{
  "version": "1",
  "scope": "Examples only. Replace origin and paths with targets you control and may test with read-only GET requests.",
  "packs": {
    "release": {
      "checks": [
        {
          "id": "release",
          "url": "https://your-deployment.example/health",
          "status": 200,
          "json": [
            {
              "path": [
                "release"
              ],
              "equals": "COMMIT_SHA"
            },
            {
              "path": [
                "ready"
              ],
              "equals": true
            }
          ]
        }
      ]
    },
    "page": {
      "checks": [
        {
          "id": "page",
          "url": "https://your-deployment.example/",
          "status": 200,
          "text": "Expected page title"
        }
      ]
    },
    "json_contract": {
      "checks": [
        {
          "id": "contract",
          "url": "https://your-deployment.example/status",
          "status": 200,
          "json": [
            {
              "path": [
                "service"
              ],
              "equals": "your-service"
            },
            {
              "path": [
                "maintenance"
              ],
              "equals": false
            }
          ]
        }
      ]
    }
  },
  "workflow": [
    "Generate and retain a random private 32-128 character read token. Do not put it in a target URL or public proof file.",
    "POST /v1/enrollments with origin,paths,owner_authorized:true,read_only_paths:true and Authorization:Bearer token.",
    "Publish returned expected_file exactly at proof_url; POST /v1/enrollments/{id}/verify with the same token.",
    "POST /v1/preflight with the exact CheckPack, bearer token,X-ProofRun-Enrollment and a new stable 16-64 character Idempotency-Key. No signature. Ready means configuration/enrollment only, not a passing deployment.",
    "POST /v1/checks unsigned with the same inputs; review the live 402 amount/network/recipient. Caller wallet creates at most one payment authorization; retry with PAYMENT-SIGNATURE.",
    "Save original request,payment header,read token and idempotency key privately. Never sign/pay again after uncertain settlement.",
    "GET /v1/reports/{idempotency_key} or MCP read_report with the same token. This is the original result, not a new run. report_id is an evidence UUID, NOT the recovery URL key."
  ],
  "limits": {
    "checks": 5,
    "assertions": "one status,optional text-contains and up to eight scalar JSON equality assertions per check",
    "body_bytes_per_check": 131072,
    "target_timeout_ms": 5000,
    "pending_proof_minutes": 10,
    "verified_enrollment_hours": 24,
    "report_retention_days": 7
  },
  "payment": {
    "amount": "10000",
    "currency": "USDC",
    "network": "eip155:8453",
    "price_usdc": "0.01",
    "challenge": "Live PAYMENT-REQUIRED header is authoritative."
  },
  "non_goals": [
    "No security,visual,payment,legal-ownership or full-application certification.",
    "No arbitrary scripts,auth headers,query secrets,redirects or private-network targets.",
    "Failed assertions and unverified checks are delivered results. Free curl/local tests may be enough."
  ]
}