Do not take our word for any of this.

curl -s https://intelligence.voidly.ai:8443/.well-known/voidly-session-provider.json \
  | jq '{provider_did, signing_public_key_base64,
         payee_chain: (.services[0].price.payee_account | split(":")[0:2] | join(":")),
         payee_ends:  (.services[0].price.payee_account | .[-8:]),
         min_amount:  .services[0].price.min_amount,
         signed:      (.signature_base64 | length > 0)}'

cat > verify-manifest.js <<'EOF'
const crypto = require('crypto')
const URL = 'https://intelligence.voidly.ai:8443/.well-known/voidly-session-provider.json'

// RFC 8785 JCS: keys sorted by code unit, no whitespace, and nothing else.
const jcs = (v) =>
  Array.isArray(v) ? '[' + v.map(jcs).join(',') + ']'
  : v && typeof v === 'object'
    ? '{' + Object.keys(v).sort().map((k) => JSON.stringify(k) + ':' + jcs(v[k])).join(',') + '}'
    : JSON.stringify(v)

;(async () => {
  const doc = await (await fetch(URL)).json()
  const { signature_base64, ...signed } = doc

  // Raw 32-byte Ed25519 key -> SPKI, so node's verifier will accept it.
  const key = crypto.createPublicKey({
    key: Buffer.concat([
      Buffer.from('302a300506032b6570032100', 'hex'),
      Buffer.from(doc.signing_public_key_base64, 'base64'),
    ]),
    format: 'der',
    type: 'spki',
  })

  const ok = crypto.verify(null, Buffer.from(jcs(signed), 'utf8'), key,
                           Buffer.from(signature_base64, 'base64'))
  console.log('signature valid:', ok)
  process.exit(ok ? 0 : 1)
})()
EOF
node verify-manifest.js

node -e '
const c = require("crypto"), U = "https://intelligence.voidly.ai:8443/.well-known/voidly-session-provider.json";
const jcs = v => Array.isArray(v) ? "[" + v.map(jcs).join(",") + "]"
  : v && typeof v === "object"
    ? "{" + Object.keys(v).sort().map(k => JSON.stringify(k) + ":" + jcs(v[k])).join(",") + "}"
    : JSON.stringify(v);
(async () => {
  const doc = await (await fetch(U)).json();
  const key = c.createPublicKey({ key: Buffer.concat([Buffer.from("302a300506032b6570032100","hex"),
    Buffer.from(doc.signing_public_key_base64,"base64")]), format: "der", type: "spki" });
  const ck = d => { const { signature_base64, ...s } = d;
    return c.verify(null, Buffer.from(jcs(s),"utf8"), key, Buffer.from(signature_base64,"base64")); };
  const bend = f => { const d = structuredClone(doc); f(d); return ck(d); };
  console.log("untouched          :", ck(structuredClone(doc)));
  console.log("min_amount 50000+1 :", bend(d => d.services[0].price.min_amount = "50001"));
  console.log("payee last byte    :", bend(d => d.services[0].price.payee_account =
                                           d.services[0].price.payee_account.slice(0, -1) + "3"));
  console.log("provider_did       :", bend(d => d.provider_did = "did:voidly:AAAAAAAAAAAAAAAAAAAAAA"));
})()'

cat > derive-did.js <<'EOF'
const ALPHABET = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz'
const b58 = (buf) => {
  let n = BigInt('0x' + buf.toString('hex')), s = ''
  while (n > 0n) { s = ALPHABET[Number(n % 58n)] + s; n /= 58n }
  for (const b of buf) { if (b) break; s = '1' + s }
  return s
}

