align runtime-core to canonical CLAS proof envelope

README.md

@@ -126,18 +126,26 @@ const valid = verifyCanonical(canonical, signature, publicKeyPem);
 const validFromRaw = verifyCanonicalWithRawKey(canonical, signature, rawPublicKey);
 ```
 
-### Legacy compat shims (runtime/server.mjs bridge)
+### Canonical CLAS proof envelope
 
-If you need the older `metadata.proof` envelope format, import the compat helpers directly:
+Use the canonical metadata proof API:
 
 ```ts
 import {
-  signReceiptEd25519Sha256,
-  verifyReceiptEd25519Sha256,
+  signCommandLayerReceipt,
+  verifyCommandLayerReceipt,
+  buildCanonicalProof,
+  isSignedCommandLayerReceipt,
 } from '@commandlayer/runtime-core';
 ```
 
-These are explicitly legacy APIs. New integrations should use `signReceipt` / `verifyReceipt`.
+Canonical envelope fields:
+- `metadata.proof.canonicalization`
+- `metadata.proof.hash.alg`
+- `metadata.proof.hash.value`
+- `metadata.proof.signature.alg`
+- `metadata.proof.signature.value`
+- `metadata.proof.signature.kid`
 
 ### Cross-repo canonicalization alignment
 

src/canonicalize.ts

@@ -181,6 +181,6 @@ export const CANONICAL_TEST_VECTORS = [
     input: { verb: "verify", family: "trust", version: "1.0.0" },
     expected: '{"family":"trust","verb":"verify","version":"1.0.0"}',
     // SHA-256 of the canonical string (UTF-8 encoded):
-    sha256: "3c3e2e6f63b02c1dc4d0dc0f6429bcef5fe27f11059c856218a52a4f43f90e44",
+    sha256: "7f84cc113290c283fe97e3beb9bd3f65e5de0022e278cad25ef7619c398b1bab",
   },
 ] as const;