Skip to content

Commit a42bdf3

Browse files
GsCommandGsCommand
committed
Rebuild ambient verification page around working auto-verify model
1 parent 9d69f57 commit a42bdf3

1 file changed

Lines changed: 114 additions & 83 deletions

File tree

‎public/ambient-verification.html‎

Lines changed: 114 additions & 83 deletions
Original file line numberDiff line numberDiff line change
@@ -3,119 +3,150 @@
33
<head>
44
<meta charset="UTF-8" />
55
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
6-
<title>Ambient Machine-Action Verification | CommandLayer</title>
7-
<meta name="description" content="Move from manual receipt checks to ambient machine-action verification across URLs, badges, webhooks, SDK calls, and agent workflows." />
6+
<title>Automatic Verification | CommandLayer</title>
7+
<meta name="description" content="Automatic verification for CommandLayer receipts across webhooks, SDKs, MCP bridges, badges, and agent workflows." />
88
<link rel="icon" href="/icon2.png" />
99
<link rel="preconnect" href="https://fonts.googleapis.com" />
1010
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
1111
<link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet" />
1212
<link rel="stylesheet" href="/css/site.css" />
1313
<style>
14-
.nav-links a.active { color: var(--text); background: var(--surface); }
15-
main { padding: 36px 0 56px; }
16-
.hero { padding: 28px; margin: 0 0 16px; text-align: left; border: 1px solid var(--border); border-radius: 16px; background: linear-gradient(180deg, #ffffff 0%, #f8faff 100%); }
17-
.hero h1 { margin:0 0 10px; font-size: clamp(30px, 5vw, 52px); line-height:1.05; }
18-
.subtitle { margin:0; color: var(--text-2); font-size: clamp(1rem, 1.9vw, 1.22rem); }
19-
.grid { display:grid; gap:16px; grid-template-columns: repeat(auto-fit, minmax(240px, 1fr)); margin: 16px 0; }
20-
.feat-card { padding: 18px; }
21-
.flow { font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; color:#0f766e; font-weight:700; line-height:1.8; }
22-
.checks { padding-left:18px; color:#334155; font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; }
23-
h2 { margin:0 0 10px; font-size:1.16rem; }
24-
p { margin:0 0 10px; color: var(--muted); line-height:1.6; }
25-
.quote { border-left:3px solid var(--blue); padding:8px 12px; margin:10px 0; color:#334155; background:#f3f6ff; border-radius:6px; }
26-
.quote strong { color: var(--purple); }
27-
.link, .link-list a, .cta-row a { color:#3b82f6; text-decoration:none; font-weight:600; }
28-
.link:hover, .link-list a:hover, .cta-row a:hover { text-decoration:underline; text-underline-offset:2px; }
29-
.cta-row { display:flex; flex-wrap:wrap; gap:10px; margin-top:12px; }
30-
footer { padding: 16px 0 28px; margin-top: 24px; }
31-
.foot-links { display:flex; justify-content:center; gap:28px; font-size:13px; flex-wrap:wrap; }
32-
.foot-links a { color: var(--muted); text-decoration:none; }
33-
.foot-links a:hover { color: var(--text); text-decoration:underline; }
14+
.brand{gap:0}.brand img{height:68px;width:auto;object-fit:contain}.brand span{display:none}
15+
.nav-links{display:flex;align-items:center;gap:2px;list-style:none;flex-wrap:wrap;margin:0;padding:0}
16+
.nav-links a{color:var(--muted);text-decoration:none;font-size:14px;font-weight:500;padding:7px 12px;border-radius:8px;background:none;border:none;font-family:inherit}
17+
.nav-links a:hover,.nav-drop:hover>a,.nav-drop:focus-within>a,.nav-drop>a.active{color:var(--text);background:var(--surface)}
18+
.nav-drop{position:relative}.nav-drop>a{display:inline-flex;align-items:center;gap:4px}
19+
.nav-drop-menu{position:absolute;top:calc(100% - 1px);left:0;background:#fff;border:1px solid var(--border);border-radius:12px;box-shadow:0 10px 34px rgba(15,23,42,.12);padding:8px;display:none;min-width:280px;z-index:200}
20+
.nav-drop-menu::before{content:"";position:absolute;left:0;right:0;top:-8px;height:8px}.nav-drop-menu a{display:block;white-space:nowrap}
21+
.nav-drop:hover .nav-drop-menu,.nav-drop:focus-within .nav-drop-menu{display:grid}
