{
  "tool_id": "art-394-x402-deferred-handshake-validator",
  "note": "ART394-LAND-1: golden fixture, computed via the kernel (not hand-typed).",
  "vectors": [
    {
      "name": "valid_accept",
      "policy_parameters": {
        "offer": {
          "scheme": "deferred",
          "id": "set-ref-001",
          "termsUrl": "https://merchant.example/terms/x402"
        },
        "covered_components": [
          "@method",
          "@target-uri",
          "content-digest"
        ],
        "id_continuity": {
          "prior_ids": [
            "set-ref-000"
          ]
        }
      },
      "output_payload": {
        "verdict": "ACCEPT",
        "score": 100,
        "errors": 0,
        "warnings": 0,
        "passes": 7,
        "settlement_reference_id": "set-ref-001",
        "required_covered_components": [
          "@method",
          "@target-uri",
          "content-digest"
        ],
        "findings": [
          {
            "level": "pass",
            "msg": "offer.scheme is \"deferred\"."
          },
          {
            "level": "pass",
            "msg": "offer.id present."
          },
          {
            "level": "pass",
            "msg": "offer.termsUrl is a valid https URL."
          },
          {
            "level": "pass",
            "msg": "Signature-Input covers \"@method\"."
          },
          {
            "level": "pass",
            "msg": "Signature-Input covers \"@target-uri\"."
          },
          {
            "level": "pass",
            "msg": "Signature-Input covers \"content-digest\"."
          },
          {
            "level": "pass",
            "msg": "id \"set-ref-001\" is unique against 1 prior id(s)."
          }
        ],
        "scope_note": "Validates the deferred-scheme offer, RFC 9421 signature-component coverage, and settlement-reference id continuity only. Cryptographic signature verification is verify_webbotauth_signature (art-129); rollup/batch settlement arithmetic is reconcile_x402_batch_settlement (art-61). Scheme registry is a plugin surface, not hard-coded — verify against the current x402 scheme registry."
      },
      "compliance_flags": [
        "X402_DEFERRED_HANDSHAKE_ASSESSED",
        "DEFERRED_OFFER_VALID"
      ],
      "golden_hash": "ff4cfd2a1c9a366b05ad3b96fcd13730c68ea916b0d437464dad40c6773db5ff"
    },
    {
      "name": "wrong_scheme",
      "policy_parameters": {
        "offer": {
          "scheme": "exact",
          "id": "set-ref-002",
          "termsUrl": "https://merchant.example/terms/x402"
        },
        "covered_components": [
          "@method",
          "@target-uri",
          "content-digest"
        ],
        "id_continuity": {
          "prior_ids": []
        }
      },
      "output_payload": {
        "verdict": "REFUSE",
        "score": 85,
        "errors": 1,
        "warnings": 0,
        "passes": 6,
        "settlement_reference_id": "set-ref-002",
        "required_covered_components": [
          "@method",
          "@target-uri",
          "content-digest"
        ],
        "findings": [
          {
            "level": "error",
            "msg": "offer.scheme must be \"deferred\" (got \"exact\")."
          },
          {
            "level": "pass",
            "msg": "offer.id present."
          },
          {
            "level": "pass",
            "msg": "offer.termsUrl is a valid https URL."
          },
          {
            "level": "pass",
            "msg": "Signature-Input covers \"@method\"."
          },
          {
            "level": "pass",
            "msg": "Signature-Input covers \"@target-uri\"."
          },
          {
            "level": "pass",
            "msg": "Signature-Input covers \"content-digest\"."
          },
          {
            "level": "pass",
            "msg": "id \"set-ref-002\" is unique against 0 prior id(s)."
          }
        ],
        "scope_note": "Validates the deferred-scheme offer, RFC 9421 signature-component coverage, and settlement-reference id continuity only. Cryptographic signature verification is verify_webbotauth_signature (art-129); rollup/batch settlement arithmetic is reconcile_x402_batch_settlement (art-61). Scheme registry is a plugin surface, not hard-coded — verify against the current x402 scheme registry."
