Integrate

Envelope specification

Openness here costs nothing (security rests on the embedded circuit, not schema obscurity). This is the contract Gate enforces.

Binding formula

Canonical request_hash preimage

request_hash = sha256(
  method
  || endpoint_id
  || request_body_hash
  || policy_hash
  || tau
  || nonce_uuid
)

Fields are concatenated with || as the delimiter (string join), then hashed with SHA-256. The gate recomputes this digest from server-side constants and the received body, it does not trust the client’s self-described endpoint or policy.

Core fields

method, HTTP method or logical verb the policy allows
endpoint_id, stable identifier for the protected route (server constant)
request_body_hash, digest of the canonical request body
policy_hash, digest of the server policy string for that route
tau, microsecond timestamp from nonce reservation / challenge
nonce_uuid, ledger-issued one-use identifier
proof material, twin fields (bearings, proof_hash, shards) per variant
child_handle / anchor, circuit handle the gate checks for activation

What the gate does not trust

Self-descriptive fields in the envelope are inputs to verification, not authority. Swapping endpoint_id or loosening policy_hash while keeping an otherwise consistent envelope still fails when the gate compares against its own constants.

Mechanism claims

Every envelope binds method, endpoint_id, request body hash, policy hash, tau, and nonce_uuid into one composite digest.Shippingrequest_hash = sha256(method || endpoint_id || request_body_hash || policy_hash || tau || nonce_uuid).Holds under the reference architecture

An envelope minted for one endpoint_id cannot authorize a different route.ShippingThe gate recomputes digests against its own endpoint_id and policy constants, not the client’s self-description.Holds under the reference architecture

The nonce is burned before twin validation, so a failed or replayed submission cannot be spent twice.ShippingGate order spends nonce_uuid prior to validate-proof; spent nonces reject at the nonce stage.Holds under the reference architecture