@synoi/gateway-lite 0.1.0

package/dist/verify-router.js

@@ -0,0 +1,1755 @@
+"use strict";
+/**
+ * verify-router.ts
+ *
+ * Public Decision Receipt verification endpoint.
+ *
+ * GET /verify/:receipt_id
+ *   — Returns full receipt + signature validity + chain summary
+ *   — No auth required — this is the public verification surface
+ *   — Anyone with a receipt_id can verify it was signed by SynOI
+ *
+ * GET /verify/:receipt_id/raw
+ *   — Returns the raw signed payload (the exact bytes that were signed)
+ *   — Enables independent verification with any Ed25519 library
+ *
+ * Signature scheme (published at /verify/scheme):
+ *   1. Canonical payload = JSON.stringify({ receipt_id, tenant_id, decision,
+ *        action_class, risk_level, oid_hex, recorded_at }, sorted keys)
+ *   2. Signed with Ed25519 using SYNOI_SIGNING_KEY (private)
+ *   3. Signature hex stored in receipts.db alongside signer_key_id
+ *   4. Public key published at /verify/pubkey — anyone can verify offline
+ *
+ * GET /verify/pubkey
+ *   — Returns the current Ed25519 public key (hex) for offline verification
+ *
+ * GET /verify/scheme
+ *   — Returns the full signature scheme documentation as JSON
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CANONICAL_FIELDS = exports.K1_HYBRID_CUTOVER_MS = void 0;
+exports.initSigningKeys = initSigningKeys;
+exports.getSignerKeyId = getSignerKeyId;
+exports.__setSigningBundleForTest = __setSigningBundleForTest;
+exports.getSigningPubkey = getSigningPubkey;
+exports.signReceiptPayload = signReceiptPayload;
+exports.verifyReceiptSignature = verifyReceiptSignature;
+exports.getMlDsaPubkey = getMlDsaPubkey;
+exports.signReceiptPayloadHybrid = signReceiptPayloadHybrid;
+exports.signDssePayload = signDssePayload;
+exports.signDsseWithBundle = signDsseWithBundle;
+exports.deriveMlDsaKeyEphemeral = deriveMlDsaKeyEphemeral;
+exports.verifyReceiptSignatureHybrid = verifyReceiptSignatureHybrid;
+exports.signCanonicalBytesHybrid = signCanonicalBytesHybrid;
+exports.verifyCanonicalBytesHybrid = verifyCanonicalBytesHybrid;
+exports.grantSigningCanonical = grantSigningCanonical;
+exports.verifyCanonicalBytesEd = verifyCanonicalBytesEd;
+exports.isPostCutoverDowngrade = isPostCutoverDowngrade;
+exports.schemeLabel = schemeLabel;
+exports.canonicalPayload = canonicalPayload;
+const express_1 = require("express");
+const crypto_1 = require("crypto");
+// Node 18 doesn't expose globalThis.crypto.getRandomValues by default; @noble
+// libraries expect it. Idempotent polyfill — no-op on Node 19+. Must run
+// BEFORE the @noble/post-quantum import below so ml_dsa65's module init
+// sees a populated globalThis.crypto.
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+if (!globalThis.crypto)
+    globalThis.crypto = crypto_1.webcrypto;
+const ml_dsa_js_1 = require("@noble/post-quantum/ml-dsa.js");
+const native_mldsa_1 = require("./native-mldsa");
+const sraid_1 = require("@synoi/sraid");
+const receipt_store_1 = require("./receipt-store");
+const key_provider_1 = require("./key-provider");
+const router = (0, express_1.Router)();
+/**
+ * Defensively decode a receipt/grant id that may have been percent-encoded
+ * more than once by an intermediate proxy or CDN. Idempotent and safe on an
+ * already-decoded id; falls back to the raw value on a malformed sequence.
+ */
+function normalizeReceiptId(raw) {
+    let id = raw;
+    for (let i = 0; i < 2 && id.includes('%'); i++) {
+        let decoded;
+        try {
+            decoded = decodeURIComponent(id);
+        }
+        catch {
+            break;
+        }
+        if (decoded === id)
+            break;
+        id = decoded;
+    }
+    return id;
+}
+// CORS for the public verification surface. The demo frontend fetches
+// /verify/pubkey and /verify/:id from the browser (the tamper test and the
+// verify kit), so those cross-origin reads need the headers. Verification is
+// public + read-only, so this is safe to expose to the demo origins.
+const VERIFY_ALLOWED_ORIGINS = new Set([
+    'https://demo.synoi.systems',
+    'http://localhost:5173',
+    'http://localhost:4173',
+]);
+router.use((req, res, next) => {
+    const origin = req.header('origin');
+    if (origin && VERIFY_ALLOWED_ORIGINS.has(origin)) {
+        res.setHeader('Access-Control-Allow-Origin', origin);
+        res.setHeader('Vary', 'Origin');
+        res.setHeader('Access-Control-Allow-Methods', 'GET, OPTIONS');
+        res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Accept');
+    }
+    if (req.method === 'OPTIONS') {
+        res.sendStatus(204);
+        return;
+    }
+    next();
+});
+// ── Persistent signing key management ────────────────────────────────────────
+//
+// Keys are loaded from a KeyProvider (LocalEncryptedFileKeyProvider in most
+// deployments; AwsKmsKeyProvider stub for future AWS-native infra sprint).
+//
+// FAIL-CLOSED rule: if NODE_ENV=production and no provider is configured (or
+// the provider throws), the process exits with a non-zero code. Ephemeral keys
+// are only allowed in non-production environments, and even then only if
+// SYNOI_ALLOW_EPHEMERAL_KEYS=true is explicitly set.
+//
+// Historical verification: every loaded bundle is appended to an in-memory
+// key history (key-provider.ts). verifyReceiptSignature(Hybrid) searches the
+// history so receipts signed with a prior key remain verifiable after rotation.
+//
+// See key-provider.ts for the full provider interface, AWS KMS stub, and file
+// provider implementation.
+let _currentBundle = null;
+/**
+ * Load the current key bundle synchronously from the module-level cache, or
+ * throw if the key has not been initialized yet. Call initSigningKeys() at
+ * startup before any signing or verification.
+ */
+function currentBundle() {
+    if (_currentBundle)
+        return _currentBundle;
+    // This path is hit if signing is attempted before initSigningKeys() completed.
+    throw new Error('[verify-router] Signing keys not initialized. Call initSigningKeys() at startup.');
+}
+/**
+ * Initialize persistent signing keys. Must be awaited at gateway startup
+ * before any signing operation. Exported so index.ts / tests can call it.
+ *
+ * Fail-closed behaviour:
+ *   - production: any error propagates — caller must abort startup.
+ *   - non-production: if provider fails AND SYNOI_ALLOW_EPHEMERAL_KEYS=true,
+ *     falls back to ephemeral keys with a loud warning. Otherwise throws.
+ */
+async function initSigningKeys() {
+    const isProduction = process.env['NODE_ENV'] === 'production';
+    const allowEphemeral = process.env['SYNOI_ALLOW_EPHEMERAL_KEYS'] === 'true';
+    try {
+        const provider = (0, key_provider_1.resolveKeyProvider)();
+        const bundle = await provider.loadCurrentKey();
+        _currentBundle = bundle;
+        (0, key_provider_1.appendKeyHistory)(bundle);
+        (0, key_provider_1.auditKeyLoad)(bundle.keyId);
+        console.info(`[verify-router] Signing keys loaded. key_id=${bundle.keyId}`);
+    }
+    catch (err) {
+        if (isProduction) {
+            // Hard fail — do not start with ephemeral keys in production.
+            throw new Error(`[verify-router] FATAL: signing key initialization failed in production. ` +
+                `Refusing to start. Original error: ${err.message}`);
+        }
+        if (!allowEphemeral) {
+            // Non-production but ephemeral not explicitly enabled — also throw.
+            throw new Error(`[verify-router] Signing key initialization failed. ` +
+                `Set SYNOI_ALLOW_EPHEMERAL_KEYS=true to permit ephemeral keys in non-production environments. ` +
+                `Original error: ${err.message}`);
+        }
+        // Non-production + explicitly opted in: fall back to ephemeral.
+        console.warn('[verify-router] WARNING: signing key initialization failed; falling back to EPHEMERAL keys. ' +
+            'Receipts will NOT survive restart. Do NOT use this in production.');
+        const { generateKeyPairSync, randomBytes } = await Promise.resolve().then(() => __importStar(require('crypto')));
+        const { privateKey, publicKey } = generateKeyPairSync('ed25519', {
+            privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
+            publicKeyEncoding: { type: 'spki', format: 'pem' },
+        });
+        const seed = new Uint8Array(randomBytes(32));
+        const ephemeralBundle = {
+            keyId: 'synoi-v1-ephemeral',
+            ed25519: { privateKeyPem: privateKey, publicKeyPem: publicKey },
+            mlDsa: { seed },
+            valid_from_ms: Date.now(),
+        };
+        _currentBundle = ephemeralBundle;
+        (0, key_provider_1.appendKeyHistory)(ephemeralBundle);
+    }
+}
+function getSignerKeyId() {
+    return _currentBundle?.keyId ?? process.env['SYNOI_SIGNING_KEY_ID'] ?? 'synoi-v1-ephemeral';
+}
+/**
+ * Internal signing-bundle mutator.
+ *
+ * SECURITY (Finding 1, CRITICAL, iter-10): direct bundle injection is a
+ * forge-any-GateDecision primitive. There is exactly ONE in-process mutation
+ * seam and it is HARD-GATED: it throws if NODE_ENV === 'production'. The
+ * friendly test alias `_testInjectKeyBundle` is NOT defined in this production
+ * module (it lives only in the test tree, test/helpers/test-key-inject.ts),
+ * so the production bundle exposes no `_testInjectKeyBundle` symbol and no
+ * ungated injection path.
+ *
+ * Production code never calls this. Production keys are loaded only through
+ * initSigningKeys() -> KeyProvider. This seam exists solely so deterministic
+ * test/round-trip harnesses (e.g. test/live-gate-test-server.ts) can supply a
+ * known keypair in non-production processes.
+ */
+function __setSigningBundleForTest(bundle) {
+    if (process.env['NODE_ENV'] === 'production') {
+        throw new Error('[verify-router] __setSigningBundleForTest is TEST-ONLY and must not be ' +
+            'called in production. Production keys load via initSigningKeys() -> KeyProvider.');
+    }
+    _currentBundle = bundle;
+    (0, key_provider_1.appendKeyHistory)(bundle);
+}
+/** Public Ed25519 verification key as raw hex (32 bytes). Used by /status
+ *  for health checks; the same value is published at /verify/pubkey for
+ *  offline receipt verification. */
+function getSigningPubkey() {
+    const { ed25519 } = currentBundle();
+    const keyObj = (0, crypto_1.createPublicKey)({ key: ed25519.publicKeyPem, format: 'pem' });
+    const der = keyObj.export({ format: 'der', type: 'spki' });
+    return der.subarray(der.length - 32).toString('hex');
+}
+// Ed25519 in Node uses crypto.sign(null, ...) — the digest algorithm is
+// implicit (Ed25519 internally does its own SHA-512 over the message). Passing
+// 'SHA512' to createSign with an Ed25519 key produces a non-standard signature
+// that no other Ed25519 library can verify. This caused the receipts signed
+// here to be incompatible with sentinel.ts (which uses sign(null, ...)).
+//
+// Sprint 11 (2026-05-20) — `signReceiptPayload` returns only the Ed25519
+// signature for backward compatibility with existing call sites. New code
+// should call `signReceiptPayloadHybrid` to also obtain the ML-DSA-65
+// signature (recommended; both signatures are stored on the receipt).
