ARTIFACTS
Machine-readable release package
- Release manifest
- Release manifest JSON Schema
- SHA-256 checksums
- SPDX 2.3 software bill of materials
- Versioned JavaScript SDK
- Versioned standalone CLI
- Versioned offline receipt verifier
- Versioned offline execution-evidence verifier
- Execution-evidence verifier TypeScript declarations
- Versioned customer-side execution gateway
- Gateway TypeScript declarations
- Versioned Stripe PaymentIntents adapter
- Versioned x402 v2 exact/EIP-3009 adapter
- x402 Gate TypeScript declarations
- Installable Node.js package
- Installable Python wheel
- Installable Go module archive
- Agent payment-authority plugin
- Pinned x402 package compatibility evidence
- x402 compatibility evidence JSON Schema
- Purchase-envelope v2.3 schema snapshot
- Gateway journal v2 schema snapshot
- x402 artifact journal v1 schema snapshot
- Execution permit v1 schema snapshot
- Execution receipt v1 schema snapshot
- ProviderSubmission v1 schema snapshot
- ProviderEvidence v1 schema snapshot
- ReconciliationRecord v1 schema snapshot
- Execution assurance-level v1 schema snapshot
WHAT THIS PROVES
Byte identity and dependency inventory
The hashes let an integrator detect a changed download. The SBOM records packages pinned in the build lockfile. The release manifest identifies exactly which public files the digests cover; it does not prove a private source-to-deployment relationship. Download every listed artifact into one directory using its final filename, add SHA256SUMS, then run sha256sum -c SHA256SUMS on Linux or shasum -a 256 -c SHA256SUMS on macOS.
VERSIONED RELEASE NAMESPACE
A changed byte requires a changed product version
The release and hosted-package builders refuse to overwrite a published artifact under /sdk/v1.10.0/ or /evidence/v1.10.0/, or a versioned Node.js, Python or Go package, with different bytes in the release source tree. This is a build guard, not an external append-only or WORM guarantee. Rolling client URLs remain available for discovery, but production installations should pin these versioned files.
HONEST BOUNDARY
First-party evidence, not certification
This package is vendor-generated. A digest detects changed bytes only when compared with a trusted copy of that digest. The package is not an independent audit, does not establish source-to-binary or source-to-deployment reproducibility while source is private, and does not prove runtime availability, conformance or security.