      },
      "compliance_flags": [
        "X402_DEFERRED_HANDSHAKE_ASSESSED",
        "DEFERRED_OFFER_INVALID",
        "SCHEME_NOT_DEFERRED"
      ],
      "golden_hash": "05d033aaa57992fd3ec773bfa3993c750d5bbbb6b0e574dc2b868e3a69a5370f"
    },
    {
      "name": "missing_id_and_terms",
      "policy_parameters": {
        "offer": {
          "scheme": "deferred"
        },
        "covered_components": [
          "@method"
        ],
        "id_continuity": {
          "prior_ids": []
        }
      },
      "output_payload": {
        "verdict": "REFUSE",
        "score": 40,
        "errors": 4,
        "warnings": 0,
        "passes": 2,
        "settlement_reference_id": null,
        "required_covered_components": [
          "@method",
          "@target-uri",
          "content-digest"
        ],
        "findings": [
          {
            "level": "pass",
            "msg": "offer.scheme is \"deferred\"."
          },
          {
            "level": "error",
            "msg": "offer.id missing or not a non-empty string."
          },
          {
            "level": "error",
            "msg": "offer.termsUrl missing or not a valid https URL."
          },
          {
            "level": "pass",
            "msg": "Signature-Input covers \"@method\"."
          },
          {
            "level": "error",
            "msg": "Signature-Input missing required covered component \"@target-uri\"."
          },
          {
            "level": "error",
            "msg": "Signature-Input missing required covered component \"content-digest\"."
          }
        ],
        "scope_note": "Validates the deferred-scheme offer, RFC 9421 signature-component coverage, and settlement-reference id continuity only. Cryptographic signature verification is verify_webbotauth_signature (art-129); rollup/batch settlement arithmetic is reconcile_x402_batch_settlement (art-61). Scheme registry is a plugin surface, not hard-coded — verify against the current x402 scheme registry."
      },
      "compliance_flags": [
        "X402_DEFERRED_HANDSHAKE_ASSESSED",
        "DEFERRED_OFFER_INVALID",
        "SIGNATURE_COMPONENT_COVERAGE_INCOMPLETE"
      ],
      "golden_hash": "fd4b8bd541a0f49e9ce2ca036c6fe9cfad70aa3de0e0e2ec948d42ea423f1059"
    },
    {
      "name": "duplicate_id_continuity",
      "policy_parameters": {
        "offer": {
          "scheme": "deferred",
          "id": "set-ref-003",
          "termsUrl": "https://merchant.example/terms/x402"
        },
        "covered_components": [
          "@method",
          "@target-uri",
          "content-digest"
        ],
        "id_continuity": {
          "prior_ids": [
            "set-ref-003",
            "set-ref-999"
          ]
        }
      },
      "output_payload": {
        "verdict": "REFUSE",
        "score": 85,
        "errors": 1,
        "warnings": 0,
        "passes": 6,
        "settlement_reference_id": "set-ref-003",
        "required_covered_components": [
          "@method",
          "@target-uri",
          "content-digest"
        ],
        "findings": [
          {
            "level": "pass",
            "msg": "offer.scheme is \"deferred\"."
          },
          {
            "level": "pass",
            "msg": "offer.id present."
          },
          {
            "level": "pass",
            "msg": "offer.termsUrl is a valid https URL."
          },
          {
            "level": "pass",
            "msg": "Signature-Input covers \"@method\"."
          },
          {
            "level": "pass",
            "msg": "Signature-Input covers \"@target-uri\"."
          },
          {
            "level": "pass",
            "msg": "Signature-Input covers \"content-digest\"."
          },
          {
            "level": "error",
            "msg": "id \"set-ref-003\" duplicates a prior settlement-reference id — continuity broken."
          }
        ],
        "scope_note": "Validates the deferred-scheme offer, RFC 9421 signature-component coverage, and settlement-reference id continuity only. Cryptographic signature verification is verify_webbotauth_signature (art-129); rollup/batch settlement arithmetic is reconcile_x402_batch_settlement (art-61). Scheme registry is a plugin surface, not hard-coded — verify against the current x402 scheme registry."
