{
  "$schema": "https://mandateshield.com/schemas/release-manifest/v3",
  "schema_version": "3.0.0",
  "release": {
    "product": "MandateShield",
    "product_version": "1.10.0",
    "specification_version": "2.4.0",
    "released_at": "2026-07-26T19:12:33.000Z"
  },
  "attestation": {
    "first_party": true,
    "independent": false,
    "source_public": false,
    "reproducible": false
  },
  "integrity": {
    "algorithm": "SHA-256",
    "checksum_file": "/sdk/v1.10.0/SHA256SUMS",
    "artifacts": [
      {
        "name": "MandateShield JavaScript SDK",
        "media_type": "text/javascript",
        "path": "/sdk/v1.10.0/mandateshield.mjs",
        "bytes": 68684,
        "sha256": "8a011a67839f0dc94051398bc70cdaeac7512066c4b5e3877621c651ac353d50"
      },
      {
        "name": "MandateShield CLI",
        "media_type": "text/javascript",
        "path": "/sdk/v1.10.0/mandateshield-cli.mjs",
        "bytes": 53326,
        "sha256": "35e5ecff7c4ebedfd2d11bc59d05dbd5e1e39238887938ffd18b85c303df5e3f"
      },
      {
        "name": "MandateShield offline receipt verifier",
        "media_type": "text/javascript",
        "path": "/sdk/v1.10.0/mandateshield-receipt-verifier.mjs",
        "bytes": 12231,
        "sha256": "5f88048f4a5455d48c9c6897c32b4d8adfeb8b4f27e32d59fc8bdc0fcf12479a"
      },
      {
        "name": "MandateShield offline execution-evidence verifier",
        "media_type": "text/javascript",
        "path": "/sdk/v1.10.0/mandateshield-execution-evidence-verifier.mjs",
        "bytes": 24723,
        "sha256": "61fbdc9a6f23dbe23babb4926068e27a68c34254302e6c47306d36305e42df91"
      },
      {
        "name": "MandateShield execution-evidence verifier TypeScript declarations",
        "media_type": "text/typescript",
        "path": "/sdk/v1.10.0/mandateshield-execution-evidence-verifier.d.ts",
        "bytes": 5300,
        "sha256": "6fcfa7dc7ce337a7bb824099e5cfc07c4652a195273dc8e15a1d00fbef52c6d9"
      },
      {
        "name": "MandateShield customer-side execution gateway",
        "media_type": "text/javascript",
        "path": "/sdk/v1.10.0/mandateshield-gateway.mjs",
        "bytes": 79691,
        "sha256": "78947fd0911d547cffbd7cc36239a9c1f20d2bc2ab8e09445d09dce9a95434d9"
      },
      {
        "name": "MandateShield gateway TypeScript declarations",
        "media_type": "text/typescript",
        "path": "/sdk/v1.10.0/mandateshield-gateway.d.ts",
        "bytes": 23735,
        "sha256": "228d952f76c387055f897e1aa308a427cca4849567375169e5f920c6f2d39278"
      },
      {
        "name": "MandateShield Stripe PaymentIntents adapter",
        "media_type": "text/javascript",
        "path": "/sdk/v1.10.0/mandateshield-stripe-payment-intents.mjs",
        "bytes": 24058,
        "sha256": "bd9008dec61bbbb76132f235baca1b1fd5a4a1cfcd1a53dc6c077c3a488a3645"
      },
      {
        "name": "MandateShield x402 v2 exact/EIP-3009 adapter",
        "media_type": "text/javascript",
        "path": "/sdk/v1.10.0/mandateshield-x402-v2-exact.mjs",
        "bytes": 74707,
        "sha256": "d8635dfe80aeacc2ca8885ec9436385d3b6a38caea20c5ed22dc994db6b231eb"
      },
      {
        "name": "MandateShield x402 TypeScript declarations",
        "media_type": "text/typescript",
        "path": "/sdk/v1.10.0/mandateshield-x402-v2-exact.d.ts",
        "bytes": 16748,
        "sha256": "33e0ce354efc408eff840573e8dfdc8ee174cc9bdb9430ff43044e21bcab926a"
      },
      {
        "name": "Purchase envelope specification v2.3 schema snapshot",
        "media_type": "application/schema+json",
        "path": "/evidence/v1.10.0/purchase-envelope-v2.3.schema.json",
        "bytes": 14252,
        "sha256": "7aff346c0d8f7ee29f79ae79b3f61e8effb95eaa4234036ca723ced539e7224d"
      },
      {
        "name": "Gateway adapter v2 journal schema snapshot",
        "media_type": "application/schema+json",
        "path": "/evidence/v1.10.0/gateway-adapter-v2.schema.json",
        "bytes": 21440,
        "sha256": "e6f0cc60a3e544ca1a1faa318a2e8540c87094ca34879cdd8b61f66351684f9d"
      },
      {
        "name": "x402 Gate artifact v1 journal schema snapshot",
        "media_type": "application/schema+json",
        "path": "/evidence/v1.10.0/x402-gate-artifact-v1.schema.json",
        "bytes": 20397,
        "sha256": "eaaca472bb3f68835a32a738c3ea2367486753d87eccde537b82008d1ae26e6f"
