Authorization Payload Linter

Lints an authorization payload before it is signed, against a signing policy the caller declares. Three declared input modes: EIP-712 typed data as passed to eth_signTypedData_v4, an EIP-7702 authorization tuple, and a bare 32-byte hash about to be signed blind. Classification is string equality of the computed EIP-712 encodeType against the canonical type strings of ERC-2612, the older DAI permit struct, the five recognized Permit2 structs, the three EIP-3009 authorizations, the EntryPoint v0.8 PackedUserOperation and the OpenZeppelin v5 ForwardRequest; a primaryType carrying a known standard's name with a different encodeType is reported as a lookalike, and anything else is reported as unrecognized rather than guessed. Every check carries a stable id and returns FLAGGED, CLEAR or NOT_EVALUATED with the field path, the observed value and the policy value. There are no numeric defaults: every threshold, allowlist, counterparty set, clock reading and chain fact is caller-declared, and a check whose input was not declared reports NOT_EVALUATED and is listed separately, never folded into a CLEAR. Zero chain reads, no signer recovery, no digest computation, and nothing is ever submitted.

Tool URL: https://ainumbers.co/chaingraph/art-700-authorization-payload-linter.html AP2/Policy Mandate export: yes