{"service":"10x402","tagline":"x402 conformance linting, sold per call over x402","home":"https://10x402.com","support":"support@10x402.com","x402_versions":[1,2],"networks":{"v1":"base","v2":"eip155:8453"},"endpoints":[{"method":"GET","path":"/check","price":"free","description":"Start here: service info, the full check catalogue with sources, prices and grades. Free."},{"method":"GET","path":"/monitor","price":"free","description":"The wing index: the latest capture day, the cross-instrument contradiction and wrongly-dead counts, and the contradictions carrying the most settled volume. JSON, or HTML with Accept: text/html."},{"method":"GET","path":"/monitor/{host}","price":"free","description":"One host, today: the three instruments side by side, the declared-verb and GET probe, and the read-time flags. No history — that is POST /monitor/history. JSON, or HTML with Accept: text/html."},{"method":"POST","path":"/lint","price":"$0.10","description":"Find conformance blockers to x402 indexing and payment on a live endpoint","input":"a JSON object: { \"url\": \"https://…\" } and optionally { \"method\": \"POST\" | \"GET\" }, default POST","output":"a JSON lint report: grade, summary, findings[] and checks_run","scope":"all 94 checks","check_required":false,"fetches":true,"paired_with":"/lint/one","sample":{"url":"https://toolshed.lemon-agent.dev/convert/md-html","method":"POST"},"sample_report":"https://10x402.com/samples/lint.json"},{"method":"POST","path":"/lint/one","price":"$0.015","description":"Run ONE named check against a live endpoint","input":"a JSON object: { \"url\": \"https://…\", \"check\": \"V2_B64_URLSAFE\" } — exactly one check id from GET /check, plus optionally { \"method\": \"POST\" | \"GET\" }","output":"a JSON single-check report: check, applied, passed, the finding with its fix (or null), regime, sources and the envelope summary","scope":"one named check","check_required":true,"fetches":true,"paired_with":"/lint","sample":{"url":"https://toolshed.lemon-agent.dev/convert/md-html","method":"POST","check":"V2_B64_URLSAFE"},"sample_report":"https://10x402.com/samples/lint-one.json"},{"method":"POST","path":"/presence","price":"$0.06","description":"Where a live x402 resource stands with the registries — Bazaar, x402scan, and on-chain","input":"a JSON object: { \"url\": \"https://…\" } — the live x402 resource to look up — and optionally { \"method\": \"POST\" | \"GET\" }, default POST","output":"a JSON presence report: per-registry verdicts (listed | not_found | unknown) with evidence, on-chain settlement activity, and a summary","scope":"registry presence, by evidence","check_required":false,"fetches":true,"paired_with":null,"sample":{"url":"https://toolshed.lemon-agent.dev/convert/md-html","method":"POST"},"sample_report":"https://10x402.com/samples/presence.json"},{"method":"POST","path":"/monitor/verdict","price":"$0.005","description":"The latest stored reading for a host: three rating instruments plus what it answered when asked — dated, never live, and it says how old it is","input":"a JSON object: { \"host\": \"socialx402.com\" } — one hostname, or the https URL of an endpoint (its host is taken). A bare 0x… wallet address is accepted too, because the rating instrument files some of its rows under one","output":"a JSON verdict: as_of, freshness, the three instruments, the two-verb probe, and the read-time flags. NULL and 0 are different claims throughout: NULL means no row or never asked; 0 means a real zero, or asked with no HTTP answer","scope":"one host, from stored daily observations","check_required":false,"fetches":false,"paired_with":null,"sample":{"host":"10x402.com"},"sample_report":"https://10x402.com/samples/monitor-verdict.json"},{"method":"POST","path":"/monitor/history","price":"$0.03","description":"Every day this wing has held for one host — instrument readings and probes","input":"a JSON object: { \"host\": \"socialx402.com\" } — the same subject form as /monitor/verdict. A bare 0x… wallet subject holds readings but can never hold probes, so its series carries no probe rows","output":"a JSON series: days_held, first_day, last_day, probed_days, and one entry per UTC day with instruments, probe and flags. NULL and 0 are different claims throughout: NULL means no row or never asked; 0 means a real zero, or asked with no HTTP answer","scope":"one host, from stored daily observations","check_required":false,"fetches":false,"paired_with":null,"sample":{"host":"10x402.com"},"sample_report":"https://10x402.com/samples/monitor-history.json"},{"method":"POST","path":"/monitor/receipt","price":"$0.12","description":"The dispute pack: the series, the contradiction stated, a SHA-256 digest and an attestation","input":"a JSON object: { \"host\": \"socialx402.com\" } — the same subject form as /monitor/verdict. A bare 0x… wallet subject holds readings but can never hold probes, so its pack carries no probe evidence","output":"a JSON dispute pack: issued_at, the contradiction statement, the full series, the attestation, and a SHA-256 digest with the canonicalisation rule to recompute it. NULL and 0 are different claims throughout: NULL means no row or never asked; 0 means a real zero, or asked with no HTTP answer","scope":"one host, from stored daily observations","check_required":false,"fetches":false,"paired_with":null,"sample":{"host":"10x402.com"},"sample_report":"https://10x402.com/samples/monitor-receipt.json"},{"method":"POST","path":"/lint/envelope","price":"$0.04","description":"Check a captured x402 402 for indexing and payment blockers — no fetch","input":"a JSON object: { \"status\": 402, \"headers\": { \"payment-required\": \"…\", … }, \"body\": \"…\" }","output":"a JSON lint report: grade, summary, findings[] and checks_run","scope":"all 94 checks","check_required":false,"fetches":false,"paired_with":"/lint/envelope/one","sample":{"status":402,"headers":{"content-type":"application/json"},"body":"{\"x402Version\":1,\"accepts\":[{\"scheme\":\"exact\",\"network\":\"base\",\"maxAmountRequired\":\"1000\",\"resource\":\"https://example.com/api/thing\",\"description\":\"an example paid endpoint\",\"mimeType\":\"application/json\",\"payTo\":\"0x0000000000000000000000000000000000000001\",\"maxTimeoutSeconds\":60,\"asset\":\"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913\",\"extra\":{\"name\":\"USD Coin\",\"version\":\"2\"},\"outputSchema\":{\"input\":{\"type\":\"http\",\"method\":\"POST\",\"discoverable\":true,\"bodyType\":\"text\",\"description\":\"the request body\"},\"output\":{\"type\":\"string\",\"description\":\"the response body\"}}}]}"},"sample_report":"https://10x402.com/samples/lint-envelope.json"},{"method":"POST","path":"/lint/envelope/one","price":"$0.004","description":"Run ONE named check against a response you paste","input":"a JSON object: { \"status\": 402, \"headers\": { … }, \"body\": \"…\", \"check\": \"V2_B64_URLSAFE\" } — exactly one check id from GET /check","output":"a JSON single-check report: check, applied, passed, the finding with its fix (or null), regime, sources and the envelope summary","scope":"one named check","check_required":true,"fetches":false,"paired_with":"/lint/envelope","sample":{"status":402,"headers":{"content-type":"application/json"},"body":"{\"x402Version\":1,\"accepts\":[{\"scheme\":\"exact\",\"network\":\"base\",\"maxAmountRequired\":\"1000\",\"resource\":\"https://example.com/api/thing\",\"description\":\"an example paid endpoint\",\"mimeType\":\"application/json\",\"payTo\":\"0x0000000000000000000000000000000000000001\",\"maxTimeoutSeconds\":60,\"asset\":\"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913\",\"extra\":{\"name\":\"USD Coin\",\"version\":\"2\"},\"outputSchema\":{\"input\":{\"type\":\"http\",\"method\":\"POST\",\"discoverable\":true,\"bodyType\":\"text\",\"description\":\"the request body\"},\"output\":{\"type\":\"string\",\"description\":\"the response body\"}}}]}","check":"V2_HEADER_PRESENT"},"sample_report":"https://10x402.com/samples/lint-envelope-one.json"}],"pricing":{"batch_multiples":{"live":6.667,"pasted":10},"per_check_advantage":{"live":14.1,"pasted":9.4},"singles_cheaper_through":{"live":6,"pasted":9},"note":"A full 94-check report costs 6.667x one check on a live URL and 10x on a pasted response — a 14.1x and 9.4x per-check advantage. Singles stay the cheaper buy through 6 questions live and 9 pasted; past that, buy the report.","scope_pricing":"the two scopes are two products. A full report is priced for the incident it resolves — a 402 that passes validate and still is not indexed, with nothing in the stack saying which of 94 things is wrong. A single check is priced to be run in CI, over and over, which is why it stays micro.","envelope_discount":"the pasted-response routes cost less than the ones that fetch, because they make no outbound request on your behalf.","per":"every price is per SERVED report — a bad URL, an unreachable target, a malformed paste or an unknown check id settles nothing, even when the payment verified."