csoai-gspc-mcp 0.2.0 → 0.2.2

package/README.md

@@ -23,45 +23,53 @@ are reported as two labelled numbers and never reconciled.
 | `get_root` | GET `https://councilof.ai/root.json`. Three states: VALID / UNREACHABLE / UNCHECKABLE. Separate from GSPC. Never a certificate. |
 | `get_card` | GET one card-v0 leaf by sha256. VALID / INVALID (not a leaf) / UNCHECKABLE (fetch failed). A 404 leaf is INVALID, not UNCHECKABLE. |
 | `verify_inclusion` | GET `/api/proof?sha=`. VALID (included) / INVALID (not a leaf) / UNCHECKABLE (proof endpoint unreachable). |
+| `x402_trust` | Latest x402 catalog trust snapshot: counts of correct challenges and phantom resources. A 402 is a challenge, not delivery. |
 
-Seven free tools above; five metered ones below. `tools/list` returns all twelve, and
+Eight free tools above; four metered ones below. `tools/list` returns all twelve, and
 `wired-tools.test.mjs` fails if a listed tool does not run or a running tool is not listed.
 
-The same seven free tools, from the same definitions file
+The same eight free tools, from the same definitions file
 (`functions/mcp/gspc-tools.json`), are served over HTTP at
 `https://councilof.ai/mcp` (streamable HTTP, JSON-RPC 2.0 POST). Use whichever
 transport your client speaks; the contracts are identical.
 
-### The five x402-metered tools — carried here since 0.2.0
+### The four x402-metered tools
 
 | tool | route | free path |
 |---|---|---|
 | `commission_card` | `/api/request-attestation` | — (a payment never mints a MEASURED cell) |
 | `art50_marking_evidence` | `/api/art50/marking-evidence` | `preview: true` |
 | `rwa_evidence` | `/api/rwa/evidence` | `preview: true` (unsigned state) |
-| `witness_hash` | `/api/witness` | — |
 | `receipts_batch` | `/api/receipts/batch` | `preview: true` (count, span, roots, batch sha256) |
 
 Payment travels as the **`x_payment` argument**, not as a transport header — so stdio carries these
 exactly as the HTTP door does. Up to 0.1.1 this README said the opposite ("stdio has no payment header to
 forward"); that was a statement about the transport, and it was wrong about the mechanism. The server
-forwards your `x_payment` verbatim as the `X-PAYMENT` header on one request to `councilof.ai` and never
-inspects, signs or invents a receipt. Settlement is the route's job, fail-closed.
+forwards your `x_payment` verbatim as the `X-PAYMENT` header on one request to `councilof.ai`. It never
+authenticates, signs or invents a receipt; it only classifies the opaque response's receipt shape.
+Settlement is the route's job, fail-closed.
 
-Four honest statuses, and no fifth:
+Top-level statuses describe delivery, not settlement:
 
 - **`PAYMENT_REQUIRED`** — the route answered 402. The full challenge (`accepts[]`, the `PAYMENT-REQUIRED`
-  header) comes back as `structuredContent`. Nothing was charged. A challenge is an answer, not a failure.
-- **`DELIVERED`** — the route answered 2xx, with the settle echo when the route sent one.
+  header) comes back as `structuredContent`. With no `x_payment`, nothing was charged by that request. If
+  an authorization was presented, settlement remains `UNCONFIRMED`; inspect before signing or retrying.
+  A challenge is an answer, not a failure.
+- **`DELIVERED`** — the route answered 2xx and returned a deliverable. Inspect `delivery_kind`:
+  `PREVIEW_OR_FREE`, `DELIVERED_SETTLEMENT_UNCONFIRMED`, `DELIVERED_RECEIPT_GAP`, or
+  `DELIVERED_WITH_ROUTE_RECEIPT`. `receipt_state: PRESENT_UNVERIFIED` means a JWS-shaped receipt was
+  present in the route's opaque response; this wrapper has not verified it.
 - **`NOT_DEPLOYED`** — the route answered 404 on this origin. Said plainly, never a fabricated result.
-- **`UNREACHABLE`** / **`BAD_ARGUMENTS`** — the call could not be made. Nothing was charged.
-
-**Known limitation, stated rather than hidden (2026-09-04):** the free `preview` paths and the 402
-challenge work today, but **settlement on the live rail is failing** — a genuine signed EIP-3009
-authorization is rejected by the facilitator with HTTP 400 after the buyer signs, because the facilitator
-now advertises two x402 dialects for Base and the wrong one is being selected. The fix is written and
-tested but not merged. Until it is, treat the paid paths as: challenge yes, delivery no. This server
-reports what the route actually said and never converts a failed settlement into a result.
+- **`UNREACHABLE`** / **`BAD_ARGUMENTS`** — the call could not be made. After an authorization is
+  presented, a transport failure makes delivery and settlement unknown; never retry blindly.
+
+The package does not infer settlement from a challenge, a 2xx, or its own request. It reports delivery
+and the route's settlement evidence separately: a 402 is `PAYMENT_REQUIRED`, a 2xx is `DELIVERED`,
+and a transport failure remains `UNREACHABLE`. A settle echo is `REPORTED_BY_ROUTE`, not independent
+chain verification; a missing or unreadable signed receipt is a named gap and never a silent success.
+`settlement_state` is exactly `NOT_REQUESTED`, `UNCONFIRMED`, or `REPORTED_BY_ROUTE`.
+`receipt_state` on a delivered result is exactly `NOT_REQUESTED`, `ABSENT`, `MISSING`, `UNREADABLE`,
+or `PRESENT_UNVERIFIED`.
 