+function signReceiptPayload(payload) {
+    const { ed25519 } = currentBundle();
+    const canonical = canonicalPayload(payload);
+    const keyObj = (0, crypto_1.createPrivateKey)({ key: ed25519.privateKeyPem, format: 'pem' });
+    const sigBuf = (0, crypto_1.sign)(null, Buffer.from(canonical, 'utf8'), keyObj);
+    return sigBuf.toString('hex');
+}
+function verifyReceiptSignature(payload, signatureHex) {
+    // Attempt verification against the current key first, then fall back through
+    // the key history so receipts signed with a rotated-away key still verify.
+    const canonical = canonicalPayload(payload);
+    const canonicalBytes = Buffer.from(canonical, 'utf8');
+    for (const bundle of (0, key_provider_1.getKeyHistory)()) {
+        try {
+            const keyObj = (0, crypto_1.createPublicKey)({ key: bundle.ed25519.publicKeyPem, format: 'pem' });
+            if ((0, crypto_1.verify)(null, canonicalBytes, keyObj, Buffer.from(signatureHex, 'hex')))
+                return true;
+        }
+        catch {
+            // Key object construction failed for this bundle; try the next.
+        }
+    }
+    return false;
+}
+// ─── Post-quantum hybrid signing (FIPS 204 / ML-DSA-65) ───────────────────────
+//
+// Per POST_QUANTUM_SPEC.md and the customer-visible promise in the IHC
+// briefing: every Decision Receipt carries TWO signatures over the same
+// canonical bytes:
+//
+//   1. Ed25519 (classical) — verifiable today with any standard library
+//   2. ML-DSA-65 (FIPS 204, "Dilithium-3") — quantum-resistant
+//
+// Both must verify for the receipt to count as authentic. Existing
+// Ed25519-only receipts (pre-Sprint 11) still verify under the classical
+// path — verifyReceiptSignature(payload, ed25519Hex) above. New receipts
+// add the post-quantum signature; verifiers gain quantum resistance
+// without invalidating prior signatures.
+//
+// Why hybrid not pure replacement:
+//  - ML-DSA is new (FIPS 204 finalized August 2024). Real-world attacks
+//    against lattice-based crypto could emerge; Ed25519 stays as a
+//    second-source assurance during the transition window.
+//  - Cryptographic agility: if a library bug surfaces in either path,
+//    the other still authenticates.
+//  - Backward compatibility: existing verifier code paths keep working
+//    with the Ed25519 signature unchanged.
+//
+// Size note: ML-DSA-65 signatures are ~3309 bytes (vs 64 bytes for
+// Ed25519). Stored as base64 in a separate column (~4400 chars). Receipt
+// total size grows from ~600 bytes JSON to ~5000 bytes JSON. Cost is
+// real but worthwhile for 7-25 year compliance retention horizons.
+// ML-DSA keypair cache: maps key-id to generated keypair. Generated
+// deterministically from the seed stored in the KeyBundle, so the same seed
+// always produces the same keypair. This avoids re-running keygen on every sign.
+const _mlDsaCache = new Map();
+function getMlDsaKey(bundle) {
+    const b = bundle ?? currentBundle();
+    const cached = _mlDsaCache.get(b.keyId);
+    if (cached)
+        return cached;
+    const derived = ml_dsa_js_1.ml_dsa65.keygen(b.mlDsa.seed);
+    _mlDsaCache.set(b.keyId, derived);
+    return derived;
+}
+/** ML-DSA-65 public key, base64. Published at /verify/pubkey alongside Ed25519. */
+function getMlDsaPubkey() {
+    return Buffer.from(getMlDsaKey(currentBundle()).publicKey).toString('base64');
+}
+/**
+ * Sign the canonical payload with BOTH Ed25519 and ML-DSA-65. Returns
+ * both signatures; receipt-store persists both. Verification requires
+ * both to pass.
+ */
+function signReceiptPayloadHybrid(payload) {
+    const canonical = canonicalPayload(payload);
+    const canonicalBytes = Buffer.from(canonical, 'utf8');
+    const bundle = currentBundle();
+    // Ed25519 — same as classical path
+    const edKeyObj = (0, crypto_1.createPrivateKey)({ key: bundle.ed25519.privateKeyPem, format: 'pem' });
+    const edSig = (0, crypto_1.sign)(null, canonicalBytes, edKeyObj);
+    // ML-DSA-65 — randomized signature; deterministic input -> different output
+    // each call, but verifier doesn't care (only the verify check matters).
+    const { secretKey } = getMlDsaKey(bundle);
+    const mlDsaSig = ml_dsa_js_1.ml_dsa65.sign(new Uint8Array(canonicalBytes), secretKey);
+    return {
+        ed25519: edSig.toString('hex'),
+        ml_dsa: Buffer.from(mlDsaSig).toString('base64'),
+    };
+}
+/**
+ * K1 — produce a DSSE AttestationEnvelope over a canonical payload string.
+ *
+ * Signs PAE(payloadType, payload) with BOTH Ed25519 and ML-DSA-65 using the
+ * current key bundle. The `payloadType` is bound into the signed bytes via the
+ * DSSE PAE, closing the cross-type confused-deputy hazard (SRAID F7 / A4).
+ *
+ * Used by signGapReceiptV2 (agp/receipt-sign.ts) to produce the DSSE
+ * attestation envelope on receipt.attestation. Not called by the v1 path.
+ */
+function signDssePayload(payloadType, payload) {
+    return signDsseWithBundle(payloadType, payload, currentBundle());
+}
+/**
+ * K1 core: produce a DSSE AttestationEnvelope over a canonical payload string
+ * using an EXPLICIT key bundle rather than the process-global signing key.
+ *
+ * This is the single hybrid DSSE signing path. `signDssePayload` above is the
+ * thin wrapper that binds it to `currentBundle()` (the in-process KeyProvider
+ * chain); the Vault/KMS signing oracle passes a bundle it fetched from Secrets
+ * Manager for the signing call frame only. Keeping ONE signer here means the
+ * PAE construction, the always-both-signatures shape, and the keyid binding are
+ * byte-identical no matter which custody tier produced the receipt (the ladder
+ * invariant). There is no single-signature return path.
+ *
+ * The `mlDsaKey` override lets the KMS oracle pass an already-derived ML-DSA
+ * keypair so it never has to touch the process-global `_mlDsaCache` (which is
+ * keyed by key-id and would otherwise cache the operator key material for the
+ * process lifetime). When omitted, the process cache is used (default tier).
+ */
+function signDsseWithBundle(payloadType, payload, bundle, mlDsaKey) {
+    // PAE: DSSEv1 LEN(type) type LEN(body) body
+    const enc = new TextEncoder();
+    const typeBytes = enc.encode(payloadType);
+    const bodyBytes = enc.encode(payload);
+    const prefix = enc.encode(`DSSEv1 ${typeBytes.length} ${payloadType} ${bodyBytes.length} `);
+    const paeBytes = new Uint8Array(prefix.length + bodyBytes.length);
+    paeBytes.set(prefix, 0);
+    paeBytes.set(bodyBytes, prefix.length);
+    // Ed25519
+    const edKeyObj = (0, crypto_1.createPrivateKey)({ key: bundle.ed25519.privateKeyPem, format: 'pem' });
+    const edSig = (0, crypto_1.sign)(null, Buffer.from(paeBytes), edKeyObj);
+    // ML-DSA-65
+    const { secretKey } = mlDsaKey ?? getMlDsaKey(bundle);
+    const mlDsaSig = ml_dsa_js_1.ml_dsa65.sign(new Uint8Array(paeBytes), secretKey);
+    return {
+        payloadType,
+        payload,
+        signatures: [
+            {
+                alg: 'ed25519',
+                sig: Buffer.from(edSig).toString('base64'),
+                keyid: bundle.keyId,
+            },
+            {
+                alg: 'ml-dsa-65',
+                sig: Buffer.from(mlDsaSig).toString('base64'),
+                keyid: bundle.keyId,
+            },
+        ],
+    };
+}
+/**
+ * Derive the ML-DSA-65 keypair for a bundle WITHOUT touching the process-global
+ * `_mlDsaCache`. The KMS oracle uses this so operator key material is confined
+ * to the signing call frame and garbage-collected after, never retained for the
+ * process lifetime. Same deterministic keygen as `getMlDsaKey`, no side effect.
+ */
+function deriveMlDsaKeyEphemeral(bundle) {
+    return ml_dsa_js_1.ml_dsa65.keygen(bundle.mlDsa.seed);
+}
+/**
+ * Decode an Ed25519 signature string to raw bytes, tolerating BOTH encodings
+ * the codebase produces:
+ *   - hex (128 lowercase/uppercase hex chars) — the inline / legacy receipt path
+ *     (signReceiptPayloadHybrid returns hex, anthropic-receipt-sign stores it).
+ *   - base64url (86 chars, no padding) — the GAP CDRO path (signGapReceipt writes
+ *     `Buffer.from(sigs.ed25519,'hex').toString('base64url')` per GAP spec §2.1,
+ *     commit 439f147).
+ *
+ * A 64-byte Ed25519 signature is ALWAYS exactly 128 chars in hex and 86 chars in
+ * base64url, so length + hex-alphabet is an unambiguous discriminator. Before this,
+ * verifyReceiptSignatureHybrid parsed hex-only, silently mangling a base64url
+ * signature (ed=false) if a GAP receipt's signature was ever fed to it directly.
+ */
+function decodeEdSignatureBytes(sig) {
+    if (sig.length === 128 && /^[0-9a-fA-F]+$/.test(sig)) {
+        return Buffer.from(sig, 'hex');
+    }
+    return Buffer.from(sig, 'base64url');
+}
+function verifyReceiptSignatureHybrid(payload, signatures) {
+    // Try each key in history (newest first) so receipts signed with a prior key
+    // still verify after rotation. Both Ed25519 AND ML-DSA must verify with the
+    // SAME bundle for the receipt to be considered authentic (ok=true).
+    //
+    // Diagnostic reporting: return the per-algorithm results from the BEST
+    // bundle attempt (i.e., the bundle that produced the highest partial match).
+    // This preserves the diagnostic surface: callers that tamper only Ed25519
+    // or only ML-DSA can still see which algorithm failed. The same bundle is
+    // used for both checks so cross-key forgery (Ed25519 from key A, ML-DSA
+    // from key B) is still rejected even if each individually would verify.
+    const canonical = canonicalPayload(payload);
+    const canonicalBytes = Buffer.from(canonical, 'utf8');
+    // Best partial result seen so far, for diagnostic reporting when no bundle
+    // produces ok=true.
+    let bestEd = false;
+    let bestMl = false;
+    for (const bundle of (0, key_provider_1.getKeyHistory)()) {
+        let edOk = false;
+        let mlDsaOk = false;
+        try {
+            const edKeyObj = (0, crypto_1.createPublicKey)({ key: bundle.ed25519.publicKeyPem, format: 'pem' });
+            edOk = (0, crypto_1.verify)(null, canonicalBytes, edKeyObj, decodeEdSignatureBytes(signatures.ed25519));
+        }
+        catch { /* fail-closed for this bundle */ }
+        try {
+            const { publicKey: mlDsaPub } = getMlDsaKey(bundle);
+            mlDsaOk = (0, native_mldsa_1.verifyMlDsa65)(new Uint8Array(Buffer.from(signatures.ml_dsa, 'base64')), new Uint8Array(canonicalBytes), mlDsaPub);
+        }
+        catch { /* fail-closed for this bundle */ }
+        if (edOk && mlDsaOk)
+            return { ok: true, ed25519: true, ml_dsa: true };
+        // Track the best partial result for diagnostics.
