{
  "run": {
    "started_at": "2026-09-10T21:56:30Z",
    "ended_at": "2026-09-10T21:56:34Z",
    "domains": {
      "seller": "travel.agenthaven.dev",
      "buyer": "not given",
      "authority": "none"
    },
    "correlation_ids": [],
    "versions": {
      "card_version": "0.1.0",
      "protocol_version": "0.3",
      "interfaces": [
        [
          "JSONRPC",
          "0.3"
        ],
        [
          "MCP",
          "2025-06-18"
        ]
      ]
    },
    "verifier": "agent-verifier/0.0.1"
  },
  "dimensions": [
    {
      "dimension": "discovery",
      "mandatory": true,
      "verdict": "PROVED",
      "evidence": [
        "archive://dns/travel.agenthaven.dev.SVCB.wire",
        "archive://seller/agent-card.json"
      ],
      "checks": [
        {
          "name": "record_validated",
          "ok": true,
          "detail": "SVCB at travel.agenthaven.dev: RRSIG validated locally against the zone DNSKEY, DS matched at the parent; chain above the zone by the resolver AD flag (True)"
        },
        {
          "name": "card_url_declared",
          "ok": true,
          "detail": "key65400 = https://travel.agenthaven.dev/.well-known/agent-card.json"
        },
        {
          "name": "dane_endpoint",
          "ok": true,
          "detail": "travel.agenthaven.dev presents SPKI 3e974da4286b4a05… matching TLSA 3 1 1 from an authenticated answer; certificate valid to 2026-11-25T20:47:09Z",
          "measured": {
            "spki_sha256": "3e974da4286b4a050da0b3e8eeb2d749d4fdcb0b501ad72c95842cbce91a4a7a",
            "not_after": "2026-11-25T20:47:09Z"
          }
        },
        {
          "name": "card_digest",
          "ok": true,
          "detail": "cap-sha256 MxWh6g4dj_u0ToZ_0Czb71ek_NNgBclqYL2rdzyPMFg vs fetched MxWh6g4dj_u0ToZ_0Czb71ek_NNgBclqYL2rdzyPMFg",
          "measured": {
            "card_sha256": "3315a1ea0e1d8ffbb44e867fd02cdbef57a4fcd36005c96a60bdab773c8f3058"
          }
        },
        {
          "name": "endpoint_in_zone",
          "ok": true,
          "detail": "https://travel.agenthaven.dev/a2a inside agenthaven.dev (POC profile)"
        }
      ],
      "notes": ""
    },
    {
      "dimension": "publisher_control",
      "mandatory": true,
      "verdict": "PROVED",
      "evidence": [
        "archive://dns/travel.agenthaven.dev.SVCB.txt",
        "archive://seller/dns-aid-jwks.json"
      ],
      "checks": [
        {
          "name": "dane_key_host",
          "ok": true,
          "detail": "dns-aid.agenthaven.dev presents SPKI 3ff63922c2b33fdc… matching TLSA 3 1 1; valid to 2026-12-01T09:27:20Z",
          "measured": {
            "spki_sha256": "3ff63922c2b33fdc8fd26a242f36b8efedd5d1df334c97c4e57cba3570426e24",
            "not_after": "2026-12-01T09:27:20Z"
          }
        },
        {
          "name": "record_signature",
          "ok": true,
          "detail": "sig kid dnsaid-2026-09 verifies; binding ok; svcb claim covers the wire; expires 2026-12-06; kid is a label, thumbprint Ol3NxvkXhB-Q…",
          "measured": {
            "sig_exp": 1796582061,
            "sig_kid": "dnsaid-2026-09"
          }
        }
      ],
      "notes": ""
    },
    {
      "dimension": "registered_identity",
      "mandatory": true,
      "verdict": "PROVED",
      "evidence": [
        "archive://seller/_ans-badge.txt",
        "archive://seller/_ans.txt",
        "archive://seller/ans-registry-entry.json",
        "archive://seller/ans-transparency-receipt.json"
      ],
      "checks": [
        {
          "name": "ans_records",
          "ok": true,
          "detail": "_ans present; badge https://transparency.ans.godaddy.com/v1/agents/9a311416-b877-4f0d-8ee5-1d63d047e82f"
        },
        {
          "name": "ans_receipt",
          "ok": true,
          "detail": "transparency receipt 200, Merkle proof leaf 199068"
        },
        {
          "name": "ans_status",
          "ok": true,
          "detail": "registry entry 200: lifecycle {\"status\": \"ACTIVE\"}; expires 2026-11-25T20:47:09Z; trust score 55 (a third-party opinion, shown as one)",
          "measured": {
            "trust_score": 55,
            "trust_vector": {
              "identity": 55,
              "integrity": 80
            },
            "expires_at": "2026-11-25T20:47:09Z"
          }
        }
      ],
      "notes": ""
    },
    {
      "dimension": "instance",
      "mandatory": true,
      "verdict": "PROVED",
      "evidence": [
        "archive://seller/spiffe-bundle.json",
        "archive://seller/spiffe-svid.json"
      ],
      "checks": [
        {
          "name": "seller_svid",
          "ok": true,
          "detail": "spiffe://agenthaven.dev/merchant/demo-travel-seller/y53CDyiqoPptlOkBPKGmxLzl7WcTDWMqII7yZtfPu2Y: SVID verifies against the bundle (trust domain agenthaven.dev); vouches for the instance key (same); expires 2026-12-01",
          "measured": {
            "svid_exp": 1796133301,
            "instance_kid": "y53CDyiqoPptlOkBPKGmxLzl7WcTDWMqII7yZtfPu2Y"
          }
        }
      ],
      "notes": ""
    },
    {
      "dimension": "mandate",
      "mandatory": true,
      "verdict": "NOT_TESTED",
      "evidence": [],
      "checks": [],
      "notes": "the external mandate path needs an authority; the seller's refusals on the self-issued path are in its ledger but not replayed by this verifier yet"
    },
