{
  "tool_id": "art-596-ap2-x402-cart-correlation",
  "note": "Golden vectors for the AP2<->x402 correlation kernel (SPEC-AGENT-COMMERCE-CHAIN-1-2026-08-09.md sect7/sect8). cart_root recomputed from cart_items via the same keccak256/canon algorithm art-595 defines. human_sign_off: PENDING.",
  "vectors": [
    {
      "name": "correlated-chain-intact-total-match-merchant-match",
      "policy_parameters": {
        "cart_root": "0x2eeb01a35e5facd325ab3b60ba97fe4d26222584419fdf93106d3ca3575729fb",
        "cart_items": [
          {
            "sku": "SKU-100",
            "description": "Widget",
            "quantity": 2,
            "unit_price": 9.99,
            "currency": "USD"
          },
          {
            "sku": "SKU-200",
            "description": "Gadget",
            "quantity": 1,
            "unit_price": 24.5,
            "currency": "USD"
          }
        ],
        "merchant": "0x2a1530c4c41db0b0b2bb646cb5eb1a67b7158667",
        "x402_spend_evidence": {
          "authorization": {
            "from": "0x2a1530c4c41db0b0b2bb646cb5eb1a67b7158667",
            "to": "0x2a1530c4c41db0b0b2bb646cb5eb1a67b7158667",
            "value": "44.480000000000004",
            "validAfter": "0",
            "validBefore": "2000000000",
            "nonce": "0x0000000000000000000000000000000000000000000000000000000000000001"
          },
          "digest": "0xb68e5d60d6169bad9739d30399af8f8c7378d464d25f4d971911ab65ef0b014b",
          "verdict": "AUTHORIZATION_VALID",
          "disclosure": "ev"
        }
      },
      "output_payload": {
        "correlation_status": "CORRELATED",
        "cart_total_matches_authorization_value": true,
        "merchant_matches_authorization_to": true,
        "cart_chain_intact": true,
        "disclosure": "This tool observes that the cart total and merchant identity are consistent with the x402 authorization's amount and recipient. It does not cryptographically bind the two -- no signature, hash, or on-chain reference ties this specific CartMandate to this specific x402 authorization. A party could present a valid CartMandate alongside an unrelated valid x402 authorization and this check would still report CORRELATED.",
        "reasons": []
      },
      "golden_hash": "c557ee846ad04c523eab7c59842beb566d4de05a085bedc618d25df8b8187c7a"
    },
    {
      "name": "not-correlated-total-mismatch",
      "policy_parameters": {
        "cart_root": "0x2eeb01a35e5facd325ab3b60ba97fe4d26222584419fdf93106d3ca3575729fb",
        "cart_items": [
          {
            "sku": "SKU-100",
            "description": "Widget",
            "quantity": 2,
            "unit_price": 9.99,
            "currency": "USD"
          },
          {
            "sku": "SKU-200",
            "description": "Gadget",
            "quantity": 1,
            "unit_price": 24.5,
            "currency": "USD"
          }
        ],
        "merchant": "0x2a1530c4c41db0b0b2bb646cb5eb1a67b7158667",
        "x402_spend_evidence": {
          "authorization": {
            "from": "0x2a1530c4c41db0b0b2bb646cb5eb1a67b7158667",
            "to": "0x2a1530c4c41db0b0b2bb646cb5eb1a67b7158667",
            "value": "999",
            "validAfter": "0",
            "validBefore": "2000000000",
            "nonce": "0x01"
          },
          "verdict": "AUTHORIZATION_VALID",
          "disclosure": "ev"
        }
      },
      "output_payload": {
        "correlation_status": "NOT_CORRELATED",
        "cart_total_matches_authorization_value": false,
        "merchant_matches_authorization_to": true,
        "cart_chain_intact": true,
        "disclosure": "This tool observes that the cart total and merchant identity are consistent with the x402 authorization's amount and recipient. It does not cryptographically bind the two -- no signature, hash, or on-chain reference ties this specific CartMandate to this specific x402 authorization. A party could present a valid CartMandate alongside an unrelated valid x402 authorization and this check would still report CORRELATED.",
        "reasons": []
      },
      "golden_hash": "2c4c3e4a154c064e53eb38511e621671bdb8937656d5ce1e25c182db364b7ec0"
    },
    {
      "name": "not-correlated-chain-broken",
      "policy_parameters": {
        "cart_root": "0x2eeb01a35e5facd325ab3b60ba97fe4d26222584419fdf93106d3ca3575729fb",
        "cart_items": [
          {
            "sku": "SKU-100",
            "description": "Widget",
            "quantity": 3,
            "unit_price": 9.99,
            "currency": "USD"
          },
          {
            "sku": "SKU-200",
            "description": "Gadget",
