Bind a self-reported result to an external subject—without inflating the claim.

ATTESTATION CLASS

MandateShield acts as a binding notary

Every issued record has attestation_type=EXTERNALLY_BOUND_SELF_REPORT, issuer_role=BINDING_NOTARY and non_authorizing=true. MandateShield signs the exact subject binding, report digest, claimant-supplied report and assurance caveat with ES256. The compact attestation uses application/mandateshield-proof-attestation+jwt and can be checked against the public JWKS.

CHALLENGE REQUEST

Submit every current offline vector and one external subject

A claimant sends application/json to POST /api/v1/proof-network/challenges without an Authorization header. The subject is either a public HTTPS origin with no path, query, fragment, credentials or custom port, or one public github.com/owner/repository URL. MandateShield-hosted subjects are forbidden.

The report must use application/mandateshield-conformance-report+json;v=1, profile https://mandateshield.com/conformance/v1, version 1.0.0 and scope OFFLINE_POLICY_VECTORS. It must cover exactly the 8 current executable offline vectors published by that profile, once each, and must have been generated within the last 30 days.

POST /api/v1/proof-network/challenges
Content-Type: application/json

{
  "subject": {
    "kind": "https-domain",
    "uri": "https://merchant.example.com"
  },
  "report": {
    "format": "application/mandateshield-conformance-report+json;v=1",
    "profile": "https://mandateshield.com/conformance/v1",
    "profile_version": "1.0.0",
    "scope": "OFFLINE_POLICY_VECTORS",
    "runner": {"name": "my-verifier", "version": "1.0.0"},
    "executed_at": "2026-07-26T12:00:00.000Z",
    "results": ["exactly the current published offline vectors"]
  }
}

MandateShield compares the supplied decisions and finding codes with the published expected outputs and signs a 24-hour application/mandateshield-proof-challenge+jwt challenge. It does not run or inspect the claimant implementation. Matching outputs remain a claimant self-report.

EXTERNAL BINDING

Prove DNS control or pin one exact repository commit

• HTTPS domain: publish the exact TXT value at the record name returned in required_proof. The DNS binding is checked at issuance time; the HTTPS endpoint itself is not fetched.
• GitHub repository: commit the exact returned binding document at /.well-known/mandateshield-proof.json, then provide that immutable 40-hex public commit identifier.

The binding proves control of the named DNS location or presence of the exact document in the named repository commit. It does not establish who operates the subject, whether the implementation is deployed there or whether any payment provider recognizes it.

ISSUANCE AND RETRIEVAL

Finalize the challenge, then verify the signed public record

Send the signed challenge_token to POST /api/v1/proof-network/attestations. A GitHub challenge additionally requires repository_commit; a domain challenge forbids it. Successful issuance persists one signed proof and returns its machine record, human page and explicitly labeled badge.

• GET /api/v1/proof-network/proofs lists at most 50 bounded summaries.
• GET /api/v1/proof-network/proofs/{proofId} returns the complete record and compact attestation.
• GET /api/v1/proof-network/proofs/{proofId}/badge.svg returns a badge labeled “externally bound self-report.”

ASSURANCE MATRIX

Verified binding, self-reported execution

The signed conformance object therefore fixes result_verification=SELF_REPORTED_OUTPUTS_ONLY, conformance_execution_verified=false, independently_verified=false, third_party_conformance=false and certification=false.

ADOPTION SEMANTICS

A proof entry is not a user, installation or customer

Proof-list entries set entries_are_users=false and entries_are_installations=false. Hosted sandbox runs and client telemetry are excluded. A proof does not establish a customer relationship, production deployment, revenue, real-world use, provider adoption or provider-enforced status. The badge must never be presented as a certification mark.

CANONICAL RESOURCES

Resolve the live profile before constructing a report

• Current versioned conformance vectors
• Conformance profile JSON Schema
• Current OpenAPI request and response schemas
• Public Proof Network workflow and records
• Machine-readable proof list