      },
      "compliance_flags": [
        "X402_DEFERRED_HANDSHAKE_ASSESSED",
        "DEFERRED_OFFER_INVALID",
        "ID_CONTINUITY_BROKEN"
      ],
      "golden_hash": "81276dc5fbb8f7e1db7eaf172e7b386953c04f082b921456835f506579fd1be9"
    },
    {
      "name": "missing_component_coverage",
      "policy_parameters": {
        "offer": {
          "scheme": "deferred",
          "id": "set-ref-004",
          "termsUrl": "https://merchant.example/terms/x402"
        },
        "covered_components": [
          "@method"
        ],
        "id_continuity": {
          "prior_ids": []
        }
      },
      "output_payload": {
        "verdict": "REFUSE",
        "score": 70,
        "errors": 2,
        "warnings": 0,
        "passes": 5,
        "settlement_reference_id": "set-ref-004",
        "required_covered_components": [
          "@method",
          "@target-uri",
          "content-digest"
        ],
        "findings": [
          {
            "level": "pass",
            "msg": "offer.scheme is \"deferred\"."
          },
          {
            "level": "pass",
            "msg": "offer.id present."
          },
          {
            "level": "pass",
            "msg": "offer.termsUrl is a valid https URL."
          },
          {
            "level": "pass",
            "msg": "Signature-Input covers \"@method\"."
          },
          {
            "level": "error",
            "msg": "Signature-Input missing required covered component \"@target-uri\"."
          },
          {
            "level": "error",
            "msg": "Signature-Input missing required covered component \"content-digest\"."
          },
          {
            "level": "pass",
            "msg": "id \"set-ref-004\" is unique against 0 prior id(s)."
          }
        ],
        "scope_note": "Validates the deferred-scheme offer, RFC 9421 signature-component coverage, and settlement-reference id continuity only. Cryptographic signature verification is verify_webbotauth_signature (art-129); rollup/batch settlement arithmetic is reconcile_x402_batch_settlement (art-61). Scheme registry is a plugin surface, not hard-coded — verify against the current x402 scheme registry."
      },
      "compliance_flags": [
        "X402_DEFERRED_HANDSHAKE_ASSESSED",
        "DEFERRED_OFFER_INVALID",
        "SIGNATURE_COMPONENT_COVERAGE_INCOMPLETE"
      ],
      "golden_hash": "5cc88f2ef5b18092d103df3e434456a4f9c4c9405fe1cfdbc5c46cef86264ed4"
    },
    {
      "name": "empty_input",
      "policy_parameters": {},
      "output_payload": {
        "verdict": "REFUSE",
        "score": 10,
        "errors": 6,
        "warnings": 0,
        "passes": 0,
        "settlement_reference_id": null,
        "required_covered_components": [
          "@method",
          "@target-uri",
          "content-digest"
        ],
        "findings": [
          {
            "level": "error",
            "msg": "offer.scheme must be \"deferred\" (got \"undefined\")."
          },
          {
            "level": "error",
            "msg": "offer.id missing or not a non-empty string."
          },
          {
            "level": "error",
            "msg": "offer.termsUrl missing or not a valid https URL."
          },
          {
            "level": "error",
            "msg": "Signature-Input missing required covered component \"@method\"."
          },
          {
            "level": "error",
            "msg": "Signature-Input missing required covered component \"@target-uri\"."
          },
          {
            "level": "error",
            "msg": "Signature-Input missing required covered component \"content-digest\"."
          }
        ],
        "scope_note": "Validates the deferred-scheme offer, RFC 9421 signature-component coverage, and settlement-reference id continuity only. Cryptographic signature verification is verify_webbotauth_signature (art-129); rollup/batch settlement arithmetic is reconcile_x402_batch_settlement (art-61). Scheme registry is a plugin surface, not hard-coded — verify against the current x402 scheme registry."
      },
      "compliance_flags": [
        "X402_DEFERRED_HANDSHAKE_ASSESSED",
        "DEFERRED_OFFER_INVALID",
        "SCHEME_NOT_DEFERRED",
        "SIGNATURE_COMPONENT_COVERAGE_INCOMPLETE"
      ],
      "golden_hash": "7d2032d92930f58b2255ec85d5607c99581fe35dffe84c6c25f30a15af6622a9"
    }
  ]
}