Developer docs

Integrate the factory without inheriting its complexity.

CommandLayer exposes stable machine contracts while keeping provider routing, settlement adapters, execution state, retries, and receipt production behind the service boundary.

Factory contract

The public surface is intentionally smaller than the implementation.

Buyer-visible

Service identity and version, request schema, result schema, execution mode, quote semantics, payment options, acceptance conditions, evidence contract, and stable endpoints.

Factory-internal

Primitive graph, provider selection, retries, budget enforcement, content fees, model costs, storage, payment/facilitator cost, and execution ledger internals.

Contract rule: an adapter may translate the service into OpenAPI, MCP, ENS, x402, ERC-8004, or another ecosystem. The adapter does not get to redefine the service.
Trust boundary

Verification is precise by design.

A valid receipt can prove canonical integrity, signature validity, signer/provenance information, and declared execution evidence. It does not prove that a statement is factually true merely because it was signed.

Conceptual receipt boundary
// payment evidence and execution evidence remain distinct
{
  "execution": {
    "input_hash": "sha256:...",
    "output_hash": "sha256:...",
    "acceptance": "passed"
  },
  "proof": "signed execution scope"
}