{
  "$schema": "https://mandateshield.com/schemas/release-manifest/v3",
  "schema_version": "3.0.0",
  "release": {
    "product": "MandateShield",
    "product_version": "1.13.0",
    "specification_version": "2.4.0",
    "released_at": "2026-07-28T14:25:22.000Z"
  },
  "attestation": {
    "first_party": true,
    "independent": false,
    "source_public": false,
    "reproducible": false
  },
  "integrity": {
    "algorithm": "SHA-256",
    "checksum_file": "/sdk/v1.13.0/SHA256SUMS",
    "artifacts": [
      {
        "name": "MandateShield JavaScript SDK",
        "media_type": "text/javascript",
        "path": "/sdk/v1.13.0/mandateshield.mjs",
        "bytes": 68701,
        "sha256": "4dc7a2d950a400c7ab21f60e718397e5639e8bf4a05e99bc5da9a2ab781bcbca"
      },
      {
        "name": "MandateShield CLI",
        "media_type": "text/javascript",
        "path": "/sdk/v1.13.0/mandateshield-cli.mjs",
        "bytes": 56772,
        "sha256": "ef6cb1e88b41fbca36671986ba7c9d3a523c31d7d68b623f3befd98dbdf3c673"
      },
      {
        "name": "MandateShield offline receipt verifier",
        "media_type": "text/javascript",
        "path": "/sdk/v1.13.0/mandateshield-receipt-verifier.mjs",
        "bytes": 12231,
        "sha256": "5f88048f4a5455d48c9c6897c32b4d8adfeb8b4f27e32d59fc8bdc0fcf12479a"
      },
      {
        "name": "MandateShield offline execution-evidence verifier",
        "media_type": "text/javascript",
        "path": "/sdk/v1.13.0/mandateshield-execution-evidence-verifier.mjs",
        "bytes": 24723,
        "sha256": "61fbdc9a6f23dbe23babb4926068e27a68c34254302e6c47306d36305e42df91"
      },
      {
        "name": "MandateShield execution-evidence verifier TypeScript declarations",
        "media_type": "text/typescript",
        "path": "/sdk/v1.13.0/mandateshield-execution-evidence-verifier.d.ts",
        "bytes": 5300,
        "sha256": "6fcfa7dc7ce337a7bb824099e5cfc07c4652a195273dc8e15a1d00fbef52c6d9"
      },
      {
        "name": "MandateShield customer-side execution gateway",
        "media_type": "text/javascript",
        "path": "/sdk/v1.13.0/mandateshield-gateway.mjs",
        "bytes": 80158,
        "sha256": "a1a7f46e917d445c4451910ff3c60a0b8f6cb12dcf42f99116c9a23fa33949ff"
      },
      {
        "name": "MandateShield gateway TypeScript declarations",
        "media_type": "text/typescript",
        "path": "/sdk/v1.13.0/mandateshield-gateway.d.ts",
        "bytes": 25201,
        "sha256": "580cfa1eb74f4ce073d7bb0b4e7c9cf5cea6351105448335a8cde39f13c29175"
      },
      {
        "name": "MandateShield PostgreSQL DurableGatewayJournal",
        "media_type": "text/javascript",
        "path": "/sdk/v1.13.0/mandateshield-postgres-gateway-journal.mjs",
        "bytes": 28863,
        "sha256": "3eeb20f837571ff4202abb3b95e9631dc92bdd3b5d21b786aa7c96e66e6f3482"
      },
      {
        "name": "MandateShield PostgreSQL DurableGatewayJournal TypeScript declarations",
        "media_type": "text/typescript",
        "path": "/sdk/v1.13.0/mandateshield-postgres-gateway-journal.d.ts",
        "bytes": 3525,
        "sha256": "979d0fb3e80220b51fa05f4cd4e0de92745f50a02558d04e6f67bf249ba863d0"
      },
      {
        "name": "MandateShield PostgreSQL DurableGatewayJournal schema",
        "media_type": "application/sql",
        "path": "/sdk/v1.13.0/mandateshield-postgres-gateway-journal.sql",
        "bytes": 4135,
        "sha256": "51fa8ac2d8877cb91c10c31de3f6bb604153284ce186325ebe8815a773647cb4"
      },
