{"artifact_class":"replay_kit","store_identity":{"name":"SCVD General Store","what":"A human-run general store selling small signed goods to autonomous agents, paid in USDC over x402 v2 on a network offered in the current payment quote (see /rails). Also a free conformance desk that checks any issuer's x402 offers and receipts, including stores it competes with.","homepage":"https://scvd.store","verify":"Anyone can check this artifact without asking us and without an account: https://scvd.store/api/verify/{id}, free and permanent. The signing key is at https://scvd.store/.well-known/scvd-signing-key, and the offline verifier is MIT-licensed. The conformance desk is POST https://scvd.store/api/conformance/v1 — send any issuer's x402 signed offer or receipt, ours or not.","feedback":"What this store's clients said about it, at an address this store cannot write to: ERC-8004 agent 86957 in the Reputation Registry at 0x8004BAa17C55a88189AE136b182e5fdA19dE9b63 on Base (eip155:8453). Buyers write from their own addresses; the contract rejects the agent owner, so none of it is ours. Read it with getClients, or leave your own — the call and a pre-filled proof-of-payment ride every purchase response. This store turns none of it into a number, about itself or anyone.","rights":"You own what you bought outright and owe this store no credit for it. This block is here so the artifact can explain itself to whoever holds it next, not because attribution is required — see /rights."},"replay_url":"https://scvd.store/api/replay/cert_4dww28dx5j","verify_url":"https://scvd.store/api/verify/cert_4dww28dx5j","call":{"cert_id":"cert_4dww28dx5j","item":"hello","patron_number":1,"date":"2026-07-22T16:16:11.933Z"},"offer":{"quote":null,"accepted_terms":null,"recovered_from":"not_applicable: no money moved on this certificate, so no terms were accepted.","jws":null,"jws_note":"No offer can be signed: the accepted terms could not be recovered (recovered_from says why). A kit with a made-up offer would be worse than one without.","kid":"did:web:scvd.store#key-2","did_document":"https://scvd.store/.well-known/did.json","check":"jws_verify(offer.jws, key_from(did_document, offer.kid)) and sha256(jcs(lowercase_evm_addresses(five_terms_of(payload)))) == offer.quote == certificate.quote"},"settlement":{"state":"no_payment_recorded","transaction":null,"network":null,"explorer":null,"payer":null,"paid_usdc":null,"asset":null,"check":"Read the transaction on the named network yourself: a USDC Transfer from settlement.payer to the offer's payTo for the offer's amount, in the block the explorer shows. The store's word is the certificate; the chain is the proof, and it does not need us.","standing":{"payment_state":"no_payment_recorded","delivery_state":"delivered","order_of_operations":"settled_then_delivered","delivery_audit":{"state":"not_applicable","means":"No on-chain settlement is named on this certificate, so no delivery-audit row was ever keyed to it: the free shelf, a trade-account sale the marketplace collected, or a settle that returned no transaction hash."},"failed_attempts":{"on_this_receipt":"none_possible","why":"A certificate is minted only after the goods were produced. A delivery that fails before settlement takes no money and mints nothing, so it cannot appear on any receipt — there is nothing to receipt. This record is the delivery.","where":"Per-attempt state — payment_state settled | not_settled | unknown, charged, delivery_state, reconciliation_reference — lives on the buyer's purchase journal, opened only by the buyer's own token: GET /api/purchase-status/{purchase_id} with Authorization: Bearer <status_token>, or the check_purchase MCP tool. Both are returned with every purchase response and every decline. The store publishes its own conduct, never a buyer's failed attempts."},"derived_from":"The certificate's signed fields (settled_via, settlement_tx, paid_usdc, date) and a live read of the delivery-audit row keyed by settlement_tx. Nothing here is stored beside the certificate or typed by hand."}},"response":{"form":"current","signed_payload":"{\"cert_id\":\"cert_4dww28dx5j\",\"item\":\"hello\",\"patron_number\":1,\"date\":\"2026-07-22T16:16:11.933Z\",\"name\":\"First Customer\"}","signature":"9a4cd68cbea168345fe6537ecb9351d0a8aaed027b4e6c3fff249f9bb7c533f023b9b3eb224149766caf67e06ee61b1201c8d13ce9440ac103dd27b037796201","signature_jcs":null,"public_key":"d98ebec640489852c7076aee66615705200971e7d32c54964e173aea3d37e1af","algorithm":"ed25519","artifact_hash":"184f937e87d0a6ba881ea0bc6523890a6994f6566c58e561e2e931721e469eb6","check":"ed25519_verify(utf8(signed_payload), hex(signature), hex(public_key)) against a key you fetch from /.well-known/scvd-signing-key, then sha256(utf8(signed_payload)) == artifact_hash. Every field in the certificate is inside signed_payload; anything you find outside it is unsigned."