PUBLIC ACTIVATION CONTRACT · V1

Prove one real control-path activation—without pretending it proves payment.

A Deployment Activation Proof is a signed, expiring record that binds an external subject to one exact MandateShield production reservation and one fresh credential-bound permit redemption. It reports only what MandateShield observed; out-of-band activity is outside the proof.

NORMATIVE CLAIM

Two positive observations and an explicit stopping point

A conforming proof states that the MandateShield production service observed one persisted strict ALLOW reservation and that the exact one-use execution permit was freshly redeemed by the separately scoped processor credential. Both observations must belong to the same account, entitlement, mandate, trusted authority key, verification key, processor key, authorization, and permit.

The fixed activation profile is GENERIC_HTTP_V1 in the test environment for exactly $0.01 USD. The official external runner stops immediately after permit redemption and contains no client that calls the bound resource or a payment provider. The signed record cannot observe unrelated out-of-band activity.

SUBJECT AND ACCOUNT BINDING

The record cannot come from an anonymous hosted demo

Before activation, an authenticated account accepts the current legal documents, expressly directs publication of the selected time-limited record, and proves control of either an HTTPS domain by DNS TXT or a public GitHub repository by placing a fixed binding document at the exact current HEAD of its default branch. The publication direction and its version are carried inside the signed, account-bound challenge. MandateShield verifies that HEAD through GitHub before reading the file, records the binding digest, and applies its published operator/internal/test exclusion policy. A commit that exists only in a fork, pull-request ref, or non-default branch is rejected.

The eligibility result ELIGIBLE_EXTERNAL_CANDIDATE means only that the submitted subject did not match those exclusions at the recorded evaluated_at time. Subject control is separately scoped to the binding verified_at time. Final proof issuance reuses those recorded results and does not rerun either check. Neither result is independent identity verification or can establish that the publisher is unrelated to MandateShield.

ONE-TIME ENTITLEMENT

Credentials are narrow, short-lived, and chain-bound

  1. The account receives one expiring deployment-proof entitlement.
  2. Bootstrap creates separate one-time live VERIFY and PROCESSOR credentials, one trusted P-256 authority key, and one immutable one-cent mandate.
  3. The authority assertion binds the exact final amount, currency, merchant, resource, nonce, and challenge.
  4. Strict verification persists one reservation and consumes the complete one-cent lifetime budget.
  5. Provider-bound consume issues one short permit; exact online redemption claims it once.
  6. Finalization reloads and matches the complete server-side chain before signing the public record.

Replays, different credentials, different resources, missing persistence, stale permits, subject mismatches, and incomplete chains fail closed.

MACHINE-READABLE BOUNDARY

Scoped observations and false assurances are signed

{
  "attestation_type": "ACCOUNT_BOUND_SERVER_OBSERVED_ACTIVATION",
  "binding": {
    "verified_at": "2026-07-28T12:00:00.000Z",
    "subject_control_verified_at_binding": true
  },
  "eligibility": {
    "evaluated_at": "2026-07-28T11:55:00.000Z",
    "operator_exclusion_no_match_at_evaluation": true
  },
  "activation": {
    "strict_live_reservation_server_observed": true,
    "provider_permit_redeemed": true,
    "mandateshield_provider_submission_observed": false,
    "mandateshield_provider_enforcement_observed": false,
    "provider_evidence_recorded": false,
    "independent_terminal_evidence_verified": false
  },
  "assurance": {
    "counts_as_verified_activation": true,
    "counts_as_customer": false,
    "counts_as_revenue": false,
    "deployment_runtime_inspected": false,
    "non_bypassability_verified": false,
    "independent_organization_verified": false,
    "audit": false,
    "certification": false,
    "security_guarantee": false,
    "non_authorizing": true,
    "observation_scope": "MandateShield observed no provider submission or provider evidence in this proof flow. Out-of-band activity is outside this proof."
  }
}

A published entry is therefore valid activation evidence, but it does not establish whether the holder acted outside MandateShield. It is not evidence of a paid account, a customer, revenue, continuous deployment, non-bypassability, payment submission, provider enforcement, settlement, independent testing, an audit, certification, or security.

PUBLIC VERIFICATION

Every active proof has human and machine representations