Quickstart: key → gate → pack → verify

Five minutes from nothing to an offline-verified dispute pack. Every command below is real and runs against the FARIGATE Cloud bundle in deploy/cloud/ of the repository (or, with a different URL, against the hosted gate).

0 — Bring up the gate

# from a checkout of the FARIGATE repository
cd farigate-platform  # repo root
docker compose -f deploy/cloud/docker-compose.yml build
deploy/cloud/scripts/cloud-up.sh

The gate is now at http://127.0.0.1:8801. First boot generated this deployment's Ed25519 signing key and exported the PUBLIC half to deploy/cloud/trust-export/ — everything you verify later checks against that file. Already have a hosted gate? Skip this and use its URL below.

1 — Provision an API key

deploy/cloud/scripts/provision-tenant.sh
# ... prints ONCE:
# fg_actor_9f2c4e...                <- your actor-bound API key
export FARIGATE_API_KEY=fg_actor_9f2c4e...

The key is actor-bound (default actor agent-demo-operator, role approver — what the published governance policy expects) and stored server-side only as a sha256 hash.

2 — Submit an agent_payment

An agent_payment request carries the AP2 v0.2.0 SD-JWT mandate chain plus the canonical action digest over it. The repo ships a helper that builds a ready-to-submit request from the committed, SDK-minted mandate vectors (tokens are never hand-minted):

cargo build --manifest-path demos/agentic-commerce/Cargo.toml
demos/agentic-commerce/target/debug/agentic-commerce print-request in-policy > request.json

curl -s -X POST http://127.0.0.1:8801/gate \
  -H "Authorization: Bearer $FARIGATE_API_KEY" \
  -H "Content-Type: application/json" \
  --data-binary @request.json > pack.json

python3 -c 'import json; r = json.load(open("pack.json")); print(r["decision"], r["policy_reason"])'
# allow CEDAR_PERMIT

The full response IS the evidence: decision, signed receipt (receipt_bytes_b64), and a self-contained evidence_pack with the mandate tokens as bound artifacts. Integrating for real? The request schema is in the API reference; mint fresh mandates per the AP2 integration guide.

3 — Receive the pack (refusals included)

# the refusal path is a product too: expired mandates -> deny + refusal pack
demos/agentic-commerce/target/debug/agentic-commerce print-request expired > request-expired.json
curl -s -X POST http://127.0.0.1:8801/gate \
  -H "Authorization: Bearer $FARIGATE_API_KEY" \
  -H "Content-Type: application/json" \
  --data-binary @request-expired.json | python3 -c 'import json,sys; print(json.load(sys.stdin)["decision"])'
# deny

4 — Verify in the browser

Open the browser verifier, switch the trust source to FARIGATE Cloud (registry) (one fetch of the published trust JSON; verification then stays offline in your browser), and drop pack.json. You get the five dispute questions answered, badged with the hosted-cloud trust label.

CLI alternative, against your deployment's exported public key:

cargo run -p farigate-cli -- verify-evidence-pack \
  --pack pack.json \
  --receipt-signer-trust-dir deploy/cloud/trust-export \
  --agent-mandate-trust-dir appliance/fixtures/agent-dispute-packs/agent_mandate_trust_demo