+        if (edOk || mlDsaOk) {
+            bestEd = edOk || bestEd;
+            bestMl = mlDsaOk || bestMl;
+        }
+    }
+    return { ok: false, ed25519: bestEd, ml_dsa: bestMl };
+}
+// ─── Raw-canonical-bytes hybrid sign/verify ───────────────────────────────────
+//
+// signReceiptPayloadHybrid / verifyReceiptSignatureHybrid run their input
+// through canonicalPayload(), whose CANONICAL_FIELDS allow-list is tuned for
+// Decision-Receipts and DROPS every field it does not recognise. That is wrong
+// for a CapabilityGrant CDRO: its content (grantee, scopes, predicate, expiry)
+// lives under keys that allow-list does not contain, so the grant signature
+// would bind almost nothing. Per the GAP spec a CDRO signature MUST cover the
+// canonical envelope, so grants are signed/verified over
+// canonicalize(cdroContentCore(grant)) -- the full content core string -- via
+// these helpers instead.
+function signCanonicalBytesHybrid(canonical) {
+    const canonicalBytes = Buffer.from(canonical, 'utf8');
+    const bundle = currentBundle();
+    const edKeyObj = (0, crypto_1.createPrivateKey)({ key: bundle.ed25519.privateKeyPem, format: 'pem' });
+    const edSig = (0, crypto_1.sign)(null, canonicalBytes, edKeyObj);
+    const { secretKey } = getMlDsaKey(bundle);
+    const mlDsaSig = ml_dsa_js_1.ml_dsa65.sign(new Uint8Array(canonicalBytes), secretKey);
+    return { ed25519: edSig.toString('hex'), ml_dsa: Buffer.from(mlDsaSig).toString('base64') };
+}
+function verifyCanonicalBytesHybrid(canonical, signatures) {
+    const canonicalBytes = Buffer.from(canonical, 'utf8');
+    let bestEd = false;
+    let bestMl = false;
+    for (const bundle of (0, key_provider_1.getKeyHistory)()) {
+        let edOk = false;
+        let mlDsaOk = false;
+        try {
+            const edKeyObj = (0, crypto_1.createPublicKey)({ key: bundle.ed25519.publicKeyPem, format: 'pem' });
+            edOk = (0, crypto_1.verify)(null, canonicalBytes, edKeyObj, Buffer.from(signatures.ed25519, 'hex'));
+        }
+        catch { /* fail-closed for this bundle */ }
+        try {
+            const { publicKey: mlDsaPub } = getMlDsaKey(bundle);
+            mlDsaOk = (0, native_mldsa_1.verifyMlDsa65)(new Uint8Array(Buffer.from(signatures.ml_dsa, 'base64')), new Uint8Array(canonicalBytes), mlDsaPub);
+        }
+        catch { /* fail-closed for this bundle */ }
+        if (edOk && mlDsaOk)
+            return { ok: true, ed25519: true, ml_dsa: true };
+        if (edOk || mlDsaOk) {
+            bestEd = edOk || bestEd;
+            bestMl = mlDsaOk || bestMl;
+        }
+    }
+    return { ok: false, ed25519: bestEd, ml_dsa: bestMl };
+}
+/**
+ * Canonical bytes a CapabilityGrant signature covers: the content core minus
+ * EVERY signature-carrying field. cdroContentCore strips oid/signature/
+ * attestation but NOT ml_dsa_signature or signature_key_id, which are unset at
+ * sign time and set at verify time; dropping them here keeps the sign-time and
+ * verify-time bytes byte-identical. Used by BOTH signGrantCdro (engine) and
+ * tryVerifyGrant so they stay symmetric.
+ */
+function grantSigningCanonical(grant) {
+    const core = (0, sraid_1.cdroContentCore)(grant);
+    delete core['ml_dsa_signature'];
+    delete core['signature_key_id'];
+    return (0, sraid_1.canonicalize)(core);
+}
+/** Ed25519-only verify over a raw canonical string (legacy single-signature grants). */
+function verifyCanonicalBytesEd(canonical, signatureHex) {
+    const canonicalBytes = Buffer.from(canonical, 'utf8');
+    for (const bundle of (0, key_provider_1.getKeyHistory)()) {
+        try {
+            const keyObj = (0, crypto_1.createPublicKey)({ key: bundle.ed25519.publicKeyPem, format: 'pem' });
+            if ((0, crypto_1.verify)(null, canonicalBytes, keyObj, Buffer.from(signatureHex, 'hex')))
+                return true;
+        }
+        catch { /* try next bundle */ }
+    }
+    return false;
+}
+// F10 — K1 hybrid-signature cutover. Receipts / grants recorded at or after
+// this instant MUST carry an ml_dsa_signature; an Ed25519-only artifact dated
+// >= K1 is a downgrade (ML-DSA stripped, or forged on the classical path) and
+// hard-fails. Pre-K1 artifacts were correctly signed Ed25519-only and are
+// immutable valid history, so they continue to verify classically. This is the
+// standard crypto-agility cutover discipline: do not ban the old algorithm
+// globally, ban it only after the instant you committed to stop emitting it.
+// Overridable for tests / staged rollout via SYNOI_HYBRID_CUTOVER (ISO-8601).
+exports.K1_HYBRID_CUTOVER_MS = Date.parse(process.env['SYNOI_HYBRID_CUTOVER'] ?? '2026-06-27T00:00:00Z');
+/**
+ * F10 — true when an Ed25519-only artifact must be REJECTED as a downgrade
+ * because it is dated at/after the K1 hybrid cutover. `recordedAtMs` is the
+ * artifact's recorded_at / created_at_ms (epoch milliseconds) or null/undefined.
+ * Fail-closed: a missing or non-finite date cannot be proven pre-cutover, so it
+ * is treated as in-scope and rejected. (All genuine pre-K1 receipts in the store
+ * carry a real recorded_at, so this does not harm valid history.)
+ */
+function isPostCutoverDowngrade(recordedAtMs, hasMlDsa) {
+    if (hasMlDsa)
+        return false; // hybrid present — never a downgrade
+    return !Number.isFinite(recordedAtMs) || recordedAtMs >= exports.K1_HYBRID_CUTOVER_MS;
+}
+/**
+ * F10 — single source of truth for the verification `scheme` label so every
+ * route (legacy receipt, GAP receipt, grant; JSON and HTML) reports the cutover
+ * state identically. A post-K1 Ed25519-only artifact is labelled REJECTED.
+ */
+function schemeLabel(recordedAtMs, hasMlDsa) {
+    if (hasMlDsa)
+        return 'hybrid Ed25519 + ML-DSA-65';
+    if (isPostCutoverDowngrade(recordedAtMs, hasMlDsa)) {
+        return 'REJECTED: post-K1 Ed25519-only (hybrid required)';
+    }
+    return 'Ed25519 (legacy, pre-cutover)';
+}
+/**
+ * CANONICAL_FIELDS is the complete set of receipt fields that participate in
+ * the Ed25519 + ML-DSA-65 signature seal. This is the single source of
+ * truth; the /scheme endpoint and all example code derive from it.
+ *
+ * Omit-when-absent rule: if a field is undefined or null in the stored
+ * receipt it is excluded from the canonical form. Adding a new optional
+ * field never changes the canonical bytes for older receipts.
+ *
+ * Field notes (inline with omit-when-absent semantics):
+ *   action_payload_hash   #101: SHA-256 hex of action payload
+ *   cited_oracle_inputs   S1.1: oracle values cited by the gate (omit-when-absent)
+ *   gateway_manifest_sha256  Sprint 1.2 (2026-05-19): RE-protection
+ *   grant_oid / intent_oid / rule_id / subject_oid  T14 (#274): authority context
+ *   policy_versions       #101: JSON array of {id,version} tuples
+ *   prev                  T15 (#277): lineage edge of a Decision-Receipt state change
+ *   replayed_after        S2.3: denial->execution Merkle edge (omit-when-absent)
+ *   sequence              #101: per-tenant monotonic counter
+ *   session_id            #101: GAP actor_session_id (null on direct path)
+ *   state_sha256          #124: SHA-256 of canonical policy-pack state (omit-when-null)
+ *   status                T15: GAP receipt status
+ *   target_class          #124: category of authorized target (omit-when-null)
+ *   target_id             #124: correlation key — authorized target identifier (omit-when-null)
+ */
+exports.CANONICAL_FIELDS = [
+    'action_class',
+    'action_payload_hash',
+    'cited_oracle_inputs',
+    'decision',
+    'decision_subject_oid',
+    'degraded',
+    'gateway_manifest_sha256',
+    'grant_oid',
+    'intent_oid',
+    'oid_hex',
+    'policy_versions',
+    'prev',
+    'receipt_id',
+    'recorded_at',
+    'replayed_after',
+    'risk_level',
+    'rule_id',
+    'sequence',
+    'session_id',
+    'state_sha256',
+    'status',
+    'subject_oid',
+    'target_class',
+    'target_id',
+    'tenant_id',
+];
+function canonicalPayload(payload) {
+    const obj = {};
+    for (const key of [...exports.CANONICAL_FIELDS].sort()) {
+        // Omit keys that are absent OR explicitly null — null authority fields
+        // (no grant / intent / rule / subject for this receipt) must not be
+        // included in the canonical form. A receipt signed without a grant_oid
+        // must verify identically whether grant_oid is absent or null in the
+        // store. Only the pre-T14 8-field receipts omit all four new keys;
+        // T14 receipts include only the keys that are non-null.
