@paybond/kit 0.10.0 → 0.11.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (335) hide show
  1. package/completion-presets/catalog.json +1187 -0
  2. package/completion-presets/catalog.sha256 +1 -0
  3. package/dev/trace-ui/dashboard.html +617 -0
  4. package/dist/agent/adapter.d.ts +51 -0
  5. package/dist/agent/adapter.js +66 -0
  6. package/dist/agent/attach-bundle.d.ts +37 -0
  7. package/dist/agent/attach-bundle.js +118 -0
  8. package/dist/agent/authorization-cache.d.ts +22 -0
  9. package/dist/agent/authorization-cache.js +36 -0
  10. package/dist/agent/deferred-tools.d.ts +11 -0
  11. package/dist/agent/deferred-tools.js +62 -0
  12. package/dist/agent/discover.d.ts +41 -0
  13. package/dist/agent/discover.js +147 -0
  14. package/dist/agent/evidence.d.ts +9 -0
  15. package/dist/agent/evidence.js +28 -0
  16. package/dist/agent/facade.d.ts +48 -0
  17. package/dist/agent/facade.js +112 -0
  18. package/dist/agent/gateway-trace-reporter.d.ts +28 -0
  19. package/dist/agent/gateway-trace-reporter.js +49 -0
  20. package/dist/agent/generic-runner.d.ts +14 -0
  21. package/dist/agent/generic-runner.js +49 -0
  22. package/dist/agent/generic-sandbox-demo.d.ts +36 -0
  23. package/dist/agent/generic-sandbox-demo.js +82 -0
  24. package/dist/agent/guarded-agent.d.ts +49 -0
  25. package/dist/agent/guarded-agent.js +100 -0
  26. package/dist/agent/index.d.ts +13 -0
  27. package/dist/agent/index.js +13 -0
  28. package/dist/agent/instrument.d.ts +156 -0
  29. package/dist/agent/instrument.js +442 -0
  30. package/dist/agent/interceptor.d.ts +24 -0
  31. package/dist/agent/interceptor.js +440 -0
  32. package/dist/agent/lazy-context-tools.d.ts +15 -0
  33. package/dist/agent/lazy-context-tools.js +81 -0
  34. package/dist/agent/registry-file.d.ts +39 -0
  35. package/dist/agent/registry-file.js +219 -0
  36. package/dist/agent/registry.d.ts +37 -0
  37. package/dist/agent/registry.js +128 -0
  38. package/dist/agent/run.d.ts +124 -0
  39. package/dist/agent/run.js +301 -0
  40. package/dist/agent/types.d.ts +318 -0
  41. package/dist/agent/types.js +42 -0
  42. package/dist/agent-recognition.d.ts +72 -0
  43. package/dist/agent-recognition.js +165 -0
  44. package/dist/bincode-wire.d.ts +18 -0
  45. package/dist/bincode-wire.js +93 -0
  46. package/dist/claude-agents/config.d.ts +21 -0
  47. package/dist/claude-agents/config.js +145 -0
  48. package/dist/claude-agents/index.d.ts +2 -0
  49. package/dist/claude-agents/index.js +2 -0
  50. package/dist/claude-agents/sandbox-demo.d.ts +30 -0
  51. package/dist/claude-agents/sandbox-demo.js +91 -0
  52. package/dist/cli/agent/env-quote.d.ts +1 -0
  53. package/dist/cli/agent/env-quote.js +6 -0
  54. package/dist/cli/agent/env-write.d.ts +8 -0
  55. package/dist/cli/agent/env-write.js +47 -0
  56. package/dist/cli/agent/paybond.d.ts +16 -0
  57. package/dist/cli/agent/paybond.js +55 -0
  58. package/dist/cli/agent/policy-file.d.ts +29 -0
  59. package/dist/cli/agent/policy-file.js +61 -0
  60. package/dist/cli/agent/production-evidence.d.ts +24 -0
  61. package/dist/cli/agent/production-evidence.js +98 -0
  62. package/dist/cli/agent/run-store.d.ts +30 -0
  63. package/dist/cli/agent/run-store.js +42 -0
  64. package/dist/cli/agent/run-trace-store.d.ts +39 -0
  65. package/dist/cli/agent/run-trace-store.js +143 -0
  66. package/dist/cli/agent-run-trace-table.d.ts +9 -0
  67. package/dist/cli/agent-run-trace-table.js +24 -0
  68. package/dist/cli/agent-sandbox-smoke-checklist.d.ts +9 -0
  69. package/dist/cli/agent-sandbox-smoke-checklist.js +50 -0
  70. package/dist/cli/command-spec.d.ts +1 -0
  71. package/dist/cli/command-spec.js +286 -5
  72. package/dist/cli/commands/agent.d.ts +16 -0
  73. package/dist/cli/commands/agent.js +1135 -0
  74. package/dist/cli/commands/dev.d.ts +7 -0
  75. package/dist/cli/commands/dev.js +348 -0
  76. package/dist/cli/commands/discovery.js +3 -3
  77. package/dist/cli/commands/policy.d.ts +13 -0
  78. package/dist/cli/commands/policy.js +769 -0
  79. package/dist/cli/commands/setup.d.ts +3 -0
  80. package/dist/cli/commands/setup.js +124 -8
  81. package/dist/cli/commands/workflows.js +9 -4
  82. package/dist/cli/config.d.ts +2 -0
  83. package/dist/cli/config.js +4 -2
  84. package/dist/cli/context.js +2 -1
  85. package/dist/cli/credentials.js +2 -2
  86. package/dist/cli/doctor-agent-middleware.d.ts +5 -0
  87. package/dist/cli/doctor-agent-middleware.js +49 -0
  88. package/dist/cli/globals.d.ts +1 -0
  89. package/dist/cli/globals.js +11 -1
  90. package/dist/cli/help.d.ts +1 -1
  91. package/dist/cli/help.js +35 -3
  92. package/dist/cli/mcp-install.js +2 -2
  93. package/dist/cli/mcp-policy.d.ts +3 -0
  94. package/dist/cli/mcp-policy.js +19 -13
  95. package/dist/cli/mcp-verify-config.js +9 -11
  96. package/dist/cli/redact.js +29 -8
  97. package/dist/cli/router.js +105 -2
  98. package/dist/cli/smoke-deep-links.d.ts +15 -0
  99. package/dist/cli/smoke-deep-links.js +63 -0
  100. package/dist/cli/telemetry.d.ts +17 -0
  101. package/dist/cli/telemetry.js +94 -0
  102. package/dist/completion-catalog-digest.d.ts +2 -0
  103. package/dist/completion-catalog-digest.js +2 -0
  104. package/dist/completion-catalog-integrity.d.ts +2 -0
  105. package/dist/completion-catalog-integrity.js +17 -0
  106. package/dist/completion-catalog.d.ts +49 -0
  107. package/dist/completion-catalog.js +62 -0
  108. package/dist/completion-contract-digest.d.ts +37 -0
  109. package/dist/completion-contract-digest.js +73 -0
  110. package/dist/completion-forbidden-fields.d.ts +5 -0
  111. package/dist/completion-forbidden-fields.js +26 -0
  112. package/dist/completion-init.d.ts +8 -0
  113. package/dist/completion-init.js +334 -0
  114. package/dist/completion-resolve.d.ts +21 -0
  115. package/dist/completion-resolve.js +86 -0
  116. package/dist/completion-validate-evidence.d.ts +24 -0
  117. package/dist/completion-validate-evidence.js +145 -0
  118. package/dist/dev/offline-gateway.d.ts +24 -0
  119. package/dist/dev/offline-gateway.js +102 -0
  120. package/dist/dev/trace-buffer.d.ts +61 -0
  121. package/dist/dev/trace-buffer.js +330 -0
  122. package/dist/dev/trace-security-headers.d.ts +11 -0
  123. package/dist/dev/trace-security-headers.js +16 -0
  124. package/dist/dev/trace-server.d.ts +8 -0
  125. package/dist/dev/trace-server.js +38 -0
  126. package/dist/dev/trace-ui.d.ts +4 -0
  127. package/dist/dev/trace-ui.js +25 -0
  128. package/dist/dev/wiremock-up.d.ts +15 -0
  129. package/dist/dev/wiremock-up.js +118 -0
  130. package/dist/doctor-completion.d.ts +17 -0
  131. package/dist/doctor-completion.js +428 -0
  132. package/dist/gateway-url.d.ts +7 -0
  133. package/dist/gateway-url.js +69 -0
  134. package/dist/index.d.ts +119 -2
  135. package/dist/index.js +267 -6
  136. package/dist/init.js +374 -57
  137. package/dist/langgraph/awrap-tool-call.d.ts +25 -0
