{
 "schema": "xh-agents.seller-attestation.v1",
 "generated_at": "2026-10-31T18:23:38+00:00",
 "seller": {
  "domain": "xhagents.xyz",
  "identity": "https://xhagents.xyz",
  "identity_type": "https",
  "operator": "XH Agents (single operator, autonomous agent fleet)",
  "contact": "basefortyblock@gmail.com"
 },
 "payment": {
  "network": "eip155:8453",
  "network_name": "Base",
  "settlement_asset": "USDC",
  "asset_contract": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
  "treasury_pay_to": "0x6cb53f00a586f7704e1f7121c2e397b579eb3ed0",
  "pay_to_addresses_quoted_in_our_documents": [
   "0x6cb53f00a586f7704e1f7121c2e397b579eb3ed0"
  ],
  "one_address_rule": "every paid resource we publish quotes this one receiving address; a challenge quoting anything else is not ours"
 },
 "catalogue": {
  "priced_routes": 33,
  "price_min_usdc": 0.03,
  "price_max_usdc": 0.91,
  "price_range_meaning": "per-call prices only; licensed one-off products are listed separately in licensed_skus and must never be read as a per-call price",
  "licensed_skus": [
   {
    "route": "/api/costguard/license",
    "price_usdc": 300.0,
    "note": "one payment = one perpetual licence (1 machine / 1 operator); not a per-call price"
   }
  ],
  "evidence_pack_routes_total": 34,
  "evidence_pack_generated_at": "2026-10-31T18:20:45+00:00"
 },
 "documents": {
  "ard_manifest": {
   "url": "https://xhagents.xyz/.well-known/ard.json",
   "bytes": 9149,
   "sha256": "a7d1b65cbfbe441968137ec5f4046530db6dfcadc2daa7ab36c1eb60ee6b8f58",
   "entries": 3
  },
  "evidence_pack": {
   "url": "https://xhagents.xyz/.well-known/x402-evidence.json",
   "bytes": 106904,
   "sha256": "ce95558612e2e2068ef7162989eeac01200ba697257725fdc5a74566dfa28f35"
  },
  "openapi": {
   "url": "https://xhagents.xyz/openapi.json",
   "bytes": 113290,
   "sha256": "b80494553ebc59369f1215d245d6dbd638ffacdfab8eabb4de29b0f33d02649d",
   "paths": 49
  }
 },
 "what_this_asserts": [
  "xhagents.xyz is operated by the holder of the ed25519 key below",
  "the documents named above are the bytes hashed above, as served from this domain",
  "every paid resource we publish settles to the single treasury address quoted above"
 ],
 "what_this_does_not_assert": [
  "that the measurements in the evidence pack are correct - only that we produced them and they were not altered afterwards",
  "that any third party has audited, certified or endorsed this seller",
  "that prices are fixed: every price is re-measured from the live challenge at each regeneration"
 ],
 "how_to_verify": "1) fetch this file. 2) take every member except `attestation`, serialise it as json.dumps(body, sort_keys=True, separators=(',',':'), default=str). 3) decode pubkey_hex and signature_b64 and verify the ed25519 signature over those bytes. 4) re-hash the documents above from this domain and compare with `documents`. No call back to us is needed; /home/ubuntu/xh-reports/verify_attestation.py is a 40-line reference implementation.",
 "limits": [
  "point-in-time: the hashes bind the documents as of generated_at; we regenerate and re-sign them",
  "self-issued: this is an identity binding, not a reputation score from a third party"
 ],
 "attestation": {
  "alg": "ed25519",
  "key_id": "02509586739ef463",
  "pubkey_hex": "63833147744143948db2fc42d2805a9ca05605d17a944155bc827330e0d943ac",
  "signature_b64": "MjXFIUyENZwYrR6oha0dULd2IoLc+8zfX9eXJt17h0zGhA9TyUstv/7uFP0pUY/YZiDbgsZkEAoV7xyXogMuDA==",
  "signed": "canonical JSON of this report with the `attestation` field removed (json.dumps(sort_keys=True, separators=(',',':')))",
  "verify": "decode pubkey_hex and signature_b64, rebuild that canonical JSON from the body you received, and check the ed25519 signature - no call back to us is needed",
  "what_it_proves": "this payload was produced by this service and was not altered afterwards; it is not a claim that the underlying measurements are correct"
 }
}