Merge origin/main into site split

Resolve rename/modify conflicts from #828 (ar→obsigna browse-link
canonicalization) against the site/→site-obsigna/ move. Git auto-applied
main's edits to the moved mdx files; two mcp-proxy pages conflicted where
both sides touched the same link lines. Resolved by keeping the branch's
absolute cross-site URLs (agentreceipts.ai for spec pages) and applying
main's ar→obsigna rename to the GitHub browse links.

Both site/ and site-obsigna/ build successfully.

Author: ojongerius

AGENTS.md

@@ -73,7 +73,7 @@ After cloning, no extra setup is required: `go build`, `go test`, and `go vet` f
 - Never store plaintext secrets in receipts — parameters must be hashed before inclusion.
 - Ed25519 is the only supported signing algorithm. Do not introduce alternative or weaker schemes.
 - Validate all inputs at trust boundaries (function parameters, environment variables, stored data). Crypto code must reject invalid inputs explicitly, not silently degrade.
-- Report vulnerabilities via [GitHub Security Advisories](https://github.com/agent-receipts/ar/security/advisories/new), not public issues. See [SECURITY.md](SECURITY.md).
+- Report vulnerabilities via [GitHub Security Advisories](https://github.com/agent-receipts/obsigna/security/advisories/new), not public issues. See [SECURITY.md](SECURITY.md).
 
 ## Mindset
 

CONTEXT.md

@@ -10,7 +10,7 @@
 It is a **protocol first, library second**. Wire-format decisions outrank ergonomic API decisions.
 Implementations exist in three languages (TypeScript, Python, Go) and must agree byte-for-byte on the wire.
 
-The canonical home is `agentreceipts.ai`. The reference monorepo is `github.com/agent-receipts/ar`.
+The canonical home is `agentreceipts.ai`. The reference monorepo is `github.com/agent-receipts/obsigna`.
 
 ## Core domain terms
 

README.md

@@ -4,9 +4,12 @@
 
 **Cryptographically signed audit trails for AI agent actions**
 
-[![Go Tests](https://github.com/agent-receipts/ar/actions/workflows/sdk-go.yml/badge.svg)](https://github.com/agent-receipts/ar/actions/workflows/sdk-go.yml)
-[![TS Tests](https://github.com/agent-receipts/ar/actions/workflows/sdk-ts.yml/badge.svg)](https://github.com/agent-receipts/ar/actions/workflows/sdk-ts.yml)
-[![Python Tests](https://github.com/agent-receipts/ar/actions/workflows/sdk-py.yml/badge.svg)](https://github.com/agent-receipts/ar/actions/workflows/sdk-py.yml)
+[![Go Tests](https://github.com/agent-receipts/obsigna/actions/workflows/sdk-go.yml/badge.svg)](https://github.com/agent-receipts/obsigna/actions/workflows/sdk-go.yml)
+[![TS Tests](https://github.com/agent-receipts/obsigna/actions/workflows/sdk-ts.yml/badge.svg)](https://github.com/agent-receipts/obsigna/actions/workflows/sdk-ts.yml)
+[![Python Tests](https://github.com/agent-receipts/obsigna/actions/workflows/sdk-py.yml/badge.svg)](https://github.com/agent-receipts/obsigna/actions/workflows/sdk-py.yml)
+[![Daemon](https://github.com/agent-receipts/obsigna/actions/workflows/daemon.yml/badge.svg)](https://github.com/agent-receipts/obsigna/actions/workflows/daemon.yml)
+[![MCP Proxy](https://github.com/agent-receipts/obsigna/actions/workflows/mcp-proxy.yml/badge.svg)](https://github.com/agent-receipts/obsigna/actions/workflows/mcp-proxy.yml)
+[![Hook](https://github.com/agent-receipts/obsigna/actions/workflows/hook.yml/badge.svg)](https://github.com/agent-receipts/obsigna/actions/workflows/hook.yml)
 [![License: Apache-2.0](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](LICENSE)
 
 </div>
@@ -23,72 +26,72 @@
 
 ---
 
-## Start here
-
-The fastest way to try Agent Receipts is to put [`mcp-proxy/`](mcp-proxy/) in front of an MCP server you already use.
-
-In one step, you get:
-
-- Signed receipts for every tool call
-- A tamper-evident audit chain you can verify later
-- Risk scoring and policy hooks without changing the client or server
-
-If you want to audit GitHub MCP in a real agent workflow, start with:
+## What is this?
 
