Runtime signs canonical receipts.

What runtime does

• Executes actions.
• Emits metadata.proof receipts.
• Signs receipts with Ed25519.
• Exposes /verify.
• Supports Trust Verification v1 endpoints.

Production signer

• signer_id = runtime.commandlayer.eth
• kid = vC4WbcNoq2znSCiQ
• metadata.proof.canonicalization = json.sorted_keys.v1
• metadata.proof.hash.alg = SHA-256
• metadata.proof.signature.alg = Ed25519

Live endpoint examples

GET  https://runtime.commandlayer.org/health
POST https://runtime.commandlayer.org/verify
POST https://runtime.commandlayer.org/trust-verification/sign/v1.0.0
POST https://runtime.commandlayer.org/trust-verification/attest/v1.0.0
POST https://runtime.commandlayer.org/trust-verification/authorize/v1.0.0
POST https://runtime.commandlayer.org/trust-verification/approve/v1.0.0
POST https://runtime.commandlayer.org/trust-verification/reject/v1.0.0
POST https://runtime.commandlayer.org/trust-verification/permit/v1.0.0
POST https://runtime.commandlayer.org/trust-verification/grant/v1.0.0
POST https://runtime.commandlayer.org/trust-verification/authenticate/v1.0.0
POST https://runtime.commandlayer.org/trust-verification/endorse/v1.0.0

Trust boundary

• Runtime signs.
• MCP does not sign.
• Verifier validates.
• SDK wraps.