{
  "service": "srf-attestor",
  "version": "v0",
  "description": "Sovereign Review Fabric receipt attestor — signs and verifies Gamma QC + DrkLynX artifact receipts with Ed25519 (Phase A live, ML-DSA-65 / NIST FIPS-204 in Phase B roadmap).",
  "base": "https://attest.gammaqc.com",
  "algos": {
    "current": "Ed25519",
    "roadmap": "ML-DSA-65 (NIST FIPS-204)"
  },
  "endpoints": {
    "GET /": "Auditor-friendly paste-and-verify HTML UI (no signup)",
    "GET /api": "Self-documenting endpoint index (this)",
    "GET /healthz": "Liveness probe — returns \"ok\"",
    "GET /.well-known/attestor.json": "JWKS — public verifying keys (current + previous during rotation window)",
    "POST /sign": "Backend-only (Bearer SRF_INTERNAL_KEY). Signs a receipt body. Body: receipt JSON. Returns {receipt, signature, alg}.",
    "GET /verify?receipt=<urlencoded-json>&sig=<hex>": "Public verify (query-string). 200/422 with reason.",
    "POST /verify": "Public verify (JSON body). Body: {receipt: {...}, signature: \"<hex>\"}. Returns {verified, key_id, artifact_kind?, artifact_id?, reason?}."
  },
  "receipt_envelope_spec": {
    "canonical_form": "RFC8785-style — sort keys recursively, no whitespace, stable order",
    "signature_format": "lowercase hex Ed25519 signature over canonical-JSON UTF-8 bytes",
    "required_fields_for_sign": [
      "artifact_kind",
      "generated_at OR issued_at"
    ],
    "attestor_stamp_added_on_sign": {
      "key_id": "string",
      "alg": "ed25519",
      "version": "srf-receipt-v0",
      "signed_at": "ISO-8601"
    }
  },
  "rotation_policy": {
    "period_days": 180,
    "overlap_days": 60
  },
  "jwks_url": "https://attest.gammaqc.com/.well-known/attestor.json",
  "example": {
    "command": "curl -s -X POST https://attest.gammaqc.com/verify -H 'content-type: application/json' -d '{\"receipt\": {...}, \"signature\": \"<hex>\"}'",
    "response_shape": {
      "verified": true,
      "key_id": "srf-2026-06",
      "artifact_kind": "...",
      "artifact_id": "..."
    }
  }
}