-- [Claude Desktop integration](https://agentreceipts.ai/mcp-proxy/claude-desktop/)
-- [Claude Code integration](https://agentreceipts.ai/mcp-proxy/claude-code/)
-- [Codex integration](https://agentreceipts.ai/mcp-proxy/codex/)
+**Agent Receipts** is an open protocol for producing cryptographically signed, tamper-evident records of AI agent actions. It defines the receipt format, signing scheme, chain structure, and taxonomy of action types. Anyone can implement it — in any language, in any runtime.
 
-## What is this?
+**Obsigna** is the reference toolset that implements the protocol:
 
-Agent Receipts is an open protocol and set of SDKs for producing cryptographically signed, tamper-evident records of AI agent actions. Every action an agent takes -- API calls, tool use, data access -- gets a verifiable receipt that can be audited later.
+| Tool | What it does |
+|------|-------------|
+| `obsigna-mcp` | MCP stdio proxy — signs every tool call, adds policy hooks |
+| `obsigna-daemon` | Out-of-process signing daemon — holds the key, owns the audit chain |
+| `obsigna-hook` | PostToolUse hook for Claude Code and other runtimes |
+| `obsigna` | CLI for browsing and verifying receipt databases |
+| `sdk/go`, `@obsigna/sdk-ts`, `obsigna` (Python) | SDKs for embedding receipt creation in your own code |
 
 <picture>
   <img alt="How it works: Authorize → Act → Sign → Link → Audit" src=".github/how-it-works.svg">
 </picture>
 
-## Project layout
+## Start here
 
-| Project | Description |
-|---------|-------------|
-| [`docs/adr/`](docs/adr/) | Architecture Decision Records |
-| [`spec/`](spec/) | Protocol specification, JSON schemas, governance |
-| [`sdk/go/`](sdk/go/) | Go SDK |
-| [`sdk/ts/`](sdk/ts/) | TypeScript SDK |
-| [`sdk/py/`](sdk/py/) | Python SDK |
-| [`daemon/`](daemon/) | Signing daemon — out-of-process key custody, shared audit chain |
-| [`mcp-proxy/`](mcp-proxy/) | MCP proxy with receipt signing, policy engine, intent tracking |
-| [`cross-sdk-tests/`](cross-sdk-tests/) | Cross-language verification tests |
-| [dashboard](https://github.com/agent-receipts/dashboard) | Local web UI for browsing and verifying receipt databases |
-| [openclaw](https://github.com/agent-receipts/openclaw) | Agent Receipts plugin for OpenClaw |
+Both paths below require the daemon — it holds the signing key and owns the audit chain. Install it first:
 
-## 10-minute audited MCP quick start
+```bash
+brew install agent-receipts/tap/obsigna
+obsigna daemon start
+```
 
-Install the proxy:
+**Fastest path — PostToolUse hook (Claude Code):** one config snippet and every tool call gets a signed receipt automatically:
 
-```bash
-go install github.com/agent-receipts/ar/mcp-proxy/cmd/obsigna-mcp@latest
+```json
+{
+  "hooks": {
+    "PostToolUse": [{ "matcher": "", "hooks": [{ "type": "command", "command": "obsigna-hook" }] }]
+  }
+}
 ```
 
-Wrap any MCP server:
+Add that to `~/.claude/settings.json`, then inspect the audit trail:
 
