Evidence row 565066

What was observed

{
  "count": 4,
  "tools": [
    {
      "description": "Use before submitting a mobile or web app to the Apple App Store, Google Play or Google OAuth verification. Pass an inventory of what the app collects, which SDKs it uses and which Google scopes it requests (build it by reading the repo). Returns the problems reviewers are likely to reject, how to fix each one, and which paid package generates the missing documents. Free. The first call returns an app_token: save it in .approvekit.json at the project root and pass it on later calls so the app is updated instead of duplicated.",
      "inputSchema": {
        "$schema": "http://json-schema.org/draft-07/schema#",
        "properties": {
          "app_token": {
            "description": "The app_token returned by audit_app. It is stored in .approvekit.json at the project root. Omit on the first audit of an app.",
            "type": "string"
          },
          "inventory": {
            "properties": {
              "account_deletion_in_app": {
                "description": "True if the app already lets users delete their account from inside the app.",
                "type": [
                  "boolean",
                  "null"
                ]
              },
              "account_deletion_url": {
                "anyOf": [
                  {
                    "format": "uri",
                    "type": "string"
                  },
                  {
                    "type": "null"
                  }
                ],
                "description": "Existing public page where users can request account deletion, if any."
              },
              "android_target_sdk": {
                "anyOf": [
                  {
                    "maximum": 9007199254740991,
                    "minimum": -9007199254740991,
                    "type": "integer"
                  },
                  {
                    "type": "null"
                  }
                ],
                "description": "targetSdkVersion from build.gradle, if known."
              },
              "app_name": {
                "maxLength": 100,
                "minLength": 1,
                "type": "string"
              },
              "auth_providers": {
                "default": [],
                "description": "How users sign in, e.g. \"Sign in with Apple\", \"Google\", \"email and password\", \"Supabase Auth\".",
                "items": {
                  "type": "string"
                },
                "type": "array"
              },
              "bundle_ids": {
                "anyOf": [
                  {
                    "properties": {
                      "android": {
                        "type": [
                          "string",
                          "null"
                        ]
                      },
                      "ios": {
                        "type": [
                          "string",
                          "null"
                        ]
                      }
                    },
                    "type": "object"
                  },
                  {
                    "type": "null"
                  }
                ],
                "description": "iOS bundle identifier and Android application id."
              },
              "data_collected": {
                "default": [],
                "items": {
                  "properties": {
                    "purpose": {
                      "description": "Why it is collected, e.g. \"account login\", \"analytics\".",
                      "type": "string"
                    },
                    "shared_with": {
                      "anyOf": [
                        {
                          "items": {
                            "type": "string"
                          },
                          "type": "array"
                        },
                        {
                          "type": "null"
                        }
                      ],
                      "description": "Third parties that receive this data."
                    },
                    "type": {
                      "description": "Kind of data, e.g. \"email\", \"precise location\", \"photos\", \"purchase history\".",
                      "type": "string"
                    }
                  },
                  "required": [
                    "type",
                    "purpose"
                  ],
                  "type": "object"
                },
                "type": "array"
              },
              "developer_name": {
                "description": "Legal name that appears in the policies, usually the company or the individual developer.",
                "maxLength": 200,
                "minLength": 1,
                "type": "string"
              },
              "google_oauth_scopes": {
                "default": [],
                "description": "Full Google OAuth scope URLs the app requests, if it uses Sign in with Google or Google APIs.",
                "items": {
                  "type": "string"
                },
                "type": "array"
              },
              "has_user_accounts": {
                "description": "True if users can sign up or log in.",
                "type": "boolean"
              },
              "permissions": {
                "default": [],
                "description": "iOS usage-description keys and Android permissions the app declares, e.g. NSCameraUsageDescription, android.permission.READ_CONTACTS.",
                "items": {
                  "type": "string"
                },
                "type": "array"
              },
              "platforms": {
                "items": {
                  "enum": [
                    "ios",
                    "android",
                    "web"
                  ],
                  "type": "string"
                },
                "minItems": 1,
                "type": "array"
              },
              "play_developer_account": {
                "anyOf": [
                  {
                    "enum": [
                      "personal-new",
                      "personal-old",
                      "organization"
                    ],
                    "type": "string"
                  },
                  {
                    "type": "null"
                  }
                ],
                "description": "Google Play account type: personal created after 2023-11-13 (closed-testing requirement applies), personal created before, or organization. Ask the user."
              },
              "privacy_policy_url": {
                "anyOf": [
                  {
                    "format": "uri",
                    "type": "string"
                  },
                  {
                    "type": "null"
                  }
                ],
                "description": "Existing privacy policy URL, if any."
              },
              "stack": {
                "anyOf": [
                  {
                    "enum": [
                      "expo",
                      "react-native",
                      "flutter",
                      "ios",
                      "android",
                      "web"
                    ],
                    "type": "string"
                  },
                  {
                    "type": "null"
                  }
                ],
                "description": "How the app is built. Expo config plugins add permission strings automatically, so some checks differ."
              },
              "support_email": {
                "description": "Public contact address for privacy and deletion requests.",
                "format": "email",
                "pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$",
                "type": "string"
              },
              "takes_payments": {
                "type": [
                  "boolean",
                  "null"
                ]
              },
              "third_party_sdks": {
                "default": [],
                "description": "SDKs found in the dependencies, e.g. \"Firebase Analytics\", \"RevenueCat\", \"Sentry\".",
                "items": {
                  "type": "string"
                },
                "type": "array"
              }
            },
            "required": [
              "app_name",
              "developer_name",
              "support_email",
              "platforms",
              "has_user_accounts"
            ],
            "type": "object"
          }
        },
        "required": [
          "inventory"
        ],
        "type": "object"
      },
      "name": "audit_app"
    },
    {
      "description": "Creates a Stripe Checkout link for one app. Only call this after the user agreed to the purchase. Show the link to the user so they can pay; then call get_order with the returned order_id to receive the documents.",
      "inputSchema": {
        "$schema": "http://json-schema.org/draft-07/schema#",
        "properties": {
          "app_token": {
            "description": "The app_token returned by audit_app. It is stored in .approvekit.json at the project root.",
            "type": "string"
          },
          "product": {
            "description": "launch_pass (US$49) or oauth_pack (US$249).",
            "enum": [
              "launch_pass",
              "oauth_pack"
            ],
            "type": "string"
          }
        },
        "required": [
          "app_token",
          "product"
        ],
        "type": "object"
      },
      "name": "create_checkout"
    },
    {
      "description": "Returns the payment status of an order. Once paid, returns every generated document as Markdown plus the public URLs of the hosted privacy policy and account deletion pages, ready to paste into App Store Connect, Play Console or the Google OAuth consent screen.",
      "inputSchema": {
        "$schema": "http://json-schema.org/draft-07/schema#",
        "properties": {
          "app_token": {
            "description": "The app_token returned by audit_app. It is stored in .approvekit.json at the project root.",
            "type": "string"
          },
          "order_id": {
            "description": "The order_id returned by create_checkout.",
            "type": "string"
          }
        },
        "required": [
          "app_token",
          "order_id"
        ],
        "type": "object"
      },
      "name": "get_order"
    },
    {
      "description": "Saves the final version of a document after every [CONFIRM: ...] placeholder has been resolved with the user. For privacy-policy and account-deletion this makes the hosted page live at its public URL; for the other kinds it just stores the final text. Call it again whenever the text needs an update (for example after the app adds a new data type).",
      "inputSchema": {
        "$schema": "http://json-schema.org/draft-07/schema#",
        "properties": {
          "app_token": {
            "description": "The app_token returned by audit_app. It is stored in .approvekit.json at the project root.",
            "type": "string"
          },
          "kind": {
            "enum": [
              "privacy-policy",
              "account-deletion",
              "reviewer-notes",
              "oauth-scope-justifications",
              "oauth-demo-script"
            ],
            "type": "string"
          },
          "markdown": {
            "description": "The complete final document in Markdown (headings, lists, bold and links only).",
            "minLength": 50,
            "type": "string"
          }
        },
        "required": [
          "app_token",
          "kind",
          "markdown"
        ],
        "type": "object"
      },
      "name": "publish_document"
    }
  ]
}