  138. package/dist/langgraph/awrap-tool-call.js +81 -0
  139. package/dist/langgraph/config.d.ts +13 -0
  140. package/dist/langgraph/config.js +11 -0
  141. package/dist/langgraph/index.d.ts +4 -0
  142. package/dist/langgraph/index.js +4 -0
  143. package/dist/langgraph/sandbox-demo.d.ts +40 -0
  144. package/dist/langgraph/sandbox-demo.js +96 -0
  145. package/dist/langgraph/tool-node.d.ts +10 -0
  146. package/dist/langgraph/tool-node.js +38 -0
  147. package/dist/login.js +7 -0
  148. package/dist/mcp/index.d.ts +1 -0
  149. package/dist/mcp/index.js +1 -0
  150. package/dist/mcp/tool-surface.d.ts +25 -0
  151. package/dist/mcp/tool-surface.js +17 -0
  152. package/dist/mcp-capability-token-cache.d.ts +24 -0
  153. package/dist/mcp-capability-token-cache.js +101 -0
  154. package/dist/mcp-evidence-policy.d.ts +48 -0
  155. package/dist/mcp-evidence-policy.js +117 -0
  156. package/dist/mcp-policy-reload.d.ts +79 -0
  157. package/dist/mcp-policy-reload.js +200 -0
  158. package/dist/mcp-sep2828-evidence.d.ts +36 -0
  159. package/dist/mcp-sep2828-evidence.js +65 -0
  160. package/dist/mcp-server.d.ts +6 -0
  161. package/dist/mcp-server.js +224 -44
  162. package/dist/openai-agents/index.d.ts +40 -0
  163. package/dist/openai-agents/index.js +151 -0
  164. package/dist/openai-agents/sandbox-demo.d.ts +34 -0
  165. package/dist/openai-agents/sandbox-demo.js +118 -0
  166. package/dist/payee-evidence.js +2 -29
  167. package/dist/policy/catalog.d.ts +31 -0
  168. package/dist/policy/catalog.js +48 -0
  169. package/dist/policy/compose-utils.d.ts +3 -0
  170. package/dist/policy/compose-utils.js +4 -0
  171. package/dist/policy/compose.d.ts +20 -0
  172. package/dist/policy/compose.js +240 -0
  173. package/dist/policy/digest.d.ts +7 -0
  174. package/dist/policy/digest.js +75 -0
  175. package/dist/policy/domain.d.ts +15 -0
  176. package/dist/policy/domain.js +28 -0
  177. package/dist/policy/guardrail-spec.d.ts +17 -0
  178. package/dist/policy/guardrail-spec.js +140 -0
  179. package/dist/policy/guardrails.d.ts +48 -0
  180. package/dist/policy/guardrails.js +72 -0
  181. package/dist/policy/index.d.ts +21 -0
  182. package/dist/policy/index.js +21 -0
  183. package/dist/policy/init.d.ts +102 -0
  184. package/dist/policy/init.js +351 -0
  185. package/dist/policy/intent-spec.d.ts +52 -0
  186. package/dist/policy/intent-spec.js +176 -0
  187. package/dist/policy/json-path.d.ts +4 -0
  188. package/dist/policy/json-path.js +23 -0
  189. package/dist/policy/layers-io.d.ts +7 -0
  190. package/dist/policy/layers-io.js +28 -0
  191. package/dist/policy/load-effective.d.ts +22 -0
  192. package/dist/policy/load-effective.js +77 -0
  193. package/dist/policy/load.d.ts +85 -0
  194. package/dist/policy/load.js +164 -0
  195. package/dist/policy/merge.d.ts +29 -0
  196. package/dist/policy/merge.js +297 -0
  197. package/dist/policy/parse-text.d.ts +2 -0
  198. package/dist/policy/parse-text.js +126 -0
  199. package/dist/policy/policy-api.d.ts +45 -0
  200. package/dist/policy/policy-api.js +61 -0
  201. package/dist/policy/presets.d.ts +19 -0
  202. package/dist/policy/presets.js +66 -0
  203. package/dist/policy/registry.d.ts +7 -0
  204. package/dist/policy/registry.js +33 -0
  205. package/dist/policy/reload.d.ts +86 -0
  206. package/dist/policy/reload.js +233 -0
  207. package/dist/policy/render-yaml.d.ts +3 -0
  208. package/dist/policy/render-yaml.js +69 -0
  209. package/dist/policy/sandbox-bootstrap.d.ts +19 -0
  210. package/dist/policy/sandbox-bootstrap.js +66 -0
  211. package/dist/policy/schema.d.ts +204 -0
  212. package/dist/policy/schema.js +255 -0
  213. package/dist/policy/snapshot.d.ts +33 -0
  214. package/dist/policy/snapshot.js +23 -0
  215. package/dist/policy/validate-remote.d.ts +43 -0
  216. package/dist/policy/validate-remote.js +104 -0
  217. package/dist/policy/validate.d.ts +36 -0
  218. package/dist/policy/validate.js +150 -0
  219. package/dist/policy/watcher.d.ts +29 -0
  220. package/dist/policy/watcher.js +112 -0
  221. package/dist/principal-intent.d.ts +52 -0
  222. package/dist/principal-intent.js +193 -37
  223. package/dist/project-init.d.ts +34 -0
  224. package/dist/project-init.js +898 -0
  225. package/dist/sep2828-signature.d.ts +10 -0
  226. package/dist/sep2828-signature.js +134 -0
  227. package/dist/solutions/api.d.ts +22 -0
  228. package/dist/solutions/api.js +40 -0
  229. package/dist/solutions/catalog.d.ts +34 -0
  230. package/dist/solutions/catalog.js +129 -0
  231. package/dist/solutions/index.d.ts +2 -0
  232. package/dist/solutions/index.js +2 -0
  233. package/dist/template-init.d.ts +54 -0
  234. package/dist/template-init.js +203 -0
  235. package/dist/vercel-ai/config.d.ts +15 -0
  236. package/dist/vercel-ai/config.js +13 -0
  237. package/dist/vercel-ai/index.d.ts +4 -0
  238. package/dist/vercel-ai/index.js +4 -0
  239. package/dist/vercel-ai/sandbox-demo.d.ts +44 -0
  240. package/dist/vercel-ai/sandbox-demo.js +153 -0
  241. package/dist/vercel-ai/tool-approval.d.ts +16 -0
  242. package/dist/vercel-ai/tool-approval.js +41 -0
  243. package/dist/vercel-ai/wrap-tools.d.ts +9 -0
  244. package/dist/vercel-ai/wrap-tools.js +40 -0
  245. package/dist/x402-receipt-evidence.d.ts +29 -0
  246. package/dist/x402-receipt-evidence.js +97 -0
  247. package/dist/x402-receipt-signature.d.ts +12 -0
  248. package/dist/x402-receipt-signature.js +211 -0
  249. package/package.json +75 -3
  250. package/solutions/aws.json +17 -0
  251. package/solutions/saas.json +17 -0
  252. package/solutions/shopping.json +17 -0
  253. package/solutions/travel.json +18 -0
  254. package/templates/manifest.json +169 -0
  255. package/templates/openai-shopping-agent/.env.example +3 -0
  256. package/templates/openai-shopping-agent/.github/workflows/smoke.yml +20 -0
  257. package/templates/openai-shopping-agent/LICENSE +201 -0
  258. package/templates/openai-shopping-agent/README.md +29 -0
  259. package/templates/openai-shopping-agent/package.json +22 -0
  260. package/templates/openai-shopping-agent/paybond.policy.yaml +22 -0
  261. package/templates/openai-shopping-agent/src/index.ts +22 -0
  262. package/templates/openai-shopping-agent/src/paybond.config.ts +51 -0
  263. package/templates/openai-shopping-agent/tsconfig.json +13 -0
  264. package/templates/paybond-aws-operator/.env.example +3 -0
  265. package/templates/paybond-aws-operator/.github/workflows/smoke.yml +20 -0
  266. package/templates/paybond-aws-operator/LICENSE +201 -0
  267. package/templates/paybond-aws-operator/README.md +29 -0
  268. package/templates/paybond-aws-operator/package.json +20 -0
  269. package/templates/paybond-aws-operator/paybond.policy.yaml +22 -0
  270. package/templates/paybond-aws-operator/src/index.ts +54 -0
  271. package/templates/paybond-aws-operator/src/paybond.config.ts +51 -0