 ```bash
-obsigna-mcp node /path/to/mcp-server.js
+obsigna list
+obsigna show <seq>
+obsigna verify
 ```
 
-Then point your agent client at the proxy instead of the raw server:
+**More control — MCP proxy:** wraps any MCP server and adds policy hooks and risk scoring on top of signed receipts:
 
 - [Claude Desktop setup](https://agentreceipts.ai/mcp-proxy/claude-desktop/)
 - [Claude Code setup](https://agentreceipts.ai/mcp-proxy/claude-code/)
 - [Codex setup](https://agentreceipts.ai/mcp-proxy/codex/)
 
-Once your agent makes tool calls, inspect the signed audit trail:
+## Project layout
 
-```bash
-obsigna list
-obsigna show <seq>
-obsigna verify
-```
+| Project | Description |
+|---------|-------------|
+| [`spec/`](spec/) | Protocol specification, JSON schemas, governance |
+| [`sdk/go/`](sdk/go/) | Go SDK |
+| [`sdk/ts/`](sdk/ts/) | TypeScript SDK |
+| [`sdk/py/`](sdk/py/) | Python SDK |
+| [`daemon/`](daemon/) | Signing daemon — out-of-process key custody, shared audit chain |
+| [`mcp-proxy/`](mcp-proxy/) | MCP proxy with receipt signing, policy engine, intent tracking |
+| [`hook/`](hook/) | PostToolUse hook binary for Claude Code and other runtimes |
+| [`cross-sdk-tests/`](cross-sdk-tests/) | Cross-language verification tests |
+| [`docs/adr/`](docs/adr/) | Architecture Decision Records |
+| [dashboard](https://github.com/agent-receipts/dashboard) | Local web UI for browsing and verifying receipt databases |
+| [openclaw](https://github.com/agent-receipts/openclaw) | Agent Receipts plugin for OpenClaw |
 
 ## SDK quick start
 

SECURITY.md

@@ -9,7 +9,7 @@ Security fixes are applied to the latest release of each component. We do not ba
 **Do not report security vulnerabilities through public GitHub issues.**
 
 Instead, please use GitHub's **Report a vulnerability** feature on this repository:
-[Report a vulnerability](https://github.com/agent-receipts/ar/security/advisories/new)
+[Report a vulnerability](https://github.com/agent-receipts/obsigna/security/advisories/new)
 
 Include as much detail as possible: description, steps to reproduce, impact assessment, and any suggested fix.
 

collector/CHANGELOG.md

@@ -8,7 +8,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 This file starts at the `obsigna-collector` rename; earlier releases are recorded
 only in git history. A repo-wide effort to auto-generate changelogs from
 Conventional Commits is tracked in
-[#253](https://github.com/agent-receipts/ar/issues/253).
+[#253](https://github.com/agent-receipts/obsigna/issues/253).
 
 ## [Unreleased]
 

collector/README.md

@@ -163,6 +163,6 @@ database (under `t.TempDir()`) for the SQLite-adapter tests.
   — collector binary topology (`obsigna-collector`, `obsigna collector run`)
 - [ADR-0018](../docs/adr/0018-signer-abstraction-and-cloud-agnostic-keyprovider-design.md)
   — `Signer` interface (production key story for HTTP emitters)
-- Issue [#533](https://github.com/agent-receipts/ar/issues/533) — this work
-- Issue [#486](https://github.com/agent-receipts/ar/issues/486) — `HttpEmitter` (paired client work)
-- Issue [#536](https://github.com/agent-receipts/ar/issues/536) — operator guide
+- Issue [#533](https://github.com/agent-receipts/obsigna/issues/533) — this work
+- Issue [#486](https://github.com/agent-receipts/obsigna/issues/486) — `HttpEmitter` (paired client work)
+- Issue [#536](https://github.com/agent-receipts/obsigna/issues/536) — operator guide