none.private_beta.v1
Without signer env vars, public web receipts use an unsigned private-beta digest. That is fine for demos and schema testing, but verifiers should not treat it as production issuer proof.
Hekate Receipts
Move receipts from private beta digests to Ed25519 signatures.
Hekate Lite can already issue AgentSec-compatible receipts. Configure the receipt signer to make those receipts portable: verifiers can check issuer identity, evidence hash, policy hash, scanner version, and decision without trusting a screenshot or mutable dashboard.
ed25519.signer.v1
With an Ed25519 key configured, every new preflight receipt includes a public key PEM, signer id, and `ed25519:` signature that `/v1/receipts/verify` can validate.
Required env
Three values unlock portable receipt verification.
HEKATE_RECEIPT_ED25519_PRIVATE_KEY_PEM
Ed25519 PKCS#8 private key. Store only in Vercel/secret manager.
HEKATE_RECEIPT_KEY_ID
Stable public key id exposed by /v1/agentsec/trust.
HEKATE_RECEIPT_SIGNER_ID
Human-readable signer identity for issued receipts.
Operator sequence
Do this in order.
Generate
Run npm run hekate:receipt-keygen locally and store the private key outside the repo.
Configure
Add the three env vars to the Vercel Production environment for hekategate.com.
Redeploy
Redeploy the web project so new preflight responses sign with Ed25519.
Inspect
Check GET /v1/receipts/signing-status for the active signature scheme and key fingerprint.
Verify
Check /v1/agentsec/trust and submit a new receipt to /v1/receipts/verify.
Ed25519 signing proves Hekate issued a receipt over a specific evidence hash and policy hash. It does not certify mainnet flows, replace external review, or guarantee that an agent is safe.