Skip to content

docs: add normative verifier obligation for checkout_hash #243

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
chopmob-cloud wants to merge 8 commits into
base: main
Choose a base branch
from
+48 −25
Open

docs: add normative verifier obligation for checkout_hash #243

Changes from 1 commit
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
2097688
docs: add normative verifier obligation for checkout_hash
chopmob-cloud Apr 29, 2026
cbb0f3a
fix: resolve pre-existing markdown lint issues in checkout_mandate.md
chopmob-cloud Apr 29, 2026
c8321f4
fix: use single cspell:disable block around Examples section
chopmob-cloud Apr 29, 2026
0aff643
fix: resolve remaining lint issues in checkout_mandate.md
chopmob-cloud Apr 29, 2026
021cf5f
fix: add gitleaks to cspell wordlist
chopmob-cloud Apr 29, 2026
2b50445
fix: move gitleaks config to .github/linters/ (super-linter default p…
chopmob-cloud Apr 29, 2026
f75408f
Merge branch 'main' into docs/verifier-checkout-hash-obligation
chopmob-cloud Apr 29, 2026
0a2d1d8
docs(checkout-mandate): rephrase verifier obligation for clarity
chopmob-cloud Apr 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions docs/ap2/checkout_mandate.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,13 @@
The algorithm used MUST be the same as the SD-JWT, as defined by the `_sd_alg`
claim in the base payload, or `sha-256` if not present.

Before releasing credentials or initiating payment, the Credential Provider,
Merchant, and Merchant Payment Processor each MUST independently recompute
`checkout_hash` by applying the `_sd_alg` algorithm (or `sha-256` if absent)
to the raw bytes of the `checkout_jwt` value and comparing the result to the
`checkout_hash` field. If the values do not match, the verifier MUST reject
the mandate and MUST NOT proceed with the transaction.
Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist Bot Apr 29, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

low

For improved readability, consider rephrasing this paragraph to more clearly separate the primary requirement from the implementation details. Breaking the first long sentence into two can make the instruction easier to parse.

Suggested change
Before releasing credentials or initiating payment, the Credential Provider,
Merchant, and Merchant Payment Processor each MUST independently recompute
`checkout_hash` by applying the `_sd_alg` algorithm (or `sha-256` if absent)
to the raw bytes of the `checkout_jwt` value and comparing the result to the
`checkout_hash` field. If the values do not match, the verifier MUST reject
the mandate and MUST NOT proceed with the transaction.
Before releasing credentials or initiating payment, the Credential Provider,
Merchant, and Merchant Payment Processor each MUST verify that the `checkout_hash`
field's value matches a computed hash of the `checkout_jwt` value. The hash
MUST be computed by applying the `_sd_alg` algorithm (or `sha-256` if absent)
to the raw bytes of the `checkout_jwt` value. If the values do not match, the
verifier MUST reject the mandate and MUST NOT proceed with the transaction.


`checkout_jwt` is the merchant-signed JWT containing the details of the
checkout. The details of the payload are outside the scope of this
specification, when used with the [Universal Commerce Protocol](https://ucp.dev)
Expand Down Expand Up @@ -175,13 +182,13 @@
"decoded": [
"4n3L_-3_Fm2GgyFAF8Ct_g",
{
"id": "supershoe_limited_edition_gold_sneaker_womens_9_0",

Check warning on line 185 in docs/ap2/checkout_mandate.md

View workflow job for this annotation

GitHub Actions / spellcheck 

Misspelled word (womens) Suggestions: (women*)

Check warning on line 185 in docs/ap2/checkout_mandate.md

View workflow job for this annotation

GitHub Actions / spellcheck 

Unknown word (supershoe)
"title": "SuperShoe Limited Edition Gold"
}
]
},
{
"digest": "a5UMAdxCk_MRayyVdRhpIAZ0ZhjVLEq1g2BWyruKUwg",

Check warning on line 191 in docs/ap2/checkout_mandate.md

View workflow job for this annotation

GitHub Actions / spellcheck 

Unknown word (Wyru)

Check warning on line 191 in docs/ap2/checkout_mandate.md

View workflow job for this annotation

GitHub Actions / spellcheck 

Unknown word (Rayy)
"decoded": [
"2zPL6vqLBg2WYAdbW9-1lQ",
{
Expand All @@ -194,7 +201,7 @@
{
"digest": "QtXTJtWqg999CmUWGjHFTWMkRPguDfeK3wGSaInd-dw",
"decoded": [
"laAoWKNRuGnwREjJWYJ7pg",

Check warning on line 204 in docs/ap2/checkout_mandate.md

View workflow job for this annotation

GitHub Actions / spellcheck 

Unknown word (JWYJ)
{
"vct": "mandate.checkout.open.1",
"constraints": [
Expand All @@ -216,7 +223,7 @@
"type": "checkout.allowed_merchants",
"allowed": [
{
"...": "a5UMAdxCk_MRayyVdRhpIAZ0ZhjVLEq1g2BWyruKUwg"

