diff --git a/README.md b/README.md index 8803796..e259654 100644 --- a/README.md +++ b/README.md @@ -304,7 +304,7 @@ CI runs all three checks on Python 3.10 and 3.12 for every push and pull request - [Preventing AP2 Open-Mandate Overuse with Runtime Idempotency](https://runcycles.io/blog/ap2-open-mandate-consume-once-runtime-idempotency) — engineering write-up of the keying decision (`open_mandate_hash` vs `transaction_id`), post-PSP commit uncertainty, and the AP2 §6 consume-once defense. - [AP2 GitHub Discussion #262](https://github.com/google-agentic-commerce/AP2/discussions/262) — spec-level discussion on `open_mandate_hash` canonicalization and adapter shape with the upstream AP2 community. -- [AP2 `open_mandate_hash` v0 conformance vectors](https://gist.github.com/chopmob-cloud/1dca25fd6107db4b7a30bed5dbf2ded8) — community-seeded 7-vector set covering JCS canonicalization edges (object-key order, array order, optional-field presence, currency minor-unit, Unicode NFC-vs-NFD) for `open_mandate_hash = SHA-256(JCS_RFC8785(unsigned mandate body))`. Hash input is the claims object, not the JWS envelope. Cross-implementation reproduced under two non-overlapping JCS impls — Python `rfc8785@0.1.4` (Woodruff) and JavaScript `canonicalize@3.0.0` (Erdtman + Rundgren, RFC 8785 author) — different authors, different languages, different codebases, same canonical bytes and hashes on every vector. Community-seeded, not AP2-spec-blessed — see discussion #262 for scope. +- [AP2 `open_mandate_hash` v0 conformance vectors](https://gist.github.com/chopmob-cloud/1dca25fd6107db4b7a30bed5dbf2ded8) — community-seeded 7-vector set covering JCS canonicalization edges (object-key order, array order, optional-field presence, currency minor-unit, Unicode NFC-vs-NFD) for `open_mandate_hash = SHA-256(JCS_RFC8785(unsigned mandate body))`. Hash input is the claims object, not the JWS envelope. Cross-implementation reproduced under three non-overlapping JCS impls — Python `rfc8785@0.1.4` (Woodruff), JavaScript `canonicalize@3.0.0` (Erdtman + Rundgren, RFC 8785 author), and Go `gowebpki/jcs v1.0.1` — different authors, different languages, different codebases, same canonical bytes and hashes on every vector. Community-seeded, not AP2-spec-blessed — see discussion #262 for scope. ## Documentation