+        if (payload[key] !== undefined && payload[key] !== null)
+            obj[key] = payload[key];
+    }
+    return JSON.stringify(obj);
+}
+// ── Routes ────────────────────────────────────────────────────────────────────
+// GET /verify/pubkey — public verification keys (Ed25519 + ML-DSA-65)
+router.get('/pubkey', (_req, res) => {
+    const { ed25519 } = currentBundle();
+    const edPub = ed25519.publicKeyPem;
+    res.json({
+        key_id: getSignerKeyId(),
+        scheme: 'hybrid Ed25519 + ML-DSA-65 (FIPS 204), enforced for receipts recorded on/after 2026-06-27 (K1)',
+        ed25519: {
+            public_key: edPub,
+            algorithm: 'Ed25519',
+            encoding: 'PEM/SPKI',
+            note: 'Use any standard Ed25519 library. Classical signature.',
+        },
+        ml_dsa: {
+            public_key: getMlDsaPubkey(),
+            algorithm: 'ML-DSA-65',
+            standard: 'NIST FIPS 204',
+            encoding: 'base64 raw public-key bytes (1952 bytes decoded)',
+            note: 'Use FIPS 204 ML-DSA-65 / "Dilithium-3". Post-quantum signature.',
+        },
+        note: 'Hybrid: BOTH signatures must verify. Receipts recorded before K1 (2026-06-27) may carry only Ed25519 and verify classically; receipts recorded on/after K1 MUST be hybrid — an Ed25519-only receipt dated on/after K1 is rejected as a downgrade.',
+    });
+});
+// GET /verify/pubkey/ed25519 — legacy single-algorithm endpoint
+router.get('/pubkey/ed25519', (_req, res) => {
+    const { ed25519 } = currentBundle();
+    res.json({
+        key_id: getSignerKeyId(),
+        public_key: ed25519.publicKeyPem,
+        algorithm: 'Ed25519',
+        encoding: 'PEM/SPKI',
+    });
+});
+// GET /verify/pubkey/ml-dsa — raw ML-DSA pubkey for verifier libraries
+router.get('/pubkey/ml-dsa', (_req, res) => {
+    res.json({
+        key_id: getSignerKeyId(),
+        public_key: getMlDsaPubkey(),
+        algorithm: 'ML-DSA-65',
+        standard: 'NIST FIPS 204',
+        encoding: 'base64',
+    });
+});
+// GET /verify/scheme — published signature scheme
+router.get('/scheme', (_req, res) => {
+    res.json({
+        name: 'SynOI Decision Receipt Signature Scheme v2 (Hybrid)',
+        version: '2',
+        algorithm: 'hybrid Ed25519 + ML-DSA-65',
+        enforcement: {
+            hybrid_required_after: '2026-06-27T00:00:00Z',
+            cutover_name: 'K1',
+            ed25519_only: 'rejected as a downgrade for artifacts recorded on/after the cutover; permitted only for pre-cutover legacy artifacts',
+        },
+        classical: {
+            algorithm: 'Ed25519',
+            signature_encoding: 'hex (raw 64-byte signature)',
+            pubkey_endpoint: '/verify/pubkey/ed25519',
+        },
+        post_quantum: {
+            algorithm: 'ML-DSA-65',
+            standard: 'NIST FIPS 204',
+            signature_encoding: 'base64 (raw ~3309-byte signature)',
+            pubkey_endpoint: '/verify/pubkey/ml-dsa',
+        },
+        canonical_fields: [...exports.CANONICAL_FIELDS].sort(),
+        canonical_form: 'JSON.stringify({ each field above THAT IS PRESENT AND NON-NULL in the receipt }, keys sorted alphabetically, no spaces). Omit any field absent or null -- e.g. legacy receipts without gateway_manifest_sha256 canonicalize over the remaining 7; receipts without session_id (direct-inference path) omit that field.',
+        pubkey_endpoint: '/verify/pubkey',
+        verification_steps: [
+            '1. Fetch the receipt from GET /verify/:receipt_id',
+            '2. Extract the canonical_fields from the receipt payload',
+            '3. Sort the keys alphabetically and serialize to JSON (no spaces)',
+            '4. Fetch both public keys from GET /verify/pubkey',
+            '5. Verify receipt.signature (Ed25519, hex) against the canonical bytes using any Ed25519 library',
+            '6. Verify receipt.ml_dsa_signature (ML-DSA-65, base64) against the canonical bytes using a FIPS 204 library',
+            '7. Receipt is authentic IFF BOTH verifications pass (hybrid). Receipts recorded before K1 (2026-06-27) without ml_dsa_signature verify under Ed25519 alone; an Ed25519-only receipt recorded on/after K1 is rejected as a downgrade.',
+        ],
+        example_code: {
+            node: `
+const { verify, createPublicKey } = require('crypto')
+const receipt = await fetch('/verify/RECEIPT_ID').then(r => r.json())
+const { public_key } = await fetch('/verify/pubkey').then(r => r.json())
+const fields = ${JSON.stringify([...exports.CANONICAL_FIELDS].sort())}
+const present = fields.filter(k => receipt.receipt[k] != null).sort()
+const canonical = JSON.stringify(Object.fromEntries(present.map(k => [k, receipt.receipt[k]])))
+const keyObj = createPublicKey({ key: public_key, format: 'pem' })
+const valid = verify(null, Buffer.from(canonical), keyObj, Buffer.from(receipt.receipt.signature, 'hex'))
+console.log('Valid:', valid)
+`.trim(),
+            python: `
+import json, base64
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
+# pip install cryptography requests
+import requests
+receipt = requests.get('/verify/RECEIPT_ID').json()['receipt']
+pubkey_pem = requests.get('/verify/pubkey').json()['public_key'].encode()
+fields = sorted([f for f in ['action_class','decision','degraded','gateway_manifest_sha256','grant_oid','intent_oid','oid_hex','receipt_id','recorded_at','risk_level','rule_id','subject_oid','tenant_id'] if receipt.get(f) is not None])
+canonical = json.dumps({k: receipt[k] for k in fields}, separators=(',',':')).encode()
+from cryptography.hazmat.primitives.serialization import load_pem_public_key
+pub = load_pem_public_key(pubkey_pem)
+sig = bytes.fromhex(receipt['signature'])
+pub.verify(sig, canonical)  # raises if invalid
+print('Valid')
+`.trim(),
+        },
+    });
+});
+// POST /verify/state-absence — verify a signed provable-absence statement.
+//
+// DEFECT [12] closer: absence.ts MINTS a signed negative but nothing re-checked
+// it, so the digest-pinning + distinct payloadType were decorative. This is the
+// independent verifier. It is a POST (not GET-by-OID) because absence statements
+// are minted inline in the drift response and are NOT persisted server-side, so
+// the caller presents the full statement here, optionally alongside the
+// authorizing-receipt corpus they hold (`corpus_oids`) to pin the snapshot.
+//
+// Body: { statement: StateAbsenceStatement, corpus_oids?: string[] }
+//
+// A decision-receipt (or any non-absence) envelope presented here is rejected
+// with reason 'wrong-payload-type' so the two attestation classes are never
+// interchangeable. Must be declared BEFORE the '/:receipt_id' catch-all so the
+// literal path is not swallowed by the param route.
+router.post('/state-absence', (req, res) => {
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    // `any` deliberately, not `typeof import('./gap/state/absence-verify')`: that
+    // whole-module type reference pulls gap/state/absence.ts, and through it
+    // gap/signing-oracle.ts (the KMS-hybrid managed-custody tier), into ANY
+    // program that type-checks this file -- including src/daemon.ts (the lite
+    // entrypoint), even though this handler is dead code from daemon.ts's
+    // perspective (it lives on the verifyRouter default export, which daemon.ts
+    // never mounts). Runtime behavior is unchanged: the lazy require() still
+    // resolves the real function; only the static type-graph edge is dropped.
+    // Enforced by test/daemon-dep-graph.test.ts.
+    const { verifyStateAbsence } = require('./gap/state/absence-verify');
+    const body = (req.body ?? {});
+    const statement = body.statement;
+    if (!statement || typeof statement !== 'object') {
+        res.status(400).json({
+            valid: false,
+            error: { message: '`statement` (a signed absence statement) is required', type: 'validation_error' },
+        });
+        return;
+    }
+    const corpus_oids = Array.isArray(body.corpus_oids) && body.corpus_oids.every(o => typeof o === 'string')
+        ? body.corpus_oids
+        : undefined;
+    const outcome = verifyStateAbsence({
+        statement,
+        ...(corpus_oids !== undefined ? { presentedCorpusOids: corpus_oids } : {}),
+    });
+    // Fail-closed verification: a signature/type/corpus failure is a 200 with
+    // valid=false (the verification RAN and returned a verdict), not an error.
+    res.json({
+        verified: outcome.valid,
+        receipt_class: 'gap:state_absence',
+        reasons: outcome.reasons,
+        payload_type: outcome.payload_type ?? null,
+        ed25519_valid: outcome.ed25519_valid,
+        ml_dsa_valid: outcome.ml_dsa_valid,
+        corpus_checked: outcome.corpus_checked,
+        signed_examined_receipt_digest: outcome.signed_examined_receipt_digest ?? null,
+        recomputed_examined_receipt_digest: outcome.recomputed_examined_receipt_digest ?? null,
+        signed_claim: outcome.signed_claim ?? null,
+        pubkey_url: '/verify/pubkey',
+        scheme_url: '/verify/scheme',
+    });
+});
+// GET /verify/:receipt_id — verify a specific receipt
+// Content-negotiated: Accept: text/html → human page, Accept: application/json
+// (default) → the JSON shape we've always returned.
+router.get('/:receipt_id', (req, res) => {
+    // GAP OIDs carry a literal colon in their first path segment
+    // ("sha256:<hex>"); some proxies/CDNs in front of a caller leave that colon
+    // percent-encoded ("%3A") even though Express already decodes the route
+    // param once. Decode again defensively so a double-encoded id still
+    // resolves — this protects every caller of /verify, not just our own
+    // portal (which normalizes on its side too).
+    const receipt_id = normalizeReceiptId(req.params.receipt_id);
+    const receipt = receipt_store_1.receiptStore.getReceipt(receipt_id);
+    if (!receipt) {
+        // GAP CDRO fallback. The inline path's Sentinel `receipts` table is only one
+        // of two receipt stores. The GAP engine (and the demo router) emit
+        // `agp:decision_receipt` CDROs into gap_receipts, hybrid-signed over
+        // canonicalReceiptProjection (agp/receipt-sign), NOT the inline canonical
+        // form this route reads first. Resolve and verify them under their own
+        // canonical form so a /verify link minted by the GAP path (e.g. the Steve
+        // demo's verify_url) resolves and verifies instead of 404ing.
+        const agp = tryVerifyAgpReceipt(receipt_id);
+        if (agp) {
+            if (wantsHtml(req)) {
+                res.type('html').send(renderAgpReceiptHtml(agp));
+                return;
+            }
+            res.json({
+                verified: agp.signatureValid,
+                receipt_id,
+                signer_key_id: agp.receipt.signature_key_id || getSignerKeyId(),
+                receipt: {
+                    ...agp.projection,
+                    subject_kind: agp.receipt.body.subject_kind,
+                    created_at_ms: agp.receipt.created_at_ms,
+                    signature: agp.receipt.signature ?? null,
+                    ml_dsa_signature: agp.receipt.ml_dsa_signature ?? null,
+                    cited_oracle_inputs: agp.receipt.body.cited_oracle_inputs ?? null,
+                    // Demo body extras surfaced so the verify surface can render context
+                    // (e.g. WHO signed an NDA). Omit-when-absent keeps other receipts clean.
+                    ...(((b) => {
+                        const out = {};
+                        for (const k of ['detail', 'predicate_evaluation', 'nda_signer', 'nda_version', 'nda_sha256', 'operator_signature', 'operator_pubkey_hex']) {
+                            if (b[k] !== undefined && b[k] !== null)
+                                out[k] = b[k];
+                        }
+                        return out;
+                    })(agp.receipt.body)),
+                },
+                verification: {
+                    scheme: schemeLabel(agp.receipt.created_at_ms, agp.hasMlDsa),
+                    ed25519_valid: agp.edValid,
+                    ml_dsa_valid: agp.mlDsaValid,
+                    canonical_payload: agp.canonicalString,
+                    receipt_class: 'gap:decision_receipt',
+                    pubkey_url: '/verify/pubkey',
+                    scheme_url: '/verify/scheme',
+                },
+            });
+            return;
+        }
+        // Grant CDRO fallback. The grant-update lineage shown in the demo
+        // (parent -> current) are grant OIDs, not receipts. Grants are hybrid-signed
+        // (signGrantCdro) and content-addressed, so resolve + verify them here too,
+        // otherwise clicking a grant version 404s as "Receipt not found".
+        const grantOutcome = tryVerifyGrant(receipt_id);
+        if (grantOutcome) {
+            if (wantsHtml(req)) {
+                res.type('html').send(renderGrantHtml(grantOutcome));
+                return;
+            }
+            res.json({
+                verified: grantOutcome.signatureValid,
+                oid: grantOutcome.grant.oid,
+                object_class: 'gap:capability_grant',
+                signer_key_id: grantOutcome.grant.signature_key_id || getSignerKeyId(),
+                grant: {
+                    tenant_id: grantOutcome.grant.tenant_id,
+                    created_at_ms: grantOutcome.grant.created_at_ms,
+                    created_by: grantOutcome.grant.created_by,
+                    supersedes: grantOutcome.grant.supersedes ?? null,
+                    body: grantOutcome.grant.body,
+                    signature: grantOutcome.grant.signature ?? null,
+                    ml_dsa_signature: grantOutcome.grant.ml_dsa_signature ?? null,
+                },
+                verification: {
+                    scheme: schemeLabel(grantOutcome.grant.created_at_ms, grantOutcome.hasMlDsa),
+                    ed25519_valid: grantOutcome.edValid,
+                    ml_dsa_valid: grantOutcome.mlDsaValid,
+                    canonical_payload: grantOutcome.canonical,
+                    object_class: 'gap:capability_grant',
+                    pubkey_url: '/verify/pubkey',
+                    scheme_url: '/verify/scheme',
+                },
+            });
+            return;
+        }
+        if (wantsHtml(req)) {
+            res.status(404).type('html').send(renderNotFoundHtml(receipt_id));
+            return;
+        }
+        res.status(404).json({
+            verified: false,
+            error: 'Receipt not found',
+            receipt_id,
+        });
+        return;
+    }
+    const payload = {
+        receipt_id: receipt.receipt_id,
+        tenant_id: receipt.tenant_id,
+        decision: receipt.decision,
+        action_class: receipt.action_class,
+        risk_level: receipt.risk_level,
+        oid_hex: receipt.oid_hex,
+        recorded_at: receipt.recorded_at,
+        // CR-1: the signer binds gateway_manifest_sha256 when a manifest is present
+        // (the production case). It MUST be reconstructed here or every production
+        // receipt fails verification. `?? undefined` lets canonicalPayload drop it
+        // for legacy 7-field receipts so those still verify.
