ArtifactGuard

ArtifactGuard validates AI-generated JSON, ZIP, PDF, and DOCX deliveries and returns an Ed25519-signed PASS, WARN, or FAIL receipt. It is built for agent-to-agent handoffs where the buyer needs deterministic evidence that a delivery matched a contract.

Buyer case — signed AI deliverable QA: an AI agent validates its customer file against an acceptance contract, then attaches the signed receipt to the handoff. The public buyer example contains copy-ready Apify and x402 requests plus an independent verifier.

validate_manifest checks declared names, sizes, MIME types, SHA-256 values, and required archive paths for USD 0.01. validate_artifact inspects Base64 file bytes up to 10 MiB for USD 0.05. A malformed request is rejected before billing. A completed inspection whose result is FAIL is a valid paid result.

The CiteSeal endpoints verify claims against a public HTTPS web page for USD 0.02 or PDF for USD 0.05 and return a signed evidence receipt. Sources are limited to 2 MiB; private-network addresses, non-standard ports, query credentials, compressed responses, and redirect chains beyond two hops are blocked.

POST /v1/fetch/web is the USD 0.01 AgentFetch endpoint. It extracts up to 20,000 characters of compact text from a restricted public HTTPS page, removes script/style/template content, flags common prompt-injection phrases, and returns an Ed25519-signed content receipt. Direct, Morse, Base64, hex, percent-encoded, and Unicode-hidden injection patterns trigger fail-closed quarantine: returned title/text is empty and only hashes and safety signals remain. A PASS means no configured marker matched; all returned source content must still be treated as untrusted data, never as instructions.

What it checks

• JSON parsing and optional JSON Schema Draft 2020-12
• ZIP path traversal, duplicate paths, excessive expansion, compression ratios, encryption, symlinks, executables, and macro payloads
• PDF parsing, encryption, and page-count contracts
• DOCX container structure, parsing, text, executable, and macro checks
• Declared size and SHA-256
• Required and forbidden paths, required text, forbidden literal patterns
• Common private-key, API-key, local-user-path, and file:// leakage patterns

ArtifactGuard never follows arbitrary or private-network URLs. CiteSeal fetches only restricted public HTTPS sources, while direct artifact bytes are sent to a resource-limited parser process. Source and artifact bytes are not written to the revenue ledger and are released after the request. Logs and revenue events contain hashes, format/event metadata, payer hashes, and payment references—not document bytes or wallet private keys.

REST example

Generate the fixed examples, start the local server, and post any request file:

python -m pip install -e '.[test]'
python scripts/generate_release_assets.py
artifactguard
curl -X POST http://127.0.0.1:8000/v1/validate/artifact \
  -H 'content-type: application/json' \
  --data-binary @samples/requests/json.json

Free endpoints are /health, /capabilities, /v1/keys/{key_id}, and POST /v1/receipts/verify. /presets publishes copy-ready validation contracts for JSON agent results, ZIP handoffs, PDF reports, and DOCX deliveries. Invalid paid requests include /examples and /presets recovery links without charging. The verification endpoint validates the receipt schema, key ID, canonical receipt hash, and Ed25519 signature without echoing the supplied receipt contents. Interactive OpenAPI is at /docs. A configured /dashboard provides a password-protected, read-only view of external revenue while excluding owner, testnet, local, and Bazaar-indexing payments. It never displays payer hashes, wallet addresses, payment references, or request bodies. Apify deployments also expose streamable HTTP MCP at /mcp with validate_manifest, validate_artifact, and the free verify_receipt tool.

Every successful response is wrapped as:

{
  "data": {
    "artifact_sha256": "...",
    "contract_sha256": "...",
    "status": "PASS",
    "checks": [],
    "validator_version": "0.1.0",
    "generated_at": "2026-07-28T00:00:00+00:00",
    "receipt_sha256": "...",
    "key_id": "ed25519-...",
    "signature": "..."
  },
  "error": null,
  "meta": {}
}

Fetch the public Ed25519 key from /v1/keys/{key_id}. Verify the signature over the canonical JSON receipt after removing only the signature field. The same idempotency key and request returns the exact cached receipt; binding that key to different bytes returns 409.

Run modes

• local: no charge, loopback bind, ephemeral signing key allowed.
• apify: Pay-per-event standard runs plus Standby REST/OpenAPI and /mcp.
• x402: FastAPI x402 v2 middleware with Bazaar and required Payment Identifier extensions. MCP is consumed through Bazaar discovery rather than mounted directly on this instance.

In the Apify Input tab, choose validate-manifest or validate-artifact to receive the signed receipt in the run dataset and OUTPUT record. Automated Store tests are forced to the free readiness check and do not trigger a paid event.

Production refuses to start without ARTIFACTGUARD_ED25519_PRIVATE_KEY_B64. The x402 mode additionally requires X402_PAY_TO; the service never needs the receiving wallet's private key. Use the CDP facilitator for Bazaar indexing. The first successful mainnet settlement is automatically excluded as bazaar_indexing; testnet, owner, and local calls are also excluded from external revenue.

scripts/generate_signing_key.py stores a newly generated signing key in a mode-0600 file under .secrets/ and prints only its path and public metadata. Move the private value into the platform Secret and delete the local file after the public-key endpoint is verified.

Production x402 also requires measured per-call cost estimates for manifest, artifact, web-evidence, PDF-evidence, and AgentFetch operations. Startup is blocked if any estimated hosting cost reaches its configured call price.

See sales/APIFY_RELEASE.md and sales/X402_RELEASE.md for account-side launch gates. Prices must be configured in the Apify Console with exact event names manifest-validation and artifact-validation.

Verification

pytest
python scripts/release_check.py
python scripts/revenue_status.py
docker build -t artifactguard:local .

The release suite covers normal and damaged files, path traversal, compression bombs, macros and executables, encrypted PDF, sensitive patterns, oversize preflight, receipt tampering, concurrent duplicates, parser failure retries without a second application charge, x402 preflight, 402, and revenue classification.

한국어 안내

ArtifactGuard는 다른 AI가 만든 JSON·ZIP·PDF·DOCX 납품물을 계약 기준으로 검사하고, 독립 검증 가능한 Ed25519 서명 PASS/WARN/FAIL 영수증을 반환합니다. 잘못된 요청은 과금 전에 거절하고, 정상 파일을 실제로 검사한 뒤 나온 FAIL은 유료 결과로 처리합니다.

원본 문서는 매출 원장이나 로그에 저장하지 않습니다. Apify에서는 PPE 이벤트 가격과 플랫폼 사용비 사용자 부담을 설정하고, x402에서는 Base Sepolia 검증 후 Base USDC 메인넷으로 전환합니다. 테스트넷·자기결제·첫 Bazaar 색인 정산은 실제 매출에서 자동 제외합니다.

Operational limits

The local SQLite ledger and idempotency store protect concurrency and retries inside one running service instance. x402 replay protection additionally uses the required Payment Identifier extension. A multi-replica deployment must place idempotency state in a transactional shared store before horizontal scaling; keep the initial Standby deployment at one active service instance.

ArtifactGuard is a delivery-contract validator, not antivirus software, legal certification, or a guarantee that document contents are true.