Is the market open?
Signed. No signup.

The one use case

Don't let my agent trade into a halted venue.

Your loop is autonomous. It picks a trade. Before it acts, you want a cryptographic check that the venue is actually open. If anything is unclear — the API is unreachable, the receipt is stale, the signature doesn't match, the venue is HALTED, the venue's status is UNKNOWN — the loop halts. UNKNOWN is treated as CLOSED. That is the fail-closed contract.

1. 1

   Fetch a signed receipt (free, no key)

   Unauthenticated. Rate-limited at the edge. Returns the same authoritative receipt as the paid /v5/status — byte-equivalent canonical bytes for the same MIC at the same instant.

   copy

   $ curl https://headlessoracle.com/v1/status/XNYS
   
   {
     "receipt_id":     "8c2a…",
     "issued_at":      "2026-06-14T13:42:11.000Z",
     "expires_at":     "2026-06-14T13:43:11.000Z",
     "issuer":         "headlessoracle.com",
     "mic":            "XNYS",
     "status":         "OPEN",
     "source":         "SCHEDULE",
     "halt_detection": "active",
     "receipt_mode":   "live",
     "schema_version": "v5.0",
     "public_key_id":  "key_2026_v1",
     "signature":      "f3a…",                          // 64-byte Ed25519, hex
     "receipt":        { …same flat fields above… },    // unsigned wrapper — mirror, do not include in canonical bytes
     "discovery_url":  "…/.well-known/mcp/server-card.json"   // unsigned wrapper — discovery only
   }

   Signed canonical payload is the flat field set above (everything except signature, receipt, and discovery_url), sorted alphabetically and JSON-stringified with no whitespace. receipt and discovery_url are unsigned wrapper fields — exclude them before verifying or you will get INVALID_SIGNATURE. The @headlessoracle/verify SDK strips them automatically via its UNSIGNED_WRAPPER_FIELDS allowlist.

2. 2

   Drop the guard into your loop (npm)

   Five lines. safeToExecute() fetches the receipt, verifies the signature, enforces your freshness policy, checks the MIC, checks the venue is OPEN. Any failure mode → safe: false with a machine-readable reason. The receipt is returned either way — log it.

   copy

   $ npm install @headlessoracle/verify
   
   import { safeToExecute } from '@headlessoracle/verify';
   
   const { safe, reason, receipt } = await safeToExecute('XNYS', {
     max_attestation_age: 30,  // seconds — YOUR freshness policy. No default.
   });
   
   // Log the artifact whichever way the decision went — receipt is the audit trail.
   logEvent({ kind: 'pretrade-gate', safe, reason, receipt });
   
   if (!safe) return;          // fail-closed: do nothing
   await placeOrder(/* ... */);

   max_attestation_age is required. There is no default — the IETF environment.* family rule is that the relying party declares its own freshness policy. Tight is safe — your relying-party policy should typically be shorter than HO's TTL.

3. 3

   Gate on-chain too — receipt-or-revert (Solidity)

   A Solidity reference implementation of the same pattern: contracts/HaltGuard.sol. Pass the canonical signed bytes; the contract verifies the Ed25519 signature against HO's published public key, binds your freshness window to the signed issued_at, and reverts unless the venue is OPEN. Reference code — not audited for production.

   copy

   // In your trading contract, before any state-changing action:
   haltGuard.checkSafe(
       canonicalReceiptBytes,   // alpha-sorted JSON form of receipt minus signature
       signature,               // the Ed25519 signature returned by /v1/status
       issuedAtIso              // receipt.issued_at — bound to signed bytes inside
   );
   // If checkSafe() returns, the venue is OPEN, the receipt is fresh, and the
   // signature is valid. If anything fails — the call reverts.

   Ed25519 on EVM is non-trivial. The reference contract abstracts the verifier via IEd25519Verifier; plug in a chain-native precompile (Solana, Aptos, Sui, some L2s) or a Solidity library where no precompile exists.