CANONICAL LIFECYCLE
resolve_authority → reserve → consume → redeem_once → verify_outcome → retain_proof
The order is normative for accounts created at or after 2026-07-26T12:01:24.000Z, and for any account whose creation evidence is missing or malformed. A strict authority result first creates a persisted reservation. A separately scoped processor then consumes that reservation with exact provider binding, and the bound execution service redeems the signed permit online; only one fresh atomic claim can succeed. The executor must still make one idempotent provider operation. For configured Stripe PaymentIntent and x402 EIP-3009 profiles, MandateShield checks provider evidence independently of the caller assertion before terminal proof is retained. Every new integration should implement this order.
Only accounts created before that exact cutoff retain legacy unbound CONSUME compatibility. That compatibility path may return direct permission and therefore does not include redeem_once. It is not the recommended path, is not available to new accounts, and callers must not probe or infer legacy eligibility.
INTERFACE SCOPE
Each advertised interface has an explicit capability boundary
HTTP and OpenAPI describe the full lifecycle. MCP and A2A expose non-executable analysis, narrow protocol-field projection and a VERIFY-scoped strict signed-authority reservation. They expose no processor transition, permit redemption, provider submission, provider egress or payment execution.
The machine document also links decision- and execution-receipt verifiers, live JWKS, and the release-scoped receipt-key archive. MandateShield issues one common receipt schema across the explicitly supported outcome profiles; it does not claim coverage beyond those profiles or constitute an independent audit.
The discovery payload and its public JSON Schema are CORS-readable and versioned independently from the product and OpenAPI contract.
GLOBAL EXECUTION INTERLOCK
Pause new MandateShield-mediated execution without hiding outcomes
An authenticated account owner may atomically pause new strict reservations, processor consume transitions, and permit redemptions across MandateShield keys and strict lifecycle operations in that account. The current terminal-outcome profiles are configured Stripe PaymentIntents and the supported x402 EIP-3009 profile—not every rail or provider. Verification, outcome reporting, reconciliation, and receipt verification remain available.
The interlock cannot stop customer infrastructure that bypasses MandateShield or recall work that committed before the pause transition. Callers must use the returned generation for compare-and-set transitions.
CLAIM BOUNDARY
Published for discovery—not declared as an industry standard
This is a MandateShield-published discovery profile. Publication does not establish accreditation, independent certification, adoption by external agents or providers, or provider-side enforcement. Foreign agents are not claimed to discover, require, recommend, or use it. Protocol labels do not establish full conformance. Outcome verification is performed by MandateShield independently of the caller assertion, not by an independent organization.
MACHINE CONTRACTS