{
  "signed_version": "1.0",
  "what_this_lane_is": "Submissions signed by a key this deployment does not hold. The open lane at /x/witness/observe proves somebody handed us a tip. This lane proves the holder of a specific private key did - including against us, because we only ever hold the public half.",
  "why_it_exists": "The HMAC lane binds a name to a shared secret, and a shared secret is held by both parties. It closes third-party submission under your name and does not close operator submission under your name. This lane closes both, and it does so by arithmetic rather than by our promise.",
  "steps": [
    "1. Generate an Ed25519 keypair. Keep the private half. It never leaves your side and we have no route that accepts one.",
    "2. POST /x/signed/enroll with {\"chain\":\"<name>\",\"pubkey\":\"<64 hex>\"}.",
    "3. Build the canonical message, sign it, and POST /x/signed/submit with {\"chain\",\"tip\",\"ts\",\"signature\"}.",
    "4. GET /x/signed/verify?peer=&tip= for the receipt, which carries everything a third party needs to recheck it without us."
  ],
  "canonical_message": {
    "submit": "aileash-signed-v1\\n<chain>\\n<tip>\\n<ts>",
    "rotate": "aileash-rotate-v1\\n<chain>\\n<new pubkey>\\n<ts>",
    "encoding": "UTF-8, single \\n between lines, no trailing newline. ts is integer epoch seconds."
  },
  "replay_controls": {
    "max_age_seconds": 900,
    "max_future_seconds": 120,
    "monotonic": "ts must be strictly greater than the last ts accepted for the name",
    "duplicate_signatures": "refused"
  },
  "this_lane_rejects": "Unlike the open lane, a submission that does not verify is refused and nothing is sealed. Writing an unverifiable signature into a name's history is the harm, not the protection.",
  "key_rotation": "A rotation must be signed by the key being replaced. Nobody who lacks the current private key can rotate it, this deployment included, and every rotation is sealed with both keys recorded.",
  "honest_limits": [
    "Does not prove the records behind the tip are true.",
    "Does not prove the chain is complete. Catching an omission needs an audit protocol, not cryptography.",
    "Does not prove who the keyholder is in the world - only that the same party signed each time.",
    "Enrolment is open, so the first party to enrol a name gets it. An enrolment over a name already seen in the open lane is flagged permanently, which is detection and not prevention."
  ],
  "what_this_proves": "That the holder of the enrolled private key produced this exact statement - name, tip and timestamp - and that we sealed it at the recorded time. This deployment holds only the public key and cannot produce such a signature, so it is not a claim you have to take on our word. Recheck it yourself with any Ed25519 library.",
  "what_this_does_not_prove": "Nothing about whether the records behind the tip are true, nothing about whether the chain is complete, and nothing about who the keyholder is in the world. It proves the same party signed each time."
}