+        gateway_manifest_sha256: receipt.gateway_manifest_sha256 ?? undefined,
+        // T14 (#274) — Authority context. Include only when non-null so pre-T14
+        // receipts continue to verify against the 8-field (or fewer) canonical form.
+        // canonicalPayload() omits null/undefined, so a null stored value produces
+        // the same canonical bytes as absent.
+        ...(receipt.grant_oid ? { grant_oid: receipt.grant_oid } : {}),
+        ...(receipt.intent_oid ? { intent_oid: receipt.intent_oid } : {}),
+        ...(receipt.rule_id ? { rule_id: receipt.rule_id } : {}),
+        ...(receipt.subject_oid ? { subject_oid: receipt.subject_oid } : {}),
+        // #101 -- four governance-sensing fields. Each omitted (not null) when
+        // absent so pre-#101 receipts canonicalize identically to before.
+        ...(receipt.session_id != null ? { session_id: receipt.session_id } : {}),
+        ...(receipt.policy_versions != null ? { policy_versions: receipt.policy_versions } : {}),
+        ...(receipt.action_payload_hash != null ? { action_payload_hash: receipt.action_payload_hash } : {}),
+        ...(receipt.sequence != null ? { sequence: receipt.sequence } : {}),
+        // #124 -- correlation key fields. Omit-when-null so pre-#124 receipts
+        // (including all legacy and direct-inference receipts) canonicalize
+        // identically and verify unchanged.
+        ...(receipt.target_id != null ? { target_id: receipt.target_id } : {}),
+        ...(receipt.target_class != null ? { target_class: receipt.target_class } : {}),
+        ...(receipt.state_sha256 != null ? { state_sha256: receipt.state_sha256 } : {}),
+    };
+    // Hybrid verification — receipts produced by Sprint 11+ carry both
+    // Ed25519 (signature) AND ML-DSA-65 (ml_dsa_signature) signatures over
+    // the same canonical bytes. Legacy receipts (pre-Sprint-11) carry only
+    // Ed25519; for those we fall back to the classical-only check.
+    const hasMlDsa = !!receipt.ml_dsa_signature;
+    let edValid = false;
+    let mlDsaValid = false;
+    let signatureValid = false;
+    // #253: new receipts bind `degraded` into the signed canonical payload;
+    // legacy / pre-#253 receipts did not. Verify against the degraded-bound form
+    // first, then fall back to the legacy form. A NEW receipt whose stored
+    // `degraded` was flipped matches NEITHER form, so the tamper is detected;
+    // only a receipt genuinely signed without `degraded` passes via the fallback.
+    const verifyPayload = (p) => {
+        if (!receipt.signature)
+            return { ed: false, ml: false, ok: false };
+        if (hasMlDsa) {
+            const h = verifyReceiptSignatureHybrid(p, { ed25519: receipt.signature, ml_dsa: receipt.ml_dsa_signature });
+            return { ed: h.ed25519, ml: h.ml_dsa, ok: h.ok };
+        }
+        // F10: a post-K1 Ed25519-only receipt is a downgrade — hard-fail, no fallback.
+        if (isPostCutoverDowngrade(receipt.recorded_at, hasMlDsa)) {
+            return { ed: false, ml: false, ok: false };
+        }
+        const ed = verifyReceiptSignature(p, receipt.signature);
+        return { ed, ml: false, ok: ed };
+    };
+    let v = verifyPayload({ ...payload, degraded: !!receipt.degraded });
+    if (!v.ok) {
+        // Fallback: try without `degraded` for legacy receipts signed before the
+        // `degraded` field was bound into the canonical payload. If the fallback
+        // also fails, keep the FIRST attempt's per-algorithm diagnostics so that
+        // callers can still see WHICH algorithm failed (e.g. Ed25519 ok but ML-DSA
+        // tampered). Overwriting the diagnostics with the fallback's all-false
+        // result would hide the per-algorithm detail that makes tamper detection
+        // observable.
+        const vFallback = verifyPayload(payload);
+        if (vFallback.ok) {
+            v = vFallback;
+        }
+        else {
+            // Neither attempt produced ok=true. Prefer the diagnostics from
+            // whichever attempt produced more information (any true field).
+            const firstHasInfo = v.ed || v.ml;
+            if (!firstHasInfo)
+                v = vFallback;
+            // else keep v (first attempt) — it has richer per-algorithm detail.
+        }
+    }
+    edValid = v.ed;
+    mlDsaValid = v.ml;
+    signatureValid = v.ok;
+    if (wantsHtml(req)) {
+        res.type('html').send(renderReceiptHtml(receipt, payload, signatureValid));
+        return;
+    }
+    res.json({
+        verified: signatureValid,
+        receipt_id: receipt.receipt_id,
+        signer_key_id: receipt.signer_key_id || getSignerKeyId(),
+        receipt: {
+            ...payload,
+            action_type: receipt.action_type,
+            action_desc: receipt.action_desc,
+            provider: receipt.provider,
+            mode: receipt.mode,
+            latency_ms: receipt.latency_ms,
+            signature: receipt.signature,
+            ml_dsa_signature: receipt.ml_dsa_signature ?? null,
+            policy_refs: JSON.parse(receipt.policy_refs || '[]'),
+            // T14 (#274) — Authority context (null when not present on the receipt)
+            grant_oid: receipt.grant_oid ?? null,
+            intent_oid: receipt.intent_oid ?? null,
+            rule_id: receipt.rule_id ?? null,
+            subject_oid: receipt.subject_oid ?? null,
+            // #101 -- governance-sensing fields (null when not present)
+            session_id: receipt.session_id ?? null,
+            policy_versions: receipt.policy_versions != null
+                ? (() => { try {
+                    return JSON.parse(receipt.policy_versions);
+                }
+                catch {
+                    return null;
+                } })()
+                : null,
+            action_payload_hash: receipt.action_payload_hash ?? null,
+            sequence: receipt.sequence ?? null,
+            // #124 -- correlation key fields (null when not present)
+            target_id: receipt.target_id ?? null,
+            target_class: receipt.target_class ?? null,
+            state_sha256: receipt.state_sha256 ?? null,
+        },
+        verification: {
+            scheme: schemeLabel(receipt.recorded_at, hasMlDsa),
+            ed25519_valid: edValid,
+            ml_dsa_valid: mlDsaValid,
+            canonical_payload: canonicalPayload(payload),
+            pubkey_url: '/verify/pubkey',
+            scheme_url: '/verify/scheme',
+        },
+    });
+});
+// ── HTML render helpers ─────────────────────────────────────────────────────
+// Public verification page. Anyone with a receipt_id can open this in a browser
+// and see: what action, what verdict, who decided, when, and whether the
+// Ed25519 signature on the SynOI-canonical payload verifies against our
+// published public key. Designed to be the SHAREABLE proof artifact — drop a
+// URL in a compliance ticket / sales deck / audit log.
+function wantsHtml(req) {
+    const accept = (req.header('accept') ?? '').toLowerCase();
+    // Browsers send "text/html,application/xhtml+xml,...". curl/code clients
+    // either send no Accept or send application/json explicitly.
+    if (accept.includes('text/html'))
+        return true;
+    if (accept.includes('application/json'))
+        return false;
+    // Programmatic callers without an Accept header get JSON (backward-compat
+    // with everything that's been calling /verify/:id since launch).
+    return false;
+}
+function escapeHtml(s) {
+    if (s == null)
+        return '';
+    return String(s).replace(/[&<>"']/g, c => ({
+        '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;',
+    })[c]);
+}
+function fmtDate(ms) {
+    try {
+        return new Date(ms).toISOString().replace('T', ' ').replace('.000Z', ' UTC');
+    }
+    catch {
+        return String(ms);
+    }
+}
+function decisionBadge(decision) {
+    const color = decision === 'allow' ? '#3fb950'
+        : decision === 'deny' ? '#f85149'
+            : decision === 'shadow_block' ? '#d29922'
+                : '#6e7681';
+    return `<span style="background:${color};color:#fff;padding:4px 12px;border-radius:6px;font-weight:600;font-size:13px;text-transform:uppercase;letter-spacing:0.5px;">${escapeHtml(decision)}</span>`;
+}
+function riskBadge(level) {
+    const color = level === 'high' ? '#f85149' : level === 'medium' ? '#d29922' : '#3fb950';
+    return `<span style="background:${color}33;color:${color};padding:2px 8px;border-radius:4px;font-weight:600;font-size:11px;text-transform:uppercase;">${escapeHtml(level)}</span>`;
+}
+function sigBadge(valid) {
+    return valid
+        ? `<span style="background:#3fb95033;color:#3fb950;padding:4px 10px;border-radius:4px;font-weight:600;font-size:12px;">✓ Signature valid</span>`
+        : `<span style="background:#f8514933;color:#f85149;padding:4px 10px;border-radius:4px;font-weight:600;font-size:12px;">✗ Signature INVALID</span>`;
+}
+function renderReceiptHtml(receipt, payload, valid) {
+    return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>SynOI Decision Receipt — ${escapeHtml(receipt.receipt_id)}</title>
+<meta property="og:title" content="SynOI Decision Receipt — ${escapeHtml(receipt.decision)} ${escapeHtml(receipt.action_type)}">
+<meta property="og:description" content="Cryptographically-signed audit record of an AI action governed by SynOI.">
+<style>
+  :root { color-scheme: light dark; }
+  * { box-sizing: border-box; }
+  body { margin:0; padding:32px 24px; font:14px/1.5 ui-sans-serif,system-ui,-apple-system,"Segoe UI",sans-serif;
+         background:#0d1117; color:#c9d1d9; min-height:100vh; }
+  @media (prefers-color-scheme: light) {
+    body { background:#f6f8fa; color:#1f2328; }
+    .card, header { background:#fff; border-color:#d0d7de; }
+    .muted, footer { color:#656d76 !important; }
+    th { color:#656d76 !important; }
+    code { background:#f0f1f3 !important; color:#1f2328 !important; }
+  }
+  .wrap { max-width:780px; margin:0 auto; }
+  header { background:#161b22; border:1px solid #30363d; border-radius:8px; padding:24px; margin-bottom:20px; }
+  header h1 { margin:0 0 6px; font-size:16px; font-weight:600; color:#8b949e; text-transform:uppercase; letter-spacing:1px; }
+  header .id { font-family:ui-monospace,SFMono-Regular,monospace; font-size:13px; color:#8b949e; word-break:break-all; }
+  .verdict-row { display:flex; gap:12px; align-items:center; margin-top:18px; flex-wrap:wrap; }
+  .card { background:#161b22; border:1px solid #30363d; border-radius:8px; padding:20px; margin-bottom:16px; }
