Manav signed the canonical JSON below with its server secret. Hash the JSON with HMAC-SHA256 using the MANAV_SERVER_SIGNING_SECRET and compare - if it matches, this proof is authentic.
Canonical proof JSON
{"actionPayloadHash":"cbb14f4ae93010d9e3793d5ef6e8c7a1efb3bca3923c79e7be7b5fbe927aef6c","actionTitle":"Work session approved · tao.ai","actionType":"work_session","actorHandle":null,"externalReference":null,"organizationSlug":null,"signatureSlug":"mnav_sig_Vj1YTHLDfHbG","signedAt":"2026-06-02 13:34:40"}
Action payload hash · SHA-256 of the canonical action payload
cbb14f4ae93010d9e3793d5ef6e8c7a1efb3bca3923c79e7be7b5fbe927aef6c
Server signature · HMAC-SHA256 over canonical JSON above
34f9cf8af68e8849a7ba528fe53c8e4079160f0489b830432c976af57f31c5b9
Recompute it yourself
$ printf '%s' '{"actionPayloadHash":"cbb14f4ae93010d9e3793d5ef6e8c7a1efb3bca3923c79e7be7b5fbe927aef6c","actionTitle":"Work session approved · tao.ai","actionType":"work_session","actorHandle":null,"externalReference":null,"organizationSlug":null,"signatureSlug":"mnav_sig_Vj1YTHLDfHbG","signedAt":"2026-06-02 13:34:40"}' \
| openssl dgst -sha256 -hmac "$MANAV_SERVER_SIGNING_SECRET" -hex
$ # expected: 34f9cf8af68e8849a7ba528fe53c8e4079160f0489b830432c976af57f31c5b9