    {
      "dimension": "payment",
      "mandatory": true,
      "verdict": "NOT_TESTED",
      "evidence": [],
      "checks": [],
      "notes": "simulated rail in this run; Stripe test mode confirmation needs a read key"
    },
    {
      "dimension": "attribution",
      "mandatory": true,
      "verdict": "PROVED",
      "evidence": [
        "archive://seller/checkpoints.json",
        "archive://seller/ledger.json"
      ],
      "checks": [
        {
          "name": "seller_ledger",
          "ok": true,
          "detail": "54 entries, head 0bfe1d2c1f8d…, 50 attributed, 4 unattributed, 0 foreign signer, 0 forged, 0 unverifiable",
          "measured": {
            "counts": {
              "attributed": 50,
              "unattributed": 4,
              "foreign_signer": 0,
              "forged": 0,
              "unverifiable": 0
            }
          }
        },
        {
          "name": "checkout_closed",
          "ok": true,
          "detail": "2 intent entries closed by checkout.completed, 0 not closed since the terminal entry exists, 4 predate it; settlement simulation: simulated; completions claiming a charge: 0",
          "measured": {
            "closed": 2,
            "unclosed": 0,
            "predating": 4,
            "rails": [
              "simulation: simulated"
            ]
          }
        },
        {
          "name": "checkpoints",
          "ok": true,
          "detail": "2 checkpoint(s) signed by the instance, heads match the chain; 0 sealed at no witness; 2 unsealed",
          "measured": {
            "sealed": 0,
            "emulated": 0,
            "unsealed": 2
          }
        }
      ],
      "notes": ""
    },
    {
      "dimension": "revocation",
      "mandatory": true,
      "verdict": "NOT_TESTED",
      "evidence": [],
      "checks": [],
      "notes": "no authority to revoke at, no ANS revocation mechanics yet"
    },
    {
      "dimension": "rogue",
      "mandatory": true,
      "verdict": "FAILED",
      "evidence": [
        "archive://rogue/R-21.response.json",
        "archive://rogue/R-22.response.json",
        "archive://rogue/R-23.response.json",
        "archive://seller/ledger-after-rogue.json",
        "archive://seller/ledger.json"
      ],
      "checks": [
        {
          "name": "rogue_R-21",
          "ok": true,
          "detail": "alg: none: 401 header_forbidden (expected header_forbidden)"
        },
        {
          "name": "rogue_R-22",
          "ok": true,
          "detail": "HS256 with the public key as the secret: 401 header_forbidden (expected header_forbidden)"
        },
        {
          "name": "rogue_R-23",
          "ok": true,
          "detail": "jku pointing at a rogue-controlled key set: 401 header_forbidden (expected header_forbidden)"
        },
        {
          "name": "rogue_no_intent",
          "ok": true,
          "detail": "10 correlation ids refused as header_forbidden in the seller ledger; PaymentIntents under them: 0"
        },
        {
          "name": "refusals_marked",
          "ok": false,
          "detail": "header_forbidden refusals written since this run began: 0; carrying this run's claimed_exercise: none; unmarked: 0 (the seller writes at most two per unverified source per minute)",
          "measured": {
            "fired": [
              "R-21",
              "R-22",
              "R-23"
            ],
            "marked": []
          }
        },
        {
          "name": "refusals_attributed",
          "ok": true,
          "detail": "22 refusals in the seller ledger before this run; 10 carry claimed_exercise, 12 do not (customers, or written before 2026-09-09). The mark is the caller's claim, recorded by the seller and read by no check.",
          "measured": {
            "refusals": 22,
            "claimed": 10
          }
        }
      ],
      "notes": "refusals_marked: header_forbidden refusals written since this run began: 0; carrying this run's claimed_exercise: none; unmarked: 0 (the seller writes at most two per unverified source per minute)"
    }
  ],
  "overall": "FAILED",
  "headline": "5 of 9 dimensions PROVED",
  "accountable": {
    "name": "Fabio Ramos",
    "role": "verifier"
  },
  "freeze_manifest_sha256": "17a650b37523c4ef5a2a0c8a27dc77c313c4db218a7e8dd0de07bd7c61967d7b",
  "drift": [],
  "archive": {
    "uri": "file:///srv/verifier/runs/20260910T215630Z/evidence.tar",
    "sha256": "1dc4267b46a32eef445a430639ac85cad7c2c166e7642182e111f7e296c72c24",
    "items": [
      "dns/travel.agenthaven.dev.SVCB.txt",
      "dns/travel.agenthaven.dev.SVCB.wire",
      "rogue/R-21.response.json",
      "rogue/R-22.response.json",
      "rogue/R-23.response.json",
      "seller/_ans-badge.txt",
      "seller/_ans.txt",
      "seller/agent-card.json",
      "seller/ans-registry-entry.json",
      "seller/ans-transparency-receipt.json",
      "seller/checkpoints.json",
      "seller/dns-aid-jwks.json",
      "seller/ledger-after-rogue.json",
      "seller/ledger.json",
      "seller/spiffe-bundle.json",
      "seller/spiffe-svid.json"
    ]
  },
  "third_party_scores": [
    {
      "source": "ans-trust-index",
      "value": {
        "trust_score": 55,
        "trust_vector": {
          "identity": 55,
          "integrity": 80
        }
      },
      "evidence": "archive://seller/ans-registry-entry.json"
    }
  ]
}