{"service":"Jithox E-Invoice Readiness — signed receipts","algorithm":"Ed25519","receiptVersions":["1","2","3"],"activeKeyId":"canary-ed25519-79d92387ff24ad9a","keys":[{"keyId":"canary-ed25519-79d92387ff24ad9a","status":"active","alg":"Ed25519","alsoKnownAs":["canary-ed25519-302a300506032b65"],"publicKeyPem":"-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAEIxLYGnvDkc9GsHymAfbabfMuf9iXgSZ3uGGE79Zi+8=\n-----END PUBLIC KEY-----\n","jwk":{"crv":"Ed25519","x":"EIxLYGnvDkc9GsHymAfbabfMuf9iXgSZ3uGGE79Zi-8","kty":"OKP","kid":"canary-ed25519-79d92387ff24ad9a","use":"sig"}}],"canonicalization":{"v1":"newline-joined: 'jithox.receipt.v1', keyId, alg, executionId, requestHash, resultHash, tool, identityClass, usageRef, outcome, String(billable), ts","v2":"'jithox.receipt.v2' + '\\n' + canonical JSON of the receipt WITHOUT the signature field (object keys sorted lexicographically at every depth, undefined values dropped, arrays in order)","v3":"'jithox.receipt.v3' + '\\n' + canonical JSON of the receipt WITHOUT the keyId, alg and signature fields (same canonicalisation as v2). The context string is domain-separated, so a v3 receipt verified as v2 (or vice versa) fails closed."},"verification":{"guide":"https://mcp.jithox.com/docs#receipts","publicKeyPemUrl":"https://mcp.jithox.com/receipts/public-key.pem","verifierUrl":"https://mcp.jithox.com/receipts/verify-receipt.mjs","validSignatureMeans":"this exact receipt payload was produced by the Jithox canary signing key at issuance time and has not been altered since","validSignatureDoesNotMean":"no legal/fiscal/compliance guarantee, no proof the underlying VAT/VIES answer is still current, and no proof of payment beyond the referenced rail record","capabilityBinding":"v3 receipts carry capabilityId/capabilityVersion/toolId/toolVersion inside the signed payload. Verify those against the capability you expected: pass the expected capability id as the third argument to the published verifier."},"rotation":{"policy":"each key has a unique keyId (sha256 of its SPKI); on rotation the new key is ADDED here and previous public keys remain listed for at least 24 months; receipts are never re-signed or rewritten","legacyAlias":"canary-ed25519-302a300506032b65"}}