22+
main{padding:44px 0 72px}
23+
.hero{padding:30px;border:1px solid var(--border);border-radius:18px;background:linear-gradient(180deg,#fff 0%,#f8faff 100%)}
24+
.eyebrow{display:inline-block;padding:6px 10px;border-radius:999px;border:1px solid #dbeafe;background:#eff6ff;color:#1d4ed8;font-weight:600;font-size:.82rem}
25+
h1{margin:14px 0 12px;font-size:clamp(2rem,4.6vw,3.3rem);line-height:1.05;letter-spacing:-.03em}
26+
.subtitle{margin:0;color:var(--text-2);font-size:clamp(1rem,1.8vw,1.2rem);line-height:1.6}
27+
.cta-row{display:flex;gap:10px;flex-wrap:wrap;margin-top:18px}
28+
.section{margin-top:16px;padding:22px;border:1px solid var(--border);border-radius:16px;background:#fff;box-shadow:0 1px 2px rgba(15,23,42,.04),0 6px 20px rgba(99,91,255,.04)}
29+
h2{margin:0 0 10px;font-size:1.24rem;letter-spacing:-.01em}
30+
p{margin:0 0 10px;color:var(--text-2);line-height:1.7}
31+
.flow{margin-top:10px;display:grid;gap:8px;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;color:#0f766e;font-weight:700}
32+
.grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(240px,1fr));gap:14px;margin-top:12px}
33+
.card{padding:16px;border:1px solid var(--border);border-radius:12px;background:var(--surface)}
34+
.card h3{margin:0 0 8px;font-size:1.03rem}
35+
.card p{margin:0 0 8px}
36+
a.link{font-weight:600;text-decoration:none}
37+
a.link:hover{text-decoration:underline;text-underline-offset:2px}
38+
.code-panel{background:#0E1322;color:#E2E8F0;border-radius:14px;border:1px solid rgba(30,41,59,.3);padding:18px;overflow:auto;font:13px/1.7 ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;white-space:pre}
39+
ul{margin:0;padding-left:18px} li{margin:6px 0;color:var(--text-2)}
40+
.warning{border-left:3px solid #f59e0b;padding:10px 12px;background:#fffbeb;border-radius:8px;color:#78350f;font-weight:600}
41+
footer{border-top:1px solid var(--border);background:#fff;margin-top:24px}
42+
.footer-grid{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:24px;padding:36px 0}
43+
.footer-grid h4{font-size:14px;margin-bottom:10px}.footer-grid a{display:block;color:var(--text-2);margin:8px 0;font-size:14px}
44+
@media(max-width:900px){.footer-grid{grid-template-columns:1fr}.nav-drop{width:100%}.nav-drop-menu{position:static;display:grid;margin-top:2px;min-width:0;box-shadow:none}}
3445
</style>
3546
</head>
3647
<body>
37-
<nav>
38-
<div class="container nav-inner">
39-
<a href="/" class="brand"><img src="/icon2.png" alt="CommandLayer" />CommandLayer</a>
40-
<div class="nav-links">
41-
<a href="/">Home</a>
42-
<a href="/protocol.html">Protocol</a>
43-
<a href="/capabilities.html">Capabilities</a>
44-
<a href="/verify.html" class="active">Verifier</a>
45-
<a href="/sdk-records.html">SDK</a>
46-
<a href="/docs/wrap-your-agent.html">Docs</a>
47-
<a href="/claim.html">Claim</a>
48-
<a href="https://github.com/commandlayer" target="_blank" rel="noopener">GitHub</a>
49-
</div>
50-
</div>
51-
</nav>
48+
<nav><div class="container nav-inner"><a href="/" class="brand"><img src="/commandlayer-logo.png" alt="CommandLayer" /><span>CommandLayer</span></a><ul class="nav-links"><li><a href="/">Home</a></li><li><a href="/protocol.html">Protocol</a></li><li><a href="/capabilities.html">Capabilities</a></li><li><a href="/verify.html">Verifier</a></li><li><a href="/sdk-records.html">SDK</a></li><li class="nav-drop"><a href="/docs.html" class="active" aria-haspopup="true">Docs ▾</a><div class="nav-drop-menu"><a href="/docs.html">Docs Home</a><a href="/docs/wrap-your-agent.html">Wrap Your Agent</a><a href="/stack-proof-demo.html">Production Proof</a><a href="/runtime.html">Runtime</a><a href="/mcp.html">MCP Bridge</a><a href="/schemas.html">Schemas</a><a href="/api.html">API Reference</a><a href="/trust-verification.html">Trust Verification</a><a href="/claim.html">Claim / Namespace Activation</a></div></li><li><a href="/claim.html">Claim</a></li><li><a href="https://github.com/commandlayer" target="_blank" rel="noopener">GitHub</a></li></ul></div></nav>
5249