;(async () => {
  const url = 'https://intelligence.voidly.ai:8443/.well-known/voidly-session-provider.json'
  const doc = await (await fetch(url)).json()
  const key = Buffer.from(doc.signing_public_key_base64, 'base64')
  const derived = 'did:voidly:' + b58(key.subarray(0, 16))

  console.log('derived from key:', derived)
  console.log('claimed in doc:  ', doc.provider_did)
  console.log('match:           ', derived === doc.provider_did)
  process.exit(derived === doc.provider_did ? 0 : 1)
})()
EOF
node derive-did.js

curl -s https://mainnet.base.org \
  -H 'content-type: application/json' \
  --data '{"jsonrpc":"2.0","id":1,"method":"eth_getTransactionReceipt",
           "params":["0xb1ac733095c19e2e4829a3d448a02b8297d08e55f98678adfcba2e3e92747a3a"]}' \
  | jq 'def hex: ltrimstr("0x") | explode
        | reduce .[] as $c (0; . * 16 + (if $c < 58 then $c - 48 else $c - 87 end));
        def short: .[0:10] + "…" + .[-8:];
        .result
        | {status, block: (.blockNumber | hex), from: (.from | short), to: (.to | short)}'

cat > cross-check.js <<'EOF'
// Fetches three things that do not trust each other: the provider's signed
// manifest, Voidly's published settlement record, and a Base RPC. Then it checks
// they agree. Addresses are printed with the middle elided; drop the elide()
// call to see them whole.
const MANIFEST = 'https://intelligence.voidly.ai:8443/.well-known/voidly-session-provider.json'
const RECORD = 'https://voidly.ai/pay-first-settlement.json'
const RPC = 'https://mainnet.base.org'

const TRANSFER = '0xddf252ad1be2c89b69c2b068fc378daa952ba7f163c4a11628f55a4df523b3ef'
const AUTH_USED = '0x98de503528ee59b575ef0c0a2576a82497bfc029a5685b209e9ec333479b10a5'

const elide = (s) => s.slice(0, 10) + '…' + s.slice(-8)
const topicAddr = (t) => '0x' + t.slice(26)
const row = (label, ok) => console.log(label.padEnd(46), ok ? 'MATCH' : 'MISMATCH')

;(async () => {
  const manifest = await (await fetch(MANIFEST)).json()
  const record = await (await fetch(RECORD)).json()

  const receipt = (await (await fetch(RPC, {
    method: 'POST',
    headers: { 'content-type': 'application/json' },
    body: JSON.stringify({
      jsonrpc: '2.0', id: 1, method: 'eth_getTransactionReceipt',
      params: [record.result.txHash],
    }),
  })).json()).result

  const price = manifest.services[0].price
  // "eip155:8453:0x…" -> "0x…"
  const signedPayee = price.payee_account.split(':').pop().toLowerCase()

  const transfer = receipt.logs.find((l) => l.topics[0] === TRANSFER)
  const auth = receipt.logs.find((l) => l.topics[0] === AUTH_USED)

  const chainPayee = topicAddr(transfer.topics[2])
  const chainAmount = BigInt(transfer.data).toString()
  const chainNonce = auth.topics[2].replace(/^0x/, '')

  console.log('tx                 ', elide(record.result.txHash))
  console.log('block              ', Number(receipt.blockNumber))
  console.log('receipt status     ', receipt.status, receipt.status === '0x1' ? '(success)' : '(FAILED)')
  console.log('token contract     ', elide(transfer.address))
  console.log('paid to            ', elide(chainPayee), '<- read off the chain, not off this page')
  console.log('amount (atomic)    ', chainAmount, '=', Number(chainAmount) / 1e6, 'USDC')
  console.log('')
  row('signed payee_account == chain recipient', signedPayee === chainPayee)
  row('signed min_amount == chain amount', price.min_amount === chainAmount)
  row('record bindingRef == chain auth nonce', record.result.bindingRef === chainNonce)
  row('record txHash == receipt txHash', record.result.txHash === receipt.transactionHash)

  const all = signedPayee === chainPayee && price.min_amount === chainAmount
    && record.result.bindingRef === chainNonce
    && record.result.txHash === receipt.transactionHash
  process.exit(all && receipt.status === '0x1' ? 0 : 1)
})()
EOF
node cross-check.js