 Every paid deliverable is measurement, not certification; no tool on either transport carries a trust
 label; amounts appear only inside a 402 challenge.

package/gspc-tools.json

@@ -114,6 +114,29 @@
         ],
         "additionalProperties": false
       }
+    },
+    {
+      "name": "x402_trust",
+      "description": "GET the latest x402 catalog trust snapshot: counts of how many catalogued x402 resources open a correct 402 challenge vs how many are phantom on the wire. Counts only by doctrine — host details withheld; a 402 is NOT delivery; measurement, never certification.",
+      "inputSchema": {
+        "type": "object",
+        "properties": {},
+        "additionalProperties": false
+      },
+      "outputSchema": {
+        "type": "object",
+        "properties": {
+          "counts": {
+            "type": "object"
+          },
+          "headline": {
+            "type": "string"
+          },
+          "as_of": {
+            "type": "string"
+          }
+        }
+      }
     }
   ]
 }

package/index.mjs

@@ -32,7 +32,9 @@ import { createInterface } from "node:readline";
 import { readFileSync, existsSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 
-const VERSION = "0.2.0";
+const PACKAGE = JSON.parse(readFileSync(fileURLToPath(new URL("./package.json", import.meta.url)), "utf8"));
+const VERSION = PACKAGE.version;
+if (typeof VERSION !== "string" || !VERSION) throw new Error("package.json has no valid version");
 const ORIGIN = process.env.GSPC_ORIGIN || "https://councilof.ai";
 const FETCH_TIMEOUT_MS = 15000;
 
@@ -64,8 +66,9 @@ const FREE_TOOLS = JSON.parse(readFileSync(TOOLS_PATH, "utf8")).tools;
  *
  * Payment travels as the `x_payment` TOOL ARGUMENT, not as a transport header, so stdio carries
  * these exactly as the HTTP door does: the argument is forwarded verbatim as the X-PAYMENT header
- * on one same-origin request, and this server never inspects, signs or invents a receipt.
- * Settlement is the route's job, fail-closed. Without `x_payment` the tool returns the route's own
+ * on one same-origin request. This server never authenticates, signs or invents a receipt; it only
+ * classifies the opaque response's receipt shape. Settlement is the route's job, fail-closed.
+ * Without `x_payment` the tool returns the route's own
  * 402 challenge, which is an answer and not a failure — and `preview` is free where a tool offers it.
  */
 const PAID_TOOLS_PATH = firstExisting([
@@ -368,6 +371,29 @@ async function verifyInclusion(args) {
   }
 }
 
+/**
+ * Mirror the HTTP MCP tool's public x402-trust contract. The snapshot is the
+ * canonical measured artefact; this package delegates to it instead of
+ * copying counts or manufacturing a trust verdict locally.
+ */
+async function x402Trust() {
+  const path = "/interop/x402-trust/latest.json";
+  try {
+    const d = await fetchJson(path);
+    return {
+      state: "VALID",
+      source: `${ORIGIN}${path}`,
+      kind: d.kind ?? null,
+      as_of: d.as_of ?? null,
+      counts: d.counts ?? null,
+      headline: d.headline ?? null,
+      not_a_certification: true,
+    };
+  } catch (e) {
+    return { ...unreachable(path, e), state: "UNREACHABLE" };
+  }
+}
+
 /* ---------------------------------------------------------------- paid tools */
 