      },
      {
        "name": "Execution permit v1 schema snapshot",
        "media_type": "application/schema+json",
        "path": "/evidence/v1.10.0/execution-permit-v1.schema.json",
        "bytes": 7608,
        "sha256": "4e069879d316863fe8f1e279a9200e6b54e48c2109d3faa1fab48f9f2d5a6e70"
      },
      {
        "name": "Execution receipt v1 schema snapshot",
        "media_type": "application/schema+json",
        "path": "/evidence/v1.10.0/execution-receipt-v1.schema.json",
        "bytes": 14043,
        "sha256": "95da5b3b1e188a9cd2ce26e297eef9c442ab3bc6d8d78e42b197e5eb5b7fc307"
      },
      {
        "name": "ProviderSubmission v1 schema snapshot",
        "media_type": "application/schema+json",
        "path": "/evidence/v1.10.0/provider-submission-v1.schema.json",
        "bytes": 4942,
        "sha256": "ce863846eea5b17dccf251235e168dbf5bfba672f44337b98402b8c5f429e369"
      },
      {
        "name": "ProviderEvidence v1 schema snapshot",
        "media_type": "application/schema+json",
        "path": "/evidence/v1.10.0/provider-evidence-v1.schema.json",
        "bytes": 3708,
        "sha256": "dd83a66d6434178cfb6d4fc973916cbd5273ce824f44411c3a9b0dc108e36d81"
      },
      {
        "name": "ReconciliationRecord v1 schema snapshot",
        "media_type": "application/schema+json",
        "path": "/evidence/v1.10.0/reconciliation-record-v1.schema.json",
        "bytes": 3321,
        "sha256": "ccaf016b94a8bee096f8595505824dd6f3adb07cc3f8c22daf625414cd56b0be"
      },
      {
        "name": "Execution assurance level v1 schema snapshot",
        "media_type": "application/schema+json",
        "path": "/evidence/v1.10.0/execution-assurance-level-v1.schema.json",
        "bytes": 2367,
        "sha256": "e239c884d5e87e4227c6334ce314e968e67746643d855baa5544f4015344b390"
      },
      {
        "name": "Pinned x402 compatibility evidence",
        "media_type": "application/json",
        "path": "/evidence/v1.10.0/x402-compatibility.json",
        "bytes": 2604,
        "sha256": "54c185976de3ddceb083eb38f2924174a2e315b843bf33aa763d8d842d1827bc"
      },
      {
        "name": "SPDX software bill of materials",
        "media_type": "application/spdx+json",
        "path": "/evidence/v1.10.0/sbom.spdx.json",
        "bytes": 528169,
        "sha256": "c9f98d4fa1e63eb1d5ab714ff4d258a26699ebab3b68c242718ffa6fb74871fa"
      },
      {
        "name": "Installable MandateShield Node.js package",
        "media_type": "application/gzip",
        "path": "/packages/npm/1.10.0/mandateshield-sdk-1.10.0.tgz",
        "bytes": 18136,
        "sha256": "cab0685aea9a6e82a3a4dfbe0d92e46011086800ecc6be61bd3d1f8e3264fcae"
      },
      {
        "name": "Installable MandateShield Python wheel",
        "media_type": "application/octet-stream",
        "path": "/packages/python/1.10.0/mandateshield-1.10.0-py3-none-any.whl",
        "bytes": 47839,
        "sha256": "fb97307d6ebdb6260006c40a9b8f8dea5ab0be10183f518e685a48fc660016bb"
      },
      {
        "name": "Installable MandateShield Go module archive",
        "media_type": "application/zip",
        "path": "/packages/go/github.com/mandateshield/mandateshield-go/@v/v1.10.0.zip",
        "bytes": 66167,
        "sha256": "6ae4577dd4548686f8bc8828249c1e189a8d2e8b57e6235637ab99520ee1cabb"
      },
      {
        "name": "MandateShield agent payment-authority plugin",
        "media_type": "application/zip",
        "path": "/plugins/mandateshield/1.10.0/mandateshield-plugin-1.10.0.zip",
        "bytes": 18140,
        "sha256": "e4fa934fc62b6e7deabb8bec7c46514f3be13eddf4b766989a59035cf95e28a2"
      }
    ]
  },
  "verification": {
    "scope": "Byte integrity of the listed public release artifacts at the stated paths.",
    "procedure": "Download every integrity.artifacts path into one directory using its final filename, download /sdk/v1.10.0/SHA256SUMS into that directory, then run sha256sum -c SHA256SUMS on Linux or shasum -a 256 -c SHA256SUMS on macOS."
  },
  "limitations": [
    "This is a first-party release record, not an independent security audit.",
    "The product source is not public, so these artifacts do not establish source-to-binary reproducibility.",
    "Checksums establish byte identity only; they do not establish runtime security, availability, or protocol conformance."
  ]
}