            "quantity": 1,
            "unit_price": 24.5,
            "currency": "USD"
          }
        ],
        "merchant": "0x2a1530c4c41db0b0b2bb646cb5eb1a67b7158667",
        "x402_spend_evidence": {
          "authorization": {
            "from": "0x2a1530c4c41db0b0b2bb646cb5eb1a67b7158667",
            "to": "0x2a1530c4c41db0b0b2bb646cb5eb1a67b7158667",
            "value": "999",
            "validAfter": "0",
            "validBefore": "2000000000",
            "nonce": "0x01"
          },
          "verdict": "AUTHORIZATION_VALID",
          "disclosure": "ev"
        }
      },
      "output_payload": {
        "correlation_status": "NOT_CORRELATED",
        "cart_total_matches_authorization_value": false,
        "merchant_matches_authorization_to": true,
        "cart_chain_intact": false,
        "disclosure": "This tool observes that the cart total and merchant identity are consistent with the x402 authorization's amount and recipient. It does not cryptographically bind the two -- no signature, hash, or on-chain reference ties this specific CartMandate to this specific x402 authorization. A party could present a valid CartMandate alongside an unrelated valid x402 authorization and this check would still report CORRELATED.",
        "reasons": []
      },
      "golden_hash": "84e495898be83876d054f05be76aa2ee945812645a0351512a2ae101de3ae478"
    },
    {
      "name": "indeterminate-merchant-not-address-shaped",
      "policy_parameters": {
        "cart_root": "0x2eeb01a35e5facd325ab3b60ba97fe4d26222584419fdf93106d3ca3575729fb",
        "cart_items": [
          {
            "sku": "SKU-100",
            "description": "Widget",
            "quantity": 2,
            "unit_price": 9.99,
            "currency": "USD"
          },
          {
            "sku": "SKU-200",
            "description": "Gadget",
            "quantity": 1,
            "unit_price": 24.5,
            "currency": "USD"
          }
        ],
        "merchant": "shop.example.com",
        "x402_spend_evidence": {
          "authorization": {
            "from": "0x2a1530c4c41db0b0b2bb646cb5eb1a67b7158667",
            "to": "0x2a1530c4c41db0b0b2bb646cb5eb1a67b7158667",
            "value": "44.480000000000004",
            "validAfter": "0",
            "validBefore": "2000000000",
            "nonce": "0x0000000000000000000000000000000000000000000000000000000000000001"
          },
          "digest": "0xb68e5d60d6169bad9739d30399af8f8c7378d464d25f4d971911ab65ef0b014b",
          "verdict": "AUTHORIZATION_VALID",
          "disclosure": "ev"
        }
      },
      "output_payload": {
        "correlation_status": "INDETERMINATE",
        "cart_total_matches_authorization_value": true,
        "merchant_matches_authorization_to": null,
        "cart_chain_intact": true,
        "disclosure": "This tool observes that the cart total and merchant identity are consistent with the x402 authorization's amount and recipient. It does not cryptographically bind the two -- no signature, hash, or on-chain reference ties this specific CartMandate to this specific x402 authorization. A party could present a valid CartMandate alongside an unrelated valid x402 authorization and this check would still report CORRELATED.",
        "reasons": []
      },
      "golden_hash": "16692b4747b5fb10272682d25aca3db06280be06778f78494a702cbfc1e96a98"
    },
    {
      "name": "indeterminate-malformed-input-missing-fields",
      "policy_parameters": {
        "cart_root": "0x2eeb01a35e5facd325ab3b60ba97fe4d26222584419fdf93106d3ca3575729fb",
        "merchant": "shop.example.com"
      },
      "output_payload": {
        "correlation_status": "INDETERMINATE",
        "cart_total_matches_authorization_value": null,
        "merchant_matches_authorization_to": null,
        "cart_chain_intact": false,
        "disclosure": "This tool observes that the cart total and merchant identity are consistent with the x402 authorization's amount and recipient. It does not cryptographically bind the two -- no signature, hash, or on-chain reference ties this specific CartMandate to this specific x402 authorization. A party could present a valid CartMandate alongside an unrelated valid x402 authorization and this check would still report CORRELATED.",
        "reasons": [
          "cart_items is required and must be a non-empty array",
          "x402_spend_evidence is required (the caller-assembled §8-shaped object from the x402-spend-evidence chain)"
        ]
      },
      "golden_hash": "2fb6e9642b3a174de7ba141ea786473a052a926e42b82ee789365d5d1c2e46dc"
    }
  ]
}