},"refusal":{"wrong_scope":{"error":"This payment belongs to a different original request or interface. Read its private purchase status, or retry the original product and inputs through the original interface named in recovery. No additional payment was submitted. Repeating this mismatched request will not recover the purchase.","code":"purchase_input_mismatch","charged":true,"charged_again":false,"settlement_attempted":false,"temporary":false,"retry_with_same_request":false,"next_action":"read_purchase_status","recovery":{"purchase_recorded":true,"purchase_id":"<the original purchase's id>","status_url":"https://scvd.store/api/purchase-status/<purchase_id>","status_token":"<held by the buyer, never published>","status_tool":"check_purchase","original_door":"<the original interface: http or mcp>","original_path":"<the original purchase path>","status_auth":"GET status_url with Authorization: Bearer <status_token>. Keep the token private. This read is free and never submits payment."}},"how_to_provoke":"Present a settled payment — same PAYMENT-SIGNATURE, same nonce — against a different product or different inputs than it bought. The door answers with this body: refused, charged once (the original sale), charged_again false, settlement_attempted false, and the ORIGINAL purchase's private recovery handle so the buyer can read what the money actually bought. The placeholder values above are the shape; a real refusal carries the buyer's own ids and token, which are never published.","other_codes":{"payment_declined":"The authorization verified but did not settle; no money moved and nothing left the shelf.","settlement_unknown":"The settle call returned no verdict; the payment is unresolved and the buyer must not sign a new one. The hourly reconciler asks the chain.","purchase_not_settled":"A recorded attempt whose settlement was refused. No money moved, so the attempt hands its idempotency key back: the buyer retries with the SAME key and a fresh payment. A key is held only while an outcome is UNRESOLVED, never after a confirmed non-payment.","purchase_recovery_pending":"The payment settled and delivery is being recovered from the retained record; no second settlement is attempted."}},"replay":["1. GET replay_url. Everything below is inside this document; nothing requires an account.","2. Verify response.signed_payload against a key fetched from /.well-known/scvd-signing-key; confirm sha256 of it equals response.artifact_hash.","3. Decode offer.jws; verify it against the key offer.kid resolves to in did_document; hash its five terms and match offer.quote and the quote inside signed_payload.","4. Read settlement.transaction on settlement.network at settlement.explorer or your own RPC: payer, payTo and amount must agree with the offer.","5. Read settlement.standing.delivery_audit: closed means goods went out; open means the store owes and says so.","6. Optionally provoke refusal.wrong_scope by re-presenting a settled payment against another product: expect that code, charged_again false, and no second settlement."],"not_retained":["The exact JWS offer the paid 402 carried (per-challenge, five-minute validity, never returned by the buyer). Its five terms are recovered by hash; its validUntil is not.","The buyer's PAYMENT-SIGNATURE header. A one-way fingerprint is kept on the private purchase journal for recovery; the bytes are not served.","The facilitator's PAYMENT-RESPONSE header and the signed receipt inside it, which travelled to the buyer once and are the buyer's to keep."],"cite":"scvd.store, replay kit cert_4dww28dx5j, observed 2026-07-22T16:16:11.933Z; ed25519-signed, key at https://scvd.store/.well-known/scvd-signing-key; bytes at https://scvd.store/api/replay/cert_4dww28dx5j; verify at https://scvd.store/api/verify/cert_4dww28dx5j.","cite_format":"One line to quote verbatim: the issuer, what and which, when it was observed, how it is signed and where the key is, and the URL whose bytes are the thing cited. A citation names an observation, never a judgment.","kit_signature":{"format":"jws-detached","kid":"did:web:scvd.store#key-2","covers":"The RFC 8785 (JCS) form of this document with kit_signature removed, as the detached payload of an EdDSA JWS (RFC 7515 Appendix F): rebuild header..signature into header.base64url(payload).signature and verify against the key kid resolves to. Proves this store assembled this kit from these parts on this read; makes no part truer than its own signature does.","signature":"eyJhbGciOiJFZERTQSIsImtpZCI6ImRpZDp3ZWI6c2N2ZC5zdG9yZSNrZXktMiJ9..RIOeggsJj9LXgm-voEcGODs8QEFLKYA_HnkcJRKnWdg1YzEUFUbT3R4HnDVK56recP3scsR7apxzojCjd71KCg"}}