      {
        "name": "MandateShield Stripe PaymentIntents adapter",
        "media_type": "text/javascript",
        "path": "/sdk/v1.13.0/mandateshield-stripe-payment-intents.mjs",
        "bytes": 24333,
        "sha256": "a60fac531b0e690f2b2d51d668376a7403b47eac48b6bba57e8b6f5fcb616da0"
      },
      {
        "name": "MandateShield Stripe PaymentIntents TypeScript declarations",
        "media_type": "text/typescript",
        "path": "/sdk/v1.13.0/mandateshield-stripe-payment-intents.d.ts",
        "bytes": 3465,
        "sha256": "b9eddf8417a4713d13253924f4489f9c1520285e49ea59b636cd0549e69c0dbb"
      },
      {
        "name": "MandateShield x402 v2 exact/EIP-3009 adapter",
        "media_type": "text/javascript",
        "path": "/sdk/v1.13.0/mandateshield-x402-v2-exact.mjs",
        "bytes": 74707,
        "sha256": "d8635dfe80aeacc2ca8885ec9436385d3b6a38caea20c5ed22dc994db6b231eb"
      },
      {
        "name": "MandateShield x402 TypeScript declarations",
        "media_type": "text/typescript",
        "path": "/sdk/v1.13.0/mandateshield-x402-v2-exact.d.ts",
        "bytes": 16748,
        "sha256": "33e0ce354efc408eff840573e8dfdc8ee174cc9bdb9430ff43044e21bcab926a"
      },
      {
        "name": "Purchase envelope specification v2.3 schema snapshot",
        "media_type": "application/schema+json",
        "path": "/evidence/v1.13.0/purchase-envelope-v2.3.schema.json",
        "bytes": 14252,
        "sha256": "7aff346c0d8f7ee29f79ae79b3f61e8effb95eaa4234036ca723ced539e7224d"
      },
      {
        "name": "Gateway adapter v2 journal schema snapshot",
        "media_type": "application/schema+json",
        "path": "/evidence/v1.13.0/gateway-adapter-v2.schema.json",
        "bytes": 21440,
        "sha256": "e6f0cc60a3e544ca1a1faa318a2e8540c87094ca34879cdd8b61f66351684f9d"
      },
      {
        "name": "x402 Gate artifact v1 journal schema snapshot",
        "media_type": "application/schema+json",
        "path": "/evidence/v1.13.0/x402-gate-artifact-v1.schema.json",
        "bytes": 20397,
        "sha256": "eaaca472bb3f68835a32a738c3ea2367486753d87eccde537b82008d1ae26e6f"
      },
      {
        "name": "Execution permit v1 schema snapshot",
        "media_type": "application/schema+json",
        "path": "/evidence/v1.13.0/execution-permit-v1.schema.json",
        "bytes": 7665,
        "sha256": "caf90749898b821298a728ddd99a158106bc7109817e7cca33ff6b30b7b999a3"
      },
      {
        "name": "Execution receipt v1 schema snapshot",
        "media_type": "application/schema+json",
        "path": "/evidence/v1.13.0/execution-receipt-v1.schema.json",
        "bytes": 14043,
        "sha256": "95da5b3b1e188a9cd2ce26e297eef9c442ab3bc6d8d78e42b197e5eb5b7fc307"
      },
      {
        "name": "ProviderSubmission v1 schema snapshot",
        "media_type": "application/schema+json",
        "path": "/evidence/v1.13.0/provider-submission-v1.schema.json",
        "bytes": 4942,
        "sha256": "ce863846eea5b17dccf251235e168dbf5bfba672f44337b98402b8c5f429e369"
      },
      {
        "name": "ProviderEvidence v1 schema snapshot",
        "media_type": "application/schema+json",
        "path": "/evidence/v1.13.0/provider-evidence-v1.schema.json",
        "bytes": 4059,
        "sha256": "8646c37cb660154ae239f48f69ce151babc3a32b59c98bb2a35eaf441110ac95"
      },
      {
        "name": "ReconciliationRecord v1 schema snapshot",
        "media_type": "application/schema+json",