},"free_tier_daily":0,"grades":[{"grade":"A","when":"zero payment-regime errors and zero payment-regime warnings"},{"grade":"B","when":"zero payment-regime errors, one or two warnings"},{"grade":"C","when":"zero payment-regime errors, three or more warnings"},{"grade":"D","when":"one or more payment-regime errors, none of them core"},{"grade":"F","when":"any core error — the envelope is not usable as published"}],"regimes":{"payment":"the specs' MUSTs and what shipping clients parse, throw on, or refuse to sign. These findings, and only these, set the grade.","bazaar":"CDP's validator, prober and seller docs — what it takes to be INDEXED. These set summary.bazaar_ready and never the grade.","hygiene":"house opinions and client-quirk defenses that break no payment and block no indexing. Info only, always.","informational":"disclosures buyers have asked for in the field that no specification requires and no client or registry enforces. Reported, never graded: these move neither the grade nor summary.bazaar_ready, and their severity is always info."},"source_kinds":["spec","client-code","cdp-docs","cdp-validator","live","field-report","house-opinion"],"checks_total":94,"checks":[{"id":"HTTP_STATUS_402","area":"http","regime":"payment","severity":"error","core":true,"summary":"an unauthenticated request answers 402 — not core on a 404/405, which is as often the wrong verb as a missing route, and a 200 or a redirect is delegated to HTTP_FREE_TIER_200 and HTTP_REDIRECT rather than counted here twice","sources":[{"kind":"spec","ref":"specs/transports-v2/http.md:7-25 § Payment Required Signaling"},{"kind":"spec","ref":"specs/transports-v1/http.md § Payment Required Signaling"},{"kind":"client-code","ref":"x402-fetch@1.2.0 dist/esm/index.mjs:19 (`if (response.status !== 402) return response`)"},{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[3] returns_402 (required)"}]},{"id":"HTTP_FREE_TIER_200","area":"http","regime":"payment","severity":"warn","core":false,"summary":"no free tier serving 200s to unauthenticated callers","sources":[{"kind":"client-code","ref":"x402-fetch@1.2.0 dist/esm/index.mjs:19 — a non-402 is returned unpaid; the client never attempts payment"},{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[3] returns_402 (required)"},{"kind":"cdp-docs","ref":"https://docs.cdp.coinbase.com/x402/seller/get-discovered — endpoints are health-probed on an interval"},{"kind":"live","ref":"CDP facilitator /verify answers some invalid payments HTTP 400 WITH a well-formed { isValid: false, invalidReason: \"preflight_validation_failed\" } body — a verdict on a 4xx, which no CDP doc states"},{"kind":"field-report","ref":"house settlement record 2026-09-01--solana-rail-first-settlement (lemon-toolshed, first Solana settlement) — a smoke payment was served free because the chassis classified that HTTP 400 as \"facilitator unavailable\" and failed open; 10x402 shipped the same bug (worker/x402.js facilitatorCall)"}]},{"id":"HTTP_SERVER_ERROR","area":"http","regime":"payment","severity":"error","core":true,"summary":"the endpoint is not 5xx","sources":[{"kind":"spec","ref":"specs/transports-v2/http.md:176-186 § Error Handling"},{"kind":"client-code","ref":"x402-fetch@1.2.0 dist/esm/index.mjs:19 — a 5xx is returned unpaid"},{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[2] endpoint_reachable (required)"}]},{"id":"HTTP_REDIRECT","area":"http","regime":"payment","severity":"warn","core":false,"summary":"the 402 is not behind a redirect","sources":[{"kind":"client-code","ref":"@x402/fetch@2.23.0 dist/esm/index.mjs:10 — `await fetch(request)`, i.e. the default redirect mode, so redirects ARE followed"},{"kind":"spec","ref":"RFC 9110 § 15.4.3 — 301/302 rewrite POST to GET; 307/308 do not"},{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[0] url_valid — the ADVERTISED url is what is probed"}]},{"id":"HTTP_CONTENT_TYPE_JSON","area":"http","regime":"payment","severity":"warn","core":false,"summary":"the v1 envelope body is served as JSON","sources":[{"kind":"spec","ref":"specs/transports-v1/http.md § Payment Required Signaling (Content-Type: application/json)"},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/esm/chunk-BA2VL4DT.mjs:2163 — processResponse parses the body only when content-type includes application/json"},{"kind":"house-opinion","ref":"x402-fetch@1.2.0 dist/esm/index.mjs:22 does NOT branch on content-type, so this costs some client paths and not the main v1 one — hence warn"}]},{"id":"ENVELOPE_PRESENT","area":"http","regime":"payment","severity":"error","core":true,"summary":"at least one x402 envelope is published","sources":[{"kind":"spec","ref":"specs/transports-v2/http.md:7-25 § Payment Required Signaling"},{"kind":"spec","ref":"specs/transports-v1/http.md § Payment Required Signaling"},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/http/index.js:1620-1628 — no header and no v1 body throws \"Invalid payment required response\""}]},{"id":"HTTP_ROUTE_DISCRIMINATES","area":"http","regime":"hygiene","severity":"info","core":false,"summary":"the host tells a real path from an impossible one, so the declared path’s answer is evidence the route exists (runs only when the one-request negative control could be fetched)","sources":[{"kind":"field-report","ref":"x402-foundation/x402#3104 (Circadian-agent, 2026-08-21) — 533-host census of the live catalog: 493/526 answering hosts (93.9%) return 404/410 for an impossible path; 10 hosts (1.9%) answer 402 for everything, clustered on 5 domains — a platform property, not a per-endpoint mistake"},{"kind":"field-report","ref":"x402-foundation/x402#3104 (mayonerajan, 2026-08-21) — models the outcome as route_existence: confirmed | uninformative rather than pass/fail, and adopts the negative control into the x402-doctor design"}]},{"id":"HTTP_SOFT_404","area":"http","regime":"hygiene","severity":"info","core":false,"summary":"an impossible path is not answered with a success status — a soft-404 host defeats liveness checks, a different class than the 402 gate (runs only when the negative control could be fetched)","sources":[{"kind":"field-report","ref":"x402-foundation/x402#3104 (Circadian-agent, 2026-08-21) — 13/526 hosts (2.5%) answer 200 for an impossible path, diffuse across 13 distinct domains: independent mistakes, not a platform"},{"kind":"field-report","ref":"x402-foundation/x402#3104 (mayonerajan, 2026-08-21) — \"it is not 'route exists', merely an indeterminate positive response\"; reported distinctly from both 404/410 and 402-before-routing"}]},{"id":"UA_GATE_402","area":"http","regime":"hygiene","severity":"info","core":false,"summary":"the paid route answers every common agent client alike — a 403, 429 or challenge for some user-agents and not others is an edge bot wall between a buyer and the 402, and the buyers it turns away are exactly the scripted ones x402 is for (live lints only)","sources":[{"kind":"field-report","ref":"10x402 house incident, 2026-08-19 → 2026-09-03 — Cloudflare Pages Browser Integrity Check answered 403 \"error code: 1010\" to Python-urllib/3.x on three house hosts for about two weeks while curl and node probes of the same paths passed; a Python-stdlib buyer could pay the 402 and could not read discovery"},{"kind":"house-opinion","ref":"An edge bot wall is a zone-level toggle that refuses clients whose headers it reads as bot-like. Nothing in x402 makes a buyer a browser, so leaving it on in front of a paid route sells only to the client families the wall happens to like — and the seller cannot see it, because their own browser passes."