  272. package/templates/paybond-aws-operator/tsconfig.json +13 -0
  273. package/templates/paybond-claude-agents-demo/.env.example +3 -0
  274. package/templates/paybond-claude-agents-demo/.github/workflows/smoke.yml +20 -0
  275. package/templates/paybond-claude-agents-demo/LICENSE +201 -0
  276. package/templates/paybond-claude-agents-demo/README.md +29 -0
  277. package/templates/paybond-claude-agents-demo/package.json +22 -0
  278. package/templates/paybond-claude-agents-demo/paybond.policy.yaml +22 -0
  279. package/templates/paybond-claude-agents-demo/src/index.ts +22 -0
  280. package/templates/paybond-claude-agents-demo/src/paybond.config.ts +51 -0
  281. package/templates/paybond-claude-agents-demo/tsconfig.json +13 -0
  282. package/templates/paybond-invoice-agent/.env.example +3 -0
  283. package/templates/paybond-invoice-agent/.github/workflows/smoke.yml +19 -0
  284. package/templates/paybond-invoice-agent/LICENSE +201 -0
  285. package/templates/paybond-invoice-agent/README.md +29 -0
  286. package/templates/paybond-invoice-agent/app.py +27 -0
  287. package/templates/paybond-invoice-agent/package.json +6 -0
  288. package/templates/paybond-invoice-agent/paybond.policy.yaml +22 -0
  289. package/templates/paybond-invoice-agent/paybond_config.py +45 -0
  290. package/templates/paybond-invoice-agent/requirements.txt +2 -0
  291. package/templates/paybond-mcp-coding-agent/.env.example +3 -0
  292. package/templates/paybond-mcp-coding-agent/.github/workflows/smoke.yml +20 -0
  293. package/templates/paybond-mcp-coding-agent/LICENSE +201 -0
  294. package/templates/paybond-mcp-coding-agent/README.md +39 -0
  295. package/templates/paybond-mcp-coding-agent/package.json +20 -0
  296. package/templates/paybond-mcp-coding-agent/paybond.policy.yaml +25 -0
  297. package/templates/paybond-mcp-coding-agent/src/index.ts +40 -0
  298. package/templates/paybond-mcp-coding-agent/src/paybond.config.ts +51 -0
  299. package/templates/paybond-mcp-coding-agent/tsconfig.json +13 -0
  300. package/templates/paybond-openai-agents-demo/.env.example +3 -0
  301. package/templates/paybond-openai-agents-demo/.github/workflows/smoke.yml +20 -0
  302. package/templates/paybond-openai-agents-demo/LICENSE +201 -0
  303. package/templates/paybond-openai-agents-demo/README.md +29 -0
  304. package/templates/paybond-openai-agents-demo/package.json +22 -0
  305. package/templates/paybond-openai-agents-demo/paybond.policy.yaml +22 -0
  306. package/templates/paybond-openai-agents-demo/src/index.ts +22 -0
  307. package/templates/paybond-openai-agents-demo/src/paybond.config.ts +51 -0
  308. package/templates/paybond-openai-agents-demo/tsconfig.json +13 -0
  309. package/templates/paybond-procurement-agent/.env.example +3 -0
  310. package/templates/paybond-procurement-agent/.github/workflows/smoke.yml +20 -0
  311. package/templates/paybond-procurement-agent/LICENSE +201 -0
  312. package/templates/paybond-procurement-agent/README.md +29 -0
  313. package/templates/paybond-procurement-agent/package.json +20 -0
  314. package/templates/paybond-procurement-agent/paybond.policy.yaml +25 -0
  315. package/templates/paybond-procurement-agent/src/index.ts +54 -0
  316. package/templates/paybond-procurement-agent/src/paybond.config.ts +51 -0
  317. package/templates/paybond-procurement-agent/tsconfig.json +13 -0
  318. package/templates/paybond-travel-agent/.env.example +3 -0
  319. package/templates/paybond-travel-agent/.github/workflows/smoke.yml +20 -0
  320. package/templates/paybond-travel-agent/LICENSE +201 -0
  321. package/templates/paybond-travel-agent/README.md +29 -0
  322. package/templates/paybond-travel-agent/package.json +23 -0
  323. package/templates/paybond-travel-agent/paybond.policy.yaml +22 -0
  324. package/templates/paybond-travel-agent/src/index.ts +22 -0
  325. package/templates/paybond-travel-agent/src/paybond.config.ts +51 -0
  326. package/templates/paybond-travel-agent/tsconfig.json +13 -0
  327. package/templates/paybond-vercel-shopping-agent/.env.example +3 -0
  328. package/templates/paybond-vercel-shopping-agent/.github/workflows/smoke.yml +20 -0
  329. package/templates/paybond-vercel-shopping-agent/LICENSE +201 -0
  330. package/templates/paybond-vercel-shopping-agent/README.md +29 -0
  331. package/templates/paybond-vercel-shopping-agent/package.json +22 -0
  332. package/templates/paybond-vercel-shopping-agent/paybond.policy.yaml +22 -0
  333. package/templates/paybond-vercel-shopping-agent/src/index.ts +22 -0
  334. package/templates/paybond-vercel-shopping-agent/src/paybond.config.ts +51 -0
  335. package/templates/paybond-vercel-shopping-agent/tsconfig.json +13 -0
@@ -0,0 +1,1187 @@
1
+ {
2
+ "$schema": "./catalog.schema.json",
3
+ "version": 1,
4
+ "presets": [
5
+ {
6
+ "preset_id": "api_response_ok",
7
+ "title": "API response OK",
8
+ "description": "Paid API returned HTTP success with a vendor reference and response digest in evidence.",
9
+ "harbor_template_id": "api_response_v1",
10
+ "parameters": {
11
+ "http_status_path": [
12
+ "http_status"
13
+ ],
14
+ "expected_http_status": 200
15
+ },
16
+ "evidence_schema": {
17
+ "type": "object",
18
+ "properties": {
19
+ "http_status": {
20
+ "type": "integer"
21
+ },
22
+ "vendor_ref_id": {
23
+ "type": "string"
24
+ },
25
+ "response_digest": {
26
+ "type": "string"
27
+ }
28
+ },
29
+ "required": [
30
+ "http_status",
31
+ "vendor_ref_id",
32
+ "response_digest"
33
+ ]
34
+ },
35
+ "sample_evidence": {
36
+ "http_status": 200,
37
+ "vendor_ref_id": "ch_3NxExample",
38
+ "response_digest": "blake3:7f83b1657ff1fc53b92dc18148a1d65dfc2d4b1fa3d677284addd200126d9069"
39
+ },
40
+ "sample_failing_evidence": {
41
+ "http_status": 500,
42
+ "vendor_ref_id": "ch_3NxExample",
43
+ "response_digest": "blake3:7f83b1657ff1fc53b92dc18148a1d65dfc2d4b1fa3d677284addd200126d9069"
44
+ },
45
+ "human_summary": "Release when HTTP status is 200 and vendor_ref_id plus response_digest are present with schema types.",
46
+ "recommended_amount_cents": 500,
47
+ "scope": "tool_completion",
48
+ "spend_hints": {
49
+ "approval_threshold_cents": 2500,
50
+ "per_tool_max_cents": 10000
51
+ }
52
+ },
53
+ {
54
+ "preset_id": "webhook_confirmed",
55
+ "title": "Webhook confirmed",
56
+ "description": "Async vendor confirmation captured in evidence with event type and webhook identifiers.",
57
+ "harbor_template_id": "webhook_confirmation_v1",
58
+ "parameters": {
59
+ "event_type_path": [
60
+ "event_type"
61
+ ],
62
+ "expected_event_type": "payment.succeeded"
63
+ },
64
+ "evidence_schema": {
65
+ "type": "object",
66
+ "properties": {
67
+ "webhook_event_id": {
68
+ "type": "string"
69
+ },
70
+ "event_type": {
71
+ "type": "string"
72
+ },
73
+ "payload_digest": {
74
+ "type": "string"
75
+ }
76
+ },
77
+ "required": [
78
+ "webhook_event_id",
79
+ "event_type",
80
+ "payload_digest"
