OFFLINE DOCTOR
One local command. No secrets. No network.
curl --proto '=https' --tlsv1.2 -fsSLO https://mandateshield.com/sdk/v1.10.0/mandateshield-cli.mjs
curl --proto '=https' --tlsv1.2 -fsSLO https://mandateshield.com/sdk/v1.10.0/SHA256SUMS
if command -v sha256sum >/dev/null 2>&1; then
grep ' mandateshield-cli.mjs$' SHA256SUMS | sha256sum -c -
else
grep ' mandateshield-cli.mjs$' SHA256SUMS | shasum -a 256 -c -
fi
node mandateshield-cli.mjs doctor deployment.assurance.json
test $? -eq 0 # only PROVIDER_ATTESTED production evidence exits 0Doctor accepts only the published evidence fields. Unknown fields, malformed values and missing controls fail closed. Its output is stable JSON for CI, policy engines and deployment records.
Deployment Assurance JSON Schema
node mandateshield-cli.mjs doctor deployment.assurance.json > deployment-assurance.report.json
# Read production_ready and blockers from stable JSON.
# Exit 2 means production readiness was not established.ASSURANCE LADDER
A level is earned only when every earlier control passes
| Level | What the supplied evidence establishes |
|---|---|
UNVERIFIED | The document is invalid or does not establish that Gate is loaded. |
SDK_ONLY | Gate is present, but credential, storage and network boundaries are not established. |
CREDENTIAL_ISOLATED | Processor and provider credentials, exact audience and environments are isolated. |
EGRESS_ENFORCED | Durable consume-once state and an externally enforced, negatively tested provider-egress boundary are added. |
PROVIDER_ATTESTED | Provider webhook and authenticated lookup evidence plus receipt-key failure behavior are verified. |
Production readiness requires PROVIDER_ATTESTED, a production target and zero failed controls. A critical external condition—such as an untested egress policy or unavailable receipt keys—always prevents production-ready output.
In this ladder, PROVIDER_ATTESTED means Doctor accepted the operator-supplied webhook, authenticated lookup and receipt-key evidence together with every earlier control. It does not mean the provider validates MandateShield permits or rejects permitless submissions. Provider-mandatory, non-bypassable enforcement is reserved for a future PROVIDER_ENFORCED integration in which the provider or facilitator verifies a one-use permit and refuses the payment without it.
NODE OR CONTAINER
Separate the Gate, provider adapter and durable journal
Keep the audience-bound PROCESSOR key in Gate and the provider credential in a separate server-side adapter. Store journal state in one globally shared, linearizable database namespace that provides atomic compare-and-set across every region, worker and restart. The SDK's required consistency declaration is a customer assertion, not an independent database attestation; split-brain journals are unsafe. A process flag or application denylist does not prove egress enforcement: use a deployment-owned firewall or authenticated egress proxy, then run a direct-provider negative test from the Gate workload.
VERCEL OR SERVERLESS
Treat project boundaries as credential isolation, not proof of egress
Put Gate and the provider adapter in separately administered projects with separate environment variables and credentials. Use one external, globally shared linearizable journal with conditional writes; memory, regional replicas without linearizable writes and local files are not conforming serverless state. Project separation alone does not establish a non-bypassable provider-egress block. Leave the network fields unverified unless an external control is actually applied and a negative test passes.
KUBERNETES
Default-deny the Gate and allow only an audited egress path
Start with the reference NetworkPolicy, adapt selectors and ports, and verify that the cluster CNI enforces it. Standard NetworkPolicy does not authenticate hostnames or TLS destinations; the allowed proxy must independently restrict provider destinations. Mark egress blocked only after the applied-policy and direct-access negative tests pass from the production workload.
WHAT DOCTOR DOES NOT CLAIM
Deterministic assessment is not remote certification
Doctor checks a strict declaration; it does not inspect cloud accounts, firewalls, databases or payment-provider consoles. Each true must be backed by the operator's own test or control record. The output is not a MandateShield security audit, provider partnership, insurance policy or guarantee that an arbitrary deployment cannot be bypassed.