# Sharp Release Compatibility

Use this API when an agent must choose a sharp version for a clean Linux amd64 Node.js deployment and wants cached, reproducible native-module evidence instead of trial-and-error installation.

## Safe calling sequence

1. Read `GET /v1/sharp/coverage` for supported targets and dataset readiness.
2. Do not use a result for deployment unless `productionReady` is `true`.
3. Call the x402-protected `POST /v1/sharp/release-choice` with exactly:

```json
{
  "target": "node24-alpine-amd64",
  "profile": "native+nft-v1"
}
```

Allowed values:

- `target`: `node22-debian-amd64`, `node22-alpine-amd64`, `node24-debian-amd64`, `node24-alpine-amd64`, `node26-debian-amd64`, or `node26-alpine-amd64`
- `profile`: `native+nft-v1`

Invalid input returns HTTP 400 before payment. When reproduced evidence is unavailable, valid input returns HTTP 503 without a payment challenge. Only a ready dataset allows a valid unpaid request to return HTTP 402. A paid response includes the chosen pin, candidate results, exact evidence identifiers, safe application actions, expiry and limitations.

## Interpretation

Treat `INCONCLUSIVE` as no recommendation. A `PASS` applies only to the exact target and proof profile. It does not override application-specific testing.

When multiple prebuilt releases pass, use `choice.recommendedVersion`; it is the newest candidate that passed the complete two-run profile without requiring compilation. Do not infer the tie-break from array order. `choice.observedBestVersion` may describe a conditional or preview observation, but only `RECOMMEND` may populate `recommendedVersion`, `npmPin` and `actions`. Every other verdict requires `actions: null` and does not authorize a production dependency change.

## Safe application

Before applying anything, require all of the following:

- `dataset.productionReady` is `true`;
- the current time is not after `dataset.validUntil`;
- `choice.verdict` is exactly `RECOMMEND`;
- `choice.actions` is non-null and matches the intended target.

`actions.packageJsonDependency`, `actions.npmInstallCommand` and `actions.dockerFrom` are one coherent application set. Do not apply only a value inferred from a candidate array, and do not treat `dockerBase` by itself as authorization when `actions` is null. The product still does not inspect the caller's repository, so run the repository's own tests after applying the actions.

## Response integrity

`responseDigest` is SHA-256 over canonical JSON of the entire response after removing only the `responseDigest` field. Canonical JSON recursively sorts object keys and preserves array order. Recalculate it before automation applies the actions. A mismatch detects accidental alteration or a change made without recomputing the digest; an active party can alter both fields. It is not an external signature or proof of seller identity.