{
  "tool_id": "art-595-ap2-cartmandate-hashchain-builder",
  "note": "golden_hash filled by `node golden-parity.test.mjs --update`. The hash-chain semantics (link_0/link_i/cart_root over keccak256(canon(...))) are specified in SPEC-AGENT-COMMERCE-CHAIN-1-2026-08-09.md section 5 and reuse the same cgCanon() this repo's _hash.mjs executionHash() already uses, plus the same vendored @noble/hashes keccak_256 bundle SPEC-X402-CRYPTO-CORE-1-2026-08-09.md section 3 already named -- no new vendoring, no hand-rolled canonicalization or hashing.",
  "vectors": [
    {
      "name": "two-item-open-cart",
      "policy_parameters": {
        "agent_id": "did:example:agent-001",
        "subject": "did:example:subject-001",
        "merchant": "shop.example.com",
        "stage": "open",
        "cart_items": [
          {
            "sku": "SKU-100",
            "description": "Widget",
            "quantity": 2,
            "unit_price": 9.99,
            "currency": "USD"
          },
          {
            "sku": "SKU-200",
            "description": "Gadget",
            "quantity": 1,
            "unit_price": 24.5,
            "currency": "USD"
          }
        ]
      },
      "output_payload": {
        "vdc": {
          "@context": [
            "https://www.w3.org/ns/credentials/v2",
            "https://ap2-protocol.org/context/v1"
          ],
          "type": [
            "VerifiableCredential",
            "CartMandate"
          ],
          "issuer": "did:example:agent-001",
          "credentialSubject": {
            "id": "did:example:subject-001",
            "mandateType": "cart",
            "stage": "open",
            "merchant": "shop.example.com",
            "cart_items": [
              {
                "sku": "SKU-100",
                "description": "Widget",
                "quantity": 2,
                "unit_price": 9.99,
                "currency": "USD"
              },
              {
                "sku": "SKU-200",
                "description": "Gadget",
                "quantity": 1,
                "unit_price": 24.5,
                "currency": "USD"
              }
            ],
            "cart_root": "0x2eeb01a35e5facd325ab3b60ba97fe4d26222584419fdf93106d3ca3575729fb",
            "chain_length": 2
          },
          "proof": {
            "type": "DataIntegrityProof",
            "cryptosuite": "eddsa-2022",
            "verificationMethod": "did:example:agent-001#key-1",
            "proofPurpose": "assertionMethod",
            "proofValue": "<ILLUSTRATIVE — sign with the agent key>"
          }
        },
        "vdc_type": "CartMandate",
        "cart_root": "0x2eeb01a35e5facd325ab3b60ba97fe4d26222584419fdf93106d3ca3575729fb",
        "chain_length": 2,
        "chain_links": [
          "0xfce9e5feb64ec005b5f801ecf528a63503dd72c23bf12783816a527f5cfaf05f",
          "0x2eeb01a35e5facd325ab3b60ba97fe4d26222584419fdf93106d3ca3575729fb"
        ],
        "cart_chain_intact": true,
        "first_divergent_index": null,
        "note": "Illustrative AP2 CartMandate hash-chain skeleton (external Google AP2 payments-protocol shape, ap2-protocol.org) -- distinct from the AINumbers Policy Mandate. This chain proves the ordered cart_items list was not altered after the chain was built -- nothing more. It does NOT prove the mandate was authorised by a human, that goods were delivered, that the merchant accepted the cart, that any payment occurred, or that item prices are correct or current (unit_price is caller-supplied, unchecked against any catalog). Zero network calls; never a facilitator, proxy, gateway, or settlement relay. Sign with the agent key and verify against the live AP2 spec before real use.",
        "reasons": []
      },
      "golden_hash": "1d42d337847fc86514c7d303b83872de1423fabe1aa8d95b80911168b47a2a4d"
    },
    {
      "name": "single-item-closed-cart",
      "policy_parameters": {
        "agent_id": "did:example:agent-002",
        "subject": "did:example:subject-002",
        "merchant": "store.example.org",
        "stage": "closed",
        "cart_items": [
          {
            "sku": "ONLY-1",
            "description": "Single Item",
            "quantity": 1,
            "unit_price": 5,
            "currency": "EUR"
          }
        ]
      },
      "output_payload": {
        "vdc": {
          "@context": [
            "https://www.w3.org/ns/credentials/v2",
            "https://ap2-protocol.org/context/v1"
          ],
          "type": [
            "VerifiableCredential",
            "CartMandate"
          ],
          "issuer": "did:example:agent-002",
          "credentialSubject": {
            "id": "did:example:subject-002",
            "mandateType": "cart",
            "stage": "closed",
            "merchant": "store.example.org",
            "cart_items": [
              {
                "sku": "ONLY-1",
                "description": "Single Item",
                "quantity": 1,
                "unit_price": 5,
                "currency": "EUR"
              }
            ],
            "cart_root": "0x505b4ed8f5b51d9eaaa35a74a2fd139c0abcd857a41410366e430af83dbece8a",
            "chain_length": 1
          },
          "proof": {
            "type": "DataIntegrityProof",
            "cryptosuite": "eddsa-2022",
            "verificationMethod": "did:example:agent-002#key-1",
            "proofPurpose": "assertionMethod",
            "proofValue": "<ILLUSTRATIVE — sign with the agent key>"
          }
        },
        "vdc_type": "CartMandate",
        "cart_root": "0x505b4ed8f5b51d9eaaa35a74a2fd139c0abcd857a41410366e430af83dbece8a",
        "chain_length": 1,
        "chain_links": [
