Manav signed the canonical JSON below with its server secret. Hash the JSON with HMAC-SHA256 using the MANAV_SERVER_SIGNING_SECRET and compare - if it matches, this proof is authentic.
Canonical proof JSON
{"actionPayloadHash":"2b2d84244f19713672daba6158ab0f97a89e767e7f4408702abdebfd1b973f46","actionTitle":"Work session approved · tao.ai","actionType":"work_session","actorHandle":null,"externalReference":null,"organizationSlug":null,"signatureSlug":"mnav_sig_bgu0Gigr0CVA","signedAt":"2026-06-02 13:31:32"}
Action payload hash · SHA-256 of the canonical action payload
2b2d84244f19713672daba6158ab0f97a89e767e7f4408702abdebfd1b973f46
Server signature · HMAC-SHA256 over canonical JSON above
43836d43f66bc3edcd7c8eced5ab5bdca96036f5fc8744e153f93cd73bebba60
Recompute it yourself
$ printf '%s' '{"actionPayloadHash":"2b2d84244f19713672daba6158ab0f97a89e767e7f4408702abdebfd1b973f46","actionTitle":"Work session approved · tao.ai","actionType":"work_session","actorHandle":null,"externalReference":null,"organizationSlug":null,"signatureSlug":"mnav_sig_bgu0Gigr0CVA","signedAt":"2026-06-02 13:31:32"}' \
| openssl dgst -sha256 -hmac "$MANAV_SERVER_SIGNING_SECRET" -hex
$ # expected: 43836d43f66bc3edcd7c8eced5ab5bdca96036f5fc8744e153f93cd73bebba60