        "path": "/evidence/v1.13.0/reconciliation-record-v1.schema.json",
        "bytes": 3396,
        "sha256": "ef674a7df23b39ca67304ffd8f36df290e5daff3d9b827d8f5fd3d14c7dd0de1"
      },
      {
        "name": "Execution assurance level v1 schema snapshot",
        "media_type": "application/schema+json",
        "path": "/evidence/v1.13.0/execution-assurance-level-v1.schema.json",
        "bytes": 2688,
        "sha256": "f4585d1d015cb0ad68022a487dbb7accf8e63016903502604d9c942224578254"
      },
      {
        "name": "Release-scoped receipt verification key archive",
        "media_type": "application/jwk-set+json",
        "path": "/evidence/v1.13.0/receipt-verification-jwks.json",
        "bytes": 632,
        "sha256": "55fbc03d725d9247fd67604b7dca3875375a87e2d71b685bc370c84ce05673da"
      },
      {
        "name": "Pinned x402 compatibility evidence",
        "media_type": "application/json",
        "path": "/evidence/v1.13.0/x402-compatibility.json",
        "bytes": 2604,
        "sha256": "2fafc1539df17ed1036b9abf49f4c22f7d2516ec6872e9f70c0ee898c2636b96"
      },
      {
        "name": "SPDX software bill of materials",
        "media_type": "application/spdx+json",
        "path": "/evidence/v1.13.0/sbom.spdx.json",
        "bytes": 528169,
        "sha256": "3cd97202ea9f278c5fd68360f5a41b43d5f6a6458fd5ff5ab0fa5c16a764c0be"
      },
      {
        "name": "Installable MandateShield Node.js package",
        "media_type": "application/gzip",
        "path": "/packages/npm/1.13.0/mandateshield-sdk-1.13.0.tgz",
        "bytes": 58891,
        "sha256": "9352b41150f68f22ba786b934ccfe796ac56b03e8676e0d2bcf0aea7a0049483"
      },
      {
        "name": "Installable MandateShield Python wheel",
        "media_type": "application/octet-stream",
        "path": "/packages/python/1.13.0/mandateshield-1.13.0-py3-none-any.whl",
        "bytes": 59206,
        "sha256": "18ad6826016e68cfdc2988602ad483f1a33d5d39031bff3aa989fcfb2287fc82"
      },
      {
        "name": "Installable MandateShield Go module archive",
        "media_type": "application/zip",
        "path": "/packages/go/github.com/mandateshield/mandateshield-go/@v/v1.13.0.zip",
        "bytes": 88831,
        "sha256": "4ac787a3ec93f854130469198a19ca5cc4f9177da7ae4a0794a0efdf1ec588ba"
      },
      {
        "name": "MandateShield agent payment-authority plugin",
        "media_type": "application/zip",
        "path": "/plugins/mandateshield/1.13.0/mandateshield-plugin-1.13.0.zip",
        "bytes": 19430,
        "sha256": "040986211a5222fa40558602e293e32c8870821de65c1ee24b890d9e7ce11f21"
      }
    ]
  },
  "verification": {
    "scope": "Byte integrity of the listed public release artifacts at the stated paths.",
    "procedure": "Download every integrity.artifacts path into one directory using its final filename, download /sdk/v1.13.0/SHA256SUMS into that directory, then run sha256sum -c SHA256SUMS on Linux or shasum -a 256 -c SHA256SUMS on macOS."
  },
  "limitations": [
    "This is a first-party release record, not an independent security audit.",
    "The product source is not public, so these artifacts do not establish source-to-binary reproducibility.",
    "Checksums establish byte identity only; they do not establish runtime security, availability, or protocol conformance.",
    "The release-scoped JWKS lets verifiers retain the public keys needed for offline receipt verification; it is first-party archival material, not independent key escrow or a business-continuity guarantee."
  ]
}