},{"kind":"spec","ref":"specs/transports-v2/http.md:7-25 § Payment Required Signaling — the transport describes the request that elicits a 402 and states NO User-Agent requirement anywhere: this check rests on client reality, not on a MUST","context":true}]},{"id":"UA_GATE_SURFACES","area":"http","regime":"hygiene","severity":"info","core":false,"summary":"the discovery surface a buyer reads (llms.txt, openapi.json, .well-known/x402) answers every common agent client alike — a surface gated by user-agent is one an agent cannot read before it decides to pay (live lints only, against the first of those paths that exists)","sources":[{"kind":"field-report","ref":"10x402 house incident, 2026-08-19 → 2026-09-03 — the gate was on the DISCOVERY paths while the paid route answered normally: the buyer could pay and could not read llms.txt or .well-known/x402"},{"kind":"house-opinion","ref":"Discovery surfaces exist to be read by programs. Serving them only to clients that look like browsers is the same defect as publishing them and then not linking them, with the added cost that the agent gets a 403 it will read as your endpoint being down."},{"kind":"spec","ref":"specs/transports-v2/http.md:7-25 § Payment Required Signaling — no User-Agent requirement is stated for any x402 request, discovery included","context":true}]},{"id":"ORIGIN_MARKER_PRESENT","area":"http","regime":"hygiene","severity":"info","core":false,"summary":"every response this lint received carries the origin marker the seller advertised — a non-2xx without it was minted on the path (a bot wall, a WAF, a cache, a CDN error page) rather than by the origin, and is reported as `edge-invented` instead of as schema drift (runs only when a marker header is advertised in the 402 envelope or /.well-known/x402)","sources":[{"kind":"field-report","ref":"Moltbook b49c9347 (@prowlnetwork) — under load, 40% of the error shapes a caller sees are undocumented: not in the seller's schema, not in any spec, and not reproducible from the seller's own testing"},{"kind":"field-report","ref":"Moltbook a6ed0b5d (@lobbyagent) — intermediaries MINT most of those shapes, and nobody has captured what the origin actually emitted: the comparison that would settle it is never made"},{"kind":"live","ref":"house incident, vault log 2026-09-03 § BIC — for two days every machine surface of the estate answered 403 from Cloudflare's Browser Integrity Check while the ORIGIN never saw the call. Every instrument pointed at the envelope; the envelope was fine and was never in the reply"},{"kind":"house-opinion","ref":"The cheap discriminator needs no cooperation from the path: the origin sets a header nothing in front of it reproduces, and a non-2xx without it is the path talking. Only non-empty presence is asserted — the value is not a secret and nothing routes on it."},{"kind":"spec","ref":"specs/transports-v2/http.md:7-25 § Payment Required Signaling — the transport names no response header other than PAYMENT-REQUIRED and requires no origin marker anywhere: this is a house convention, cited so a reader can confirm the silence","context":true}]},{"id":"V2_HEADER_PRESENT","area":"v2","regime":"bazaar","severity":"error","core":false,"summary":"a PAYMENT-REQUIRED response header is present (CDP will not index a v1-only 402)","sources":[{"kind":"spec","ref":"specs/transports-v2/http.md:7-25 § Payment Required Signaling"},{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[6] payment_required_header (required)"},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/http/index.js:1620-1628 — the v2 client DOES fall back to a v1 body"},{"kind":"field-report","ref":"x402-foundation/x402#3091 — x402-fetch@1.x is still a live buyer population"}]},{"id":"V2_B64_URLSAFE","area":"v2","regime":"payment","severity":"error","core":true,"summary":"the header is standard base64, not base64url","sources":[{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/utils/index.js:133 — Base64EncodedRegex = /^[A-Za-z0-9+/]*={0,2}$/"},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/http/index.js:1778-1781 — the regex is tested on the RAW header, then it throws, before any decode"},{"kind":"spec","ref":"specs/transports-v2/http.md:7-25 § Payment Required Signaling — \"Base64-encoded\", SILENT on the alphabet","context":true}]},{"id":"V2_B64_DECODE","area":"v2","regime":"payment","severity":"error","core":true,"summary":"the header decodes as base64","sources":[{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/http/index.js:1781 — JSON.parse(safeBase64Decode(header)), uncaught"},{"kind":"spec","ref":"specs/transports-v2/http.md:7-25 § Payment Required Signaling"}]},{"id":"V2_JSON","area":"v2","regime":"payment","severity":"error","core":true,"summary":"the decoded header is JSON","sources":[{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/http/index.js:1781 — a SyntaxError escapes decodePaymentRequiredHeader"},{"kind":"spec","ref":"specs/x402-specification-v2.md:72-107 § 5.1.1 JSON Payload"}]},{"id":"V2_VERSION","area":"v2","regime":"payment","severity":"error","core":true,"summary":"the v2 payload declares x402Version 2","sources":[{"kind":"spec","ref":"specs/x402-specification-v2.md:114 § 5.1.2 — x402Version Required, \"must be 2\""},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/schemas/index.js:111 — x402Version: z.literal(2), inside a discriminatedUnion"},{"kind":"field-report","ref":"x402-foundation/x402#3045 wire-format bug 1 — a v1-shaped challenge on a v2 resource"}]},{"id":"V2_ACCEPTS_NONEMPTY","area":"v2","regime":"payment","severity":"error","core":true,"summary":"accepts[] is a non-empty array","sources":[{"kind":"spec","ref":"specs/x402-specification-v2.md:117 § 5.1.2 — accepts Required"},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/schemas/index.js:114 — accepts: z.array(PaymentRequirementsV2Schema).min(1)"},{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[7] has_accepts (required)"}]},{"id":"V2_SCHEME","area":"v2","regime":"payment","severity":"error","core":true,"summary":"each accept names a scheme","sources":[{"kind":"spec","ref":"specs/x402-specification-v2.md:120-131 § 5.1.2 (PaymentRequirements table)"},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/schemas/index.js:102 — scheme: NonEmptyString"}]},{"id":"V2_SCHEME_KNOWN","area":"v2","regime":"payment","severity":"info","core":false,"summary":"the scheme has a published specification (v2 leaves the field open, so this is an info)","sources":[{"kind":"spec","ref":"specs/schemes/ — exact, upto, batch-settlement, auth-capture each have a scheme document"},{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[8] accepts[0].scheme, expected \"exact or upto\""},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/schemas/index.js:102 — the v2 schema accepts any non-empty string, by design"}]},{"id":"V2_NETWORK_CAIP2","area":"v2","regime":"payment","severity":"error","core":true,"summary":"network contains a colon (the client’s rule), and is not a v1 plain name","sources":[{"kind":"spec","ref":"specs/x402-specification-v2.md:125 § 5.1.2 — network Required, CAIP-2 format"},{"kind":"spec","ref":"specs/x402-specification-v2.md:616-621 § 11.1 Network Identifiers"},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/schemas/index.js:63-65 — NetworkSchemaV2 = z.string().min(3).refine(v => v.includes(\":\"))"}]},{"id":"V2_NETWORK_CAIP2_STYLE","area":"v2","regime":"hygiene","severity":"info","core":false,"summary":"the network string is CAIP-2 shaped (3–8 character namespace) — a style note, not a client rule","sources":[{"kind":"spec","ref":"specs/x402-specification-v2.md:616-621 § 11.1 — \"Networks in x402 v2 use CAIP-2 format\""},{"kind":"house-opinion","ref":"no shipping client bounds the namespace; @x402/core requires only min(3) and a colon, so this may only be an info"}]},{"id":"V2_NAMESPACE_KNOWN","area":"v2","regime":"hygiene","severity":"info","core":false,"summary":"the report says so when a network namespace was checked structurally rather than deeply","sources":[{"kind":"spec","ref":"specs/x402-specification-v2.md:616-621 § 11.1 — namespaces are open-ended; \"ach:us\" and \"sepa:eu\" are given as examples"},{"kind":"spec","ref":"specs/schemes/batch-settlement/scheme_batch_settlement_cloudflare.md:7 — cloudflare:402 is a real network with its own scheme document"},{"kind":"house-opinion","ref":"worker/lint.js addressFamily() — eip155 and solana are the namespaces whose address formats this linter knows; everything else is checked structurally, and the report says which"}]},{"id":"V2_NETWORK_SUPPORTED","area":"v2","regime":"bazaar","severity":"error","core":false,"summary":"the eip155 chain is one CDP’s facilitator settles on","sources":[{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[9] accepts[0].network, expected \"a facilitator-supported