Verify Receipt

Verify the posted receipt file and return the verdict document.

The request body is the receipt verbatim -- whatever the operator dropped, of whatever content type. Nothing under .sdd and no key material is read: the verifier works from the file's own bytes, so this endpoint answers about the upload and not about the installation serving it.

The status is always 200 for a request that carried a body. A tampered receipt, a file that is not a receipt, and an empty drop are all verdicts about the evidence rather than failed requests, and each is the answer an operator dropped the file to get.

No key can be pinned through this endpoint, so the pass it reports is always the integrity-only tier and always carries the caveat saying so. A key arriving in the same request as the receipt is not an out-of-band anchor -- it is the same channel, and treating it as one would report provenance on the strength of the upload rather than of any evidence.