Motivation

• Provide a single unified entrypoint POST /execute so clients can call the runtime without using versioned per-verb paths while preserving the existing tracing/signing/receipt semantics.
• Keep all existing per-verb routes and /verify behavior unchanged so the runtime remains the single source of truth for verb implementations and receipts.

Description

• Add a minimal POST /execute route to server.mjs that resolves the target verb from execution.verb first and falls back to top-level verb, returning JSON 400 when neither is present.
• The route dispatches directly into the existing handleVerb(verb, req, res) so trace, signing, and receipt generation behavior remain identical and unknown/disabled verbs are handled by handleVerb (resulting in JSON 404).
• Add tests in runtime/tests/runtime-signing.test.mjs that verify POST /execute with execution.verb=clean, fallback to top-level verb=summarize, error cases (missing verb -> 400, unknown verb -> 404), and that legacy per-verb route (/clean/v1.1.0) still works.
• Files changed: server.mjs and runtime/tests/runtime-signing.test.mjs.

Testing

• Ran the focused runtime tests with node --test runtime/tests/runtime-signing.test.mjs and all tests in that file passed.
• Ran the repo-local CI checks with npm test (which runs unit tests and the smoke test) and the full test suite passed.
• The new tests exercise the unified entrypoint and confirm receipts still use the canonical commons entry https://runtime.commandlayer.org/execute and that existing per-verb routes are unaffected.

Codex Task