network (Base, Solana, Polygon, Arbitrum, World)\""},{"kind":"house-opinion","ref":"a chain outside that set is legal x402 and payable through a self-hosted facilitator — it is CDP indexing that is lost, not payment"}]},{"id":"V2_AMOUNT","area":"v2","regime":"payment","severity":"error","core":true,"summary":"the price is in `amount`, not the v1 `maxAmountRequired`","sources":[{"kind":"spec","ref":"specs/x402-specification-v2.md:120-131 § 5.1.2 (PaymentRequirements table)"},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/schemas/index.js:104 — amount: NonEmptyString; maxAmountRequired is not a v2 key"}]},{"id":"V2_AMOUNT_ATOMIC","area":"v2","regime":"payment","severity":"error","core":true,"summary":"the amount is a string of atomic units","sources":[{"kind":"spec","ref":"specs/x402-specification-v2.md:120-131 § 5.1.2 (PaymentRequirements table)"},{"kind":"client-code","ref":"@x402/evm@2.23.0 dist/cjs/index.js:570 — BigInt(authorization.value); BigInt(\"0.01\") throws"},{"kind":"client-code","ref":"x402@1.2.0 dist/esm/chunk-V3RMM5AE.mjs:433,440 — the reference facilitator schema refines on isInteger"}]},{"id":"V2_AMOUNT_MINIMUM","area":"v2","regime":"bazaar","severity":"error","core":false,"summary":"the amount clears CDP’s 1000-atomic-unit ($0.001) indexing floor","sources":[{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[11] accepts[0].amount (required), expected \">= 1000\""},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/schemas/index.js:104 — the client itself applies no numeric bound, so the facilitator is the only enforcer"}]},{"id":"V2_INDEX_AMOUNT","area":"v2","regime":"bazaar","severity":"error","core":false,"summary":"the amount is a value CDP’s required amount preflight can read at all","sources":[{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[11] accepts[0].amount (required), expected \">= 1000\" — the check compares a value, so an absent or non-integer amount cannot satisfy it"}]},{"id":"V2_INDEX_TIMEOUT","area":"v2","regime":"bazaar","severity":"error","core":false,"summary":"maxTimeoutSeconds is SET, which is what CDP’s required preflight asks","sources":[{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[13] accepts[0].maxTimeoutSeconds (required) — \"maxTimeoutSeconds is set\". Presence is the whole of the provider’s stated rule; the JSON type is a payment question and V2_MAX_TIMEOUT asks it"}]},{"id":"V2_INDEX_ASSET","area":"v2","regime":"bazaar","severity":"error","core":false,"summary":"asset identifies a token on a chain CDP settles, so its required asset preflight can pass","sources":[{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[10] accepts[0].asset (required) — \"Asset is USDC\", captured with a token contract address as the actual value"},{"kind":"spec","ref":"specs/x402-specification-v2.md:127 § 5.1.2 — on a chain, asset is the token contract address; a ticker cannot be the token CDP looks up"}]},{"id":"V2_INDEX_PAYTO","area":"v2","regime":"bazaar","severity":"error","core":false,"summary":"payTo is an address, which is what CDP’s required payee preflight asks for","sources":[{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[12] accepts[0].payTo (required) — \"payTo address present\", captured with a string address as the actual value"}]},{"id":"V2_PAYTO","area":"v2","regime":"payment","severity":"error","core":true,"summary":"payTo has the address shape its network’s namespace requires","sources":[{"kind":"spec","ref":"specs/x402-specification-v2.md:128 § 5.1.2 — \"Recipient wallet address or role constant (e.g., \\\"merchant\\\")\""},{"kind":"spec","ref":"specs/schemes/exact/scheme_exact_svm.md:53-68 — a base58 payTo on solana:*"},{"kind":"client-code","ref":"@x402/evm@2.23.0 dist/cjs/index.js:537 — `to: getAddress(paymentRequirements.payTo)`; viem throws on a non-address"},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/schemas/index.js:106 — payTo: NonEmptyString, i.e. the shape rule is the scheme’s, not the envelope’s"}]},{"id":"V2_ASSET","area":"v2","regime":"payment","severity":"error","core":true,"summary":"asset names the token in the form its network’s namespace requires","sources":[{"kind":"spec","ref":"specs/x402-specification-v2.md:127 § 5.1.2 — \"Token contract address or ISO 4217 currency code for fiat\""},{"kind":"client-code","ref":"@x402/evm@2.23.0 dist/cjs/index.js:565 — verifyingContract: getAddress(requirements.asset)"},{"kind":"spec","ref":"specs/schemes/exact/scheme_exact_svm.md:71 — asset is the token mint public key"}]},{"id":"V2_MAX_TIMEOUT","area":"v2","regime":"payment","severity":"error","core":true,"summary":"maxTimeoutSeconds is a positive JSON number (a string \"60\" is not one)","sources":[{"kind":"spec","ref":"specs/x402-specification-v2.md:129 § 5.1.2 — maxTimeoutSeconds, type number, Required"},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/schemas/index.js:107 — maxTimeoutSeconds: z.number().positive(), required, no coercion"},{"kind":"client-code","ref":"@x402/evm@2.23.0 dist/cjs/index.js:539 — validBefore is computed from it; undefined yields BigInt(\"NaN\"), which throws"},{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[13] accepts[0].maxTimeoutSeconds (required)"}]},{"id":"V2_EXTRA_EIP712","area":"v2","regime":"payment","severity":"error","core":false,"summary":"extra.{name,version} is present on an eip3009 exact entry, where the client signs from it","sources":[{"kind":"spec","ref":"specs/schemes/exact/scheme_exact_evm.md:72-73 — extra.name and extra.version, both \"(required)\""},{"kind":"spec","ref":"specs/schemes/exact/scheme_exact_evm.md:171-172,285-286 — conditional under permit2, optional under erc7710"},{"kind":"client-code","ref":"@x402/evm@2.23.0 dist/cjs/index.js:555-558 — signEIP3009Authorization throws when either is absent"},{"kind":"client-code","ref":"@x402/evm@2.23.0 dist/cjs/index.js:1261 — assetTransferMethod defaults to \"eip3009\""}]},{"id":"V2_ACCEPTS_V1_FIELDS","area":"v2","regime":"payment","severity":"warn","core":false,"summary":"the accept carries no v1-only fields","sources":[{"kind":"spec","ref":"specs/x402-specification-v2.md:120-131 § 5.1.2 (PaymentRequirements table)"},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/schemas/index.js:101-109 — a plain z.object, so unknown keys are STRIPPED on any re-parse"},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/esm/client/index.mjs:262 — the raw entry is echoed as `accepted`, unstripped"}]},{"id":"V2_RESOURCE_OBJECT","area":"v2","regime":"payment","severity":"error","core":true,"summary":"resource is the v2 object, not a v1 flat string","sources":[{"kind":"spec","ref":"specs/x402-specification-v2.md:116 § 5.1.2 — resource Required, ResourceInfo object"},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/schemas/index.js:113 — resource: ResourceInfoSchema"},{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[14] has_resource (required)"}]},{"id":"V2_RESOURCE_URL_PARSES","area":"v2","regime":"payment","severity":"warn","core":false,"summary":"resource.url parses as a URL at all — it is echoed into the payment payload","sources":[{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/schemas/index.js:69 — url: NonEmptyString, so the client will happily carry a bare path"},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/client/index.js:413 — resource is copied verbatim into the outgoing PaymentPayload, which is what a settlement is attributed to"},{"kind":"field-report","ref":"x402-foundation/x402#3045 wire-format bug 3 — \"resource.url must be absolute, not a bare path\""}]},{"id":"V2_RESOURCE_URL","area":"v2","regime":"bazaar","severity":"error","core":false,"summary":"resource.url is an absolute https URL","sources":[{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[0] url_valid and preflight[1] url_https, both required"},{"kind":"spec","ref":"specs/x402-specification-v2.md:132-141 § 5.1.2 (ResourceInfo table)"},{"kind":"field-report","ref":"x402-foundation/x402#3045 wire-format bug 3"}]},{"id":"V2_RESOURCE_METHOD","area":"v2","regime":"bazaar","severity":"warn","core":false,"summary":"resource.method, when published, agrees with bazaar.info.input.method","sources":[{"kind":"spec","ref":"specs/x402-specification-v2.md:132-141 § 5.1.2 (ResourceInfo table) — there is no `method` member, so its absence is conformant"},{"kind":"spec","ref":"specs/extensions/bazaar.md:251-269 — info.input.method is the declared verb"},{"kind":"live","ref":"cdp-validator-toolshed.json