Build and verify a Google AP2 Cart Mandate chain so a merchant can confirm item, price, and shipping are cryptographically locked before accepting payment

Verified steps

1. Install the AP2 Python SDK (pip install ap2-sdk) or use the TypeScript reference from the github.com/google-agentic-commerce/AP2 repo; the canonical models live under ap2/models/ as Pydantic classes.
2. When an agent presents a cart, call the merchant's UCP endpoint and receive the returned CartMandate JSON object containing item list, total price, shipping details, and the merchant's ECDSA cryptographic signature.
3. Verify the merchant signature on the CartMandate using the SDK's verify_cart_mandate() helper, which checks the ECDSA signature against the merchant's published public key.
4. Construct a PaymentMandate referencing the CartMandate ID, attach the user's authorization token or cryptographic signature, and submit to the credential provider (e.g., PayPal or Mastercard via their AP2 extension).
5. The merchant receives both mandates, re-verifies its own CartMandate signature and the user's PaymentMandate signature before capturing payment; the SDK's verify_payment_mandate() performs both checks.
6. Log the full mandate chain (IntentMandate → CartMandate → PaymentMandate) to your audit store; AP2 mandates are W3C Verifiable Credentials and serve as the dispute evidence record.