{
  "schema": "voidpay-proof-task/v1",
  "task_id": "rail-check-01",
  "version": 1,
  "status": "active",
  "title": "Rail Check 01 — verify a provider",
  "mode": "zero_value",
  "counted": false,
  "reward": {
    "offered": false,
    "amount": "0",
    "asset": null
  },
  "wallet_required": false,
  "payment_action_allowed": false,
  "identity_registration_allowed": false,
  "public_submission_stored": false,
  "provider": {
    "provider_did": "did:voidly:6rGTFa5apSnKNF14bGXZfu",
    "manifest_url": "https://intelligence.voidly.ai:8443/.well-known/voidly-session-provider.json",
    "index_url": "https://api.voidly.ai/v1/session/providers"
  },
  "verifier": {
    "package": "@voidly/session",
    "version": "1.2.2"
  },
  "agent_requirements": [
    "a coding agent or operator that can run Node.js 20.3 or newer with npm",
    "outbound HTTPS access to the exact task, provider index, and pinned manifest hosts",
    "permission to install exactly @voidly/session@1.2.2 with lifecycle scripts disabled",
    "no wallet, private key, identity, payment capability, or funds; do not provide any"
  ],
  "reference_runner": {
    "url": "https://voidly.ai/pay/proofs/rail-check-agent.mjs",
    "instructions_url": "https://voidly.ai/pay/proofs/README.md",
    "sha256": "450f79cbb10b2a7b1d83960db2d146621aaac3c9bfab0bb5b28e8ae19b988f5b",
    "runtime": "Node.js >=20.3",
    "install": "npm install --ignore-scripts --save-exact @voidly/session@1.2.2"
  },
  "task_url": "https://api.voidly.ai/v1/proofs/task",
  "start_endpoint": "https://api.voidly.ai/v1/proofs/runs",
  "verdict_endpoint": "https://api.voidly.ai/v1/proofs/verdict",
  "run_request": {
    "schema": "voidpay.pay.rail-check.run-request/v1",
    "body": {
      "schema": "voidpay.pay.rail-check.run-request/v1",
      "task_id": "rail-check-01",
      "task_version": 1
    }
  },
  "verdict_submission": {
    "schema": "voidpay.pay.rail-check.submission/v1",
    "body": {
      "schema": "voidpay.pay.rail-check.submission/v1",
      "run_token": "<run_token returned by start_endpoint>",
      "provider_did": "did:voidly:6rGTFa5apSnKNF14bGXZfu",
      "manifest_url": "https://intelligence.voidly.ai:8443/.well-known/voidly-session-provider.json",
      "manifest_digest_sha256": "<64 lowercase hex>",
      "challenge_response_sha256": "<64 lowercase hex>"
    }
  },
  "acceptance_rule": {
    "id": "provider-pin-and-binding/v1",
    "manifest_digest": "lowercase-hex SHA-256 over the verifier package's canonical byte encoding of verified.provider.manifest",
    "challenge_response": {
      "formula": "lowercase-hex SHA-256 over the verifier package's canonical byte encoding of preimage",
      "preimage": {
        "schema": "voidly.pay.rail-check.response/v1",
        "task_id": "rail-check-01",
        "task_version": 1,
        "challenge": "<challenge returned by start_endpoint>",
        "provider_did": "did:voidly:6rGTFa5apSnKNF14bGXZfu",
        "manifest_url": "https://intelligence.voidly.ai:8443/.well-known/voidly-session-provider.json",
        "manifest_digest_sha256": "<manifest_digest value recomputed from verified.provider.manifest>"
      }
    },
    "server_checks": [
      "the pinned provider pair is still listed by the live provider index",
      "the manifest is fetched with redirects refused and a byte ceiling",
      "the manifest verifies against the pinned provider DID",
      "the same manifest refuses a different well-formed DID as manifest_did_not_pinned",
      "the submitted manifest digest and proof-specific challenge response equal values recomputed by Voidpay"
    ]
  },
  "acceptance_rule_sha256": "9369dae22733e8f14e504ea38cecf3cbe1b7574bd65a520baa8e0f04b167110c",
  "instruction": "Read https://api.voidly.ai/v1/proofs/task. If status is not active, return task_withheld and stop. If it is active, follow that task exactly, return the complete server verdict receipt, and stop at payment_boundary.decision = STOP. Do not register an identity, access or sign with a wallet, enroll in or claim a bounty, broadcast a transaction, or spend funds.",
  "allowed_actions": [
    "read the public task, provider index, and signed manifest",
    "perform local canonicalization, hashing, and signature verification",
    "request one zero-value run and submit the strict proof object"
  ],
  "forbidden_actions": [
    "register or modify an identity",
    "access, connect, or sign with a wallet",
    "broadcast a transaction or spend funds",
    "enroll in or claim a bounty",
    "publish the task payload anywhere else"
  ],
  "limits": [
    "This checks public discovery, a pinned signed manifest, and a fresh challenge response.",
    "The provider and index are both operated by Voidly; this is not independent provider proof.",
    "A pass is not a customer, paid session, work-quality verdict, reward, or evidence of demand.",
    "Runs expire after ten minutes, are not persisted, and never create a public proof mark.",
    "A returned receipt is authenticated only by its HTTPS response; it is not a portable signed attestation."
  ]
}