paymentRequirements.resource.method — indexed sellers do publish it"}]},{"id":"V2_RESOURCE_DESCRIPTION","area":"v2","regime":"bazaar","severity":"error","core":false,"summary":"resource.description is under 500 characters (absent is an info; over the limit is an error)","sources":[{"kind":"spec","ref":"specs/x402-specification-v2.md:132-141 § 5.1.2 (ResourceInfo table) — description Optional"},{"kind":"cdp-docs","ref":"https://docs.cdp.coinbase.com/x402/seller/get-discovered — \"the CDP Facilitator rejects verify and settle requests whose description exceeds that limit\" (500 characters)"}]},{"id":"V2_RESOURCE_MIMETYPE","area":"v2","regime":"hygiene","severity":"info","core":false,"summary":"resource.mimeType, when published, looks like a media type","sources":[{"kind":"spec","ref":"specs/x402-specification-v2.md:132-141 § 5.1.2 (ResourceInfo table) — mimeType Optional"},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/schemas/index.js:71 — mimeType: z.string().nullish()"}]},{"id":"V2_RESOURCE_URL_MATCHES","area":"v2","regime":"hygiene","severity":"info","core":false,"summary":"resource.url is the URL that was called","sources":[{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/client/index.js:413 — settlement is attributed to the echoed resource"},{"kind":"house-opinion","ref":"a proxy, a route template or a canonicalised host makes a mismatch legitimate, so this may only ever be an info"}]},{"id":"V2_SERVICE_NAME","area":"v2","regime":"bazaar","severity":"warn","core":false,"summary":"resource.serviceName, when published, is ≤32 printable-ASCII characters (absence is silent)","sources":[{"kind":"spec","ref":"specs/extensions/bazaar.md:389 — \"length ≤ 32 characters\"; on violation, \"Drop the field.\""},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/schemas/index.js:72 — z.string().min(1).max(32).regex(/^[\\x20-\\x7e]+$/)"}]},{"id":"V2_TAGS","area":"v2","regime":"bazaar","severity":"warn","core":false,"summary":"resource.tags, when published, are ≤5 entries of ≤32 printable-ASCII characters (absence is silent)","sources":[{"kind":"spec","ref":"specs/extensions/bazaar.md:390 — \"at most 5 entries; each entry non-empty, printable ASCII … length ≤ 32\""},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/schemas/index.js:73 — z.array(z.string().min(1).max(32).regex(PRINTABLE_ASCII)).max(5)"}]},{"id":"V2_BAZAAR_PRESENT","area":"v2","regime":"bazaar","severity":"error","core":false,"summary":"extensions.bazaar is present — in v2 its presence IS the discovery opt-in","sources":[{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[15] has_bazaar_extension (required)"},{"kind":"spec","ref":"specs/extensions/bazaar.md:512-517 § Client Behavior — omitting the extension means no cataloging"},{"kind":"field-report","ref":"x402-foundation/x402#3045 — a CDP engineer: `extensions.bazaar.discoverable` is \"not a valid field\""}]},{"id":"V2_BAZAAR_INFO","area":"v2","regime":"bazaar","severity":"error","core":false,"summary":"extensions.bazaar.info is present","sources":[{"kind":"spec","ref":"specs/x402-specification-v2.md:143-149 § 5.1.2 (Extensions table) — info Required"},{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[16] bazaar.info (required)"}]},{"id":"V2_BAZAAR_SCHEMA","area":"v2","regime":"bazaar","severity":"error","core":false,"summary":"extensions.bazaar.schema is present","sources":[{"kind":"spec","ref":"specs/x402-specification-v2.md:143-149 § 5.1.2 (Extensions table) — schema Required"},{"kind":"spec","ref":"specs/extensions/bazaar.md:322 — \"Facilitators must validate info against schema before cataloging\""},{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[23] bazaar.schema (required)"}]},{"id":"V2_BAZAAR_SCHEMA_CONTENT","area":"v2","regime":"bazaar","severity":"error","core":false,"summary":"the bazaar schema meets its own content MUSTs: requires `input`, and every $ref/$id is same-document","sources":[{"kind":"spec","ref":"specs/extensions/bazaar.md:313-322 § Schema Validation — Draft 2020-12, \"Must define an input property (required)\", and \"$ref and $id values must be same-document JSON Pointer fragments (starting with #); external references … are not allowed\""},{"kind":"field-report","ref":"x402-foundation/x402#3045 wire-format bug 5 — an external $ref broke CDP’s validator outright"}]},{"id":"V2_BAZAAR_INFO_VALIDATES","area":"v2","regime":"bazaar","severity":"error","core":false,"summary":"info validates against its own schema","sources":[{"kind":"spec","ref":"specs/extensions/bazaar.md:322 — facilitators MUST validate info against schema before cataloging"},{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[24] parse (required)"},{"kind":"field-report","ref":"x402-foundation/x402#3045 — an info/schema mismatch is declined silently; nothing reaches the seller’s logs"}]},{"id":"V2_BAZAAR_BAG_MISMATCH","area":"v2","regime":"bazaar","severity":"error","core":false,"summary":"every key a schema parameter-bag requires is supplied by info in THAT bag, not a sibling bag","sources":[{"kind":"spec","ref":"specs/extensions/bazaar.md:322 — the info/schema validation this contradiction is guaranteed to fail"},{"kind":"field-report","ref":"x402-foundation/x402#3104 (Circadian-agent, 2026-08-20) — 276 of 14,691 live listings with a `required` key fail their own schema, across 59 hosts; the named specimen requires `name` in queryParams while its own example supplies it in pathParams"},{"kind":"field-report","ref":"Circadian-agent/agent-economy-data findings/bazaar-info-fails-own-schema-2026-08-20.md — the census behind those counts"}]},{"id":"V2_BAZAAR_INPUT","area":"v2","regime":"bazaar","severity":"error","core":false,"summary":"bazaar.info.input carries a worked sample call","sources":[{"kind":"spec","ref":"specs/extensions/bazaar.md:245-282 § Discovery Info Structure — input is Required in every discriminant"},{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[17] bazaar.info.input (required)"}]},{"id":"V2_BAZAAR_INPUT_TYPE","area":"v2","regime":"bazaar","severity":"error","core":false,"summary":"bazaar.info.input.type is the \"http\" or \"mcp\" discriminator, with that branch’s required fields","sources":[{"kind":"spec","ref":"specs/extensions/bazaar.md:251-282 — type Required (\"http\"/\"mcp\"); bodyType and body Required for POST/PUT/PATCH; toolName and inputSchema Required for mcp"},{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[18] bazaar.info.input.type (required)"},{"kind":"field-report","ref":"x402-foundation/x402#3045 wire-format bug 4 — the missing `type` discriminator"}]},{"id":"V2_BAZAAR_INPUT_METHOD","area":"v2","regime":"bazaar","severity":"error","core":false,"summary":"bazaar.info.input.method is an HTTP verb from the spec’s enums, and matches the verb that was probed","sources":[{"kind":"spec","ref":"specs/extensions/bazaar.md:251-269 — method Required, one of GET/HEAD/DELETE or POST/PUT/PATCH"},{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[19] bazaar.info.input.method and preflight[20] bazaar.info.input.method.matches_request, both required"}]},{"id":"V2_BAZAAR_OUTPUT_TYPE","area":"v2","regime":"bazaar","severity":"warn","core":false,"summary":"bazaar.info.output, when published, carries its Required `type`","sources":[{"kind":"spec","ref":"specs/extensions/bazaar.md:284-294 § Output Types — output optional; within it, type Required"},{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[21] bazaar.info.output (advisory)"}]},{"id":"V2_BAZAAR_OUTPUT_EXAMPLE","area":"v2","regime":"bazaar","severity":"info","core":false,"summary":"bazaar.info.output.example is a computed response — any JSON value, and CDP grades it advisory","sources":[{"kind":"spec","ref":"specs/extensions/bazaar.md:284-294 — the example row is `example | any | No`"},{"kind":"spec","ref":"specs/extensions/bazaar.md:46-53 — the spec’s own GET example gives output.example as an OBJECT"},{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[22] bazaar.info.output.example (advisory)"}]},{"id":"V2_BAZAAR_INPUT_REPLAYABLE","area":"v2","regime":"hygiene","severity":"info","core":false,"summary":"a POST input that declares a JSON body (bodyType \"json\", or a body given as an object or array) gives it as a JSON object or array of at most 16 KB, so a buyer replaying the declaration verbatim sends that body rather than `{}` — a body declared as \"text\" or form-data is outside this check, including text that parses as JSON","sources":[{"kind":"field-report","ref":"worker/catalog.js ENDPOINTS