ORBPAY verification plane

Static, signed, public. No compute, no cookies, no per-merchant URLs, no write endpoint. Every file below except root.json and the issuer key sets is a compact JWS signed by the registry root key named in root.json.

• /v1/root.json — the registry root key set (pinned in the app binary)
• /v1/merchants/shard/{xx}.json — merchant entries, sharded by the first 2 hex of SHA-256(mid)
• /v1/status/merchants/{n}.json — bitstring status lists
• /v1/issuers/{iss}.json — issuer key sets, {iss} base64url-encoded
• /v1/history/merchants/{n}/{date}.json — daily snapshots

Verification is free and needs no ORBPAY service. This host answers GET and HEAD only.