 const PAID_DOCTRINE =
@@ -413,12 +439,6 @@ function buildPaidRequest(name, args) {
       u.searchParams.set("asset", str("asset"));
       if (flag("preview")) u.searchParams.set("preview", "1");
       break;
-    case "witness_hash":
-      if (!str("sha256") && !str("url")) return { error: "sha256 or url is required" };
-      if (str("sha256")) u.searchParams.set("sha256", str("sha256").toLowerCase());
-      if (str("url")) u.searchParams.set("url", str("url"));
-      if (str("label")) u.searchParams.set("label", str("label"));
-      break;
     case "receipts_batch":
       if (!str("from")) return { error: "from is required (ISO-8601)" };
       u.searchParams.set("from", str("from"));
@@ -431,17 +451,73 @@ function buildPaidRequest(name, args) {
   return { url: u.toString(), init: { method, headers, ...(body ? { body } : {}) }, route };
 }
 
+function inspectReceipt(paymentResponse) {
+  if (!paymentResponse) return "ABSENT";
+  try {
+    const normalized = paymentResponse.replace(/-/g, "+").replace(/_/g, "/");
+    const padded = normalized.padEnd(Math.ceil(normalized.length / 4) * 4, "=");
+    const decoded = JSON.parse(new TextDecoder().decode(Uint8Array.from(atob(padded), (c) => c.charCodeAt(0))));
+    const receipt = decoded?.extensions?.["offer-receipt"]?.info?.receipt;
+    return receipt &&
+      typeof receipt === "object" &&
+      !Array.isArray(receipt) &&
+      receipt.format === "jws" &&
+      typeof receipt.signature === "string" &&
+      /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(receipt.signature)
+      ? "PRESENT_UNVERIFIED"
+      : "MISSING";
+  } catch {
+    return "UNREADABLE";
+  }
+}
+
+function settlementFields(paymentPresented, paymentResponse) {
+  if (paymentResponse) {
+    return {
+      settlement_state: "REPORTED_BY_ROUTE",
+      payment_response_header: paymentResponse,
+    };
+  }
+  if (paymentPresented) return { settlement_state: "UNCONFIRMED" };
+  return { settlement_state: "NOT_REQUESTED", nothing_charged: true };
+}
+
+function deliveryFields(paymentPresented, paymentResponse) {
+  const receiptState = paymentResponse
+    ? inspectReceipt(paymentResponse)
+    : paymentPresented
+      ? "ABSENT"
+      : "NOT_REQUESTED";
+  if (!paymentPresented) {
+    return { delivery_kind: "PREVIEW_OR_FREE", receipt_state: receiptState };
+  }
+  if (!paymentResponse) {
+    return { delivery_kind: "DELIVERED_SETTLEMENT_UNCONFIRMED", receipt_state: receiptState };
+  }
+  if (receiptState === "PRESENT_UNVERIFIED") {
+    return { delivery_kind: "DELIVERED_WITH_ROUTE_RECEIPT", receipt_state: receiptState };
+  }
+  return {
+    delivery_kind: "DELIVERED_RECEIPT_GAP",
+    receipt_state: receiptState,
+    receipt_gap:
+      "The route reported settlement, but its opaque response did not carry a readable offer-receipt JWS. Inspect the route, chain and facilitator; do not retry blindly.",
+  };
+}
+
 /**
  * Forward one paid tool to its route and report what came back, in the route's own words.
  * 402 is PAYMENT_REQUIRED and not an error; 404 is NOT_DEPLOYED and never a fabricated result.
  */
 async function callPaidTool(name, args) {
   const tool = PAID_BY_NAME.get(name);
+  const paymentPresented = typeof args.x_payment === "string" && args.x_payment.trim().length > 0;
   const base = {
     tool: name,
     route: tool.csoai.route,
     sku: tool.csoai.sku,
     rail: tool.csoai.rail,
+    payment_presented: paymentPresented,
     doctrine: PAID_DOCTRINE,
     not_a_certification: true,
   };
@@ -456,11 +532,30 @@ async function callPaidTool(name, args) {
       ...base,
       status: "UNREACHABLE",
       reason: e instanceof Error ? e.message : String(e),
-      note: "The route could not be fetched. Nothing was charged, and no result is invented.",
+      delivery_state: "UNKNOWN",
+      ...settlementFields(paymentPresented),
+      note: paymentPresented
+        ? "The route could not be fetched. Delivery and settlement are unknown; inspect the wallet, chain and facilitator before signing or retrying."
+        : "The route could not be fetched. No payment authorization was presented, and no result is invented.",
     };
   }
 