What the leaf hashes

{"body":"19a82be1e6312490e5424a2489259297db3796b54d511753ebe352611d4386b2","id":565066,"kind":"mcp.tools","method":"probe.mcp/1","observed_us":1793138001566478,"prev":null,"subject":"693ae6eb-3c22-4d21-9f53-7802d689b6a4","subject_kind":"endpoint"}

Proof

Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of 2026-10-27 (273461 rows).

1. 0x88068f0f360b05e37c0a6f74ce52a4733eed1ff46ff84d5313902b212329adfa
2. 0x5aa9f72b42f82256179e5c85a48394887f1e42eef9b670393127063ad35af266
3. 0x6d3c49bbb479fdb37aedd55ba394a7bde41690c64a610a9dacd34a232e0226a4
4. 0xde48df7eb72d98acc8e34c226717e8ada58dde785e0b6380bc99b2023b25ecbc
5. 0x768cad4d47074fc6275bca0b71759b1e7eefb11c3cf60b128e40b4a0c0e54e8f
6. 0xd5d9f985f5227889bf9b7985a89d2d30b22170f23a4b615f2df9f902d37b4ab5
7. 0x94f29fb25efad29f517a863b0c82f140dcdf81bfcd8a1137e55039421e5be91c
8. 0x3669115200f1ba42d6d36d7beb17d9f846b56ad344e116e4c2a9f7b699ccdfcc
9. 0x97effb1ba905c8c4a8be9f09c02e6f0befa4ef0bc33765d819033db6e20edc1e
10. 0x81f89e3069fb48b6835de1962628cc388439a3163ac4e01f69f894aedd6239cf
11. 0xe661124afe6da658d35cc39e5dfcb10ff9056b0c88a42fc174890e77d2c26ca5
12. 0x470f6acef0d823e6f9e5fa35684563c8f27c3d338b165b457171afc3d44d4d86
13. 0x6251e2be57e8d16b82579481d181c265d75096882014489550b74a728741f2f1
14. 0x4964f0806efde5ed25f60da2b45d78cd2e0f07d67e64aad2822f6016ad973c47
15. 0x3c500ec3d3edf0c74b87a6ca8fcd77656bfbe03db3d478bd0c184d0c88839c6b
16. 0xfecf3d4646dd4984a13dd715499e842c3fde63692336d97394c2bfd8e877ca5d
17. 0xf30fddbf4811226c58e8f0daf36fddd79fc5f1356b592bb1d99a8061ddbabe66
18. 0x2bf8151e5f157dd183b9de6fa00469551932a7a6e3f33a694895000ac9061197
19. 0x9fc354c0ea3efc3f1b6548bb77ea902a50f2c9647647ea61592efce2bd795699

Day root

0xdd77e5e99da32c3f154180d63e3c3e6fe11e896a2c6896412ef6b5c4bcf7e795

Chained

0x23bb4dfd09f55c15ac3962f53578e02c6114d5bfd9bb451cf8794fb6e2817ef4

Published

On Arc Testnet, block 69414147: 0xb2ebd83aafeb765a0ce66e76aefb133ed06606c98038fd56191e2bcd1dcb77b4