# Stapled Resolve, v1

A site serves its own CrawlCheck verdict, so an agent can check it with no extra request and CrawlCheck never learns which site was visited.

## Site side

1. GET https://crawlcheck.io/api/v1/staple?domain=<your domain>
2. Send the record on every response:

    CrawlCheck-Staple: v=ccr1;d=example.com;st=measured;read=allow;...;s=<signature>

3. Serve the whole JSON document at /.well-known/crawlcheck-staple.json.
4. Fetch a fresh staple before refresh_after (at the latest before fresh_until).

## Agent side

Verify the record offline, exactly as a Resolve-over-DNS record (https://crawlcheck.io/spec/resolve-dns):

- k is the RFC 7638 thumbprint of x, and k is a key CrawlCheck publishes (/.well-known/http-message-signatures-directory; cache it).
- s is a valid Ed25519 signature over "crawlcheck-dns-v1\n" + the record up to ";s=".
- d is the host you sent the request to, or a parent domain of it.
- f (fresh_until) is in the future. An expired staple is ignored: ask CrawlCheck instead.

Then act on read / cite / connect / transact as you would on a Resolve answer. The SDKs do this: stapleCheck() and resolveFor(domain, { staple }) in @crawlcheck/sdk, staple_check() and resolve_for() in the Python package.