-  const text = await res.text();
+  let text;
+  try {
+    text = await res.text();
+  } catch {
+    return {
+      ...base,
+      status: "UNREADABLE_RESPONSE",
+      http_status: res.status,
+      reason: "the evidence route response could not be read",
+      delivery_state: "UNKNOWN",
+      ...settlementFields(paymentPresented),
+      note: paymentPresented
+        ? "Delivery and settlement are unknown; inspect the wallet, chain and facilitator before signing or retrying."
+        : "No payment authorization was presented, and no result is invented.",
+    };
+  }
   let body = null;
   try {
     body = text ? JSON.parse(text) : null;
@@ -475,19 +570,57 @@ async function callPaidTool(name, args) {
       http_status: 402,
       payment_required: body,
       payment_required_header: res.headers.get("payment-required"),
+      delivery_state: "NOT_DELIVERED",
+      ...settlementFields(paymentPresented),
       note:
-        "A challenge is an answer, not a failure. Pay from your own wallet against accepts[] and " +
-        "call again with x_payment. Nothing was charged by this call.",
+        "A challenge is an answer, not a failure. " +
+        (paymentPresented
+          ? "A payment authorization was presented, but this response does not prove settlement. Inspect the wallet, chain and facilitator before signing or retrying."
+          : "Pay from your own wallet against accepts[] and call again with x_payment. No payment authorization was presented; nothing was charged by this request."),
     };
   }
   if (res.status === 404) {
-    return { ...base, status: "NOT_DEPLOYED", http_status: 404, body, note: `${tool.csoai.route} is not on ${ORIGIN}.` };
+    return {
+      ...base,
+      status: "NOT_DEPLOYED",
+      http_status: 404,
+      body,
+      delivery_state: "NOT_DELIVERED",
+      ...settlementFields(paymentPresented),
+      note: paymentPresented
+        ? `${tool.csoai.route} is not on ${ORIGIN}. Settlement is unconfirmed; inspect the wallet, chain and facilitator before signing or retrying.`
+        : `${tool.csoai.route} is not on ${ORIGIN}. No payment authorization was presented; nothing was charged by this request.`,
+    };
   }
   if (res.ok) {
     const settle = res.headers.get("x-payment-response");
-    return { ...base, status: "DELIVERED", http_status: res.status, body, ...(settle ? { x_payment_response: settle } : {}) };
+    return {
+      ...base,
+      status: "DELIVERED",
+      http_status: res.status,
+      body,
+      deliverable: body,
+      delivery_state: "DELIVERED",
+      ...settlementFields(paymentPresented, settle),
+      ...deliveryFields(paymentPresented, settle),
+      payment_response_header: settle,
+      ...(settle ? { x_payment_response: settle } : {}),
+    };
   }
-  return { ...base, status: String(res.status), http_status: res.status, body };
+  const settle = res.headers.get("x-payment-response");
+  return {
+    ...base,
+    status: `HTTP_${res.status}`,
+    http_status: res.status,
+    body,
+    delivery_state: "NOT_DELIVERED",
+    ...settlementFields(paymentPresented, settle),
+    note: settle
+      ? "Settlement was reported by the route; inspect the receipt before retrying."
+      : paymentPresented
+        ? "Settlement is unconfirmed; inspect the wallet, chain and facilitator before signing or retrying."
+        : "No payment authorization was presented; nothing was charged by this request.",
+  };
 }
 
 const HANDLERS = {
@@ -498,6 +631,7 @@ const HANDLERS = {
   get_root: getRoot,
   get_card: getCard,
   verify_inclusion: verifyInclusion,
+  x402_trust: x402Trust,
 };
 