          "0x505b4ed8f5b51d9eaaa35a74a2fd139c0abcd857a41410366e430af83dbece8a"
        ],
        "cart_chain_intact": true,
        "first_divergent_index": null,
        "note": "Illustrative AP2 CartMandate hash-chain skeleton (external Google AP2 payments-protocol shape, ap2-protocol.org) -- distinct from the AINumbers Policy Mandate. This chain proves the ordered cart_items list was not altered after the chain was built -- nothing more. It does NOT prove the mandate was authorised by a human, that goods were delivered, that the merchant accepted the cart, that any payment occurred, or that item prices are correct or current (unit_price is caller-supplied, unchecked against any catalog). Zero network calls; never a facilitator, proxy, gateway, or settlement relay. Sign with the agent key and verify against the live AP2 spec before real use.",
        "reasons": []
      },
      "golden_hash": "717186fe600d0a2574d0ae76cdb9ccc870b0554fafd2811a13bae076d3423b1c"
    },
    {
      "name": "deliberately-broken-chain-tampered-item",
      "policy_parameters": {
        "agent_id": "did:example:agent-001",
        "subject": "did:example:subject-001",
        "merchant": "shop.example.com",
        "stage": "open",
        "cart_items": [
          {
            "sku": "SKU-100",
            "description": "Widget",
            "quantity": 2,
            "unit_price": 9.99,
            "currency": "USD"
          },
          {
            "sku": "SKU-200",
            "description": "Gadget",
            "quantity": 1,
            "unit_price": 999,
            "currency": "USD"
          }
        ],
        "claimed_links": [
          "0xfce9e5feb64ec005b5f801ecf528a63503dd72c23bf12783816a527f5cfaf05f",
          "0x2eeb01a35e5facd325ab3b60ba97fe4d26222584419fdf93106d3ca3575729fb"
        ]
      },
      "output_payload": {
        "vdc": {
          "@context": [
            "https://www.w3.org/ns/credentials/v2",
            "https://ap2-protocol.org/context/v1"
          ],
          "type": [
            "VerifiableCredential",
            "CartMandate"
          ],
          "issuer": "did:example:agent-001",
          "credentialSubject": {
            "id": "did:example:subject-001",
            "mandateType": "cart",
            "stage": "open",
            "merchant": "shop.example.com",
            "cart_items": [
              {
                "sku": "SKU-100",
                "description": "Widget",
                "quantity": 2,
                "unit_price": 9.99,
                "currency": "USD"
              },
              {
                "sku": "SKU-200",
                "description": "Gadget",
                "quantity": 1,
                "unit_price": 999,
                "currency": "USD"
              }
            ],
            "cart_root": "0x4254fc9cc00df63f6c8157e31682b1abde3b6e0337f5923970164ab1a52340b1",
            "chain_length": 2
          },
          "proof": {
            "type": "DataIntegrityProof",
            "cryptosuite": "eddsa-2022",
            "verificationMethod": "did:example:agent-001#key-1",
            "proofPurpose": "assertionMethod",
            "proofValue": "<ILLUSTRATIVE — sign with the agent key>"
          }
        },
        "vdc_type": "CartMandate",
        "cart_root": "0x4254fc9cc00df63f6c8157e31682b1abde3b6e0337f5923970164ab1a52340b1",
        "chain_length": 2,
        "chain_links": [
          "0xfce9e5feb64ec005b5f801ecf528a63503dd72c23bf12783816a527f5cfaf05f",
          "0x4254fc9cc00df63f6c8157e31682b1abde3b6e0337f5923970164ab1a52340b1"
        ],
        "cart_chain_intact": false,
        "first_divergent_index": 1,
        "note": "Illustrative AP2 CartMandate hash-chain skeleton (external Google AP2 payments-protocol shape, ap2-protocol.org) -- distinct from the AINumbers Policy Mandate. This chain proves the ordered cart_items list was not altered after the chain was built -- nothing more. It does NOT prove the mandate was authorised by a human, that goods were delivered, that the merchant accepted the cart, that any payment occurred, or that item prices are correct or current (unit_price is caller-supplied, unchecked against any catalog). Zero network calls; never a facilitator, proxy, gateway, or settlement relay. Sign with the agent key and verify against the live AP2 spec before real use.",
        "reasons": []
      },
      "golden_hash": "7ec5dfe03eaa08d259e6e2f08bc0d9b3b56eb7a51c1bca10b1905280b48ac064"
    },
    {
      "name": "missing-cart-items-indeterminate",
      "policy_parameters": {},
      "output_payload": {
        "vdc": null,
        "vdc_type": "CartMandate",
        "cart_root": null,
        "chain_length": 0,
        "chain_links": [],
        "cart_chain_intact": null,
        "first_divergent_index": null,
        "note": "Illustrative AP2 CartMandate hash-chain skeleton (external Google AP2 payments-protocol shape, ap2-protocol.org) -- distinct from the AINumbers Policy Mandate. This chain proves the ordered cart_items list was not altered after the chain was built -- nothing more. It does NOT prove the mandate was authorised by a human, that goods were delivered, that the merchant accepted the cart, that any payment occurred, or that item prices are correct or current (unit_price is caller-supplied, unchecked against any catalog). Zero network calls; never a facilitator, proxy, gateway, or settlement relay. Sign with the agent key and verify against the live AP2 spec before real use.",
        "reasons": [
          "cart_items is required and must be a non-empty array"
        ]
      },
      "golden_hash": "f6ecd49fde68273388d6e7a7e93e4383edf18f899f9e730b77162f0ec45ef522"
    }
  ]
}