Bind a client-built run proof of salted commitments to the active agent key and one-use nonce; appends an agent-action receipt carrying the runId (never a task, input or output value) and returns its hash with the /api/proof inclusion URL, plus a short-lived Obelisk-signed run token naming that receipt. If the receipt cannot be appended, no token is issued. The envelope has no salt field, so salts and the raw input/output stay client-side; the task travels as a hash plus an optional caller-set label. A legacy v1 envelope (unsalted hashes) is accepted and flagged unsalted-v1 in run.warnings.