 /* ----------------------------------------------------------------- transport */
@@ -539,13 +673,14 @@ function summaryLine(name, payload) {
       return `${payload.state ?? "?"} — card-v0 leaf ${String(payload.sha256 || "").slice(0, 16) || "?"}.`;
     case "verify_inclusion":
       return `${payload.state ?? "?"} — inclusion against live merkle.`;
+    case "x402_trust":
+      return `${payload.state ?? "?"} — ${payload.headline || "catalog trust counts"}.`;
     case "commission_card":
     case "art50_marking_evidence":
     case "rwa_evidence":
-    case "witness_hash":
     case "receipts_batch":
       return `${payload.status ?? "?"} — ${payload.route ?? name}${
-        payload.status === "PAYMENT_REQUIRED" ? "; nothing charged" : ""
+        payload.status === "PAYMENT_REQUIRED" && payload.payment_presented === false ? "; nothing charged" : ""
       }${payload.reason ? " — " + payload.reason : ""}. ${PAID_DOCTRINE}.`;
     default:
       return name;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "csoai-gspc-mcp",
-  "version": "0.2.0",
-  "description": "Stdio MCP server for the live GSPC board, signed measurement cards, and public-root merkle at councilof.ai. Twelve tools: seven free readers (board_totals, get_axis, verify_card with a pinned key and a three-state verdict, list_cards, get_root, get_card, verify_inclusion) and five x402-metered ones (commission_card, art50_marking_evidence, rwa_evidence, witness_hash, receipts_batch) that return the route's own 402 challenge until you pay. We measure, never certify; unmeasured is first-class; verdicts are VALID / INVALID / UNCHECKABLE, never two-state. A 404 leaf is INVALID. Zero dependencies.",
+  "version": "0.2.2",
+  "description": "Stdio MCP server for Council of AI's GSPC board and signed measurement evidence. Twelve tools: eight free readers and four x402-metered evidence tools. Measurement only, never certification. Zero runtime dependencies.",
   "type": "module",
   "bin": {
     "csoai-gspc-mcp": "index.mjs"
@@ -50,5 +50,6 @@
   },
   "engines": {
     "node": ">=20"
-  }
+  },
+  "mcpName": "io.github.CSOAI-ORG/gspc"
 }

package/paid-tools.json

@@ -49,21 +49,6 @@
       },
       "csoai": { "paid": true, "rail": "x402", "route": "/api/rwa/evidence", "sku": "rwa_evidence", "free_preview": "preview=true", "deliverable": "one card-v0 leaf, surface public.notice, kind csoai.eater.xrpl-issuer/0.1", "deployed_by": "live on councilof.ai (verified 2026-09-03)" }
     },
-    {
-      "name": "witness_hash",
-      "description": "PAID (x402 or CSOAI LTD invoice). Witness a SHA-256 digest — 'attest what you're shown' — via https://councilof.ai/api/witness: one public.notice leaf (csoai.witness.hash/0.1) in the next hourly signed public root, an RFC-3161 timestamp over the digest, and the root's Rekor + OpenTimestamps anchors. Hash-only: name a digest, or a public URL fetched once (robots honoured, never past a login, paywall or bot check → UNCHECKABLE, nothing charged). Attests existence of the digest at the root's as_of — nothing about content, legality or provenance; a self-signed card carries no legal presumption. Measurement, not certification. Status is free at /api/witness/status. Without x_payment the tool returns the 402 challenge. If the route is not deployed on this origin the tool says NOT_DEPLOYED.",
-      "inputSchema": {
-        "type": "object",
-        "properties": {
-          "sha256": { "type": "string", "pattern": "^[0-9a-f]{64}$", "description": "The digest to witness (64 lowercase hex). Or pass url." },
-          "url": { "type": "string", "description": "Optional public https URL, fetched once with our UA, hashed, never stored." },
-          "label": { "type": "string", "description": "Optional label (≤120 chars, no verdict words); appears on the leaf." },
-          "x_payment": { "type": "string", "description": "The X-PAYMENT header value signed against accepts[] from the previous 402. Omit to receive the challenge." }
-        },
-        "additionalProperties": false
-      },
-      "csoai": { "paid": true, "rail": "x402-or-invoice", "route": "/api/witness", "sku": "witness_hash", "free_status": "/api/witness/status?sha256=", "deliverable": "one public.notice leaf in the next hourly root + RFC-3161 reply + Rekor/OTS anchors", "deployed_by": "live on councilof.ai (verified 2026-09-03)" }
-    },
     {
       "name": "receipts_batch",
       "description": "PAID (x402 or CSOAI LTD invoice). A historical batch of the estate's measurement receipts via https://councilof.ai/api/receipts/batch: every signed card-v0 leaf whose as_of falls in [from,to] (≤200), each with its Merkle inclusion path and the public root(s) that carried it, plus the root index for the window and one signed manifest card citing the batch sha256. preview=true is free and returns count, span, root count and the sha256 of the exact bytes the paid call returns. Recent leaves are free at /root.json, /cards/ and /api/proof?sha= — the batch sells assembly across history, never a conclusion. No settlement-receipt stream exists (/api/receipts/latest is UNPUBLISHED) and this tool never claims one. Without x_payment the tool returns the 402 challenge.",