note (vault-v0mjp) — vet402 replays a seller's declared body only when it is a JSON object or array and otherwise sends `{}`; every one of its eight paid attempts on 10x402 (2026-09-02..17) sent `{}` and was refused 400, against a body declared as a JSON string under bodyType \"text\""},{"kind":"field-report","ref":"vet402 observatory, L1 purchase ledger (CC BY 4.0), https://vet402.com/api/v1/observatory/export.csv — request_body records `declared` vs `empty` per paid attempt; replay of the declared body began 2026-09-17 (scripts/observer-ledger-leads.mjs EMPTY_BODY_SINCE)"},{"kind":"house-opinion","ref":"the 16 KB bound: a worked example is one sample call, and a declaration past 16 KB is a payload a replaying buyer should not be asked to send blind"},{"kind":"spec","ref":"specs/extensions/bazaar.md:251-269 — bodyType is one of json, form-data, text; the spec admits a string body","context":true}]},{"id":"V2_BAZAAR_INPUT_QUERY_EXAMPLE","area":"v2","regime":"hygiene","severity":"info","core":false,"summary":"a GET input declares example `queryParams` — `{}` when the call takes none — so a buyer replaying the declaration knows what URL to call","sources":[{"kind":"house-opinion","ref":"the same replay construction as V2_BAZAAR_INPUT_REPLAYABLE, for the query-parameter family: a buyer that builds the call from the declaration alone sends the bare resource URL when queryParams is absent, and cannot tell \"takes none\" from \"forgot to say\""},{"kind":"spec","ref":"specs/extensions/bazaar.md:46-53 — the spec's own GET example declares queryParams","context":true},{"kind":"spec","ref":"specs/extensions/bazaar.md:251-269 — queryParams is optional on the query-method shape","context":true}]},{"id":"V1_ABSENT","area":"v1","regime":"payment","severity":"info","core":false,"summary":"a v1 body envelope is published alongside the v2 header","sources":[{"kind":"client-code","ref":"x402-fetch@1.2.0 dist/esm/index.mjs:22 — the v1 client reads the body and never looks at PAYMENT-REQUIRED"},{"kind":"field-report","ref":"x402-foundation/x402#3091 — the pre-header buyer population is real and shrinking"},{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[4] valid_json (required) — an EMPTY 402 body fails it, so serve at least `{}`"}]},{"id":"V1_BODY_NOT_ENVELOPE","area":"v1","regime":"payment","severity":"info","core":false,"summary":"the 402 body is a v1 envelope or is empty, not something a v1 client will misread","sources":[{"kind":"spec","ref":"specs/transports-v2/http.md:172-174 § Response Body (\"Response bodies are a server implementation concern\")"},{"kind":"spec","ref":"specs/transports-v2/http.md:19-25 — the spec’s own 402 example serves a body of `{}`"},{"kind":"client-code","ref":"x402-fetch@1.2.0 dist/esm/index.mjs:22-23 — an error blob makes accepts undefined and .map throws"},{"kind":"cdp-validator","ref":"cdp-validator-toolshed.json preflight[4] valid_json (required) — the body is parsed as JSON during indexing"}]},{"id":"V1_BODY_PRESENT","area":"v1","regime":"payment","severity":"warn","core":false,"summary":"a v1 envelope is published in the 402 body","sources":[{"kind":"spec","ref":"specs/transports-v1/http.md § Payment Required Signaling"},{"kind":"house-opinion","ref":"only fires when nothing was published in either transport; ENVELOPE_PRESENT carries the core error for that case"}]},{"id":"V1_BODY_JSON","area":"v1","regime":"payment","severity":"error","core":true,"summary":"the 402 body parses as JSON","sources":[{"kind":"spec","ref":"specs/x402-specification-v1.md § 5.1.1 JSON Payload"},{"kind":"client-code","ref":"x402-fetch@1.2.0 dist/esm/index.mjs:22 — response.json() with no try/catch"}]},{"id":"V1_VERSION","area":"v1","regime":"payment","severity":"error","core":true,"summary":"the body declares x402Version 1","sources":[{"kind":"spec","ref":"specs/x402-specification-v1.md:99-108 § 5.1.2"},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/http/index.js:1625 — the body fallback requires x402Version === 1 exactly"},{"kind":"client-code","ref":"x402@1.2.0 dist/esm/chunk-V3RMM5AE.mjs:388 — x402Versions = [1]"}]},{"id":"V1_ACCEPTS_NONEMPTY","area":"v1","regime":"payment","severity":"error","core":true,"summary":"accepts[] is a non-empty array","sources":[{"kind":"spec","ref":"specs/x402-specification-v1.md:99-108 § 5.1.2 — accepts Required"},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/schemas/index.js:93 — accepts: z.array(PaymentRequirementsV1Schema).min(1)"},{"kind":"client-code","ref":"x402-fetch@1.2.0 dist/esm/index.mjs:23 — accepts.map throws when accepts is absent"}]},{"id":"V1_SCHEME","area":"v1","regime":"payment","severity":"error","core":true,"summary":"each accept names a scheme","sources":[{"kind":"spec","ref":"specs/x402-specification-v1.md:110-124 § 5.1.2 (PaymentRequirements table)"},{"kind":"client-code","ref":"x402@1.2.0 dist/esm/chunk-V3RMM5AE.mjs:438 — scheme: z.enum(schemes)"}]},{"id":"V1_SCHEME_KNOWN","area":"v1","regime":"payment","severity":"error","core":false,"summary":"the v1 scheme is `exact` — v1’s enum is closed where v2’s is open","sources":[{"kind":"client-code","ref":"x402@1.2.0 dist/esm/chunk-V3RMM5AE.mjs:387 — var schemes = [\"exact\"]"},{"kind":"client-code","ref":"x402@1.2.0 dist/esm/chunk-V3RMM5AE.mjs:438 — scheme: z3.enum(schemes), applied per accepts entry"},{"kind":"client-code","ref":"x402-fetch@1.2.0 dist/esm/index.mjs:22-23 (response.json(), then PaymentRequirementsSchema.parse per entry)"}]},{"id":"V1_MAX_AMOUNT_REQUIRED","area":"v1","regime":"payment","severity":"error","core":true,"summary":"the price is in `maxAmountRequired`, not the v2 `amount`","sources":[{"kind":"spec","ref":"specs/x402-specification-v1.md:110-124 § 5.1.2 (PaymentRequirements table)"},{"kind":"client-code","ref":"x402@1.2.0 dist/esm/chunk-V3RMM5AE.mjs:440 — maxAmountRequired is required; `amount` is not a v1 key"}]},{"id":"V1_AMOUNT_ATOMIC","area":"v1","regime":"payment","severity":"error","core":true,"summary":"maxAmountRequired is a string of atomic units","sources":[{"kind":"spec","ref":"specs/x402-specification-v1.md:110-124 § 5.1.2 (PaymentRequirements table)"},{"kind":"client-code","ref":"x402@1.2.0 dist/esm/chunk-V3RMM5AE.mjs:433,440 — z3.string().refine(isInteger)"},{"kind":"client-code","ref":"x402-fetch@1.2.0 dist/esm/index.mjs:30 — BigInt(maxAmountRequired) throws on a non-digit string"}]},{"id":"V1_NETWORK_NAME","area":"v1","regime":"payment","severity":"error","core":true,"summary":"network is a v1 plain name, not CAIP-2","sources":[{"kind":"spec","ref":"specs/x402-specification-v1.md:110-124 § 5.1.2 (PaymentRequirements table)"},{"kind":"client-code","ref":"x402@1.2.0 dist/esm/chunk-V3RMM5AE.mjs:16-34 — NetworkSchema is a z.enum of plain names; no member contains a colon"}]},{"id":"V1_NETWORK_KNOWN","area":"v1","regime":"payment","severity":"error","core":false,"summary":"the v1 network name is one of the seventeen the dominant v1 client’s enum admits","sources":[{"kind":"client-code","ref":"x402@1.2.0 dist/esm/chunk-V3RMM5AE.mjs:16-34 — the closed z.enum: abstract, abstract-testnet, base-sepolia, base, avalanche-fuji, avalanche, iotex, solana-devnet, solana, sei, sei-testnet, polygon, polygon-amoy, peaq, story, educhain, skale-base-sepolia"},{"kind":"client-code","ref":"x402-fetch@1.2.0 dist/esm/index.mjs:22-23 (response.json(), then PaymentRequirementsSchema.parse per entry)"},{"kind":"house-opinion","ref":"@x402/core@2.23.0's v1-compatibility schema is looser (@x402/core@2.23.0 dist/cjs/schemas/index.js:62, NonEmptyString), so this is a claim about the dominant v1 client rather than about every parser — hence error, not core"}]},{"id":"V1_RESOURCE_STRING","area":"v1","regime":"payment","severity":"error","core":true,"summary":"resource is a flat, absolute URL string, not the v2 object","sources":[{"kind":"spec","ref":"specs/x402-specification-v1.md:110-124 § 5.1.2 (PaymentRequirements table)"},{"kind":"client-code","ref":"x402@1.2.0 dist/esm/chunk-V3RMM5AE.mjs:441 — resource: z3.string().url(), so a bare path is a hard ZodError"},{"kind":"field-report","ref":"x402-foundation/x402#3045 wire-format bug 3, in its v1 spelling"}]},{"id":"V1_PAYTO","area":"v1","regime":"payment","severity":"error","core":true,"summary":"payTo has the address shape its v1 network requires (EVM 0x, or base58 on solana)","sources":[{"kind":"spec","ref":"specs/x402-specification-v1.md:110-124 § 5.1.2 (PaymentRequirements table)"},{"kind":"client-code","ref":"x402@1.2.0 dist/esm/chunk-V3RMM5AE.mjs:435 — EvmOrSvmAddress = EvmAddressRegex.or(SvmAddressRegex)"},{"kind":"client-code","ref":"x402@1.2.0 dist/esm/chunk-V3RMM5AE.mjs:16-34 — the enum includes solana and solana-devnet"}]},{"id":"V1_ASSET","area":"v1","regime":"payment","severity":"error","core":true,"summary":"asset names the token in the form its v1 network requires","sources":[{"kind":"spec","ref":"specs/x402-specification-v1.md:110-124 § 5.1.2 (PaymentRequirements table)"},{"kind":"client-code","ref":"x402@1.2.0 dist/esm/chunk-V3RMM5AE.mjs:436,447 — asset: mixedAddressOrSvmAddress"},{"kind":"client-code","ref":"x402@1.2.0 dist/esm/chunk-EJI6X7BV.mjs:75 — verifyingContract: getAddress(asset), which throws on a ticker"}]},{"id":"V1_MIMETYPE","area":"v1","regime":"payment","severity":"error","core":false,"summary":"mimeType is present (spec: Optional — but the dominant v1 client’s schema requires it)","sources":[{"kind":"spec","ref":"specs/x402-specification-v1.md:110-124 § 5.1.2 (PaymentRequirements table) — mimeType Optional"},{"kind":"client-code","ref":"x402@1.2.0 dist/esm/chunk-V3RMM5AE.mjs:443 — mimeType: z3.string(), NOT .optional()"},{"kind":"client-code","ref":"x402-fetch@1.2.0 dist/esm/index.mjs:22-23 (response.json(), then PaymentRequirementsSchema.parse per entry)"},{"kind":"house-opinion","ref":"@x402/core@2.23.0's v1 schema does make it optional (@x402/core@2.23.0 dist/cjs/schemas/index.js:83) — the two v1 parsers disagree"}]},{"id":"V1_DESCRIPTION","area":"v1","regime":"payment","severity":"error","core":false,"summary":"description is present (missing is an error; present-but-empty is a warn)","sources":[{"kind":"spec","ref":"specs/x402-specification-v1.md:110-124 § 5.1.2 (PaymentRequirements table) — description Required"},{"kind":"client-code","ref":"x402@1.2.0 dist/esm/chunk-V3RMM5AE.mjs:442 — description: z3.string(), required"},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/schemas/index.js:82 — required in the modern v1-compatibility schema too"}]},{"id":"V1_MAX_TIMEOUT","area":"v1","regime":"payment","severity":"error","core":true,"summary":"maxTimeoutSeconds is a positive integer JSON number","sources":[{"kind":"spec","ref":"specs/x402-specification-v1.md:110-124 § 5.1.2 (PaymentRequirements table) — maxTimeoutSeconds, type number, Required"},{"kind":"client-code","ref":"x402@1.2.0 dist/esm/chunk-V3RMM5AE.mjs:446 — z3.number().int(), so the string \"60\" is a ZodError"},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/schemas/index.js:86 — z.number().positive(), required"}]},{"id":"V1_EXTRA_EIP712","area":"v1","regime":"payment","severity":"error","core":false,"summary":"extra carries the EIP-712 domain the v1 client signs over (EVM networks only)","sources":[{"kind":"spec","ref":"specs/schemes/exact/scheme_exact_evm.md:72-73 — extra.name and extra.version required for eip3009"},{"kind":"client-code","ref":"x402@1.2.0 dist/esm/chunk-EJI6X7BV.mjs:65-76 — signAuthorization reads extra?.name and extra?.version straight into the typed-data domain, with no fallback"},{"kind":"house-opinion","ref":"the reference facilitator recomputes the domain from its own table, so the mismatch surfaces only as invalid_exact_evm_payload_signature"},{"kind":"spec","ref":"specs/x402-specification-v1.md:261 — v1 Solana exact uses TransferChecked, which has no EIP-712 domain"}]},{"id":"V1_OUTPUT_SCHEMA","area":"v1","regime":"bazaar","severity":"warn","core":false,"summary":"outputSchema is present for v1 discovery","sources":[{"kind":"spec","ref":"specs/x402-specification-v1.md:110-124 § 5.1.2 (PaymentRequirements table) — outputSchema Optional"},{"kind":"spec","ref":"specs/extensions/bazaar.md:577+ § Backwards Compatibility — v1 discovery rode on outputSchema"},{"kind":"field-report","ref":"x402-foundation/x402#2844 — indexing began after the metadata moved there"}]},{"id":"V1_DISCOVERABLE","area":"v1","regime":"bazaar","severity":"info","core":false,"summary":"outputSchema.input.discoverable is an opt-OUT — absence means indexed","sources":[{"kind":"client-code","ref":"x402-foundation/x402 go/extensions/v1/facilitator.go (main, read 2026-08-19) — \"// Check if discoverable (default to true if not specified)\" followed by `discoverable := true`, then an override only when the key is present"},{"kind":"live","ref":"worker/positive-control.js — a live indexed seller nests the flag under outputSchema.input"},{"kind":"cdp-docs","ref":"https://docs.cdp.coinbase.com/x402/bazaar — v1 discovery data reads input.discoverable"}]},{"id":"DUAL_PAYTO","area":"dual","regime":"payment","severity":"error","core":true,"summary":"matched offers pay the same address","sources":[{"kind":"house-opinion","ref":"worker/lint.js — two views of one offer; divergence means half the revenue lands elsewhere"},{"kind":"client-code","ref":"@x402/evm@2.23.0 dist/cjs/index.js:568 — getAddress is case-insensitive, so the comparison is too","context":true}]},{"id":"DUAL_PRICE","area":"dual","regime":"payment","severity":"error","core":true,"summary":"matched offers quote the same price","sources":[{"kind":"house-opinion","ref":"worker/lint.js — one offer must not carry two prices; matched on (chain, asset) so different-decimal assets are not compared"}]},{"id":"DUAL_NETWORK","area":"dual","regime":"payment","severity":"error","core":true,"summary":"the two envelopes offer overlapping chains","sources":[{"kind":"house-opinion","ref":"worker/lint.js — a payment signed on one chain is worthless on the other"},{"kind":"client-code","ref":"x402@1.2.0 dist/esm/chunk-V3RMM5AE.mjs:52-70 — the client’s own EvmNetworkToChainId map, which is the two spellings of one chain","context":true}]},{"id":"DUAL_ASSET","area":"dual","regime":"payment","severity":"error","core":true,"summary":"matched offers name the same asset","sources":[{"kind":"house-opinion","ref":"worker/lint.js — different assets means the two versions are selling for different money"}]},{"id":"DUAL_RESOURCE","area":"dual","regime":"payment","severity":"warn","core":false,"summary":"both versions name the same resource URL","sources":[{"kind":"house-opinion","ref":"worker/lint.js — two URLs split one endpoint’s settlement record across two listings"},{"kind":"field-report","ref":"x402-foundation/x402#3045 — discovery keys on the resource URL"}]},{"id":"VERSION_HEADER_SAYS_V1","area":"version","regime":"payment","severity":"error","core":false,"summary":"the PAYMENT-REQUIRED header does not carry a v1 payload","sources":[{"kind":"spec","ref":"specs/transports-v2/http.md:7-25 § Payment Required Signaling"},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/schemas/index.js:128-131 — PaymentRequired is a discriminatedUnion on x402Version, so a v1 payload in the header is legally parsed AS v1"},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/esm/client/index.mjs:219 — registeredClientSchemes.get(paymentRequired.x402Version): dispatch is on the PAYLOAD’s version, and a v1 client answers with X-PAYMENT while a v2 server reads PAYMENT-SIGNATURE"}]},{"id":"VERSION_BODY_SAYS_V2","area":"version","regime":"payment","severity":"warn","core":false,"summary":"the 402 body does not carry a v2 payload (a core error when no valid v2 header is published)","sources":[{"kind":"spec","ref":"specs/transports-v2/http.md:172-174 § Response Body (\"Response bodies are a server implementation concern\")"},{"kind":"client-code","ref":"@x402/core@2.23.0 dist/cjs/http/index.js:1620-1628 — the header wins whenever present; the body fallback accepts only x402Version === 1"},{"kind":"client-code","ref":"x402-fetch@1.2.0 dist/esm/index.mjs:22-23 — a v1 client reads the body with v1 rules whatever it declares"}]},{"id":"BILLING_TERMS_DISCLOSED","area":"terms","regime":"informational","severity":"info","core":false,"summary":"the four billing terms buyers ask for — minimum billable unit, what a hold covers, who observes acceptance, how long silence counts as acceptance — are published as a machine-readable object (informational: no spec requires this, so it never grades)","sources":[{"kind":"field-report","ref":"Moltbook 92cd240a… (bitroadai), \"transport success is not billable completion\" — buyers asked for the minimum billable unit and what a hold covers"},{"kind":"field-report","ref":"Moltbook 6868a451… / 2d2df453… (relayzero, @miacollective) — who observes acceptance, and how long silence counts as acceptance, as terms a buyer needs before paying"},{"kind":"house-opinion","ref":"no spec requires these four, no client parses them, no registry demands them — this check can only REPORT. Key names from house PR algonormative/10x402#10"},{"kind":"spec","ref":"specs/x402-specification-v2.md § 6.1 (Payment Flow Models), read 2026-09-09 — SILENT on all four","context":true}]},{"id":"EMPTY_BODY_200","area":"paid","regime":"hygiene","severity":"info","core":false,"summary":"a paid 2xx carries a body at all — an empty or whitespace-only answer is a charge with no product, and is indistinguishable from a legitimate \"no match\" (live lints only — runs only when a paid observation is attached)","sources":[{"kind":"live","ref":"penny402 launch night, 2026-09-02 (vault log/2026/09/2026-09-02.md § \"penny402 launch night\") — inspecting bodies, not statuses, found the muse tier’s pinned model (mistral-nemo) timing out about 1 in 4 and returning token salad under HTTP 200; 10x402 lint graded the same endpoints A / bazaar_ready. Re-pinned with a gate, redraw and retries; post-fix paid check 6/6."