+  .card h2 { margin:0 0 12px; font-size:11px; font-weight:600; color:#8b949e; text-transform:uppercase; letter-spacing:0.8px; }
+  table { width:100%; border-collapse:collapse; }
+  th, td { text-align:left; padding:8px 0; border-bottom:1px solid #21262d; font-size:13px; vertical-align:top; }
+  th { width:170px; font-weight:500; color:#8b949e; }
+  td { color:#f0f6fc; word-break:break-word; }
+  code { background:#21262d; padding:1px 6px; border-radius:3px; font-family:ui-monospace,SFMono-Regular,monospace; font-size:12px; }
+  .action-desc { font-family:ui-monospace,SFMono-Regular,monospace; background:#21262d; padding:12px 14px; border-radius:6px;
+                 white-space:pre-wrap; word-break:break-word; font-size:13px; line-height:1.5; }
+  .sig { font-family:ui-monospace,SFMono-Regular,monospace; font-size:11px; color:#6e7681; word-break:break-all; }
+  .links { display:flex; gap:14px; flex-wrap:wrap; margin-top:8px; }
+  .links a { color:#58a6ff; text-decoration:none; font-size:12px; }
+  .links a:hover { text-decoration:underline; }
+  footer { text-align:center; margin-top:24px; font-size:11px; color:#6e7681; }
+  .muted { color:#6e7681; }
+</style>
+</head>
+<body>
+<div class="wrap">
+
+  <header>
+    <h1>SynOI Decision Receipt</h1>
+    <div class="id">${escapeHtml(receipt.receipt_id)}</div>
+    <div class="verdict-row">
+      ${decisionBadge(receipt.decision)}
+      ${riskBadge(receipt.risk_level)}
+      <span class="muted">Class ${escapeHtml(receipt.action_class)}</span>
+      <span style="flex:1"></span>
+      ${sigBadge(valid)}
+    </div>
+  </header>
+
+  <div class="card">
+    <h2>Action</h2>
+    <table>
+      <tr><th>Type</th><td><code>${escapeHtml(receipt.action_type)}</code></td></tr>
+      <tr><th>Description</th><td><div class="action-desc">${escapeHtml(receipt.action_desc)}</div></td></tr>
+      <tr><th>Provider</th><td>${escapeHtml(receipt.provider)}</td></tr>
+      <tr><th>Mode</th><td>${escapeHtml(receipt.mode)}</td></tr>
+    </table>
+  </div>
+
+  <div class="card">
+    <h2>Provenance</h2>
+    <table>
+      <tr><th>Tenant</th><td><code>${escapeHtml(receipt.tenant_id)}</code></td></tr>
+      <tr><th>Recorded at</th><td>${escapeHtml(fmtDate(receipt.recorded_at))}</td></tr>
+      <tr><th>Latency</th><td>${escapeHtml(receipt.latency_ms)} ms</td></tr>
+      <tr><th>OID</th><td><code>${escapeHtml(receipt.oid_hex)}</code></td></tr>
+      ${receipt.parent_receipt_id ? `<tr><th>Parent receipt</th><td><a href="/verify/${escapeHtml(receipt.parent_receipt_id)}" style="color:#58a6ff;text-decoration:none;"><code>${escapeHtml(receipt.parent_receipt_id)}</code></a></td></tr>` : ''}
+    </table>
+  </div>
+
+  <div class="card">
+    <h2>Signature</h2>
+    <table>
+      <tr><th>Status</th><td>${sigBadge(valid)}</td></tr>
+      <tr><th>Algorithm</th><td>Ed25519</td></tr>
+      <tr><th>Signer key</th><td><code>${escapeHtml(receipt.signer_key_id || getSignerKeyId())}</code></td></tr>
+      <tr><th>Signature</th><td class="sig">${escapeHtml(receipt.signature || '(unsigned)')}</td></tr>
+      <tr><th>Canonical payload</th><td><code style="display:block;padding:8px;word-break:break-all;">${escapeHtml(canonicalPayload(payload))}</code></td></tr>
+    </table>
+    <div class="links">
+      <a href="/verify/${escapeHtml(receipt.receipt_id)}/raw">Raw canonical bytes →</a>
+      <a href="/verify/pubkey">Public key →</a>
+      <a href="/verify/scheme">Verification scheme →</a>
+      <a href="/verify/${escapeHtml(receipt.receipt_id)}" onclick="event.preventDefault();fetch(this.href,{headers:{Accept:'application/json'}}).then(r=>r.json()).then(j=>{document.getElementById('json').textContent=JSON.stringify(j,null,2);document.getElementById('json-wrap').style.display='block';});return false;">Show JSON →</a>
+    </div>
+    <pre id="json-wrap" style="display:none;background:#0d1117;border:1px solid #30363d;padding:14px;border-radius:6px;margin-top:12px;overflow:auto;max-height:300px;font-size:11px;"><code id="json"></code></pre>
+  </div>
+
+  <footer>
+    This page is the public verification surface for SynOI Decision Receipts. Anyone with the receipt ID can verify the signature offline using the published Ed25519 public key.
+  </footer>
+
+</div>
+</body>
+</html>`;
+}
+function tryVerifyAgpReceipt(receiptId) {
+    // Lazy require breaks the verify-router <-> agp/receipt-sign module cycle at
+    // init time (receipt-sign imports the signer from this module). Both modules
+    // are fully initialised by the time a request reaches this handler.
+    const { getReceipt } = require('./gap/store');
+    const r = getReceipt(receiptId);
+    if (!r)
+        return null;
+    const hasMlDsa = !!r.ml_dsa_signature;
+    let edValid = false;
+    let mlDsaValid = false;
+    let signatureValid = false;
+    let projection;
+    let canonicalString;
+    if (r.signature_algorithm === 'Ed25519' && r.signature) {
+        // GAP-spec signature (2026-06+): canonical form is the envelope minus the
+        // exclusion set; Ed25519 is base64url. Use gapSigningPayload from receipt-sign
+        // so sign and verify share exactly the same exclusion set.
+        // Minimal local type instead of `typeof import('./gap/receipt-sign')`:
+        // a whole-module type reference pulls receipt-sign.ts (and its KMS-hybrid
+        // signing-oracle.ts import) into ANY program that type-checks this file,
+        // including src/daemon.ts (the lite entrypoint), even though this
+        // function is dead code from daemon.ts's perspective (it mounts
+        // initSigningKeys only, never the verifyRouter default export this
+        // function serves). The lazy runtime require() below is unchanged; only
+        // the STATIC type dependency is narrowed to the one function shape
+        // actually used, per the CI dep-graph assertion (test/daemon-dep-graph.
+        // test.ts) that enforces daemon.ts has no reachable edge into KMS.
+        const { gapSigningPayload, canonicalReceiptProjection } = require('./gap/receipt-sign');
+        // VERIFY basis: signGapReceipt signs canonicalize(gapSigningPayload(r)) — the
+        // GAP CDRO envelope form (nested `body`, top-level `type`/`created_by`/...).
+        const canonical = (0, sraid_1.canonicalize)(gapSigningPayload(r));
+        canonicalString = canonical;
+        // DISPLAY basis: the FLAT projection the JSON assembly (line ~894) and the
+        // HTML renderer consume (receipt.decision, receipt.decision_subject_oid, ...).
+        // The envelope form carries those under `body`, so spreading it left them
+        // undefined (demo-reissue / demo-revoke "decision ... got undefined").
+        projection = canonicalReceiptProjection(r);
+        const edHex = Buffer.from(r.signature, 'base64url').toString('hex');
+        if (hasMlDsa) {
+            const h = verifyCanonicalBytesHybrid(canonical, { ed25519: edHex, ml_dsa: r.ml_dsa_signature });
+            edValid = h.ed25519;
+            mlDsaValid = h.ml_dsa;
+            signatureValid = h.ok;
+        }
+        else if (isPostCutoverDowngrade(r.created_at_ms, hasMlDsa)) {
+            // F10: post-K1 Ed25519-only GAP receipt is a downgrade - hard-fail.
+            edValid = false;
+            signatureValid = false;
+        }
+        else {
+            edValid = verifyCanonicalBytesEd(canonical, edHex);
+            signatureValid = edValid;
+        }
+    }
+    else {
+        // Legacy path: projection form + hex signatures (pre-2026-06 receipts / grants).
+        // Same narrowing as above (avoid a whole-module type reference into
+        // receipt-sign.ts / signing-oracle.ts from a lite-daemon-reachable file).
+        const { canonicalReceiptProjection } = require('./gap/receipt-sign');
+        projection = canonicalReceiptProjection(r);
+        // Legacy receipts are signed over canonicalPayload(flat projection); that IS
+        // the canonical byte-basis, so display it verbatim.
+        canonicalString = canonicalPayload(projection);
+        if (r.signature) {
+            if (hasMlDsa) {
+                const h = verifyReceiptSignatureHybrid(projection, {
+                    ed25519: r.signature,
+                    ml_dsa: r.ml_dsa_signature,
+                });
+                edValid = h.ed25519;
+                mlDsaValid = h.ml_dsa;
+                signatureValid = h.ok;
+            }
+            else if (isPostCutoverDowngrade(r.created_at_ms, hasMlDsa)) {
+                // F10: post-K1 Ed25519-only legacy-projection receipt is a downgrade.
+                edValid = false;
+                signatureValid = false;
+            }
+            else {
+                edValid = verifyReceiptSignature(projection, r.signature);
+                signatureValid = edValid;
+            }
+        }
+    }
+    return { receipt: r, projection, canonicalString, edValid, mlDsaValid, signatureValid, hasMlDsa };
+}
+// Resolve + verify a CapabilityGrant CDRO by OID. Per the GAP spec a CDRO
+// signature covers the canonical envelope, so the grant is verified over
+// canonicalize(cdroContentCore(grant)) -- the SAME bytes signGrantCdro signs
+// (agp/engine). Returns null when no grant matches the OID.
+function tryVerifyGrant(oid) {
+    const { getGrant } = require('./gap/store');
+    const g = getGrant(oid);
+    if (!g)
+        return null;
+    const canonical = grantSigningCanonical(g);
+    const hasMlDsa = !!g.ml_dsa_signature;
+    let edValid = false;
+    let mlDsaValid = false;
+    let signatureValid = false;
+    if (g.signature) {
+        if (hasMlDsa) {
+            const h = verifyCanonicalBytesHybrid(canonical, { ed25519: g.signature, ml_dsa: g.ml_dsa_signature });
+            edValid = h.ed25519;
+            mlDsaValid = h.ml_dsa;
+            signatureValid = h.ok;
+        }
+        else if (isPostCutoverDowngrade(g.created_at_ms, hasMlDsa)) {
+            // F10: post-K1 Ed25519-only CapabilityGrant CDRO is a downgrade — hard-fail.
+            edValid = false;
+            signatureValid = false;
+        }
+        else {
+            edValid = verifyCanonicalBytesEd(canonical, g.signature);
+            signatureValid = edValid;
+        }
+    }
+    return { grant: g, canonical, edValid, mlDsaValid, signatureValid, hasMlDsa };
+}
+function renderAgpReceiptHtml(o) {
+    const r = o.receipt;
+    const decision = String(o.projection.decision ?? r.body.status);
+    const cited = r.body.cited_oracle_inputs ?? [];
+    const scheme = schemeLabel(r.created_at_ms, o.hasMlDsa);
+    // NDA acceptance receipts carry a signer block + document version. Render a
+    // "Signed document" card so the verify page shows WHO signed WHAT.