81
+ ]
82
+ },
83
+ "sample_evidence": {
84
+ "webhook_event_id": "evt_1NxExample",
85
+ "event_type": "payment.succeeded",
86
+ "payload_digest": "blake3:2c26b46b68ffc68ff99b453c1d3041340e45ee0e6daef0f4c932b8d4b8e8bb2e"
87
+ },
88
+ "sample_failing_evidence": {
89
+ "webhook_event_id": "evt_1NxExample",
90
+ "event_type": "payment.failed",
91
+ "payload_digest": "blake3:2c26b46b68ffc68ff99b453c1d3041340e45ee0e6daef0f4c932b8d4b8e8bb2e"
92
+ },
93
+ "human_summary": "Release when event_type is payment.succeeded and webhook_event_id plus payload_digest are present.",
94
+ "recommended_amount_cents": 1000,
95
+ "scope": "tool_completion",
96
+ "spend_hints": {
97
+ "approval_threshold_cents": 5000,
98
+ "per_tool_max_cents": 25000
99
+ }
100
+ },
101
+ {
102
+ "preset_id": "artifact_attested",
103
+ "title": "Artifact attested",
104
+ "description": "Work proven by out-of-band artifact hashes with operation and vendor reference fields.",
105
+ "harbor_template_id": "artifact_hash_v1",
106
+ "parameters": {
107
+ "operation_path": [
108
+ "operation"
109
+ ],
110
+ "expected_operation": "attested"
111
+ },
112
+ "evidence_schema": {
113
+ "type": "object",
114
+ "properties": {
115
+ "artifact_blake3_hex": {
116
+ "type": "array",
117
+ "items": {
118
+ "type": "string"
119
+ }
120
+ },
121
+ "operation": {
122
+ "type": "string"
123
+ },
124
+ "vendor_ref_id": {
125
+ "type": "string"
126
+ }
127
+ },
128
+ "required": [
129
+ "artifact_blake3_hex",
130
+ "operation",
131
+ "vendor_ref_id"
132
+ ]
133
+ },
134
+ "sample_evidence": {
135
+ "artifact_blake3_hex": [
136
+ "7f83b1657ff1fc53b92dc18148a1d65dfc2d4b1fa3d677284addd200126d9069"
137
+ ],
138
+ "operation": "attested",
139
+ "vendor_ref_id": "job_9kExample"
140
+ },
141
+ "sample_failing_evidence": {
142
+ "artifact_blake3_hex": [
143
+ "7f83b1657ff1fc53b92dc18148a1d65dfc2d4b1fa3d677284addd200126d9069"
144
+ ],
145
+ "operation": "pending",
146
+ "vendor_ref_id": "job_9kExample"
147
+ },
148
+ "human_summary": "Release when operation is attested, artifact_blake3_hex is a non-empty array, and vendor_ref_id matches the evidence schema.",
149
+ "recommended_amount_cents": 2500,
150
+ "scope": "tool_completion",
151
+ "spend_hints": {
152
+ "approval_threshold_cents": 10000,
153
+ "per_tool_max_cents": 50000
154
+ }
155
+ },
156
+ {
157
+ "preset_id": "cost_and_completion",
158
+ "title": "Cost and completion",
159
+ "description": "Completion-style status check plus evidence cost capped by intent amount_cents.",
160
+ "harbor_template_id": "completion_budget_v1",
161
+ "parameters": {
162
+ "status_path": [
163
+ "status"
164
+ ],
165
+ "expected_status": "completed",
166
+ "cost_path": [
167
+ "cost_cents"
168
+ ]
169
+ },
170
+ "evidence_schema": {
171
+ "type": "object",
172
+ "properties": {
173
+ "status": {
174
+ "type": "string"
175
+ },
176
+ "cost_cents": {
177
+ "type": "integer"
178
+ }
179
+ },
180
+ "required": [
181
+ "status",
182
+ "cost_cents"
183
+ ]
184
+ },
185
+ "sample_evidence": {
186
+ "status": "completed",
187
+ "cost_cents": 10
188
+ },
189
+ "sample_failing_evidence": {
190
+ "status": "failed",
191
+ "cost_cents": 10
192
+ },
193
+ "human_summary": "Release when status is completed and cost_cents is within the intent budget.",
194
+ "recommended_amount_cents": 100,
195
+ "scope": "tool_completion",
196
+ "spend_hints": {
197
+ "approval_threshold_cents": 1000,
198
+ "per_tool_max_cents": 5000
199
+ }
200
+ },
201
+ {
202
+ "preset_id": "sandbox_permissive",
203
+ "title": "Sandbox permissive",
204
+ "description": "Always release; use only for fast sandbox integration before strong completion rules.",
205
+ "harbor_template_id": "true_v1",
206
+ "parameters": {},
207
+ "evidence_schema": {
208
+ "type": "object",
209
+ "properties": {
210
+ "confirmation_id": {
211
+ "type": "string"
212
+ },
213
+ "charged_cents": {
214
+ "type": "integer"
215
+ }
216
+ }
217
+ },
218
+ "sample_evidence": {
219
+ "confirmation_id": "sandbox-smoke-001",
220
+ "charged_cents": 1
221
+ },
222
+ "sample_failing_evidence": {},
223
+ "human_summary": "Always pass (no evidence conditions). Opt in explicitly for sandbox smoke tests.",
224
+ "recommended_amount_cents": 100,
225
+ "scope": "sandbox_smoke"
226
+ },
227
+ {
228
+ "preset_id": "stripe_charge",
229
+ "kind": "vendor_pack",
230
+ "archetype_preset_id": "api_response_ok",
231
+ "title": "Stripe charge succeeded",
232
+ "description": "Thin wrapper over api_response_ok with Stripe charge id field conventions.",
233
+ "harbor_template_id": "api_response_v1",
234
+ "parameters": {
235
+ "http_status_path": [
236
+ "http_status"
237
+ ],
238
+ "expected_http_status": 200
239
+ },
240
+ "evidence_field_map": {
241
+ "charge_id": "vendor_ref_id",
242
+ "http_status": "http_status",
243
+ "response_digest": "response_digest"
244
+ },
245
+ "vendor_evidence_schema": {
246
+ "type": "object",
247
+ "properties": {
248
+ "charge_id": {
249
+ "type": "string",
250
+ "description": "Stripe charge id (ch_...)"
251
+ },
252
+ "http_status": {
253
+ "type": "integer"
254
+ },
255
+ "response_digest": {
256
+ "type": "string"
257
+ }
258
+ },
259
+ "required": [
260
+ "charge_id",
261
+ "http_status",
262
+ "response_digest"
263
+ ]
264
+ },
265
+ "evidence_schema": {
266
+ "type": "object",
267
+ "properties": {
268
+ "http_status": {
269
+ "type": "integer"
270
+ },
271
+ "vendor_ref_id": {
272
+ "type": "string"
273
+ },
274
+ "response_digest": {
275
+ "type": "string"
276
+ }
277
+ },
278
+ "required": [
279
+ "http_status",
280
+ "vendor_ref_id",
281
+ "response_digest"
282
+ ]
283
+ },
284
+ "vendor_sample_evidence": {
285
+ "charge_id": "ch_3NxExample",
286
+ "http_status": 200,
287
+ "response_digest": "blake3:7f83b1657ff1fc53b92dc18148a1d65dfc2d4b1fa3d677284addd200126d9069"
288
+ },
289
+ "sample_evidence": {
290
+ "http_status": 200,
291
+ "vendor_ref_id": "ch_3NxExample",
292
+ "response_digest": "blake3:7f83b1657ff1fc53b92dc18148a1d65dfc2d4b1fa3d677284addd200126d9069"
293
+ },
294
+ "sample_failing_evidence": {
295
+ "http_status": 402,
296
+ "vendor_ref_id": "ch_3NxExample",
297
+ "response_digest": "blake3:7f83b1657ff1fc53b92dc18148a1d65dfc2d4b1fa3d677284addd200126d9069"
298
+ },
299
+ "human_summary": "Release when Stripe charge HTTP status is 200 with charge_id mapped to vendor_ref_id plus response_digest.",
300
+ "recommended_amount_cents": 500,
301
+ "spend_hints": {
302
+ "approval_threshold_cents": 2500,
303
+ "per_tool_max_cents": 10000
304
+ },
305
+ "scope": "tool_completion",
306
+ "rail_hints": [
307
+ "stripe_connect"
308
+ ],
309
+ "forbidden_evidence_fields": [
310
+ "payment_intent_id",
311
+ "payment_session_id",
312
+ "authorization_id",
313
+ "mandate_id"
314
+ ],
315
+ "anti_patterns": [
316
+ "Do not submit Stripe PaymentIntent or funding webhook payloads as tool-completion evidence."