5350
<main class="container">
5451
<section class="hero">
55-
<h1>Ambient Machine-Action Verification</h1>
56-
<p class="subtitle">Systems can verify machine-action receipts automatically through URLs, badges, webhooks, SDKs, and agent-to-agent flows.</p>
52+
<span class="eyebrow">Automatic Verification</span>
53+
<h1>Verification without manual paste.</h1>
54+
<p class="subtitle">CommandLayer receipts can be verified automatically by apps, webhooks, SDKs, MCP flows, badges, and agent-to-agent systems.</p>
55+
<div class="cta-row">
56+
<a class="btn btn-primary" href="/webhook-auto-verify.html">Open Webhook Auto-Verify Demo</a>
57+
<a class="btn btn-secondary" href="https://github.com/commandlayer/commandlayer-org/tree/main/examples/webhook-auto-verify" target="_blank" rel="noopener">View Example Code</a>
58+
</div>
59+
</section>
60+
61+
<section class="section">
62+
<h2>The working model</h2>
63+
<div class="flow">
64+
<div>Runtime signs receipt</div>
65+
<div>→ receipt delivered to a system</div>
66+
<div>→ system calls verifier</div>
67+
<div>→ valid receipt accepted</div>
68+
<div>→ tampered receipt rejected</div>
69+
</div>
70+
<p>The webhook auto-verify example demonstrates this server-side. The public demo demonstrates the same flow in the browser using runtime signing and runtime verification.</p>
71+
<p>Runtime: <a class="link" href="https://runtime.commandlayer.org" target="_blank" rel="noopener">https://runtime.commandlayer.org</a><br/>Verifier: <a class="link" href="https://runtime.commandlayer.org/verify" target="_blank" rel="noopener">https://runtime.commandlayer.org/verify</a></p>
5772
</section>
5873

