OpenChainGraph Suite · ART-595 · AP2 / Agent Commerce Provenance
AP2 CartMandate Hash-Chain Builder
Builds an illustrative AP2 CartMandate skeleton whose credentialSubject carries a deterministic hash-chain over an ordered cart_items list: link_0 = keccak256(canon({index:0,item})), link_i = keccak256(canon({index:i,item,prev:link_(i-1)})), cart_root is the final link. Stands beside the existing Google AP2 Mandate Builder (ART-16) as a new node: that node's flat Checkout/Payment shape has no line-item array to chain over. Given a prior chain's links (claimed_links) and a possibly tampered cart_items, it re-verifies and reports the earliest divergent index instead of throwing.
AP2 / CartMandatekeccak256 + RFC 8785 canon (vendored, no hand-rolled crypto)Chain build or re-verify, no settlement
🔒 All inputs are processed locally in your browser. No data is transmitted. Do not enter real personal data — use synthetic or anonymised inputs only.
What This Does and Does Not Prove
An intact hash-chain proves the ordered cart_items list was not altered after the chain was built, nothing more. It does NOT prove the mandate was authorised by a human, that goods were delivered, that the merchant accepted the cart, that any payment occurred, or that item prices are correct or current (unit_price is caller-supplied, unchecked against any catalog). This node never fetches merchant state, never calls a facilitator, and is never a party to a payment.
Copy this paragraph into Claude, OpenClaw, or any MCP-aware agent to run this exact tool, with this sample, and verify the artifact.
Run the AINumbers MCP tool `build_ap2_cartmandate_hashchain`. Task: Build a deterministic hash-chain over an ordered cart_items array for an illustrative AP2 CartMandate VDC, or re-verifies a prior chain's links against a (possibly tampered) cart_items and reports whether it is intact plus the earliest divergent index.
Call it with arguments: {"policy_parameters":{"agent_id":"did:example:agent-001","subject":"did:example:subject-001","merchant":"shop.example.com","stage":"open","cart_items":[{"sku":"SKU-100","description":"Widget","quantity":2,"unit_price":9.99,"currency":"USD"},{"sku":"SKU-200","description":"Gadget","quantity":1,"unit_price":24.5,"currency":"USD"}]}}
Verify before trusting: call `verify_execution_hash` on mcp.ainumbers.co (https://mcp.ainumbers.co/mcp) with the parameter `claimed_hash` set to the returned `execution_hash`, passing the full artifact the run returned (the object containing `policy_parameters` + `output_payload` + `execution_hash`; equivalently `policy_parameters` + `output_payload` with `claimed_hash`), not the bare hash string, or re-run the in-page WebMCP tool `build_ap2_cartmandate_hashchain`.
Return the ledger link https://ledger.ainumbers.co/ so a human can re-verify without contacting us.
PII rule: All inputs are processed locally in your browser. No data is transmitted. Do not enter real personal data — use synthetic or anonymised inputs only.
Open the tool with the sample prefilled: https://ainumbers.co/chaingraph/art-595-ap2-cartmandate-hashchain-builder.html#p=v1.H4sIAAAAAAAA_wE2Acn-eyJhZ2VudF9pZCI6ImRpZDpleGFtcGxlOmFnZW50LTAwMSIsInN1YmplY3QiOiJkaWQ6ZXhhbXBsZTpzdWJqZWN0LTAwMSIsIm1lcmNoYW50Ijoic2hvcC5leGFtcGxlLmNvbSIsInN0YWdlIjoib3BlbiIsImNhcnRfaXRlbXMiOlt7InNrdSI6IlNLVS0xMDAiLCJkZXNjcmlwdGlvbiI6IldpZGdldCIsInF1YW50aXR5IjoyLCJ1bml0X3ByaWNlIjo5Ljk5LCJjdXJyZW5jeSI6IlVTRCJ9LHsic2t1IjoiU0tVLTIwMCIsImRlc2NyaXB0aW9uIjoiR2FkZ2V0IiwicXVhbnRpdHkiOjEsInVuaXRfcHJpY2UiOjI0LjUsImN1cnJlbmN5IjoiVVNEIn1dfVh49e42AQAA