{
  "schemaVersion": 1,
  "status": "passed",
  "classification": "clean-commit-candidate",
  "generatedAt": "2026-07-30T06:49:31.995Z",
  "candidateVersion": "0.2.0",
  "sourceState": {
    "headCommit": "3ef51a15ce876763bc146c2777a9dde8639eb0c0",
    "dirty": false,
    "sourceManifest": {
      "algorithm": "sha256",
      "fileCount": 110,
      "digest": "sha256-79f9d282bdfc132ba16965020cdb501db5481e8a116ca114993c14d218724223",
      "excludes": [
        ".git",
        "node_modules",
        "dist",
        "artifacts",
        "coverage",
        "public/proof/release-artifact.json"
      ]
    },
    "note": "The receipt identifies a clean local candidate by commit and deterministic source-manifest digest."
  },
  "runtime": {
    "node": "v20.20.2",
    "platform": "linux-x64"
  },
  "commands": [
    "npm pack --json --workspace @monarch-shield/x402",
    "npm pack --json --workspace x402-doctor",
    "inject the exact release gitHead into both packed manifests",
    "npm install --ignore-scripts --no-audit --no-fund <local-tarballs>",
    "node <packed-cli> doctor --ci --strict <each-public-benchmark-case>",
    "node <packed-cli> version",
    "node <packed-wrapper-cli> --version",
    "node --input-type=module --eval <runtime-callback-contract>"
  ],
  "benchmarkManifestSha256": "sha256-77c1ffbf79a2a2bc97d64064371975727e12b8f5019af958d233d8b861dcfc42",
  "packageVersion": "0.2.0",
  "packageTarball": {
    "filename": "monarch-shield-x402-0.2.0.tgz",
    "integrity": "sha512-W1AbP6gcDxAdtRhkW+b6etFhxS5JA+8MtcUMUaI4YprQCbq/8+RjW/Ur4w7LtxupNgcSYzAhZr9Prg5gBh0jBw==",
    "gitHead": "3ef51a15ce876763bc146c2777a9dde8639eb0c0"
  },
  "wrapperVersion": "0.2.0",
  "wrapperTarball": {
    "filename": "x402-doctor-0.2.0.tgz",
    "integrity": "sha512-ZbkiWvEG7S3gOS53bXhd+KjAXxOv3rwy9JM4mD5VuA8odw+aDAeI/HGUttiCnvVxOBH4Vl8jb6Sr9i+gO2pVcg==",
    "gitHead": "3ef51a15ce876763bc146c2777a9dde8639eb0c0"
  },
  "adversarialCases": [
    {
      "id": "official-fetch-missing-policy",
      "status": "failed",
      "exitCode": 1
    },
    {
      "id": "official-fetch-abort-policy",
      "status": "passed",
      "exitCode": 0
    },
    {
      "id": "dead-policy-branch",
      "status": "failed",
      "exitCode": 1
    },
    {
      "id": "official-axios-wrong-client-policy",
      "status": "failed",
      "exitCode": 1
    },
    {
      "id": "official-mcp-observer-only",
      "status": "failed",
      "exitCode": 1
    },
    {
      "id": "official-mcp-abort-policy",
      "status": "passed",
      "exitCode": 0
    },
    {
      "id": "fake-monarch-guard",
      "status": "failed",
      "exitCode": 1
    },
    {
      "id": "legacy-payment-header",
      "status": "failed",
      "exitCode": 1
    },
    {
      "id": "malformed-x402-source",
      "status": "failed",
      "exitCode": 1
    },
    {
      "id": "ordinary-fetch-control",
      "status": "failed_no_payment_flow",
      "exitCode": 1
    }
  ],
  "runtimeInvalidEvidence": {
    "decision": "block",
    "status": "invalid_payment_details",
    "invalidCallbackRan": false,
    "requiresExplicitExecution": true,
    "callbackBeforeExplicitExecution": false
  },
  "limitations": [
    "This verifies locally packed release artifacts, not npm registry publication.",
    "The scanner covers selected x402 v2 JavaScript and TypeScript buyer patterns, not the whole x402 ecosystem.",
    "The scanner recognizes specific syntactic abort or denial returns and rejects obvious constant-dead branches; it does not prove general reachability.",
    "A passing static scan does not prove policy quality, runtime behavior, or settlement."
  ]
}