Check warning on line 226 in docs/ap2/checkout_mandate.md

View workflow job for this annotation

GitHub Actions / spellcheck 

Unknown word (Wyru)

Check warning on line 226 in docs/ap2/checkout_mandate.md

View workflow job for this annotation

GitHub Actions / spellcheck 

Unknown word (Rayy)
}
]
}
Expand All @@ -226,7 +233,7 @@
"crv": "P-256",
"kty": "EC",
"x": "QpSyxPQHy38xckypDr54gZ3T42zj9iLtV4koyb5U27c",
"y": "37HLd7JJinxjJIn8J7HijssoeclbfhdW-gUL7feI9lw"

Check warning on line 236 in docs/ap2/checkout_mandate.md

View workflow job for this annotation

GitHub Actions / spellcheck 

Unknown word (Hijssoeclbfhd)

Check warning on line 236 in docs/ap2/checkout_mandate.md

View workflow job for this annotation

GitHub Actions / spellcheck 

Unknown word (Jinxj)
}
},
"iat": 1777342357,
Expand All @@ -241,7 +248,7 @@
#### Encoded Token

```
eyJhbGciOiAiRVMyNTYiLCAidHlwIjogImV4YW1wbGUrc2Qtand0IiwgImtpZCI6ICJhZ2VudC1wcm92aWRlci1rZXktMSJ9.eyJkZWxlZ2F0ZV9wYXlsb2FkIjogW3siLi4uIjogIlF0WFRKdFdxZzk5OUNtVVdHakhGVFdNa1JQZ3VEZmVLM3dHU2FJbmQtZHcifV0sICJfc2RfYWxnIjogInNoYS0yNTYifQ.HvCGk7ye_c0LN2-NFG13wfyu3LA--rckTPGm36ugO2aRvsded7ngw1py8W3JF7wBpoQnsKr17tNTF3zLeYcoWA~WyI0bjNMXy0zX0ZtMkdneUZBRjhDdF9nIiwgeyJpZCI6ICJzdXBlcnNob2VfbGltaXRlZF9lZGl0aW9uX2dvbGRfc25lYWtlcl93b21lbnNfOV8wIiwgInRpdGxlIjogIlN1cGVyU2hvZSBMaW1pdGVkIEVkaXRpb24gR29sZCJ9XQ~WyIyelBMNnZxTEJnMldZQWRiVzktMWxRIiwgeyJpZCI6ICJtZXJjaGFudF8xIiwgIm5hbWUiOiAiRGVtbyBNZXJjaGFudCIsICJ3ZWJzaXRlIjogImh0dHBzOi8vZGVtby1tZXJjaGFudC5leGFtcGxlIn1d~WyJsYUFvV0tOUnVHbndSRWpKV1lKN3BnIiwgeyJ2Y3QiOiAibWFuZGF0ZS5jaGVja291dC5vcGVuLjEiLCAiY29uc3RyYWludHMiOiBbeyJ0eXBlIjogImNoZWNrb3V0LmxpbmVfaXRlbXMiLCAiaXRlbXMiOiBbeyJpZCI6ICJsaW5lXzEiLCAiYWNjZXB0YWJsZV9pdGVtcyI6IFt7Ii4uLiI6ICJ5M2FvY0FEMnJoWXBKUU9VTU4wMTZmYURGR2tUQkdFRFZsMVIxVFJIZGJ3In1dLCAicXVhbnRpdHkiOiAxfV19LCB7InR5cGUiOiAiY2hlY2tvdXQuYWxsb3dlZF9tZXJjaGFudHMiLCAiYWxsb3dlZCI6IFt7Ii4uLiI6ICJhNVVNQWR4Q2tfTVJheXlWZFJocElBWjBaaGpWTEVxMWcyQld5cndLVXdnIn1dfV0sICJjbmYiOiB7Imp3ayI6IHsiY3J2IjogIlAtMjU2IiwgImt0eSI6ICJFQyIsICJ4IjogIlFwU3l4UFFIeTM4eGNreXZEcjU0Z1ozVDQyemo5aUx0VjRrb3liNVUyN2MiLCAieSI6ICIzN0hMZDdKSmlueGpKSW44SjdIaWpzc29lY0JsZmhkVy1nVUw3ZmVJOWx3In19LCAiaWF0IjogMTc3NzM0MjM1NywgImV4cCI6IDE3NzczNDU5NTd9XQ~

Check warning on line 251 in docs/ap2/checkout_mandate.md

View workflow job for this annotation

GitHub Actions / spellcheck 

Unknown word (wfyu)
```


Expand Down
Loading