{
  "tool_id": "art-548-vop-readiness-diagnostic",
  "note": "OCG Standard §25 ocg-private-input@1. policy_parameters carries ONLY the sha256-salted@1 commitments to the private IBAN/payee-name/account-holder-id witness — never the values themselves. Disclosure material (salts + plaintext) for these vectors lives OUT-OF-BAND in art-548-vop-readiness-diagnostic.disclosure.json (test-only, never shipped as a live artifact field). Vector 1: exact match, PSP response code consistent. Vector 2: caller-declared match_score falls below both thresholds (no_match) but the PSP declared MTCH — a genuine consistency mismatch, flagged not corrected. Vector 3: no match_score provided (not_verifiable), PSP declared NVRF, consistent.",
  "vectors": [
    {
      "name": "exact_match_consistent",
      "description": "match_score 0.97 clears match_threshold_exact 0.9 -> classification match. PSP-declared response code MTCH maps to match -> consistent.",
      "policy_parameters": {
        "iban_commitment": "sha256:d0261b5555a4df1d5fbed786c9a8977e8196c81c8859cfcf683fadfea157ea91",
        "payee_name_commitment": "sha256:47048eda633d4509b69fc56390c9240f0e33d759b98493d3cc7385bd672b8815",
        "match_threshold_exact": 0.9,
        "match_threshold_close": 0.7,
        "psp_vop_response_code": "MTCH"
      },
      "output_payload": {
        "classification": "match",
        "match_score_provided": true,
        "psp_vop_response_code": "MTCH",
        "psp_declared_maps_to": "match",
        "consistent": true,
        "scope_note": "This is a readiness/consistency diagnostic over caller-declared inputs, not a claim that this node performed IBAN or payee-name verification. It does not query any IBAN or account-holder directory and does not implement the EPC VoP fuzzy name-matching algorithm.",
        "regulatory_basis": "EU Instant Payments Regulation (Regulation (EU) 2024/886), Verification-of-Payee obligation — in force 2025-10-09 for euro-area PSPs, 2027-07-09 for non-euro-area PSPs. The EPC VoP Rulebook leaves the fuzzy name-matching algorithm to vendor-selected engines with EBA-suggested, not mandated, thresholds; this diagnostic only recomputes the deterministic threshold classification and cross-checks it against the PSP-declared response code.",
        "pii_note": "ZERO plaintext PII disclosed: the IBAN, payee name, and account-holder identifier (if collected) are private witnesses, committed via sha256-salted@1 (OCG Standard §25 ocg-private-input@1) and never present in policy_parameters or output_payload in the clear. Only the threshold classification and consistency verdict are public.",
        "not_legal_advice": "Not legal advice. A Verification-of-Payee readiness determination requires review by a qualified payments-compliance officer against the applicable PSP VoP Rulebook implementation."
      },
      "golden_hash": "d7c53941224bef030348957dff47c55f12db3636b3f4aa5ff46486c942b1a0e9"
    },
    {
      "name": "score_response_code_mismatch",
      "description": "match_score 0.55 is below match_threshold_close 0.7 -> classification no_match, but the PSP declared response code MTCH (maps to match). consistent:false — flagged, never silently corrected. Includes an optional account_holder_id commitment.",
      "policy_parameters": {
        "iban_commitment": "sha256:231a0fb60b0e14fe7baafab36d3623aa90159ec4edb68f45020ea37dff1b2455",
        "payee_name_commitment": "sha256:8f13f26a5761f7e2d00a3d372f4f300ef8c70c4e4b42a03cf0a2e0ca55116a3a",
        "account_holder_id_commitment": "sha256:c6aa12e787640fd46fcf032cbb6f523df432bc92335f65c777220970638094d1",
        "match_threshold_exact": 0.9,
        "match_threshold_close": 0.7,
        "psp_vop_response_code": "MTCH"
      },
      "output_payload": {
        "classification": "no_match",
        "match_score_provided": true,
        "psp_vop_response_code": "MTCH",
        "psp_declared_maps_to": "match",
        "consistent": false,
        "scope_note": "This is a readiness/consistency diagnostic over caller-declared inputs, not a claim that this node performed IBAN or payee-name verification. It does not query any IBAN or account-holder directory and does not implement the EPC VoP fuzzy name-matching algorithm.",
        "regulatory_basis": "EU Instant Payments Regulation (Regulation (EU) 2024/886), Verification-of-Payee obligation — in force 2025-10-09 for euro-area PSPs, 2027-07-09 for non-euro-area PSPs. The EPC VoP Rulebook leaves the fuzzy name-matching algorithm to vendor-selected engines with EBA-suggested, not mandated, thresholds; this diagnostic only recomputes the deterministic threshold classification and cross-checks it against the PSP-declared response code.",
        "pii_note": "ZERO plaintext PII disclosed: the IBAN, payee name, and account-holder identifier (if collected) are private witnesses, committed via sha256-salted@1 (OCG Standard §25 ocg-private-input@1) and never present in policy_parameters or output_payload in the clear. Only the threshold classification and consistency verdict are public.",
        "not_legal_advice": "Not legal advice. A Verification-of-Payee readiness determination requires review by a qualified payments-compliance officer against the applicable PSP VoP Rulebook implementation."
      },
      "golden_hash": "8ff51d47ca3f724ddbe24a7d819a99998f759dbb59b3791353c96c8b2471a926"
    },
    {
      "name": "no_score_not_verifiable_consistent",
      "description": "No match_score supplied -> classification not_verifiable. PSP-declared response code NVRF maps to not_verifiable -> consistent.",
      "policy_parameters": {
        "iban_commitment": "sha256:f3c06f6ae5aec54d0f742541ab717dd78bd09d20a83a7fe5a4556e7d20d38ba6",
        "payee_name_commitment": "sha256:701128fa67fd6b39e3e7cf2ef0c520257b230d2ee779a6e233cd385dadfea9ac",
        "match_threshold_exact": 0.9,
        "match_threshold_close": 0.7,
        "psp_vop_response_code": "NVRF"
      },
      "output_payload": {
        "classification": "not_verifiable",
        "match_score_provided": false,
        "psp_vop_response_code": "NVRF",
        "psp_declared_maps_to": "not_verifiable",
        "consistent": true,
        "scope_note": "This is a readiness/consistency diagnostic over caller-declared inputs, not a claim that this node performed IBAN or payee-name verification. It does not query any IBAN or account-holder directory and does not implement the EPC VoP fuzzy name-matching algorithm.",
        "regulatory_basis": "EU Instant Payments Regulation (Regulation (EU) 2024/886), Verification-of-Payee obligation — in force 2025-10-09 for euro-area PSPs, 2027-07-09 for non-euro-area PSPs. The EPC VoP Rulebook leaves the fuzzy name-matching algorithm to vendor-selected engines with EBA-suggested, not mandated, thresholds; this diagnostic only recomputes the deterministic threshold classification and cross-checks it against the PSP-declared response code.",
        "pii_note": "ZERO plaintext PII disclosed: the IBAN, payee name, and account-holder identifier (if collected) are private witnesses, committed via sha256-salted@1 (OCG Standard §25 ocg-private-input@1) and never present in policy_parameters or output_payload in the clear. Only the threshold classification and consistency verdict are public.",
        "not_legal_advice": "Not legal advice. A Verification-of-Payee readiness determination requires review by a qualified payments-compliance officer against the applicable PSP VoP Rulebook implementation."
      },
      "golden_hash": "3099f53c4ef3a633c57d72137ed69edecdad9ff9703fbe8d44662b541c501f6b"
    }
  ]
}