GARL Protocol — Cryptographic verification for AI code

# GARL Protocol — Cryptographic verification for AI code GARL signs every AI-authored commit with ECDSA-secp256k1; receipts are immutable, and their batch Merkle roots are anchored on Base mainnet (MerkleAnchor 0xBeD7EdeFbEb02be9682bCdeC5fb5D7DA28b1b6F2, chain 8453 — inclusion is verifiable on-chain). Starting with code; agent reputation is a secondary surface. ## Primary surface — GARL for Code - Landing page: https://garl.ai/for-code - Live receipt example: https://garl.ai/r/6ff83db8 - GitHub Action: https://github.com/marketplace/actions/garl-receipt Five-line workflow wires the canonical registry: ```yaml # .github/workflows/garl-receipt.yml name: GARL Receipt on: [pull_request] jobs: sign: runs-on: ubuntu-latest permissions: { contents: read, pull-requests: write, checks: write } steps: - uses: actions/checkout@v4 with: { fetch-depth: 0 } - uses: Garl-Protocol/garl-receipt-action@v1 with: garl-api-key: ${{ secrets.GARL_API_KEY }} garl-agent-id: ${{ secrets.GARL_AGENT_ID }} ``` Every PR gets a sticky comment with receipt URLs that the reviewer (or an auditor) can verify offline against the canonical key registry. ## Verification endpoints (public, no auth) - GET https://api.garl.ai/api/v1/verify/{trace_hash} — resolves 8-64 hex prefixes; returns stored certificate (no re-sign), signing_epoch, key_id, and signing key pointer. - GET https://api.garl.ai/api/v1/receipts/{trace_hash}/cert.json — raw stored certificate only. Strictly immutable per hash. - GET https://api.garl.ai/.well-known/garl-keys.json — JWKS-style public key registry (active + retired keys). - GET https://api.garl.ai/api/v1/keys — mirror of the registry. Signatures are RFC 6979 deterministic ECDSA-secp256k1 over canonical JSON (sorted keys, no whitespace). Same input ⇒ same signature. ## Compliance evidence (EU AI Act Code of Practice, CA SB 942, ISO 42001) GET https://api.garl.ai/api/v1/agents/{agent_