package/verify-card.mjs

@@ -30,8 +30,13 @@ const ORIGIN = "https://councilof.ai";
 // that the file is self-consistent — anyone can alter a body and sign it with a key they
 // just generated. Authenticity requires pinning to the key published in our DID document:
 //   did:web:csoai.org#card-attestation-1
+const CARD_KEY_ID = "did:web:csoai.org#card-attestation-1";
 const PINNED_PUBKEY_HEX =
   "d4cb0eaa16d5f50bf7633a36aa34fe09a55e124b9316ded2abdb122bb9c37e38";
+const PINNED_DID_KEYS = Object.freeze({
+  [CARD_KEY_ID]: PINNED_PUBKEY_HEX,
+  "did:web:csoai.org#board-attestation-1": "9367cf59be9cb72bbc9796adf056201ec1c58adfeaa13f83b2c5b754d6c20170",
+});
 
 // Fields whose values are floats in our schema. See "THE HONEST LIMIT" above.
 const FLOAT_FIELDS = new Set(["accuracy", "ci_low", "ci_high", "recall", "precision", "f1"]);
@@ -142,18 +147,35 @@ function jcsString(s) {
 export async function verifyCard(card) {
   if (!card || typeof card !== "object" || !card.body)
     return { state: "UNCHECKABLE", reason: "not a card: no body" };
-  if (!card.pubkey || !card.signature || !card.id)
-    return { state: "UNCHECKABLE", reason: "missing pubkey, signature or id" };
+  if (!card.signature || !card.id)
+    return { state: "UNCHECKABLE", reason: "missing signature or id" };
+  const hasPubkey = typeof card.pubkey === "string" && !!card.pubkey;
+  const hasDid = typeof card.did === "string" && !!card.did;
+  if (!hasPubkey && !hasDid)
+    return { state: "UNCHECKABLE", reason: "card names neither an inline public key nor a DID key reference" };
+  if (hasPubkey && hasDid)
+    return { state: "UNCHECKABLE", reason: "card names two key authorities; verifier will not guess" };
 
-  if (card.pubkey !== PINNED_PUBKEY_HEX)
-    return { state: "INVALID", reason: "pubkey is not the published card-attestation key" };
+  let keyHex;
+  let keyId;
+  if (hasDid) {
+    keyHex = PINNED_DID_KEYS[card.did];
+    keyId = card.did;
+    if (!keyHex)
+      return { state: "UNCHECKABLE", reason: `DID key reference ${card.did} is not pinned by this verifier` };
+  } else {
+    if (card.pubkey !== PINNED_PUBKEY_HEX)
+      return { state: "INVALID", reason: "pubkey is not the published card-attestation key" };
+    keyHex = card.pubkey;
+    keyId = CARD_KEY_ID;
+  }
 
   let preimage;
   try {
     // Preimage-rule dispatch (roadmap item 1): absent = legacy CPython v1; "jcs-rfc8785" = JCS v2.
     // Never re-sign v1 cards — the verifier dispatches on the field.
     const rule = card.preimage_rule || card.canon || "cpython-v1";
-    const fn = rule === "jcs-rfc8785" ? canonicalJcs : canonical;
+    const fn = rule === "jcs-rfc8785" || rule === "sha256(canonical body)" ? canonicalJcs : canonical;
     preimage = new TextEncoder().encode(fn(card.body));
   } catch (e) {
     return { state: "UNCHECKABLE", reason: `cannot canonicalise: ${e.message}` };
@@ -165,13 +187,13 @@ export async function verifyCard(card) {
 
   let key;
   try {
-    key = await crypto.subtle.importKey("raw", unhex(card.pubkey), "Ed25519", false, ["verify"]);
+    key = await crypto.subtle.importKey("raw", unhex(keyHex), "Ed25519", false, ["verify"]);
   } catch {
     return { state: "UNCHECKABLE", reason: "this runtime has no Ed25519 (needs Node 19+)" };
   }
   const ok = await crypto.subtle.verify("Ed25519", key, unhex(card.signature), preimage);
   return ok
-    ? { state: "VALID", id: card.id, axis: card.body.axis }
+    ? { state: "VALID", id: card.id, axis: card.body.axis, keyId }
     : { state: "INVALID", reason: "signature does not verify under the pinned key" };
 }