Confirm a caller-supplied JWKS directory document is the SAME document the caller pinned out-of-band at onboarding time, before art-130 trusts its internal shape. Computes sha256(canonicalize(directory_jwks)) and compares it to a caller-supplied pinned_digest. This tool never fetches, stores, serves, or redistributes anyone's keys: both the document and the digest are supplied by you.
visa-tap-agent-verification chain (art-129 → nonce-replay-check → art-609 → art-130), placed BEFORE art-130 so a substituted directory fails before its internal shape is even checked. What this checks: sha256(canonicalize(directory_jwks)) === pinned_digest, where canonicalize() is this codebase's one JCS/RFC-8785 canon (recursive key-sort by Unicode code point, array order preserved), hashed as lowercase hex. What it cannot know: whether your out-of-band pinning process itself was sound, since the digest-pinning check's correctness depends entirely on how and when you captured pinned_digest. Hard rail: this tool never fetches a directory from the network and never serves keys to others, it only does arithmetic over two documents you already hold.execution_hash as a parent hash when calling validate_signature_directory (art-130) to continue the visa-tap-agent-verification chain. The pin-check runs first, so a substituted directory never reaches art-130's shape check.