OFFLINE DOCTOR
One local command. No secrets. No network.
curl --proto '=https' --tlsv1.2 -fsSLO https://mandateshield.com/sdk/v1.13.0/mandateshield-cli.mjs
curl --proto '=https' --tlsv1.2 -fsSLO https://mandateshield.com/sdk/v1.13.0/SHA256SUMS
if command -v sha256sum >/dev/null 2>&1; then
grep ' mandateshield-cli.mjs$' SHA256SUMS | sha256sum -c -
else
grep ' mandateshield-cli.mjs$' SHA256SUMS | shasum -a 256 -c -
fi
node mandateshield-cli.mjs doctor deployment.assurance.json
test $? -eq 0 # only the top operator-declared production level exits 0Doctor accepts only the published evidence fields. Unknown fields, malformed values and missing controls fail closed. Its output is stable JSON for CI, policy engines and deployment records.
Mandatory execution path JSON Schema v2
node mandateshield-cli.mjs doctor deployment.assurance.json > deployment-assurance.report.json
# Read production_ready and blockers from stable JSON.
# Exit 2 means production readiness was not established.ASSURANCE LADDER
A level is earned only when every earlier control passes
| Level | What the supplied evidence establishes |
|---|---|
UNVERIFIED | The document is invalid or does not establish that Gate is loaded. |
SDK_ONLY | Gate is present, but credential, storage and network boundaries are not established. |
CREDENTIAL_ISOLATED | Processor and provider credentials are declared absent from the agent runtime; exact audience and environments are isolated. |
OPERATOR_DECLARED_EGRESS_CONTROLS | The operator declares a signed-permit execution path and an externally enforced, negatively tested agent-egress boundary. MandateShield does not inspect or audit it. |
OPERATOR_DECLARED_PROVIDER_OUTCOME_CONTROLS | The operator also declares provider outcome lookup, webhook and receipt-key failure controls. No payment provider attests to this level. |
The deterministic production-readiness output requires OPERATOR_DECLARED_PROVIDER_OUTCOME_CONTROLS, a production target and zero failed controls. It records that the submitted declaration satisfies the schema; it is not a technical inspection or independent audit. A declared critical external condition—such as an untested egress policy or unavailable receipt keys—always prevents production-ready output.
In this ladder, OPERATOR_DECLARED_PROVIDER_OUTCOME_CONTROLS means Doctor accepted the operator-supplied webhook, authenticated-lookup and receipt-key declarations together with every earlier control. MandateShield does not technically inspect the deployment or independently audit the underlying records, and no payment provider attests to this level or these controls. It does not mean the provider validates MandateShield permits or rejects permitless submissions. The declared mandatory path is scoped to the agent runtime: it requires the operator to declare that the agent has neither provider credentials nor direct provider egress, and that only the isolated execution service can submit after a fresh online permit redemption. It does not constrain a privileged operator or a compromised execution service. Provider-mandatory enforcement is reserved for a future PROVIDER_ENFORCED integration in which the provider or facilitator verifies that the exact permit still has a fresh claim and refuses the payment without it.
NODE OR CONTAINER
Separate the agent from the credential-holding Gate
Keep the audience-bound PROCESSOR key and provider credentials in the trusted execution service, never in the agent runtime, model process, browser or client. The provider adapter may run inside that service, but the agent must not be able to invoke it directly. Expose only an authenticated Gate ingress that requires the exact receipt, audience, provider binding and fresh online redemption before submission. Store journal state in one globally shared, linearizable database namespace that provides atomic compare-and-set across every region, worker and restart. The SDK's required consistency declaration is a customer assertion, not an independent database attestation; split-brain journals are unsafe. A process flag or application denylist does not prove the mandatory path: use a deployment-owned firewall or network policy to block provider access from every agent-controlled workload, then run a direct-provider negative test from the production agent runtime.
The official PostgreSQL DurableGatewayJournal supplies the required atomic begin and compare-and-set contract without sending database credentials or journal rows to MandateShield. Apply its versioned SQL with a migration role and give the runtime only schema usage, select, insert and column-limited update privileges.
POSTGRESQL TOPOLOGY
Readiness checks configuration, not global linearizability
Route every Gate process and region to the same writable PostgreSQL primary. The adapter rejects recovery, read-only and unsafe synchronous-commit settings plus missing or incompatible schema controls. It cannot prove that the connection router never serves a replica, that failover fences the old primary, or that all executors share this endpoint. Its topology attestation remains false; a split-brain deployment is unsafe.
The generic Gateway journal contains coordination state, not payment credentials. The x402 adapter still requires a separate encrypted signed-payload artifact journal. Never place provider secrets, wallet keys, card or bank data in generic Gateway state or logs.
VERCEL OR SERVERLESS
Treat project boundaries as credential isolation, not proof of egress
Put the agent runtime and credential-holding execution service in separately administered projects. Provider and PROCESSOR credentials belong only to the execution project; its authenticated ingress must not expose the provider adapter directly. Use one external, globally shared linearizable journal with conditional writes; memory, regional replicas without linearizable writes and local files are not conforming serverless state. Project separation alone does not prove that the agent cannot reach the provider. Leave the network and control-path fields false or unverified unless an external control is applied and a negative bypass test passes.
KUBERNETES
Default-deny the agent and allow only Gate
Start with the reference NetworkPolicy, adapt selectors and ports, and verify that the cluster CNI enforces both layers. The agent policy permits payment traffic only to Gate; the Gate policy permits provider traffic only through the approved proxy. Standard NetworkPolicy does not authenticate services, hostnames or TLS destinations, so Gate ingress and the proxy must independently enforce those identities. Mark agent egress blocked only after direct-provider and direct-adapter negative tests pass from the production agent workload.
WHAT DOCTOR DOES NOT CLAIM
Deterministic assessment is not remote certification
Doctor checks a strict declaration; it does not inspect cloud accounts, firewalls, databases or payment-provider consoles. Each true must be backed by the operator's own test or control record. The output is not a MandateShield security audit, provider partnership, insurance policy or guarantee that an arbitrary deployment cannot be bypassed. No payment provider attests to any Doctor level. The output always reports independently_verified=false and provider_or_facilitator_mandatory=false.