{
  "tool_id": "art-17-ap2-mcp-policy-validator",
  "note": "golden_hash pinned (see vectors).",
  "vectors": [
    {
      "name": "conformant_mandate_emitted_by_art_16",
      "policy_parameters": {
        "payload": {
          "ap2_version": "1.0",
          "mandate_id": "google-ap2-mandate-builder-2026-07-31T00-00-00",
          "issued_at": "2026-07-31T00:00:00Z",
          "issued_by": "ainumbers.co",
          "tool_id": "google-ap2-mandate-builder",
          "tool_version": "1.1.0",
          "mandate_type": "compliance_control",
          "jurisdiction": [
            "BR",
            "US"
          ],
          "regulatory_frameworks": [
            "Google AP2 (ap2-protocol.org)"
          ],
          "payload": {
            "vdc_type": "CheckoutMandate",
            "vdc_stage": "open",
            "issuer": "did:web:agent.example.com",
            "merchant": "merchant.example.com"
          },
          "summary": "AINumbers Policy Mandate ABOUT a Google AP2 mandate artifact — 2026-07-31",
          "agent_instructions": [
            "Note: the payload concerns the EXTERNAL Google AP2 spec; sign the real VDC with the agent key and verify field names at ap2-protocol.org."
          ],
          "valid_from": "2026-07-31",
          "source_tool_inputs": {},
          "regulatory_citations": [
            "ap2-protocol.org",
            "github.com/google-agentic-commerce/AP2"
          ],
          "audit_metadata": {
            "client_side_executed": true,
            "zero_pii_verified": true,
            "deterministic_run": true
          }
        }
      },
      "output_payload": {
        "validated_payload_tool_id": "google-ap2-mandate-builder",
        "compliance_score": 93,
        "deprecated_fields_found": [],
        "agent_deployment_recommended": true,
        "field_results": [
          {
            "field": "ap2_version",
            "status": "PASS",
            "detail": "\"1.0\""
          },
          {
            "field": "mandate_id",
            "status": "PASS",
            "detail": "\"google-ap2-mandate-builder-2026-07-31T00-00-00\""
          },
          {
            "field": "issued_at",
            "status": "PASS",
            "detail": "\"2026-07-31T00:00:00Z\""
          },
          {
            "field": "issued_by",
            "status": "PASS",
            "detail": "\"ainumbers.co\""
          },
          {
            "field": "tool_id",
            "status": "PASS",
            "detail": "\"google-ap2-mandate-builder\""
          },
          {
            "field": "tool_version",
            "status": "PASS",
            "detail": "\"1.1.0\""
          },
          {
            "field": "mandate_type",
            "status": "PASS",
            "detail": "\"compliance_control\""
          },
          {
            "field": "jurisdiction",
            "status": "PASS",
            "detail": "Array: [BR, US]"
          },
          {
            "field": "payload",
            "status": "PASS",
            "detail": "Object with 4 key(s)"
          },
          {
            "field": "audit_metadata",
            "status": "PASS",
            "detail": "Object with 3 key(s)"
          },
          {
            "field": "mandate_type (enum)",
            "status": "PASS",
            "detail": "\"compliance_control\" is a valid mandate_type value."
          },
          {
            "field": "audit_metadata.client_side_executed",
            "status": "PASS",
            "detail": "Set to true."
          },
          {
            "field": "audit_metadata.zero_pii_verified",
            "status": "PASS",
            "detail": "Set to true."
          },
          {
            "field": "audit_metadata.deterministic_run",
            "status": "PASS",
            "detail": "Set to true."
          },
          {
            "field": "issued_at (ISO 8601)",
            "status": "PASS",
            "detail": "Valid ISO 8601: \"2026-07-31T00:00:00Z\""
          },
          {
            "field": "valid_from (ISO 8601)",
            "status": "PASS",
            "detail": "Valid ISO 8601: \"2026-07-31\""
          },
          {
            "field": "agent_instructions",
            "status": "PASS",
            "detail": "Array with 1 instruction(s)."
          },
          {
            "field": "jurisdiction (ISO 3166-1)",
            "status": "PASS",
            "detail": "Valid country codes: BR, US"
          }
        ],
        "note": "Validates a caller-supplied payload against the AINumbers Unified Build Contract v1.0 Policy Mandate field set. Distinct from Google’s external AP2 payments protocol."
