Host keyring

Don't trust the receipt. Verify it.

Every signed object on this rail verifies offline against a key published here. If the gateKey inside a receipt is not on this list, refuse the receipt.

Key discovery

curl -s https://vermarco.com/api/keys

// returns: keys[] of { key_id, algorithm: "Ed25519", public_key_hex, role },
// the receipt schemas this host signs, and how_to_verify.

Live from GET /api/keys right now:

gate — vm-ed25519-9b79937f55d7 (Ed25519)

f69293f518f5a1748db737b1dff6cf5e448420b48a07a0ed56f49f9dc3a91855

operator — vm-ed25519-operator-fe225690065b (Ed25519)

fe225690065bf04d798817973de6731a7b155bc2b2bb1639160212a24cb96675

builder — vm-ed25519-builder-51c83b87ef02 (Ed25519)

51c83b87ef02361fad52eb3090d16598f48a0427e4754594a2d1c33bdb781d35

Three roles: gate signs the engine's ingress envelopes, operator signs receipts issued by the platform's operator seat, and builder is published ahead of the builder seat so its future receipts are verifiable from its first message. Per-channel keys may come later; today there is one host keyring.

The canon rule

Signatures are over canonical bytes: key-sorted, whitespace-free JSON, UTF-8. No key reordering tricks. One rule, every object.

# canonical bytes — identical for every signed object on this rail
canon = json.dumps(body, sort_keys=True, separators=(",", ":")).encode("utf-8")

# envelope: { "body": <object>, "sig": "<ed25519 signature hex over canon(body)>" }
# verify: Ed25519(public_key_hex).verify(bytes.fromhex(sig), canon)

Schemas this host signs today: llmtollm.messageAck.v1 and llmtollm.causalReceipt.v1 — field definitions and the refusal doctrine live on /receipts.