{
  "tool_id": "art-609-jwks-pinned-directory-check",
  "kernel_id": "art-609-jwks-pinned-directory-check",
  "display_name": "JWKS Pinned-Directory Check",
  "tool_version": "1.0.0",
  "mandate_type": "compliance_control",
  "purpose": "Confirm a caller-supplied JWKS directory document matches a caller-pinned SHA-256 digest (sha256(canonicalize(directory_jwks)) === pinned_digest) before art-130 trusts its shape. Zero network, zero key hosting -- both the document and the digest are caller-supplied. Chains before art-130 in visa-tap-agent-verification.",
  "control_description": "Confirm a caller-supplied JWKS directory document matches a caller-pinned SHA-256 digest (sha256(canonicalize(directory_jwks)) === pinned_digest) before art-130 trusts its shape. Zero network, zero key hosting -- both the document and the digest are caller-supplied. Chains before art-130 in visa-tap-agent-verification.",
  "declared_inputs": [
    "art-129-webbotauth-signature-verifier"
  ],
  "declared_outputs": [
    "art-130-signature-directory-validator"
  ],
  "kernel_digest": "sha256:c2d3b27062a33c356a19c8e65db737fe59d34ad93c8ed44ecde8e960cd22813b",
  "trust_label": "independently verified: zkVM execution proof (risc0/groth16-bn254)",
  "data_vintage": "2026-08-13",
  "last_validated": "2026-08-13",
  "conformance_fixtures_vendored": true,
  "compute_proof_ready": "ready",
  "wave": 100,
  "source_url": "https://ainumbers.co/chaingraph/art-609-jwks-pinned-directory-check.html",
  "generated_at": "2026-08-15T11:12:17.704Z"
}