{
  "tool_id": "art-596-ap2-x402-cart-correlation",
  "tool_version": "1.0.0",
  "display_name": "Ap2 X402 Cart Correlation",
  "mcp_name": "correlate_ap2_cartmandate_x402",
  "mandate_type": "compliance_control",
  "wave": 107,
  "gpu": false,
  "url": "https://ainumbers.co/chaingraph/art-596-ap2-x402-cart-correlation.html",
  "description": "Correlates a built AP2 CartMandate (cart_root, cart_items, merchant) against an x402_spend_evidence pack: does the cart total (sum of quantity*unit_price per currency) match the x402 authorization's value, does the CartMandate's merchant map to the authorization's recipient address, and does the CartMandate's own hash-chain independently re-verify against the supplied cart_items (never trusted as a self-reported flag). Output vocabulary is CORRELATION_STATUS (CORRELATED / NOT_CORRELATED / INDETERMINATE) -- this is a plausibility check over two independently-produced artifacts, never a cryptographic binding. Google has not shipped an AP2-compatible x402 extension; no field or code path here implies one exists. Zero network calls; never a facilitator, proxy, gateway, or settlement relay.",
  "input_schema_ref": "chaingraph/art-596-ap2-x402-cart-correlation.html#manifest",
  "consumes": [
    "art-595-ap2-cartmandate-hashchain-builder"
  ],
  "feeds": [],
  "status": "live",
  "conformance_fixtures": true,
  "compute_capability": "server",
  "compute_images": [
    {
      "system": "sha256-source",
      "image_id": "sha256:bd768b21783024010879049cb1560f975da0ac0a210a9fde5da62dca74523c81",
      "valid_from": "2026-08-18"
    },
    {
      "system": "risc0",
      "image_id": "sha256:a1a0bc89b5b1febaeda3519f6dbade0fa5ac16beeb143c4e1b01689573567bc6",
      "valid_from": "2026-08-21"
    }
  ],
  "export_capability": [
    "json"
  ],
  "standards_basis": "not_applicable",
  "cited_clause_digest": [],
  "compute_proof_ready": "ready",
  "compute_proof": {
    "type": "ZkVmReceipt",
    "system": "risc0",
    "receiptFormat": "groth16-bn254",
    "imageId": "sha256:a1a0bc89b5b1febaeda3519f6dbade0fa5ac16beeb143c4e1b01689573567bc6",
    "seal": "ACUZfUSrDvBjI2KqIPNmcaZoEvDK9E/e0AoS7eZGiWgiSxSL5LLePLbW3bmbS3KeBwRO2ylxqAcScLYEJblPCxmOYDvFcUxhbVIa+iGgKXyWpU3S9b61i0X5hKZUnlB0BPiJJJgQF31C6hoCSIT6hOCi1CzuSpdwBLIeOaGmFtknhBYwQvNcPZbgIBMFNO3pyT5p3ISzwNMeHKUXamC9dy5YFW+/LhV6NZe73ZABwvd53tQHAtODVlbpqNCP/2CcISWIzRkpTG2ZmUZZw/LpQlPfM4o7Ms4MFz1KEjUuMHcTcqTWaLyXK7GA1PaMfbaFUWF3fbulGDedhiNO/K5UEA==",
    "journal": {
      "chaingraph_version": "0.4.0",
      "kernel_digest": "sha256:bd768b21783024010879049cb1560f975da0ac0a210a9fde5da62dca74523c81",
      "output": {
        "cart_chain_intact": true,
        "cart_total_matches_authorization_value": true,
        "correlation_status": "CORRELATED",
        "disclosure": "This tool observes that the cart total and merchant identity are consistent with the x402 authorization's amount and recipient. It does not cryptographically bind the two -- no signature, hash, or on-chain reference ties this specific CartMandate to this specific x402 authorization. A party could present a valid CartMandate alongside an unrelated valid x402 authorization and this check would still report CORRELATED.",
        "merchant_matches_authorization_to": true,
        "reasons": []
      }
    }
  }
}