317
+ ],
318
+ "vendor_contract": {
319
+ "provider": "stripe",
320
+ "api_version": "2024-10-28.acacia",
321
+ "contract_kind": "json_schema",
322
+ "quality_fields": [
323
+ "charge_id",
324
+ "response_digest"
325
+ ],
326
+ "schema_digest_hex": "ed987475f2756ad37dd04e6a9fe6ab6e0ca77fa974d9e142306dcb665c481dd0",
327
+ "canonical_schema_digest_hex": "95a6b806adf78cab5fbb4f7bb871d1114268620c0d12cf61cfa8405558ea2577"
328
+ }
329
+ },
330
+ {
331
+ "preset_id": "vendor_webhook_confirmed",
332
+ "kind": "vendor_pack",
333
+ "archetype_preset_id": "webhook_confirmed",
334
+ "title": "Vendor webhook confirmed",
335
+ "description": "Async vendor SaaS webhook as tool-completion evidence. Use vendor job/order events — not payment-rail funding webhooks.",
336
+ "harbor_template_id": "webhook_confirmation_v1",
337
+ "parameters": {
338
+ "event_type_path": [
339
+ "event_type"
340
+ ],
341
+ "expected_event_type": "job.completed"
342
+ },
343
+ "evidence_field_map": {
344
+ "webhook_event_id": "webhook_event_id",
345
+ "event_type": "event_type",
346
+ "payload_digest": "payload_digest"
347
+ },
348
+ "vendor_evidence_schema": {
349
+ "type": "object",
350
+ "properties": {
351
+ "webhook_event_id": {
352
+ "type": "string",
353
+ "description": "Vendor webhook delivery id"
354
+ },
355
+ "event_type": {
356
+ "type": "string"
357
+ },
358
+ "payload_digest": {
359
+ "type": "string"
360
+ }
361
+ },
362
+ "required": [
363
+ "webhook_event_id",
364
+ "event_type",
365
+ "payload_digest"
366
+ ]
367
+ },
368
+ "evidence_schema": {
369
+ "type": "object",
370
+ "properties": {
371
+ "webhook_event_id": {
372
+ "type": "string"
373
+ },
374
+ "event_type": {
375
+ "type": "string"
376
+ },
377
+ "payload_digest": {
378
+ "type": "string"
379
+ }
380
+ },
381
+ "required": [
382
+ "webhook_event_id",
383
+ "event_type",
384
+ "payload_digest"
385
+ ]
386
+ },
387
+ "vendor_sample_evidence": {
388
+ "webhook_event_id": "wh_9kExample",
389
+ "event_type": "job.completed",
390
+ "payload_digest": "blake3:2c26b46b68ffc68ff99b453c1d3041340e45ee0e6daef0f4c932b8d4b8e8bb2e"
391
+ },
392
+ "sample_evidence": {
393
+ "webhook_event_id": "wh_9kExample",
394
+ "event_type": "job.completed",
395
+ "payload_digest": "blake3:2c26b46b68ffc68ff99b453c1d3041340e45ee0e6daef0f4c932b8d4b8e8bb2e"
396
+ },
397
+ "sample_failing_evidence": {
398
+ "webhook_event_id": "wh_9kExample",
399
+ "event_type": "job.failed",
400
+ "payload_digest": "blake3:2c26b46b68ffc68ff99b453c1d3041340e45ee0e6daef0f4c932b8d4b8e8bb2e"
401
+ },
402
+ "human_summary": "Release when vendor webhook event_type is job.completed with webhook_event_id and payload_digest present.",
403
+ "recommended_amount_cents": 1000,
404
+ "spend_hints": {
405
+ "approval_threshold_cents": 5000,
406
+ "per_tool_max_cents": 25000
407
+ },
408
+ "scope": "tool_completion",
409
+ "forbidden_evidence_fields": [
410
+ "payment_intent_id",
411
+ "mandate_id",
412
+ "latest_charge_id",
413
+ "transfer_id",
414
+ "refund_id",
415
+ "stripe_event_id",
416
+ "payment_session_id",
417
+ "authorization_id"
418
+ ],
419
+ "anti_patterns": [
420
+ "Do not use Stripe funding events (payment_intent.succeeded) as tool-completion evidence.",
421
+ "Do not use Coinbase authorization or x402 payment-session webhooks as tool-completion evidence."
422
+ ],
423
+ "vendor_contract": {
424
+ "provider": "generic",
425
+ "api_version": "vendor_webhook_v1",
426
+ "contract_kind": "json_schema",
427
+ "quality_fields": [
428
+ "webhook_event_id",
429
+ "payload_digest"
430
+ ],
431
+ "schema_digest_hex": "734fb59c4ebd0316367ee58936e5d74884c0c6995ffd04d018e38e54101d5026",
432
+ "canonical_schema_digest_hex": "b81b781604c053abcb6fbdf2a03d7e4f8fd27ad3e1a84b967c5d80d7071c9364"
433
+ }
434
+ },
435
+ {
436
+ "preset_id": "stripe_webhook_payment",
437
+ "kind": "vendor_pack",
438
+ "archetype_preset_id": "webhook_confirmed",
439
+ "deprecated": true,
440
+ "superseded_by": "vendor_webhook_confirmed",
441
+ "title": "Stripe payment webhook (deprecated)",
442
+ "description": "Deprecated alias — use vendor_webhook_confirmed. Accepts legacy stripe_event_id field name for one release cycle.",
443
+ "harbor_template_id": "webhook_confirmation_v1",
444
+ "parameters": {
445
+ "event_type_path": [
446
+ "event_type"
447
+ ],
448
+ "expected_event_type": "job.completed"
449
+ },
450
+ "evidence_field_map": {
451
+ "stripe_event_id": "webhook_event_id",
452
+ "webhook_event_id": "webhook_event_id",
453
+ "event_type": "event_type",
454
+ "payload_digest": "payload_digest"
455
+ },
456
+ "vendor_evidence_schema": {
457
+ "type": "object",
458
+ "properties": {
459
+ "stripe_event_id": {
460
+ "type": "string",
461
+ "description": "Legacy Stripe event id (evt_...) — prefer webhook_event_id"
462
+ },
463
+ "event_type": {
464
+ "type": "string"
465
+ },
466
+ "payload_digest": {
467
+ "type": "string"
468
+ }
469
+ },
470
+ "required": [
471
+ "stripe_event_id",
472
+ "event_type",
473
+ "payload_digest"
474
+ ]
475
+ },
476
+ "evidence_schema": {
477
+ "type": "object",
478
+ "properties": {
479
+ "webhook_event_id": {
480
+ "type": "string"
481
+ },
482
+ "event_type": {
483
+ "type": "string"
484
+ },
485
+ "payload_digest": {
486
+ "type": "string"
487
+ }
488
+ },
489
+ "required": [
490
+ "webhook_event_id",
491
+ "event_type",
492
+ "payload_digest"
493
+ ]
494
+ },
495
+ "vendor_sample_evidence": {
496
+ "stripe_event_id": "evt_1NxExample",
497
+ "event_type": "job.completed",
498
+ "payload_digest": "blake3:2c26b46b68ffc68ff99b453c1d3041340e45ee0e6daef0f4c932b8d4b8e8bb2e"
499
+ },
500
+ "sample_evidence": {
501
+ "webhook_event_id": "evt_1NxExample",
502
+ "event_type": "job.completed",
503
+ "payload_digest": "blake3:2c26b46b68ffc68ff99b453c1d3041340e45ee0e6daef0f4c932b8d4b8e8bb2e"
504
+ },
505
+ "sample_failing_evidence": {
506
+ "webhook_event_id": "evt_1NxExample",
507
+ "event_type": "job.failed",
508
+ "payload_digest": "blake3:2c26b46b68ffc68ff99b453c1d3041340e45ee0e6daef0f4c932b8d4b8e8bb2e"
509
+ },
510
+ "human_summary": "Deprecated — use vendor_webhook_confirmed. Release when event_type is job.completed with webhook id and payload digest.",
511
+ "recommended_amount_cents": 1000,
512
+ "spend_hints": {
513
+ "approval_threshold_cents": 5000,
514
+ "per_tool_max_cents": 25000
515
+ },
516
+ "scope": "tool_completion",
517
+ "rail_hints": [
518
+ "stripe_connect"
519
+ ],
520
+ "forbidden_evidence_fields": [
521
+ "payment_intent_id",
522
+ "mandate_id",
523
+ "latest_charge_id",
524
+ "transfer_id",
525
+ "refund_id",
526
+ "stripe_event_id"
527
+ ],
528
+ "anti_patterns": [
529
+ "Do not use Stripe funding events (payment_intent.succeeded) as tool-completion evidence."
