §2.1) and patch them into a .mcp.json file’s mcpServers.agentmux.env block. Returns None on any parse failure, missing mcpServers.agentmux.env object, or if neither key could be ensured — callers must keep the original content in that case; this must never block writing the agent’s config.

Shared by agent.open (server/app_api/agent_open.rs) and the WriteAgentConfig “click Launch” path (server/editor_handlers.rs) — per this module’s own doc comment, the two .mcp.json-materializing call sites that must not drift out of sync. Before this function existed, only agent.open injected these keys — WriteAgentConfig (the path a normal Launch-button click actually goes through) silently never did, so ordinarily-launched agents’ jekts rendered TRUST=self-declared even on builds well past both features shipping. See docs/specs/REPORT_JEKT_SIGNING_KEY_INJECTION_GAP_2026_08_16.md.