59-
<section aria-label="Four verification surfaces">
74+
<section class="section">
6075
<h2>Live today</h2>
6176
<div class="grid">
62-
<article class="feat-card"><h2>Manual Verifier</h2><p>Manual inspection is useful for debugging and spot checks.</p><a class="link" href="/verify.html">Open /verify.html →</a></article>
63-
<article class="feat-card"><h2>Verification URLs</h2><p>Receipt-specific URLs let systems and humans open the same verification result directly.</p><a class="link" href="/verify/r/demo-valid-receipt">Open valid receipt URL →</a><br/><a class="link" href="/verify/r/demo-tampered-receipt">Open tampered receipt URL →</a></article>
64-
<article class="feat-card"><h2>Embedded Badges</h2><p>Display verification status where decisions are made.</p><a class="link" href="/verify-badge-demo.html">Open /verify-badge-demo.html →</a></article>
65-
<article class="feat-card"><h2>SDK/runtime verification</h2><p>Use SDK and runtime verifier flows in applications that verify receipts on delivery.</p></article>
77+
<article class="card"><h3>Manual verifier</h3><p>Paste receipt JSON and inspect each verification check.</p><a class="link" href="/verify.html">Open verifier</a></article>
78+
<article class="card"><h3>Runtime verifier</h3><p>Programmatically verify receipts with <code>POST https://runtime.commandlayer.org/verify</code>.</p><a class="link" href="/runtime.html">Open runtime docs</a></article>
79+
<article class="card"><h3>Webhook auto-verify</h3><p>Backend receives receipt, verifies it server-side, and accepts/rejects the event.</p><a class="link" href="/webhook-auto-verify.html">Open demo page</a><br/><a class="link" href="https://github.com/commandlayer/commandlayer-org/tree/main/examples/webhook-auto-verify" target="_blank" rel="noopener">Open GitHub example</a></article>
80+
<article class="card"><h3>Embedded badge</h3><p>Display verification state in a UI.</p><a class="link" href="/verify-badge-demo.html">Open badge demo</a></article>
81+
<article class="card"><h3>SDK/runtime verification</h3><p>Use <code>@commandlayer/agent-sdk</code> or direct runtime calls in application code.</p><a class="link" href="/sdk-records.html">SDK records</a><br/><a class="link" href="/api.html">API reference</a></article>
6682
</div>
6783
</section>
6884

69-
<section class="feat-card" style="margin-bottom:16px;">
70-
<h2>Ambient flow</h2>
71-
<p class="flow">Receipt reference → fetch receipt → verify checks → accept/reject action</p>
72-
<p>The verifier can run inside a website, backend job, webhook consumer, SDK call, or agent-to-agent workflow.</p>
85+
<section class="section">
86+
<h2>Webhook auto-verification</h2>
87+
<p>This is the no-paste model: <code>POST /webhook</code> receives <code>{ event, receipt }</code>, the server posts <code>{ receipt }</code> to the verifier, valid proof returns accepted, and tampered proof returns rejected.</p>
88+
<pre class="code-panel">cd examples/webhook-auto-verify
89+
npm install
90+
npm run generate:samples
91+
npm start
92+
93+
curl -X POST http://localhost:3000/webhook \\
94+
-H "Content-Type: application/json" \\
95+
--data @sample-valid-webhook.json
96+
97+
curl -X POST http://localhost:3000/webhook \\
98+
-H "Content-Type: application/json" \\
99+
--data @sample-tampered-webhook.json
100+
101+
Expected:
102+
valid -&gt; 200 accepted
103+
tampered -&gt; 400 rejected</pre>
73104
</section>
74105

75-
<section class="feat-card" style="margin-bottom:16px;">
106+
<section class="section">
76107
<h2>Trust checks</h2>
77-
<ul class="checks">
78-
<li>schema_valid</li>
79-
<li>hash_matched</li>
108+
<ul>
109+
<li>receipt structure</li>
110+
<li>metadata.proof present</li>
111+
<li>canonicalization = json.sorted_keys.v1</li>
112+
<li>hash_alg = SHA-256</li>
113+
<li>hash_matches</li>
114+
<li>signature_alg = Ed25519</li>
80115
<li>signature_valid</li>
81-
<li>signer_resolved</li>
82-
<li>signer_matched</li>
83-
<li>trust_verb</li>
116+
<li>signature.kid = vC4WbcNoq2znSCiQ</li>
117+
<li>signer_id = runtime.commandlayer.eth</li>
118+
<li>supported capability verb</li>
119+
<li>tamper invalidation</li>
84120
</ul>
85-
<div class="quote"><strong>A schema-valid receipt only means the receipt has the expected shape. Cryptographic validity still depends on hash, signature, and signer checks.</strong></div>
86-
<div class="quote">Schema-valid does not always mean cryptographically valid.</div>
121+
<p class="warning">Schema-valid alone is not verified. Verification requires hash and signature checks.</p>
87122
</section>
88123

