Verify before an agent pays

# Proposal: Verify before an agent pays

## Why
An agent about to pay for a dataset, model or report has no cheap way to confirm the seller's claims of origin or verification. One anonymous call before payment answers that, without revealing what the agent is about to buy.

## What Changes
- The seller puts the record digest in its product data, or the agent hashes what it received.
- After the checkout lists the items and before payment is authorized, the agent checks every digest in one call.
- The agent refuses sealed items, reviews corrected ones, and can record the mandate and the receipt by hash.
- Add CommitOps: If the purchase fulfills a promise to a customer, record the purchase record's digest against that promise in CommitOps.

## Capabilities
### New Capabilities
- `verify-before-pay`: Call verify-batch inside ACP, UCP or x402 flows, after the item is known and before money moves.

## Impact
- External service: AI Source of Truth at https://aisourceoftruth.com. Reads are anonymous. Writes need a publisher key pair you generate, a client id and secret from registration, and a token from `/oauth/token`.
- Routes used: `POST /v1/verify-batch`, `GET /v1/model/assess/{digest}`, `POST /v1/records`.
- PromptReports products: CommitOps (optional; the change works without them).
- Source of this plan: https://aisourceoftruth.com/use-cases/verify-before-pay (CC0). Regenerate it with `curl -H 'Accept: application/json' 'https://aisourceoftruth.com/use-cases/verify-before-pay/openspec?lang=http&with=commitops'`.

# Design: Verify before an agent pays

## Context
Buying agents, agent wallets and checkout services. An agent about to pay for a dataset, model or report has no cheap way to confirm the seller's claims of origin or verification. One anonymous call before payment answers that, without revealing what the agent is about to buy.

## Where it sits in your agent
Place the check in the payment tool, between cart confirmation and payment authorization. Fail closed on `sealed`; fail open with a warning on `present: false` only if your policy allows unattested goods.

Over MCP, point the agent at `https://aisourceoftruth.com/mcp` (Streamable HTTP, JSON-RPC 2.0; read tools need no token). The tools this change uses: `verify_batch`, `assess`, `publish_record`.

## Decisions
- Treat the registry as a source of facts about records, never about the world. Show what it says, with the digest, and do not turn a verdict into a quality score.
- If the registry cannot be reached, treat the answer as unknown (the same as `check`), never as `rely`, and retry later.
- Keep content private: send hashes. Never put personal data in a record; it is public and permanent.
- Keep the private key and client secret in your secret store. Rotate keys at `POST /v1/keys`; a revoked key cannot sign.

## Setup and signing helper

```sh
# Publisher setup, once. Make an Ed25519 key pair yourself; the registry never sees the private key.
# 1. Register: POST https://aisourceoftruth.com/v1/publishers with {"id","name","public_jwk"}, signed by that key
#    (X-AISOT-Signature over the exact body bytes, base64url) and an Idempotency-Key.
#    The answer carries client_id, client_secret and your key_id.
# 2. Token (60 minutes; mint another the same way):
curl -s -X POST 'https://aisourceoftruth.com/oauth/token' -H 'Content-Type: application/json' \
  --data '{"grant_type":"client_credentials","client_id":"'"$AISOT_CLIENT_ID"'","client_secret":"'"$AISOT_CLIENT_SECRET"'"}'
# ./sign-ed25519 reads bytes on stdin and prints the base64url Ed25519 signature.
```

## Calls
### POST /v1/verify-batch
signature, inclusion proof, errata count and judge for up to 1000 digests in one call.

```sh
curl -s -X POST 'https://aisourceoftruth.com/v1/verify-batch' \
  -H 'Content-Type: application/json' \
  --data '{"digests":["{digest}"]}'
```

### GET /v1/model/assess/{digest}
rely, check or do_not_rely for one record, with the reasons.

```sh
curl -s -H 'Accept: application/json' 'https://aisourceoftruth.com/v1/model/assess/{digest}'
```

### POST /v1/records
append a signed record; the answer carries its digest and inclusion proof.

```sh
BODY='{ ...record }'
SIG=$(printf %s "$BODY" | ./sign-ed25519)   # base64url signature over these exact bytes
curl -s -X POST 'https://aisourceoftruth.com/v1/records' \
  -H "Authorization: Bearer $AISOT_TOKEN" \
  -H "X-AISOT-Key-Id: $AISOT_KEY_ID" \
  -H "X-AISOT-Signature: $SIG" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H 'Content-Type: application/vnd.aisot.record+json' \
  --data-binary "$BODY"
```

## With the PromptReports products
- **CommitOps** (https://aisourceoftruth.com/p/commitops) keeps the ledger of what a company promised its customers, and can tie a promise to the record that shows it shipped. In this change: If the purchase fulfills a promise to a customer, record the purchase record's digest against that promise in CommitOps.

## What this does not prove
- The check shows records and their state. It does not show that the goods are fit for purpose.
- Mandate and settlement records show order in the log. They are not a dispute ruling.

# Tasks: Verify before an agent pays

## 1. Configure
- [ ] 1.1 Set `AISOT_ORIGIN=https://aisourceoftruth.com` in the agent's environment.
- [ ] 1.2 Generate an Ed25519 key pair, register the publisher (`POST /v1/publishers`), and store `AISOT_CLIENT_ID`, `AISOT_CLIENT_SECRET`, `AISOT_KEY_ID` and the private key as secrets.
- [ ] 1.3 Mint a token at `/oauth/token` and confirm `GET /v1/me` answers with your publisher id.
- [ ] 1.4 Optional: add the MCP server `https://aisourceoftruth.com/mcp` to the agent's MCP config.

## 2. Build
- [ ] 2.1 Collect the digests: Read record digests from the seller's product data, or hash the delivered bytes and look them up as assets.
- [ ] 2.2 Check before paying: In ACP, before completing the checkout session. In UCP, before authorizing payment. In x402, before signing the payment payload. One call covers the whole cart. (`POST /v1/verify-batch`)
- [ ] 2.3 Decide: `present: false`: treat the provenance claim as unsupported. `sealed: true`: do not buy. `errata_count` above zero: read the errata first. Use assess when you want the reasons in words. (`GET /v1/model/assess/{digest}`)
- [ ] 2.4 Optionally witness the payment: A publisher can post a `mandate` record when the mandate is signed and a `settlement` record when it settles, both hashes only. See /guides/agent-payments for the exact fields. (`POST /v1/records`)

## 3. PromptReports products
- [ ] 3.1 CommitOps: If the purchase fulfills a promise to a customer, record the purchase record's digest against that promise in CommitOps.

## 4. Verify against the live registry
- [ ] 4.1 Collect the digests: Every item in the cart has a digest or is marked unattested.
- [ ] 4.2 Check before paying: A cart with a sealed test item stops before payment.
- [ ] 4.3 Decide: Each outcome maps to a logged decision.
- [ ] 4.4 Optionally witness the payment: The settlement's log index is greater than its mandate's.

## 5. Done when
- [ ] 5.1 No payment goes out for a sealed item.
- [ ] 5.2 Every purchase log names the digests checked and the answer.

# verify-before-pay Specification

## ADDED Requirements

### Requirement: Check before payment
The payment flow SHALL call verify-batch for every item digest after the items are known and before payment is authorized, and SHALL NOT pay for an item whose record is sealed.

#### Scenario: Sealed item
- **WHEN** verify-batch returns `sealed: true` for any item
- **THEN** the flow stops before payment and reports the digest

#### Scenario: All clear
- **WHEN** every item verifies with no seal
- **THEN** payment proceeds and the check is logged with the digests