Integrate MIZAN. From one file.

import mizan

v = mizan.check("try-me")                     # -> Verdict: a dict exactly as served, verified offline here
v.decision, v.grade, v.allow                  # "ALLOW", "PROVEN", True (ALLOW and the token verified)
v.token                                       # "mzv1.…": staple it to the payment

mizan.verify_token(v.token)["ok"]             # offline, Ed25519 against the published keys (pinned by kid)

r = mizan.require("at least 90% of at least 50 settled jobs")   # compile only, nothing published
r.readback                                    # the compiler's read-back; confirm it says what you meant
r.id                                          # "sha256:" compiled; "req_…@1" once published

pay = mizan.guard(pay, rule="at least 90% of at least 50 settled jobs", mode="advise")   # default: advise
pay("try-me", 120.00)                         # runs pay, logs the signed decision on pay.last_verdict
pay = mizan.guard(pay, rule="…", mode="enforce")
pay("stranger-abc.example", 120.00)           # raises mizan.Refused (.why, .next, .verdict); pay is never called

mizan.login()                                 # a key in one call (POST /api/agents/claim); or set MIZAN_API_KEY

import { check, require, guard, verifyToken, login, Refused } from "mizan-agent-tools";

const v = await check("try-me");             // { decision, grade, token, kid, allow, verified, reason?, next? }
const t = await verifyToken(v.token);        // { ok, reason, header, payload }   offline, pinned keys

const r = await require("at least 90% of at least 50 settled jobs");   // compile only
r.readback; r.id;                                   // id: "sha256:" compiled, "req_…@1" once published
const d = await r.check("try-me");                 // { allow, grade, explanation, verified }

pay = guard(pay, { rule: "at least 90% of at least 50 settled jobs", mode: "advise" });   // default advise
pay = guard(pay, { rule: "…", mode: "enforce" });   // throws Refused on REFUSE; pay is never called

await login();                                // a key in one call; or set MIZAN_API_KEY

# check: one signed decision, no key
curl -s https://studio.mizan.market/api/check/try-me                       # ALLOW
curl -s https://studio.mizan.market/api/check/stranger-xyz.example         # REFUSE, reason no_record, next
curl -s "https://studio.mizan.market/api/check/try-me?payee=try-me"        # token bound to the payee

# require: compile only, nothing written
curl -s -X POST https://studio.mizan.market/api/requirements/compile \
  -H 'Content-Type: application/json' -d '{"text":"at least 90% of at least 50 settled jobs"}'

# guard, as a shell: pay only when the decision is ALLOW
v=$(curl -s "https://studio.mizan.market/api/check/$PAYEE?payee=$PAYEE")
[ "$(echo "$v" | jq -r .decision)" = "ALLOW" ] && pay "$PAYEE" || echo "hold: $(echo "$v" | jq -r .reason)"

# a key in one call, only for publishing rules
curl -s -X POST https://studio.mizan.market/api/agents/claim -H 'Content-Type: application/json' -d '{"name":"my-agent"}'

import base64, json, time, urllib.request
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey   # or the SDK's pure-Python fallback
b64u = lambda s: base64.urlsafe_b64decode(s + "=" * (-len(s) % 4))
keys = {k["key_id"]: k["public_key_b64"] for k in json.load(urllib.request.urlopen(
        "https://mizan.market/.well-known/mizan-keys.json"))["keys"] if k.get("alg") == "Ed25519"}   # once; pin by kid
pre, body, sig = token.split(".")
c = json.loads(b64u(body))
Ed25519PublicKey.from_public_bytes(base64.b64decode(keys[c["kid"]])).verify(b64u(sig), f"{pre}.{body}".encode())  # raises if forged
assert pre == "mzv1" and c["typ"] == "mizan.verdict/1" and c["exp"] > time.time()
print(c["decision"], "verified offline")

const b64u = (s) => Uint8Array.from(atob(s.replace(/-/g, "+").replace(/_/g, "/")), (ch) => ch.charCodeAt(0));
const keys = await (await fetch("https://mizan.market/.well-known/mizan-keys.json")).json();   // once; pin by kid
const [pre, body, sig] = token.split(".");
const c = JSON.parse(new TextDecoder().decode(b64u(body)));
const k = keys.keys.find((x) => x.alg === "Ed25519" && x.key_id === c.kid);
const pub = await crypto.subtle.importKey("raw", b64u(k.public_key_b64), { name: "Ed25519" }, false, ["verify"]);
const ok = pre === "mzv1" && c.typ === "mizan.verdict/1" && c.exp > Date.now() / 1000 &&
  (await crypto.subtle.verify({ name: "Ed25519" }, pub, b64u(sig), new TextEncoder().encode(`${pre}.${body}`)));
console.log(c.decision, ok ? "verified offline" : "REJECT");