530
+ ],
531
+ "vendor_contract": {
532
+ "provider": "stripe",
533
+ "api_version": "stripe_webhook_legacy_v1",
534
+ "contract_kind": "json_schema",
535
+ "quality_fields": [
536
+ "stripe_event_id",
537
+ "payload_digest"
538
+ ],
539
+ "supersedes": "vendor_webhook_v1",
540
+ "migration_notes": "Deprecated — use vendor_webhook_confirmed with webhook_event_id instead of stripe_event_id.",
541
+ "schema_digest_hex": "3beb0917385fda70dedcf838dee9dbf6e81b316f30aaf9f615ec46a77277d189",
542
+ "canonical_schema_digest_hex": "b81b781604c053abcb6fbdf2a03d7e4f8fd27ad3e1a84b967c5d80d7071c9364"
543
+ }
544
+ },
545
+ {
546
+ "preset_id": "ach_paid_api_ok",
547
+ "kind": "vendor_pack",
548
+ "archetype_preset_id": "api_response_ok",
549
+ "title": "ACH paid API OK",
550
+ "description": "Synchronous vendor HTTP confirmation after ACH-funded capability gate. Maps confirmation_number to vendor_ref_id.",
551
+ "harbor_template_id": "api_response_v1",
552
+ "parameters": {
553
+ "http_status_path": [
554
+ "http_status"
555
+ ],
556
+ "expected_http_status": 200
557
+ },
558
+ "evidence_field_map": {
559
+ "confirmation_number": "vendor_ref_id",
560
+ "http_status": "http_status",
561
+ "response_digest": "response_digest"
562
+ },
563
+ "vendor_evidence_schema": {
564
+ "type": "object",
565
+ "properties": {
566
+ "confirmation_number": {
567
+ "type": "string",
568
+ "description": "Vendor booking or order confirmation id"
569
+ },
570
+ "http_status": {
571
+ "type": "integer"
572
+ },
573
+ "response_digest": {
574
+ "type": "string"
575
+ }
576
+ },
577
+ "required": [
578
+ "confirmation_number",
579
+ "http_status",
580
+ "response_digest"
581
+ ]
582
+ },
583
+ "evidence_schema": {
584
+ "type": "object",
585
+ "properties": {
586
+ "http_status": {
587
+ "type": "integer"
588
+ },
589
+ "vendor_ref_id": {
590
+ "type": "string"
591
+ },
592
+ "response_digest": {
593
+ "type": "string"
594
+ }
595
+ },
596
+ "required": [
597
+ "http_status",
598
+ "vendor_ref_id",
599
+ "response_digest"
600
+ ]
601
+ },
602
+ "vendor_sample_evidence": {
603
+ "confirmation_number": "AA-8JZ3QK",
604
+ "http_status": 200,
605
+ "response_digest": "blake3:7f83b1657ff1fc53b92dc18148a1d65dfc2d4b1fa3d677284addd200126d9069"
606
+ },
607
+ "sample_evidence": {
608
+ "http_status": 200,
609
+ "vendor_ref_id": "AA-8JZ3QK",
610
+ "response_digest": "blake3:7f83b1657ff1fc53b92dc18148a1d65dfc2d4b1fa3d677284addd200126d9069"
611
+ },
612
+ "sample_failing_evidence": {
613
+ "http_status": 500,
614
+ "vendor_ref_id": "AA-8JZ3QK",
615
+ "response_digest": "blake3:7f83b1657ff1fc53b92dc18148a1d65dfc2d4b1fa3d677284addd200126d9069"
616
+ },
617
+ "human_summary": "Release when vendor HTTP status is 200 with confirmation_number mapped to vendor_ref_id plus response_digest.",
618
+ "recommended_amount_cents": 20000,
619
+ "spend_hints": {
620
+ "approval_threshold_cents": 5000,
621
+ "per_tool_max_cents": 50000
622
+ },
623
+ "scope": "tool_completion",
624
+ "rail_hints": [
625
+ "stripe_ach_debit"
626
+ ],
627
+ "forbidden_evidence_fields": [
628
+ "payment_intent_id",
629
+ "mandate_id",
630
+ "latest_charge_id",
631
+ "transfer_id",
632
+ "refund_id",
633
+ "stripe_event_id"
634
+ ],
635
+ "anti_patterns": [
636
+ "Do not submit Stripe PaymentIntent, mandate, or ACH funding webhook payloads as tool-completion evidence."
637
+ ],
638
+ "vendor_contract": {
639
+ "provider": "generic",
640
+ "api_version": "ach_paid_api_v1",
641
+ "contract_kind": "json_schema",
642
+ "quality_fields": [
643
+ "confirmation_number",
644
+ "response_digest"
645
+ ],
646
+ "schema_digest_hex": "3da94a416d36a31864058ace9392c12ca3f43aefba78f1b1829fb90568c9cc39",
647
+ "canonical_schema_digest_hex": "95a6b806adf78cab5fbb4f7bb871d1114268620c0d12cf61cfa8405558ea2577"
648
+ }
649
+ },
650
+ {
651
+ "preset_id": "ach_travel_booking",
652
+ "kind": "vendor_pack",
653
+ "archetype_preset_id": "cost_and_completion",
654
+ "title": "ACH travel booking",
655
+ "description": "Travel booking completion with confirmation_number, total_cents budget cap, and fare_class metadata. Mirrors the admin ACH walkthrough demo.",
656
+ "harbor_template_id": "completion_budget_v1",
657
+ "parameters": {
658
+ "status_path": [
659
+ "status"
660
+ ],
661
+ "expected_status": "completed",
662
+ "cost_path": [
663
+ "total_cents"
664
+ ]
665
+ },
666
+ "evidence_field_map": {
667
+ "confirmation_number": "confirmation_number",
668
+ "total_cents": "total_cents",
669
+ "fare_class": "fare_class",
670
+ "status": "status"
671
+ },
672
+ "vendor_evidence_schema": {
673
+ "type": "object",
674
+ "properties": {
675
+ "confirmation_number": {
676
+ "type": "string"
677
+ },
678
+ "total_cents": {
679
+ "type": "integer"
680
+ },
681
+ "fare_class": {
682
+ "type": "string"
683
+ },
684
+ "status": {
685
+ "type": "string"
686
+ }
687
+ },
688
+ "required": [
689
+ "confirmation_number",
690
+ "total_cents",
691
+ "fare_class",
692
+ "status"
693
+ ]
694
+ },
695
+ "evidence_schema": {
696
+ "type": "object",
697
+ "properties": {
698
+ "confirmation_number": {
699
+ "type": "string"
700
+ },
701
+ "total_cents": {
702
+ "type": "integer"
703
+ },
704
+ "fare_class": {
705
+ "type": "string"
706
+ },
707
+ "status": {
708
+ "type": "string"
709
+ }
710
+ },
711
+ "required": [
712
+ "confirmation_number",
713
+ "total_cents",
714
+ "fare_class",
715
+ "status"
716
+ ]
717
+ },
718
+ "vendor_sample_evidence": {
719
+ "confirmation_number": "AA-8JZ3QK",
720
+ "total_cents": 19750,
721
+ "fare_class": "economy",
722
+ "status": "completed"
723
+ },
724
+ "sample_evidence": {
725
+ "confirmation_number": "AA-8JZ3QK",
726
+ "total_cents": 19750,
727
+ "fare_class": "economy",
728
+ "status": "completed"
729
+ },
730
+ "sample_failing_evidence": {
731
+ "confirmation_number": "AA-8JZ3QK",
732
+ "total_cents": 19750,
733
+ "fare_class": "business",
734
+ "status": "failed"
735
+ },
736
+ "human_summary": "Release when status is completed and total_cents is within the intent budget. confirmation_number and fare_class are schema-validated metadata.",
737
+ "recommended_amount_cents": 20000,
738
+ "spend_hints": {
739
+ "approval_threshold_cents": 10000,
740
+ "per_tool_max_cents": 50000
741
+ },
742
+ "scope": "tool_completion",
743
+ "rail_hints": [
744
+ "stripe_ach_debit"
745
+ ],
746
+ "forbidden_evidence_fields": [
747
+ "payment_intent_id",
748
+ "mandate_id",
749
+ "latest_charge_id",
750
+ "transfer_id",
751
+ "refund_id",
752
+ "stripe_event_id"
753
+ ],
754
+ "anti_patterns": [
755
+ "Do not submit Stripe PaymentIntent or ACH funding webhook payloads as tool-completion evidence."
