Correlates a built AP2 CartMandate (ART-595: cart_root, cart_items, merchant) against an x402_spend_evidence pack (assembled from the x402-spend-evidence chain): does the cart total (sum(quantity×unit_price) per currency) match authorization.value; does merchant map to authorization.to. The cart hash-chain is independently re-verified here, never trusted from the CartMandate's own self-reported flag.
Google has not shipped an AP2-compatible x402 extension. No kernel anywhere in this repo, and no published AP2 spec text, defines a cryptographic binding between an AP2 mandate and an x402 payment authorization. This tool observes that the cart total and merchant identity are consistent with the x402 authorization's amount and recipient. It does not cryptographically bind the two: no signature, hash, or on-chain reference ties this specific CartMandate to this specific x402 authorization. A party could present a valid CartMandate alongside an unrelated valid x402 authorization and this check would still report CORRELATED.
cart_root blank and use "Fill Worked Example" below to see a fully CORRELATED run.authorization.to and authorization.value are read by this correlation check. The rest of the pack (digest, domain checks, signer recovery) is the x402-spend-evidence chain's own concern, echoed here for reference only.