{
  "tool_id": "art-565-kya-x402-scope-verifier",
  "tool_version": "1.0.0",
  "display_name": "KYA Credential x x402 Payload Scope Verifier",
  "mcp_name": "verify_kya_x402_scope",
  "mandate_type": "compliance_mandate",
  "wave": 92,
  "gpu": false,
  "url": "https://ainumbers.co/chaingraph/art-565-kya-x402-scope-verifier.html",
  "description": "Cross-checks a declared KYA (Know Your Agent) credential's scope against a declared x402 PaymentPayload: amount vs the credential's spend cap, network/asset vs its allowed set, payee vs its merchant allowlist, validity window vs the payload's timestamps, and scope-string coverage of the payment scheme. Returns findings[] and a verdict of IN_SCOPE, OUT_OF_SCOPE, or INDETERMINATE (when the credential omits a claim the payload requires -- never guessed). Verify-only: never fetches either input, never contacts Skyfire or a facilitator, performs no signature verification, and never initiates or settles an x402 payment.",
  "input_schema_ref": "chaingraph/art-565-kya-x402-scope-verifier.html#manifest",
  "consumes": [],
  "feeds": [],
  "status": "live",
  "conformance_fixtures": true,
  "compute_capability": "server",
  "compute_images": [
    {"system":"sha256-source","image_id":"sha256:f6c593e542fe2fbd5e4226a231dff7ce88a280d8fa68cc757c9fe6602afe29f3","valid_from":"2026-07-10"},
    {"system":"risc0","image_id":"sha256:a1a0bc89b5b1febaeda3519f6dbade0fa5ac16beeb143c4e1b01689573567bc6","valid_from":"2026-08-07"}
  ],
  "export_capability": [
    "json"
  ],
  "compute_proof_ready": "ready",
  "compute_proof": {
    "type": "ZkVmReceipt",
    "system": "risc0",
    "receiptFormat": "groth16-bn254",
    "imageId": "sha256:a1a0bc89b5b1febaeda3519f6dbade0fa5ac16beeb143c4e1b01689573567bc6",
    "seal": "BHO67h0eMZvI3gWstPzGa8elXAfCKDN2jJ8oyU+KAugfsHnnRDQy58W3/GftIQ7eB6DyILXo3VbBgRsPp2cW8ShbZQWMM+2me9lPFYX81/2UfDf2Mdv+4D4UdV8+RG55FbsU/rFEfTeFWxx4cgtfTb/YrgBd596g61q2W6uBuMYsgAh0FWjpR8LLyYQAqQqHneMPxtRRidxfXM/hW4bwfRgCu33K+4+S2bFcEQ+ExViNPCdEM1Gpibq49ndt5KAtKk3cb5ODEnE1KAh7y2HDVxB6CDFCOCdeMh4+OzdK9ccevYOwyXA/wQrvdWEMOGthvwmML/g6T8MhFx58VqDGdg==",
    "journal": {
      "chaingraph_version": "0.4.0",
      "kernel_digest": "sha256:f6c593e542fe2fbd5e4226a231dff7ce88a280d8fa68cc757c9fe6602afe29f3",
      "output": {
        "credential_audience": "seller-agent-042",
        "credential_seller_service_id": "svc-abc123",
        "credential_subject": "buyer-agent-001",
        "findings": [
          {
            "check": "amount_vs_spend_cap",
            "detail": "payload value 5000000 vs credential spend_cap_amt 10000000",
            "pass": true
          },
          {
            "check": "network_vs_allowed_set",
            "detail": "payload network \"base\" vs credential allowed_networks [\"base\"]",
            "pass": true
          },
          {
            "check": "asset_vs_allowed_set",
            "detail": "payload asset \"0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48\" vs credential allowed_assets [\"0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48\"]",
            "pass": true
          },
          {
            "check": "payee_vs_merchant_allowlist",
            "detail": "payload payee \"0xMERCHANT0000000000000000000000000000beef\" vs credential payee_allowlist [\"0xMERCHANT0000000000000000000000000000beef\"]",
            "pass": true
          },
          {
            "check": "validity_window_vs_payload_timestamp",
            "detail": "payload window [1754400100, 1754400400] vs credential window [1754400000, 1754500000]",
            "pass": true
          },
          {
            "check": "scope_string_coverage",
            "detail": "payload scheme \"exact\" needs scope \"payments:x402:exact\" (or a wildcard) in credential scope [\"payments:x402:exact\"]",
            "pass": true
          }
        ],
        "indeterminate_reasons": [],
        "kya_claim_basis": "Skyfire kya-pay token claims (docs.skyfire.xyz/docs/common-token-claims.md, /docs/token-schemas.md, pinned 2026-08-06): documented sub/aud/ssi/sdm/iss/iat/exp/env/amt/cur/val. allowed_networks/allowed_assets/payee_allowlist/scope are this tool's own scope-representation extension, not documented Skyfire claims -- stated here so the distinction is never implied as pinned.",
        "note": "Cross-checks a declared KYA-shaped credential's scope (spend cap, allowed networks/assets, payee allowlist, validity window, scope strings) against a declared x402 PaymentPayload. Never fetches either, never contacts Skyfire or a facilitator, never verifies a signature, never initiates or settles a payment.",
        "payload_network": "base",
        "payload_scheme": "exact",
        "rationale": [
          "Ran 6 evaluable check(s) (amount vs spend cap, network vs allowed set, asset vs allowed set, payee vs merchant allowlist, validity window vs payload timestamp, scope string coverage); 0 check(s) could not run because the credential omitted a claim the payload requires.",
          "amount_vs_spend_cap: PASS -- payload value 5000000 vs credential spend_cap_amt 10000000",
          "network_vs_allowed_set: PASS -- payload network \"base\" vs credential allowed_networks [\"base\"]",
          "asset_vs_allowed_set: PASS -- payload asset \"0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48\" vs credential allowed_assets [\"0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48\"]",
          "payee_vs_merchant_allowlist: PASS -- payload payee \"0xMERCHANT0000000000000000000000000000beef\" vs credential payee_allowlist [\"0xMERCHANT0000000000000000000000000000beef\"]",
          "validity_window_vs_payload_timestamp: PASS -- payload window [1754400100, 1754400400] vs credential window [1754400000, 1754500000]",
          "scope_string_coverage: PASS -- payload scheme \"exact\" needs scope \"payments:x402:exact\" (or a wildcard) in credential scope [\"payments:x402:exact\"]",
          "Verify-only: this kernel never initiates, signs, or settles an x402 payment (x402 EXECUTION is a KILLED ledger row). It performs no signature verification -- the pinned Skyfire docs (2026-08-06) do not specify a caller-reproducible KYA signing scheme in this context, so this is a scope cross-check only.",
          "Skyfire kya-pay token claims (docs.skyfire.xyz/docs/common-token-claims.md, /docs/token-schemas.md, pinned 2026-08-06): documented sub/aud/ssi/sdm/iss/iat/exp/env/amt/cur/val. allowed_networks/allowed_assets/payee_allowlist/scope are this tool's own scope-representation extension, not documented Skyfire claims -- stated here so the distinction is never implied as pinned."
        ],
        "rejected_inputs": [],
        "verdict": "IN_SCOPE"
      }
    }
  }
}