756
+ ],
757
+ "vendor_contract": {
758
+ "provider": "generic",
759
+ "api_version": "ach_travel_booking_v1",
760
+ "contract_kind": "json_schema",
761
+ "quality_fields": [
762
+ "fare_class",
763
+ "total_cents"
764
+ ],
765
+ "schema_digest_hex": "2fb55ee27008a7d59d2df78f80dc144121e54056c71f53c62c90c5f00200dd91",
766
+ "canonical_schema_digest_hex": "2fb55ee27008a7d59d2df78f80dc144121e54056c71f53c62c90c5f00200dd91"
767
+ }
768
+ },
769
+ {
770
+ "preset_id": "ach_vendor_webhook",
771
+ "kind": "vendor_pack",
772
+ "archetype_preset_id": "webhook_confirmed",
773
+ "title": "ACH vendor webhook",
774
+ "description": "Async vendor webhook after ACH-funded tool execution. Explicitly not payment_intent.* funding events.",
775
+ "harbor_template_id": "webhook_confirmation_v1",
776
+ "parameters": {
777
+ "event_type_path": [
778
+ "event_type"
779
+ ],
780
+ "expected_event_type": "booking.confirmed"
781
+ },
782
+ "evidence_field_map": {
783
+ "vendor_event_id": "webhook_event_id",
784
+ "vendor_event_type": "event_type",
785
+ "payload_digest": "payload_digest"
786
+ },
787
+ "vendor_evidence_schema": {
788
+ "type": "object",
789
+ "properties": {
790
+ "vendor_event_id": {
791
+ "type": "string"
792
+ },
793
+ "vendor_event_type": {
794
+ "type": "string"
795
+ },
796
+ "payload_digest": {
797
+ "type": "string"
798
+ }
799
+ },
800
+ "required": [
801
+ "vendor_event_id",
802
+ "vendor_event_type",
803
+ "payload_digest"
804
+ ]
805
+ },
806
+ "evidence_schema": {
807
+ "type": "object",
808
+ "properties": {
809
+ "webhook_event_id": {
810
+ "type": "string"
811
+ },
812
+ "event_type": {
813
+ "type": "string"
814
+ },
815
+ "payload_digest": {
816
+ "type": "string"
817
+ }
818
+ },
819
+ "required": [
820
+ "webhook_event_id",
821
+ "event_type",
822
+ "payload_digest"
823
+ ]
824
+ },
825
+ "vendor_sample_evidence": {
826
+ "vendor_event_id": "wh_travel_8JZ3QK",
827
+ "vendor_event_type": "booking.confirmed",
828
+ "payload_digest": "blake3:2c26b46b68ffc68ff99b453c1d3041340e45ee0e6daef0f4c932b8d4b8e8bb2e"
829
+ },
830
+ "sample_evidence": {
831
+ "webhook_event_id": "wh_travel_8JZ3QK",
832
+ "event_type": "booking.confirmed",
833
+ "payload_digest": "blake3:2c26b46b68ffc68ff99b453c1d3041340e45ee0e6daef0f4c932b8d4b8e8bb2e"
834
+ },
835
+ "sample_failing_evidence": {
836
+ "webhook_event_id": "wh_travel_8JZ3QK",
837
+ "event_type": "booking.cancelled",
838
+ "payload_digest": "blake3:2c26b46b68ffc68ff99b453c1d3041340e45ee0e6daef0f4c932b8d4b8e8bb2e"
839
+ },
840
+ "human_summary": "Release when vendor_event_type is booking.confirmed with vendor_event_id mapped to webhook_event_id and payload digest present.",
841
+ "recommended_amount_cents": 20000,
842
+ "spend_hints": {
843
+ "approval_threshold_cents": 10000,
844
+ "per_tool_max_cents": 50000
845
+ },
846
+ "scope": "tool_completion",
847
+ "rail_hints": [
848
+ "stripe_ach_debit"
849
+ ],
850
+ "forbidden_evidence_fields": [
851
+ "payment_intent_id",
852
+ "mandate_id",
853
+ "latest_charge_id",
854
+ "transfer_id",
855
+ "refund_id",
856
+ "stripe_event_id"
857
+ ],
858
+ "anti_patterns": [
859
+ "Do not use payment_intent.* Stripe funding events as tool-completion evidence."
860
+ ],
861
+ "vendor_contract": {
862
+ "provider": "generic",
863
+ "api_version": "ach_vendor_webhook_v1",
864
+ "contract_kind": "json_schema",
865
+ "quality_fields": [
866
+ "vendor_event_id",
867
+ "payload_digest"
868
+ ],
869
+ "schema_digest_hex": "0dfacbc0ed9b8436c1a36e4d095d3813ae0ee9b7fbc1b3d46b5a441dd493984f",
870
+ "canonical_schema_digest_hex": "b81b781604c053abcb6fbdf2a03d7e4f8fd27ad3e1a84b967c5d80d7071c9364"
871
+ }
872
+ },
873
+ {
874
+ "preset_id": "x402_paid_api_ok",
875
+ "kind": "vendor_pack",
876
+ "archetype_preset_id": "api_response_ok",
877
+ "title": "x402 paid API OK",
878
+ "description": "HTTP tool completion behind an x402-funded intent. Same pattern as stripe_charge without Stripe field names.",
879
+ "harbor_template_id": "api_response_v1",
880
+ "parameters": {
881
+ "http_status_path": [
882
+ "http_status"
883
+ ],
884
+ "expected_http_status": 200
885
+ },
886
+ "evidence_field_map": {
887
+ "vendor_ref_id": "vendor_ref_id",
888
+ "http_status": "http_status",
889
+ "response_digest": "response_digest"
890
+ },
891
+ "vendor_evidence_schema": {
892
+ "type": "object",
893
+ "properties": {
894
+ "vendor_ref_id": {
895
+ "type": "string",
896
+ "description": "Vendor job or resource reference"
897
+ },
898
+ "http_status": {
899
+ "type": "integer"
900
+ },
901
+ "response_digest": {
902
+ "type": "string"
903
+ }
904
+ },
905
+ "required": [
906
+ "vendor_ref_id",
907
+ "http_status",
908
+ "response_digest"
909
+ ]
910
+ },
911
+ "evidence_schema": {
912
+ "type": "object",
913
+ "properties": {
914
+ "http_status": {
915
+ "type": "integer"
916
+ },
917
+ "vendor_ref_id": {
918
+ "type": "string"
919
+ },
920
+ "response_digest": {
921
+ "type": "string"
922
+ }
923
+ },
924
+ "required": [
925
+ "http_status",
926
+ "vendor_ref_id",
927
+ "response_digest"
928
+ ]
929
+ },
930
+ "vendor_sample_evidence": {
931
+ "vendor_ref_id": "job_9kExample",
932
+ "http_status": 200,
933
+ "response_digest": "blake3:7f83b1657ff1fc53b92dc18148a1d65dfc2d4b1fa3d677284addd200126d9069"
934
+ },
935
+ "sample_evidence": {
936
+ "http_status": 200,
937
+ "vendor_ref_id": "job_9kExample",
938
+ "response_digest": "blake3:7f83b1657ff1fc53b92dc18148a1d65dfc2d4b1fa3d677284addd200126d9069"
939
+ },
940
+ "sample_failing_evidence": {
941
+ "http_status": 402,
942
+ "vendor_ref_id": "job_9kExample",
943
+ "response_digest": "blake3:7f83b1657ff1fc53b92dc18148a1d65dfc2d4b1fa3d677284addd200126d9069"
944
+ },
945
+ "human_summary": "Release when HTTP status is 200 with vendor_ref_id and response_digest present.",
946
+ "recommended_amount_cents": 500,
947
+ "spend_hints": {
948
+ "approval_threshold_cents": 2500,
949
+ "per_tool_max_cents": 10000
950
+ },
951
+ "scope": "tool_completion",
952
+ "rail_hints": [
953
+ "x402_usdc_base"
954
+ ],
955
+ "forbidden_evidence_fields": [
956
+ "payment_session_id",
957
+ "authorization_id",
958
+ "capture_id",
959
+ "void_id",
960
+ "x402_payment_session_id",
961
+ "onchain_transaction_hashes"
962
+ ],
963
+ "anti_patterns": [
964
+ "Do not submit Coinbase payment-session or authorization payloads as tool-completion evidence."