89-
<section aria-label="Developer use cases">
90-
<h2>Developer use cases</h2>
91-
<div class="grid">
92-
<article class="feat-card"><h2>webhook filtering</h2><p>Route or block incoming events based on verification checks.</p></article>
93-
<article class="feat-card"><h2>website badges</h2><p>Show verification state directly in user-facing pages.</p></article>
94-
<article class="feat-card"><h2>automated receipt checks</h2><p>Run verification as part of backend decision logic.</p></article>
95-
<article class="feat-card"><h2>agent-to-agent validation</h2><p>Let one agent verify another agent's receipt before acting.</p></article>
96-
<article class="feat-card"><h2>audit trails</h2><p>Store verification outputs for compliance and review.</p></article>
97-
<article class="feat-card"><h2>dashboard/history pipelines</h2><p>Feed verification states into reporting and historical analytics.</p></article>
98-
</div>
124+
<section class="section">
125+
<h2>Trust boundaries</h2>
126+
<ul>
127+
<li>Runtime signs.</li>
128+
<li>Verifier validates.</li>
129+
<li>MCP bridges.</li>
130+
<li>SDK wraps.</li>
131+
<li>Schemas describe.</li>
132+
</ul>
133+
<p>Webhook sender authentication is separate from receipt verification. Production webhooks still need sender authentication, replay protection, timestamps, rate limits, and idempotency.</p>
99134
</section>
100135

101-
<section class="feat-card" style="margin-top:16px;">
102-
<h2>Planned</h2><ul class="link-list"><li>Webhook delivery and verification callbacks.</li><li>Continuous monitoring and replay checks.</li><li>Automatic third-party callback integrations.</li></ul>
136+
<section class="section">
137+
<h2>Verification URLs</h2>
138+
<p>Demo verification routes are available for illustrative receipt IDs:</p>
139+
<ul>
140+
<li><a class="link" href="/verify/r/demo-valid-receipt">/verify/r/demo-valid-receipt</a> <span>(demo route)</span></li>
141+
<li><a class="link" href="/verify/r/demo-tampered-receipt">/verify/r/demo-tampered-receipt</a> <span>(demo route)</span></li>
142+
</ul>
103143
</section>
104144

105-
<section class="feat-card" style="margin-top:16px;">
106-
<h2>Careful wording</h2>
107-
<ul class="link-list">
108-
<li>Ambient verification should happen automatically, not manually.</li>
109-
<li>Ambient verification does not require manual copy/paste.</li>
110-
<li>Schema-valid does not always mean cryptographically valid.</li>
111-
<li>CLAS is network-agnostic; ENS/ERC-8004 can assist discovery and identity but are not required for every verification flow.</li>
112-
</ul>
113-
<div class="cta-row">
114-
<a href="/verify/r/demo-valid-receipt">Try verification URL →</a>
115-
<a href="/verify-badge-demo.html">Open badge demo →</a>
116-
<a href="/how-it-works.html">Read how it works →</a>
117-
<a href="/docs/wrap-your-agent.html">Wrap your agent →</a>
118-
</div>
145+
<section class="section">
146+
<h2>Live vs planned</h2>
147+
<p><strong>Live today:</strong> manual verifier, runtime <code>/verify</code>, webhook auto-verify example, SDK/runtime verification, and embedded badge demo.</p>
148+
<p><strong>Planned:</strong> managed webhook delivery network, third-party callbacks, continuous monitoring, replay-check service, and dashboard/history pipelines.</p>
149+
<p><a class="link" href="/stack-proof-demo.html">View Production Proof</a> · <a class="link" href="/runtime.html">Runtime</a> · <a class="link" href="/api.html">API</a> · <a class="link" href="/verify.html">Verifier</a></p>
119150
</section>
120151
</main>
121152

0 commit comments

Comments
 (0)