Implement a verifier

A Fiscal402 receipt is larger than the Fiscal402 API. Anyone can implement a verifier from the public spec and the frozen fixtures.

Algorithm

1. Reject unless spec is fiscal402.receipt and spec_version is 1.0.0.
2. Drop hashes and signature. Recursively sort object keys. Serialize compact UTF-8 JSON (fiscal402.sorted-json/1, not RFC 8785).
3. SHA-256 that UTF-8 string. Compare to hashes.canonical_payload_sha256.
4. Resolve signature.key_id in JWKS. Ed25519-verify the hex digest string.
5. If UBL is provided, SHA-256 the exact UTF-8 bytes (no XML C14N).
6. Require settlement network and tx_hash.

Conformance fixtures

• valid receipt
• matching JWKS
• bound UBL

TypeScript and Python verifiers in this repository must return the same VERIFIED/INVALID result on those bytes. Tampering the determination must fail canonical match. Unknown kid must fail. v2 documents are unsupported on the v1 verifier.