965
+ ],
966
+ "vendor_contract": {
967
+ "provider": "x402",
968
+ "api_version": "x402_api_v1",
969
+ "contract_kind": "json_schema",
970
+ "quality_fields": [
971
+ "vendor_ref_id",
972
+ "response_digest"
973
+ ],
974
+ "schema_digest_hex": "873dfa3000388d1bc0b730872ca2509560ce0346e7c3b1023ba97d5c7f25e1bf",
975
+ "canonical_schema_digest_hex": "95a6b806adf78cab5fbb4f7bb871d1114268620c0d12cf61cfa8405558ea2577"
976
+ }
977
+ },
978
+ {
979
+ "preset_id": "x402_delivery_receipt",
980
+ "kind": "vendor_pack",
981
+ "archetype_preset_id": "artifact_attested",
982
+ "title": "x402 delivery receipt",
983
+ "description": "x402 Signed Offer & Receipt extension mapped to artifact_attested. Maps resourceUrl to vendor_ref_id — not Coinbase session ids.",
984
+ "harbor_template_id": "artifact_hash_v1",
985
+ "parameters": {
986
+ "operation_path": [
987
+ "operation"
988
+ ],
989
+ "expected_operation": "attested"
990
+ },
991
+ "evidence_field_map": {
992
+ "receipt_digest": "artifact_blake3_hex",
993
+ "resource_url": "vendor_ref_id",
994
+ "operation": "operation"
995
+ },
996
+ "vendor_evidence_schema": {
997
+ "type": "object",
998
+ "properties": {
999
+ "receipt_digest": {
1000
+ "type": "string",
1001
+ "description": "BLAKE3 hex digest of signed x402 receipt bytes"
1002
+ },
1003
+ "resource_url": {
1004
+ "type": "string",
1005
+ "description": "x402 resourceUrl from signed receipt"
1006
+ },
1007
+ "operation": {
1008
+ "type": "string"
1009
+ }
1010
+ },
1011
+ "required": [
1012
+ "receipt_digest",
1013
+ "resource_url",
1014
+ "operation"
1015
+ ]
1016
+ },
1017
+ "evidence_schema": {
1018
+ "type": "object",
1019
+ "properties": {
1020
+ "artifact_blake3_hex": {
1021
+ "type": "array",
1022
+ "items": {
1023
+ "type": "string"
1024
+ }
1025
+ },
1026
+ "operation": {
1027
+ "type": "string"
1028
+ },
1029
+ "vendor_ref_id": {
1030
+ "type": "string"
1031
+ }
1032
+ },
1033
+ "required": [
1034
+ "artifact_blake3_hex",
1035
+ "operation",
1036
+ "vendor_ref_id"
1037
+ ]
1038
+ },
1039
+ "vendor_sample_evidence": {
1040
+ "receipt_digest": "7f83b1657ff1fc53b92dc18148a1d65dfc2d4b1fa3d677284addd200126d9069",
1041
+ "resource_url": "https://api.vendor.example/job/123",
1042
+ "operation": "attested"
1043
+ },
1044
+ "sample_evidence": {
1045
+ "artifact_blake3_hex": [
1046
+ "7f83b1657ff1fc53b92dc18148a1d65dfc2d4b1fa3d677284addd200126d9069"
1047
+ ],
1048
+ "operation": "attested",
1049
+ "vendor_ref_id": "https://api.vendor.example/job/123"
1050
+ },
1051
+ "sample_failing_evidence": {
1052
+ "artifact_blake3_hex": [
1053
+ "7f83b1657ff1fc53b92dc18148a1d65dfc2d4b1fa3d677284addd200126d9069"
1054
+ ],
1055
+ "operation": "pending",
1056
+ "vendor_ref_id": "https://api.vendor.example/job/123"
1057
+ },
1058
+ "human_summary": "Release when operation is attested, receipt_digest maps to artifact_blake3_hex, and resource_url maps to vendor_ref_id.",
1059
+ "recommended_amount_cents": 2500,
1060
+ "spend_hints": {
1061
+ "approval_threshold_cents": 10000,
1062
+ "per_tool_max_cents": 50000
1063
+ },
1064
+ "scope": "tool_completion",
1065
+ "rail_hints": [
1066
+ "x402_usdc_base"
1067
+ ],
1068
+ "forbidden_evidence_fields": [
1069
+ "payment_session_id",
1070
+ "authorization_id",
1071
+ "capture_id",
1072
+ "void_id",
1073
+ "x402_payment_session_id",
1074
+ "onchain_transaction_hashes"
1075
+ ],
1076
+ "anti_patterns": [
1077
+ "Do not submit Coinbase payment-session ids or on-chain auth transaction hashes as tool-completion evidence."
1078
+ ],
1079
+ "vendor_contract": {
1080
+ "provider": "x402",
1081
+ "api_version": "x402_receipt_v1",
1082
+ "contract_kind": "mapper_version",
1083
+ "quality_fields": [
1084
+ "receipt_digest",
1085
+ "resource_url"
1086
+ ],
1087
+ "schema_digest_hex": "04d3de014778e39be771bcc267b742f8fb701ce5c0aa75c27c24a564714e1ae0",
1088
+ "canonical_schema_digest_hex": "20e4dced0ae235b09c2613cd9fc551f2d85c0ff6781d34c763b57d7222c0d3e0"
1089
+ }
1090
+ },
1091
+ {
1092
+ "preset_id": "x402_cost_and_completion",
1093
+ "kind": "vendor_pack",
1094
+ "archetype_preset_id": "cost_and_completion",
1095
+ "title": "x402 cost and completion",
1096
+ "description": "Metered agent tool completion on the x402_usdc_base rail with standard status and cost_cents fields.",
1097
+ "harbor_template_id": "completion_budget_v1",
1098
+ "parameters": {
1099
+ "status_path": [
1100
+ "status"
1101
+ ],
1102
+ "expected_status": "completed",
1103
+ "cost_path": [
1104
+ "cost_cents"
1105
+ ]
1106
+ },
1107
+ "evidence_field_map": {
1108
+ "status": "status",
1109
+ "cost_cents": "cost_cents"
1110
+ },
1111
+ "vendor_evidence_schema": {
1112
+ "type": "object",
1113
+ "properties": {
1114
+ "status": {
1115
+ "type": "string"
1116
+ },
1117
+ "cost_cents": {
1118
+ "type": "integer"
1119
+ }
1120
+ },
1121
+ "required": [
1122
+ "status",
1123
+ "cost_cents"
1124
+ ]
1125
+ },
1126
+ "evidence_schema": {
1127
+ "type": "object",
1128
+ "properties": {
1129
+ "status": {
1130
+ "type": "string"
1131
+ },
1132
+ "cost_cents": {
1133
+ "type": "integer"
1134
+ }
1135
+ },
1136
+ "required": [
1137
+ "status",
1138
+ "cost_cents"
1139
+ ]
1140
+ },
1141
+ "vendor_sample_evidence": {
1142
+ "status": "completed",
1143
+ "cost_cents": 10
1144
+ },
1145
+ "sample_evidence": {
1146
+ "status": "completed",
1147
+ "cost_cents": 10
1148
+ },
1149
+ "sample_failing_evidence": {
1150
+ "status": "failed",
1151
+ "cost_cents": 10
1152
+ },
1153
+ "human_summary": "Release when status is completed and cost_cents is within the intent budget.",
1154
+ "recommended_amount_cents": 100,
1155
+ "spend_hints": {
1156
+ "approval_threshold_cents": 1000,
1157
+ "per_tool_max_cents": 5000
1158
+ },
1159
+ "scope": "tool_completion",
1160
+ "rail_hints": [
1161
+ "x402_usdc_base"
1162
+ ],
1163
+ "forbidden_evidence_fields": [
1164
+ "payment_session_id",
1165
+ "authorization_id",
1166
+ "capture_id",
1167
+ "void_id",
1168
+ "x402_payment_session_id",
1169
+ "onchain_transaction_hashes"
1170
+ ],
1171
+ "anti_patterns": [
1172
+ "Do not submit Coinbase authorization or payment-session payloads as tool-completion evidence."
1173
+ ],
1174
+ "vendor_contract": {
1175
+ "provider": "x402",
1176
+ "api_version": "x402_metered_v1",
1177
+ "contract_kind": "json_schema",
1178
+ "quality_fields": [
1179
+ "status",
1180
+ "cost_cents"
1181
+ ],
1182
+ "schema_digest_hex": "30a152fec1fa2965578938f26b82c805263f15e324db1be345453dc65598cc9c",
1183
+ "canonical_schema_digest_hex": "30a152fec1fa2965578938f26b82c805263f15e324db1be345453dc65598cc9c"
1184
+ }
1185
+ }
1186
+ ]
1187
+ }