From 0d969b5c184ed78d6ed2611660c10bc7918c1368 Mon Sep 17 00:00:00 2001 From: Greg Soucy Date: Mon, 25 May 2026 09:13:23 -0400 Subject: [PATCH] Restyle proof page to match canonical site layout --- public/proof.html | 182 +++++++++++++++++++++++++++------------------- 1 file changed, 107 insertions(+), 75 deletions(-) diff --git a/public/proof.html b/public/proof.html index dfe883e..b57921c 100644 --- a/public/proof.html +++ b/public/proof.html @@ -1,89 +1,121 @@ - - - Live Proof | CommandLayer - - - + + +Live Proof | CommandLayer + + + + + + + - + -
-
-

Live Proof

+
+
+
+
Live Proof
+

Live proof for signed CommandLayer receipts

The runtime signs. The verifier validates. Tampering is rejected. These demos show CommandLayer receipts moving from action/event to signed proof to independent verification.

-
+
+ Run Full Proof Flow + Try Auto Verify + Read Receipts +
+ + -
-

Trust boundary upfront

+
+
+

Trust boundary upfront

The Coinbase webhook step in browser demos is simulated because real Coinbase delivery requires COINBASE_WEBHOOK_SECRET server-side. The x402 paid-action and verifier steps are live network calls. x402 runs in demo_accepted_envelope mode by default; provider_verified mode requires X402_PROVIDER_VERIFICATION_URL. Demo mode is not real settlement.

-
- -
-

Automatic verification

-

Generate a receipt, verify it, tamper with it, and watch verification fail.

-

Automatic Webhook Verification

-
- -
-

Full proof flow

-

Simulated Coinbase event → live x402 signed endpoint → action execution → live verifier.

-

Full Proof Flow Composer

-

Successful runs should show status: VERIFIED, public_key_source: ens_txt, ens_resolved: true, hash_matches: true, and signature_valid: true.

-
- -
-

What each step proves

-
    -
  • Coinbase: event authenticity to server via HMAC; public portability begins after CommandLayer signing.
    • -
  • x402: payment rail proves payment acceptance/settlement; CommandLayer proves execution result.
    • -
  • Verify: ENS TXT public key, hash check, Ed25519 signature check.
    • -
-
- -
-

What this does not replace

-
    -
  • sender authentication for production webhooks
    • -
  • replay protection
    • -
  • rate limiting
    • -
  • real settlement unless provider_verified mode is configured
    • -
  • schema validation alone
    • -
-
+ +
-
-

Where to go next

- -
-
+
+
+ + +
+
- + + + +