PUBLIC TEST CONTRACT · V1

Exercise the strict lifecycle without an account—or a payment.

The Strict Lifecycle Sandbox runs MandateShield's real cryptographic and state-transition primitives inside one isolated request while keeping every provider outcome simulated and every artifact test-only.

NORMATIVE ENDPOINT

One public POST with one deliberately narrow input

A client sends application/json to POST /api/v2/sandbox/lifecycle. The body must be an empty object or exactly {"scenario":"SUCCESS"}. The request must be smaller than 1 KB. An Authorization header is forbidden so an API key or production credential cannot be forwarded accidentally.

POST /api/v2/sandbox/lifecycle
Content-Type: application/json

{"scenario":"SUCCESS"}

The endpoint is rate-limited using pseudonymous abuse counters and fails closed when the isolated run or its abuse controls are unavailable. Successful responses use Cache-Control: no-store.

EXECUTED LIFECYCLE

The test follows the same security boundaries in order

  1. A fresh challenge and isolated test account are created.
  2. An account-pinned ES256 authority assertion is signed and verified against the exact audience, nonce and input digest.
  3. An active mandate constrains amount, currency, merchant, expiry and cumulative budget before a strict ALLOW.
  4. Test-only decision evidence is signed and independently reverified inside the request.
  5. Budget reservation and RESERVED → CONSUMED occur in one request-local compare-and-set ledger.
  6. A short-lived permit binds one exact simulated-provider request, payee, amount, resource and idempotency key.
  7. The first online permit claim grants one simulated submission; replay is observed and denied.
  8. A separate ephemeral provider key signs a simulated outcome, the ledger commits and a test-only execution receipt is verified.

RESPONSE INVARIANTS

Machine-readable false values are part of the contract

Every successful response identifies profile MANDATESHIELD_STRICT_LIFECYCLE_SANDBOX_V1 and returns the lifecycle steps, ephemeral public keys, signed test artifacts, verification results and timestamps. These values are immutable assurance boundaries, not presentation labels:

{
  "mode": "strict-lifecycle-sandbox/test-only",
  "profile": "MANDATESHIELD_STRICT_LIFECYCLE_SANDBOX_V1",
  "test_only": true,
  "money_moved": false,
  "production_accepted": false,
  "provider": {
    "id": "MANDATESHIELD_SANDBOX_PROVIDER_V1",
    "environment": "test",
    "simulated": true,
    "external_provider": false,
    "independent_organization": false,
    "outbound_calls": 0,
    "money_moved": false
  }
}

The response also states that lifecycle state is request-local, nothing survives after the response, no production credential is used, no user-supplied outbound URL is accepted and only pseudonymous abuse-counter state may persist.

ASSURANCE BOUNDARY

Role separation is demonstrated; third-party evidence is not

Fresh authority, simulated-provider and artifact keys demonstrate separate cryptographic roles. The provider is still a MandateShield-created request-local simulation. No external payment provider or independent organization participates, no external provider outcome is verified and no money moves.

A successful run therefore does not prove production conformance, real settlement, provider adoption, provider enforcement, independent testing, an audit or certification. Its signed artifacts are explicitly test_only=true and production_accepted=false.

CANONICAL RESOURCES

Use the live contract—not a copied description