Implement CommandLayer Python SDK with Ed25519 signing

[GsCommand]

Summary

This PR implements a complete Python SDK for CommandLayer that enables agents to sign and verify action receipts using Ed25519 cryptography. The implementation mirrors the TypeScript SDK's functionality while following Python conventions.

Key Changes

• Python SDK Implementation (python-sdk/commandlayer/__init__.py):

  • Added CommandLayer class with wrap() method to execute functions, record metadata, and sign receipts with Ed25519
  • Added verify() method to POST receipts to the CommandLayer verifier endpoint
  • Implemented canonical JSON serialization (_canonicalize()) with sorted keys for deterministic signing
  • Added Ed25519 private key loading and base64 signature encoding
  • Graceful handling of missing cryptography dependency with helpful error messages
  • Support for both signer and agent parameters (agent takes precedence)

• Schema Updates (src/schemas.trust-receipt-v1.json):

  • Flattened schema structure from nested allOf to direct property definitions
  • Updated proof field names: kid (was key_id), signer_id (was signer), alg (was signature_alg), canonical (was canonicalization)
  • Added explicit additionalProperties: false for stricter validation
  • Defined allowed verbs: verify, authenticate, authorize, attest, sign, permit, grant, approve, reject, endorse

• Documentation (python-sdk/README.md):

  • Added comprehensive quickstart guide with environment variable setup
  • Documented API surface: CommandLayer() constructor, wrap(), and verify() methods
  • Included receipt proof schema reference
  • Added installation instructions with optional crypto dependencies

• TypeScript SDK Refinements:

  • Added VerifyResult interface for type-safe verification responses
  • Removed deprecated privateKey parameter warning
  • Replaced console.log() with process.stdout.write() for cleaner output in examples
  • Updated example files to use dotenv/config for environment variable loading
  • Fixed verifier URL handling to use configured URL consistently

• Project Configuration:

  • Updated python-sdk/pyproject.toml with version 1.0.0 and proper description
  • Added optional crypto dependency group for cryptography package
  • Updated .env.example with CL_VERIFIER_URL configuration option

Implementation Details

• The Python SDK uses the same receipt format and signing algorithm (Ed25519 with base64 encoding) as the TypeScript implementation
• Execution metadata (duration, timestamps, status) is automatically captured during wrap() execution
• Errors during function execution are caught and recorded in the receipt with status "error"
• The verifier endpoint communication uses standard urllib with 10-second timeout
• Private key validation ensures only Ed25519 keys are accepted

https://claude.ai/code/session_01GQcff5HnFcrTbyuwuvsNEv