      },
      "golden_hash": "c71da85a276be5ce573a15814493a727dbd68a569ee8d95e0c447362f937e2fa"
    },
    {
      "name": "legacy_version_with_deprecated_fields",
      "policy_parameters": {
        "payload": {
          "ap2_version": "1.0.0",
          "mandate_id": "google-ap2-mandate-builder-2026-07-31T00-00-00",
          "issued_at": "2026-07-31T00:00:00Z",
          "issued_by": "ainumbers.co",
          "tool_id": "google-ap2-mandate-builder",
          "tool_version": "1.1.0",
          "mandate_type": "compliance_control",
          "jurisdiction": [
            "Brazil"
          ],
          "regulatory_frameworks": [
            "Google AP2 (ap2-protocol.org)"
          ],
          "payload": {
            "vdc_type": "CheckoutMandate",
            "vdc_stage": "open",
            "issuer": "did:web:agent.example.com",
            "merchant": "merchant.example.com"
          },
          "summary": "AINumbers Policy Mandate ABOUT a Google AP2 mandate artifact — 2026-07-31",
          "agent_instructions": [
            "Note: the payload concerns the EXTERNAL Google AP2 spec; sign the real VDC with the agent key and verify field names at ap2-protocol.org."
          ],
          "valid_from": "2026-07-31",
          "source_tool_inputs": {},
          "regulatory_citations": [
            "ap2-protocol.org",
            "github.com/google-agentic-commerce/AP2"
          ],
          "audit_metadata": {
            "client_side_executed": true,
            "zero_pii_verified": false,
            "deterministic_run": true
          },
          "output_payload": {
            "legacy": true
          },
          "policy_parameters": {
            "legacy": true
          }
        }
      },
      "output_payload": {
        "validated_payload_tool_id": "google-ap2-mandate-builder",
        "compliance_score": 68,
        "deprecated_fields_found": [
          "output_payload",
          "policy_parameters"
        ],
        "agent_deployment_recommended": false,
        "field_results": [
          {
            "field": "ap2_version",
            "status": "FAIL",
            "detail": "ap2_version must be \"1.0\" (string), not \"1.0.0\". Update per UBC §3.1."
          },
          {
            "field": "mandate_id",
            "status": "PASS",
            "detail": "\"google-ap2-mandate-builder-2026-07-31T00-00-00\""
          },
          {
            "field": "issued_at",
            "status": "PASS",
            "detail": "\"2026-07-31T00:00:00Z\""
          },
          {
            "field": "issued_by",
            "status": "PASS",
            "detail": "\"ainumbers.co\""
          },
          {
            "field": "tool_id",
            "status": "PASS",
            "detail": "\"google-ap2-mandate-builder\""
          },
          {
            "field": "tool_version",
            "status": "PASS",
            "detail": "\"1.1.0\""
          },
          {
            "field": "mandate_type",
            "status": "PASS",
            "detail": "\"compliance_control\""
          },
          {
            "field": "jurisdiction",
            "status": "PASS",
            "detail": "Array: [Brazil]"
          },
          {
            "field": "payload",
            "status": "PASS",
            "detail": "Object with 4 key(s)"
          },
          {
            "field": "audit_metadata",
            "status": "PASS",
            "detail": "Object with 3 key(s)"
          },
          {
            "field": "mandate_type (enum)",
            "status": "PASS",
            "detail": "\"compliance_control\" is a valid mandate_type value."
          },
          {
            "field": "audit_metadata.client_side_executed",
            "status": "PASS",
            "detail": "Set to true."
          },
          {
            "field": "audit_metadata.zero_pii_verified",
            "status": "FAIL",
            "detail": "Must be true for UBC compliance (currently false)."
          },
          {
            "field": "audit_metadata.deterministic_run",
            "status": "PASS",
            "detail": "Set to true."
          },
          {
            "field": "issued_at (ISO 8601)",
            "status": "PASS",
            "detail": "Valid ISO 8601: \"2026-07-31T00:00:00Z\""
          },
          {
            "field": "valid_from (ISO 8601)",
            "status": "PASS",
            "detail": "Valid ISO 8601: \"2026-07-31\""
          },
          {
            "field": "agent_instructions",
            "status": "PASS",
            "detail": "Array with 1 instruction(s)."
          },
          {
            "field": "jurisdiction (ISO 3166-1)",
            "status": "WARN",
            "detail": "Some jurisdiction values may not be ISO 3166-1 alpha-2 codes."
          },
          {
            "field": "⚠ output_payload (DEPRECATED)",
            "status": "FAIL",
            "detail": "\"output_payload\" is a deprecated AP2 field and must be removed. See UBC §3.1."
          },
          {
            "field": "⚠ policy_parameters (DEPRECATED)",
            "status": "FAIL",
            "detail": "\"policy_parameters\" is a deprecated AP2 field and must be removed. See UBC §3.1."
          }
        ],
        "note": "Validates a caller-supplied payload against the AINumbers Unified Build Contract v1.0 Policy Mandate field set. Distinct from Google’s external AP2 payments protocol."
      },
      "golden_hash": "287d1484784caa68ec8e244ec203c4470334afc7801c0c3949c15f026127e722"
    }
  ]
}