+    const bodyx = r.body;
+    const ndaSigner = bodyx['nda_signer'];
+    const ndaVersion = bodyx['nda_version'];
+    const signerCard = ndaSigner ? `<div class="card">
+    <h2>Signed document</h2>
+    <table>
+      ${ndaSigner['name'] ? `<tr><th>Signed by</th><td>${escapeHtml(String(ndaSigner['name']))}</td></tr>` : ''}
+      ${ndaSigner['email'] ? `<tr><th>Email</th><td>${escapeHtml(String(ndaSigner['email']))}</td></tr>` : ''}
+      ${ndaSigner['company'] ? `<tr><th>Company</th><td>${escapeHtml(String(ndaSigner['company']))}</td></tr>` : ''}
+      ${ndaSigner['title'] ? `<tr><th>Title</th><td>${escapeHtml(String(ndaSigner['title']))}</td></tr>` : ''}
+      ${ndaVersion ? `<tr><th>Document version</th><td><code>${escapeHtml(String(ndaVersion))}</code></td></tr>` : ''}
+      <tr><th>Document hash</th><td><code>${escapeHtml(r.body.subject_oid)}</code></td></tr>
+    </table>
+  </div>` : '';
+    const citedRows = cited.map((c) => {
+        const raw = JSON.stringify(c.raw_value ?? c.value ?? {}, null, 0);
+        return `<tr>
+      <th>${escapeHtml(String(c.subject_type ?? 'oracle'))}</th>
+      <td>
+        <div class="action-desc">${escapeHtml(raw)}</div>
+        ${c.source_url ? `<div class="muted" style="margin-top:6px;font-size:12px;">source: <code>${escapeHtml(String(c.source_url))}</code></div>` : ''}
+        ${c.fetched_at ? `<div class="muted" style="font-size:12px;">fetched: ${escapeHtml(String(c.fetched_at))}</div>` : ''}
+        ${c.value_hash ? `<div class="sig" style="margin-top:4px;">${escapeHtml(String(c.value_hash))}</div>` : ''}
+      </td>
+    </tr>`;
+    }).join('');
+    return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>SynOI Decision Receipt — ${escapeHtml(r.oid)}</title>
+<meta property="og:title" content="SynOI Decision Receipt — ${escapeHtml(decision)}">
+<meta property="og:description" content="Cryptographically-signed audit record of an AI action governed by SynOI.">
+<style>
+  :root { color-scheme: light dark; }
+  * { box-sizing: border-box; }
+  body { margin:0; padding:32px 24px; font:14px/1.5 ui-sans-serif,system-ui,-apple-system,"Segoe UI",sans-serif;
+         background:#0d1117; color:#c9d1d9; min-height:100vh; }
+  @media (prefers-color-scheme: light) {
+    body { background:#f6f8fa; color:#1f2328; }
+    .card, header { background:#fff; border-color:#d0d7de; }
+    .muted, footer { color:#656d76 !important; }
+    th { color:#656d76 !important; }
+    code { background:#f0f1f3 !important; color:#1f2328 !important; }
+  }
+  .wrap { max-width:780px; margin:0 auto; }
+  header { background:#161b22; border:1px solid #30363d; border-radius:8px; padding:24px; margin-bottom:20px; }
+  header h1 { margin:0 0 6px; font-size:16px; font-weight:600; color:#8b949e; text-transform:uppercase; letter-spacing:1px; }
+  header .id { font-family:ui-monospace,SFMono-Regular,monospace; font-size:13px; color:#8b949e; word-break:break-all; }
+  .verdict-row { display:flex; gap:12px; align-items:center; margin-top:18px; flex-wrap:wrap; }
+  .card { background:#161b22; border:1px solid #30363d; border-radius:8px; padding:20px; margin-bottom:16px; }
+  .card h2 { margin:0 0 12px; font-size:11px; font-weight:600; color:#8b949e; text-transform:uppercase; letter-spacing:0.8px; }
+  table { width:100%; border-collapse:collapse; }
+  th, td { text-align:left; padding:8px 0; border-bottom:1px solid #21262d; font-size:13px; vertical-align:top; }
+  th { width:170px; font-weight:500; color:#8b949e; }
+  td { color:#f0f6fc; word-break:break-word; }
+  code { background:#21262d; padding:1px 6px; border-radius:3px; font-family:ui-monospace,SFMono-Regular,monospace; font-size:12px; }
+  .action-desc { font-family:ui-monospace,SFMono-Regular,monospace; background:#21262d; padding:12px 14px; border-radius:6px;
+                 white-space:pre-wrap; word-break:break-word; font-size:13px; line-height:1.5; }
+  .sig { font-family:ui-monospace,SFMono-Regular,monospace; font-size:11px; color:#6e7681; word-break:break-all; }
+  .links { display:flex; gap:14px; flex-wrap:wrap; margin-top:8px; }
+  .links a { color:#58a6ff; text-decoration:none; font-size:12px; }
+  .links a:hover { text-decoration:underline; }
+  footer { text-align:center; margin-top:24px; font-size:11px; color:#6e7681; }
+  .muted { color:#6e7681; }
+</style>
+</head>
+<body>
+<div class="wrap">
+
+  <header>
+    <h1>SynOI Decision Receipt</h1>
+    <div class="id">${escapeHtml(r.oid)}</div>
+    <div class="verdict-row">
+      ${decisionBadge(decision)}
+      <span class="muted">${escapeHtml(r.body.subject_kind)}</span>
+      <span style="flex:1"></span>
+      ${sigBadge(o.signatureValid)}
+    </div>
+  </header>
+
+  <div class="card">
+    <h2>Provenance</h2>
+    <table>
+      <tr><th>Tenant</th><td><code>${escapeHtml(r.tenant_id)}</code></td></tr>
+      <tr><th>Decided at</th><td>${escapeHtml(fmtDate(r.created_at_ms))}</td></tr>
+      <tr><th>Status</th><td><code>${escapeHtml(r.body.status)}</code></td></tr>
+      <tr><th>Subject OID</th><td><code>${escapeHtml(r.body.subject_oid)}</code></td></tr>
+      ${r.prev ? `<tr><th>Supersedes</th><td><a href="/verify/${escapeHtml(r.prev)}" style="color:#58a6ff;text-decoration:none;"><code>${escapeHtml(r.prev)}</code></a></td></tr>` : ''}
+    </table>
+  </div>
+
+  ${signerCard}
+
+  ${citedRows ? `<div class="card">
+    <h2>Cited oracle inputs</h2>
+    <table>${citedRows}</table>
+  </div>` : ''}
+
+  <div class="card">
+    <h2>Signature</h2>
+    <table>
+      <tr><th>Status</th><td>${sigBadge(o.signatureValid)}</td></tr>
+      <tr><th>Scheme</th><td>${escapeHtml(scheme)}</td></tr>
+      <tr><th>Ed25519</th><td>${o.edValid ? 'valid' : 'INVALID'}</td></tr>
+      ${o.hasMlDsa ? `<tr><th>ML-DSA-65</th><td>${o.mlDsaValid ? 'valid' : 'INVALID'}</td></tr>` : ''}
+      <tr><th>Signer key</th><td><code>${escapeHtml(r.signature_key_id || getSignerKeyId())}</code></td></tr>
+      <tr><th>Signature</th><td class="sig">${escapeHtml(r.signature || '(unsigned)')}</td></tr>
+      <tr><th>Canonical payload</th><td><code style="display:block;padding:8px;word-break:break-all;">${escapeHtml(o.canonicalString)}</code></td></tr>
+    </table>
+    <div class="links">
+      <a href="/verify/pubkey">Public key →</a>
+      <a href="/verify/scheme">Verification scheme →</a>
+      <a href="/verify/${escapeHtml(r.oid)}" onclick="event.preventDefault();fetch(this.href,{headers:{Accept:'application/json'}}).then(r=>r.json()).then(j=>{document.getElementById('json').textContent=JSON.stringify(j,null,2);document.getElementById('json-wrap').style.display='block';});return false;">Show JSON →</a>
+    </div>
+    <pre id="json-wrap" style="display:none;background:#0d1117;border:1px solid #30363d;padding:14px;border-radius:6px;margin-top:12px;overflow:auto;max-height:300px;font-size:11px;"><code id="json"></code></pre>
+  </div>
+
+  <footer>
+    This page is the public verification surface for SynOI Decision Receipts. Anyone with the receipt ID can verify the signature offline using the published public keys.
+  </footer>
+
+</div>
+</body>
+</html>`;
+}
+function renderGrantHtml(o) {
+    const g = o.grant;
+    const scheme = schemeLabel(g.created_at_ms, o.hasMlDsa);
+    const body = g.body;
+    const grantee = body['grantee'];
+    const granteeOid = grantee ? String(grantee['actor_oid'] ?? grantee['actor_id'] ?? '') : '';
+    // Surface the predicate / scopes when present; always show the full body too.
+    const predicate = body['predicate'] ?? body['capability_scopes'] ?? body['capability'] ?? null;
+    const bodyJson = JSON.stringify(g.body, null, 2);
+    return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>SynOI Capability Grant — ${escapeHtml(g.oid)}</title>
+<meta property="og:title" content="SynOI Capability Grant">
+<meta property="og:description" content="Cryptographically-signed authorization grant governed by SynOI.">
+<style>
+  :root { color-scheme: light dark; }
+  * { box-sizing: border-box; }
+  body { margin:0; padding:32px 24px; font:14px/1.5 ui-sans-serif,system-ui,-apple-system,"Segoe UI",sans-serif;
+         background:#0d1117; color:#c9d1d9; min-height:100vh; }
+  @media (prefers-color-scheme: light) {
+    body { background:#f6f8fa; color:#1f2328; }
+    .card, header { background:#fff; border-color:#d0d7de; }
+    .muted, footer { color:#656d76 !important; }
+    th { color:#656d76 !important; }
+    code { background:#f0f1f3 !important; color:#1f2328 !important; }
+  }
+  .wrap { max-width:780px; margin:0 auto; }
+  header { background:#161b22; border:1px solid #30363d; border-radius:8px; padding:24px; margin-bottom:20px; }
+  header h1 { margin:0 0 6px; font-size:16px; font-weight:600; color:#8b949e; text-transform:uppercase; letter-spacing:1px; }
+  header .id { font-family:ui-monospace,SFMono-Regular,monospace; font-size:13px; color:#8b949e; word-break:break-all; }
+  .verdict-row { display:flex; gap:12px; align-items:center; margin-top:18px; flex-wrap:wrap; }
+  .card { background:#161b22; border:1px solid #30363d; border-radius:8px; padding:20px; margin-bottom:16px; }
+  .card h2 { margin:0 0 12px; font-size:11px; font-weight:600; color:#8b949e; text-transform:uppercase; letter-spacing:0.8px; }
+  table { width:100%; border-collapse:collapse; }
+  th, td { text-align:left; padding:8px 0; border-bottom:1px solid #21262d; font-size:13px; vertical-align:top; }
+  th { width:170px; font-weight:500; color:#8b949e; }
+  td { color:#f0f6fc; word-break:break-word; }
+  code { background:#21262d; padding:1px 6px; border-radius:3px; font-family:ui-monospace,SFMono-Regular,monospace; font-size:12px; }
+  .action-desc { font-family:ui-monospace,SFMono-Regular,monospace; background:#21262d; padding:12px 14px; border-radius:6px;
+                 white-space:pre-wrap; word-break:break-word; font-size:13px; line-height:1.5; }
+  .sig { font-family:ui-monospace,SFMono-Regular,monospace; font-size:11px; color:#6e7681; word-break:break-all; }
+  .links { display:flex; gap:14px; flex-wrap:wrap; margin-top:8px; }
+  .links a { color:#58a6ff; text-decoration:none; font-size:12px; }
+  .links a:hover { text-decoration:underline; }
+  footer { text-align:center; margin-top:24px; font-size:11px; color:#6e7681; }
+  .muted { color:#6e7681; }
+</style>
+</head>
+<body>
+<div class="wrap">
+
+  <header>
+    <h1>SynOI Capability Grant</h1>
+    <div class="id">${escapeHtml(g.oid)}</div>
+    <div class="verdict-row">
+      <span class="muted">capability grant</span>
+      <span style="flex:1"></span>
+      ${sigBadge(o.signatureValid)}
+    </div>
+  </header>
+
+  <div class="card">
+    <h2>Provenance</h2>
+    <table>
+      <tr><th>Tenant</th><td><code>${escapeHtml(g.tenant_id)}</code></td></tr>
+      <tr><th>Issued at</th><td>${escapeHtml(fmtDate(g.created_at_ms))}</td></tr>
+      <tr><th>Issued by</th><td><code>${escapeHtml(g.created_by)}</code></td></tr>
+      ${granteeOid ? `<tr><th>Grantee</th><td><code>${escapeHtml(granteeOid)}</code></td></tr>` : ''}
+      ${g.supersedes ? `<tr><th>Supersedes</th><td><a href="/verify/${escapeHtml(g.supersedes)}" style="color:#58a6ff;text-decoration:none;"><code>${escapeHtml(g.supersedes)}</code></a></td></tr>` : ''}
+    </table>
+  </div>
+
+  ${predicate !== null ? `<div class="card">
+    <h2>Authorized predicate</h2>
+    <div class="action-desc">${escapeHtml(JSON.stringify(predicate, null, 2))}</div>
+  </div>` : ''}
+
+  <div class="card">
+    <h2>Grant body</h2>
+    <div class="action-desc">${escapeHtml(bodyJson)}</div>
+  </div>
+
+  <div class="card">
+    <h2>Signature</h2>
+    <table>
+      <tr><th>Status</th><td>${sigBadge(o.signatureValid)}</td></tr>
+      <tr><th>Scheme</th><td>${escapeHtml(scheme)}</td></tr>
+      <tr><th>Ed25519</th><td>${o.edValid ? 'valid' : 'INVALID'}</td></tr>
+      ${o.hasMlDsa ? `<tr><th>ML-DSA-65</th><td>${o.mlDsaValid ? 'valid' : 'INVALID'}</td></tr>` : ''}
+      <tr><th>Signer key</th><td><code>${escapeHtml(g.signature_key_id || getSignerKeyId())}</code></td></tr>
+      <tr><th>Signature</th><td class="sig">${escapeHtml(g.signature || '(unsigned)')}</td></tr>
+      <tr><th>Canonical payload</th><td><code style="display:block;padding:8px;word-break:break-all;">${escapeHtml(o.canonical)}</code></td></tr>
+    </table>
+    <div class="links">
+      <a href="/verify/pubkey">Public key →</a>
+      <a href="/verify/scheme">Verification scheme →</a>
+      <a href="/verify/${escapeHtml(g.oid)}" onclick="event.preventDefault();fetch(this.href,{headers:{Accept:'application/json'}}).then(r=>r.json()).then(j=>{document.getElementById('json').textContent=JSON.stringify(j,null,2);document.getElementById('json-wrap').style.display='block';});return false;">Show JSON →</a>
+    </div>
+    <pre id="json-wrap" style="display:none;background:#0d1117;border:1px solid #30363d;padding:14px;border-radius:6px;margin-top:12px;overflow:auto;max-height:300px;font-size:11px;"><code id="json"></code></pre>
+  </div>
+
+  <footer>
+    This page is the public verification surface for a SynOI Capability Grant. Anyone with the grant OID can verify the signature offline using the published public keys.
+  </footer>
+
+</div>
+</body>
+</html>`;
+}
+function renderNotFoundHtml(receiptId) {
+    return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Receipt not found</title>
+<style>
+  body { font:14px/1.5 ui-sans-serif,system-ui,sans-serif; background:#0d1117; color:#c9d1d9;
+         display:flex; align-items:center; justify-content:center; min-height:100vh; margin:0; }
+  .wrap { max-width:480px; padding:32px; text-align:center; }
+  h1 { font-size:18px; color:#f85149; margin:0 0 12px; }
+  code { background:#21262d; padding:2px 8px; border-radius:3px; font-family:ui-monospace,monospace; font-size:13px; }
+  p { color:#8b949e; }
+</style>
+</head>
+<body><div class="wrap">
+  <h1>Receipt not found</h1>
+  <p>No record matches <code>${escapeHtml(receiptId)}</code>.</p>
+  <p>Receipts older than the retention window may have been pruned. Receipt IDs are typed as <code>rcpt-{timestamp}-{random}</code>.</p>
+</div></body>
+</html>`;
+}
+// GET /verify/:receipt_id/raw — raw canonical payload for manual verification
+router.get('/:receipt_id/raw', (req, res) => {
+    const receipt_id = normalizeReceiptId(req.params.receipt_id);
+    const receipt = receipt_store_1.receiptStore.getReceipt(receipt_id);
+    if (!receipt) {
+        res.status(404).json({ error: 'Receipt not found', receipt_id });
+        return;
+    }
+    // Reconstruct the SAME payload as GET /verify/:id, including the fields the
+    // signer binds: gateway_manifest_sha256 and the T14 (#274) authority context
+    // (grant_oid, intent_oid, rule_id, subject_oid). Omitting any of these
+    // produces canonical bytes that do NOT match what was signed, defeating the
+    // entire purpose of this endpoint (independent verification). canonicalPayload()
+    // drops null/undefined, so absent fields produce the same bytes as before.
+    const payload = {
+        receipt_id: receipt.receipt_id,
+        tenant_id: receipt.tenant_id,
+        decision: receipt.decision,
+        action_class: receipt.action_class,
+        risk_level: receipt.risk_level,
+        oid_hex: receipt.oid_hex,
+        recorded_at: receipt.recorded_at,
+        gateway_manifest_sha256: receipt.gateway_manifest_sha256 ?? undefined,
+        ...(receipt.grant_oid ? { grant_oid: receipt.grant_oid } : {}),
+        ...(receipt.intent_oid ? { intent_oid: receipt.intent_oid } : {}),
+        ...(receipt.rule_id ? { rule_id: receipt.rule_id } : {}),
+        ...(receipt.subject_oid ? { subject_oid: receipt.subject_oid } : {}),
+        // #101 -- governance-sensing fields; omit-when-null so pre-#101 receipts
+        // produce identical canonical bytes. These were missing from the raw
+        // endpoint but are bound into the signed payload for new receipts.
+        ...(receipt.session_id != null ? { session_id: receipt.session_id } : {}),
+        ...(receipt.policy_versions != null ? { policy_versions: receipt.policy_versions } : {}),
+        ...(receipt.action_payload_hash != null ? { action_payload_hash: receipt.action_payload_hash } : {}),
+        ...(receipt.sequence != null ? { sequence: receipt.sequence } : {}),
+        // #124 -- correlation key fields; omit-when-null so pre-#124 receipts
+        // produce identical canonical bytes.
+        ...(receipt.target_id != null ? { target_id: receipt.target_id } : {}),
+        ...(receipt.target_class != null ? { target_class: receipt.target_class } : {}),
+        ...(receipt.state_sha256 != null ? { state_sha256: receipt.state_sha256 } : {}),
+    };
+    // #253: new receipts bind `degraded` into the signed canonical payload;
+    // legacy receipts did not. Return whichever form actually verifies so the
+    // raw bytes match what was signed — for a new receipt that is the
+    // degraded-bound form, for a legacy receipt the form without `degraded`.
+    const verifies = (p) => {
+        if (!receipt.signature)
+            return false;
+        if (receipt.ml_dsa_signature) {
+            return verifyReceiptSignatureHybrid(p, {
+                ed25519: receipt.signature,
+                ml_dsa: receipt.ml_dsa_signature,
+            }).ok;
+        }
+        // F10: keep this internal helper in lockstep with the route handlers — a
+        // post-K1 Ed25519-only receipt is a downgrade and must NOT verify here either.
+        if (isPostCutoverDowngrade(receipt.recorded_at, false))
+            return false;
+        return verifyReceiptSignature(p, receipt.signature);
+    };
+    const withDegraded = { ...payload, degraded: !!receipt.degraded };
+    const signedPayload = verifies(withDegraded) ? withDegraded
+        : verifies(payload) ? payload
+            : withDegraded;
+    res.setHeader('Content-Type', 'text/plain');
+    res.send(canonicalPayload(signedPayload));
+});
+// GET /verify/:receipt_id/anchor — Sprint 3, ticket #195.
+//
+// Returns the receipt's Merkle inclusion proof + the batch's anchor data.
+// Verifiers walk the proof from the leaf_hash up to the merkle_root, then
+// (when ots_proof is present) verify the merkle_root against the
+// OpenTimestamps proof using standard `ots verify` tooling.
+//
+// Response shape:
+//   200 — { batch_id, merkle_root, leaf_hash, proof, batch }
+//   404 — receipt not found, or not yet anchored
+//
+// `proof` is an array of { sibling: hex, position: 'L'|'R' } steps. The
+// verifier algorithm is the RFC 6962 audit-path walk implemented in
+// src/merkle.ts:verifyAuditPath() — also exposed as a portable function
+// in @synoi/verify (see package release notes).
+router.get('/:receipt_id/anchor', (req, res) => {
+    const receipt_id = normalizeReceiptId(req.params.receipt_id);
+    const receipt = receipt_store_1.receiptStore.getReceipt(receipt_id);
+    if (!receipt) {
+        res.status(404).json({ error: 'Receipt not found', receipt_id });
+        return;
+    }
+    if (!receipt.batch_id || !receipt.leaf_hash || !receipt.merkle_proof_json) {
+        res.status(404).json({
+            error: 'Receipt not yet anchored',
+            receipt_id,
+            anchor_status: receipt.anchor_status ?? null,
+            hint: 'Anchor batches run every 10 minutes. Try again after that interval, or check /verify/scheme for details.',
+        });
+        return;
+    }
+    const batch = receipt_store_1.receiptStore.getAnchorBatch(receipt.batch_id);
+    if (!batch) {
+        res.status(404).json({ error: 'Anchor batch missing', receipt_id, batch_id: receipt.batch_id });
+        return;
+    }
+    res.json({
+        receipt_id,
+        batch_id: receipt.batch_id,
+        leaf_hash: receipt.leaf_hash,
+        merkle_root: batch.merkle_root,
+        proof: JSON.parse(receipt.merkle_proof_json),
+        anchored_at: receipt.anchored_at,
+        anchor_status: receipt.anchor_status,
+        // Sprint 5 — SynOI counter-signature on the batch root. Verifiers
+        // fetch synoi.public_key from a published location (e.g.,
+        // https://api.synoi.systems/v1/synoi/pubkey) and verify the signature
+        // against canonical_bundle.
+        synoi: batch.synoi_signature ? {
+            signature: batch.synoi_signature,
+            signer_key_id: batch.synoi_signer_key_id,
+            status: batch.synoi_status,
+            reason: batch.synoi_reason,
+            signed_at: batch.synoi_signed_at,
+            canonical_bundle: batch.synoi_canonical_bundle,
+        } : null,
+        ots: {
+            proof_b64: batch.ots_proof,
+            submitted_at: batch.ots_submitted_at,
+            upgraded_at: batch.ots_upgraded_at,
+        },
+        rekor: {
+            log_id: batch.rekor_log_id,
+            log_index: batch.rekor_log_index,
+            at: batch.rekor_at,
+        },
+        leaf_count: batch.leaf_count,
+        batch_created_at: batch.created_at,
+        verification_hint: 'Verify: (1) start from leaf_hash, apply each proof step (hash with sibling on indicated side), arrive at merkle_root. ' +
+            '(2) When synoi.signature is present, verify Ed25519(synoi.canonical_bundle) against SynOI\'s published public key. ' +
+            '(3) For Bitcoin-anchored verification, run `ots verify <ots.bin>` against the decoded ots.proof_b64. ' +
+            'Implementation reference: src/merkle.ts:verifyAuditPath() and @synoi/verify.',
+    });
+});
+exports.default = router;