},{"kind":"field-report","ref":"moltbook c6e9a0b6 (@clawdsmith) — a false-miss rate is unmeasurable once \"wrong answer\" and \"no match\" share an empty body"},{"kind":"house-opinion","ref":"An answer body is the product on a paid call. A seller who returns nothing has charged for nothing, and has also destroyed the buyer's ability to measure how often the service misses — because the miss and the outage are the same bytes."},{"kind":"spec","ref":"specs/transports-v2/http.md:172-174 § Response Body (\"Response bodies are a server implementation concern\")","context":true}]},{"id":"UNPARSEABLE_BODY_200","area":"paid","regime":"hygiene","severity":"info","core":false,"summary":"a paid 2xx that declares a JSON content-type parses as JSON — runs only for a JSON content-type and a non-empty, unclipped body (live lints only — runs only when a paid observation is attached)","sources":[{"kind":"live","ref":"penny402 launch night, 2026-09-02 (vault log/2026/09/2026-09-02.md § \"penny402 launch night\") — inspecting bodies, not statuses, found the muse tier’s pinned model (mistral-nemo) timing out about 1 in 4 and returning token salad under HTTP 200; 10x402 lint graded the same endpoints A / bazaar_ready. Re-pinned with a gate, redraw and retries; post-fix paid check 6/6."},{"kind":"field-report","ref":"moltbook d261592d / 4c614192 (@smokeinthedesert) — \"everything proves the write, nothing proves the read\": receipts prove settlement, nothing proves the served body was an answer"},{"kind":"house-opinion","ref":"A content-type is a promise about how the bytes may be read. A buyer that has already paid cannot renegotiate it, so a body that does not parse under its own declared type is an unusable purchase served with a 200."},{"kind":"spec","ref":"specs/transports-v2/http.md:172-174 § Response Body (\"Response bodies are a server implementation concern\")","context":true}]},{"id":"SCHEMA_SHAPE_200","area":"paid","regime":"hygiene","severity":"info","core":false,"summary":"a paid 2xx matches the output shape the SKU itself declares (extensions.bazaar.info.output, or v1 outputSchema.output) — runs only when that declaration is an actual schema (live lints only — runs only when a paid observation is attached)","sources":[{"kind":"live","ref":"penny402 launch night, 2026-09-02 (vault log/2026/09/2026-09-02.md § \"penny402 launch night\") — inspecting bodies, not statuses, found the muse tier’s pinned model (mistral-nemo) timing out about 1 in 4 and returning token salad under HTTP 200; 10x402 lint graded the same endpoints A / bazaar_ready. Re-pinned with a gate, redraw and retries; post-fix paid check 6/6."},{"kind":"field-report","ref":"moltbook d261592d / 4c614192 (@smokeinthedesert) — \"everything proves the write, nothing proves the read\": receipts prove settlement, nothing proves the served body was an answer"},{"kind":"house-opinion","ref":"The output shape published in discovery is what an agent planned its call around. A served body that does not match it is a contract the seller wrote and then broke, and the buyer finds out after paying."},{"kind":"spec","ref":"specs/transports-v2/http.md:172-174 § Response Body (\"Response bodies are a server implementation concern\")","context":true}]},{"id":"DEGENERATE_TEXT_200","area":"paid","regime":"hygiene","severity":"info","core":false,"summary":"a paid text answer is not degenerate — a HEURISTIC over token diversity, consecutive repetition and a mid-token cut, capped at warn if ever graded, info today (live lints only — runs only when a paid observation is attached)","sources":[{"kind":"live","ref":"penny402 launch night, 2026-09-02 (vault log/2026/09/2026-09-02.md § \"penny402 launch night\") — inspecting bodies, not statuses, found the muse tier’s pinned model (mistral-nemo) timing out about 1 in 4 and returning token salad under HTTP 200; 10x402 lint graded the same endpoints A / bazaar_ready. Re-pinned with a gate, redraw and retries; post-fix paid check 6/6."},{"kind":"field-report","ref":"moltbook e1bb08bb (@pressuretestagent) — receipts cannot split rejected-but-charged from settled-with-effect"},{"kind":"house-opinion","ref":"Token salad under a 200 is what a timed-out or truncated generation looks like from the buyer's side. The thresholds below are house opinion and are named as constants so a reader can disagree with a number rather than with a verdict."},{"kind":"spec","ref":"specs/transports-v2/http.md:172-174 § Response Body (\"Response bodies are a server implementation concern\")","context":true}]},{"id":"CROSS_ROUTE_CONSISTENCY","area":"routes","regime":"hygiene","severity":"info","core":false,"summary":"the routes that publish this resource agree about it — price, payTo, network and the description, compared against the 402 envelope, with a description that is a strict prefix of another route's reported as TRUNCATED rather than as a mismatch (live lints only — runs only when route observations are attached)","sources":[{"kind":"field-report","ref":"moltbook 21b29f40 (@mayalaran) — every listing route on one API served a 500-character prefix of the description with no truncation marker, while the canonical route served the whole body: the two disagreed and nothing told a reader which was the offer"},{"kind":"field-report","ref":"moltbook 3edaffd8 (@lobbyagent) — the same observation framed as a parser differential: two readers of one resource reach two different answers, and neither is wrong about what it read. Nobody in that thread could check it for themselves"},{"kind":"house-opinion","ref":"A seller publishes one resource through several surfaces and a buyer agent reads whichever it found first. The envelope is the only one a payment is signed against, so every other surface that disagrees with it is a call planned against terms that will not be honoured — and the seller cannot see it, because they read their own canonical route."},{"kind":"spec","ref":"specs/transports-v2/http.md:7-25 § Payment Required Signaling","context":true}]},{"id":"LISTED_PRICE_MATCHES","area":"routes","regime":"hygiene","severity":"info","core":false,"summary":"the price the 402 quotes to a bare probe equals the price the seller lists for the resource in /.well-known/x402 (per rail) and in openapi.json's x-x402 prices (runs only when a discovery document is supplied)","sources":[{"kind":"field-report","ref":"vet402 L0 `price_mismatch` — the condition the estate improve loop recorded against an observer-unbuyable seller: the quote a bare probe receives differs from the listed price (vault-1tv7o, cycle 0, 2026-09-28)"},{"kind":"house-opinion","ref":"the envelope is the only surface a payment is signed against, so a listing that disagrees with it is a price a buyer planned against and will not be charged — and an observer that compares the two stops before paying"}]},{"id":"ACCEPTS_TRUNCATED","area":"report","regime":"hygiene","severity":"info","core":false,"summary":"at most 8 accepts[] entries are linted per envelope","sources":[{"kind":"house-opinion","ref":"worker/lint.js MAX_ACCEPTS_LINTED = 8"}]},{"id":"FINDINGS_TRUNCATED","area":"report","regime":"hygiene","severity":"info","core":false,"summary":"this report is complete — no bound clipped it","sources":[{"kind":"house-opinion","ref":"worker/lint.js — MAX_FINDINGS = 200, MAX_ACCEPTS_LINTED = 8, and the caller's body byte cap"}]}],"notes":["A 402 from a paid endpoint here is a price quote, not an error.","The /monitor routes answer a different question from the lint: not \"is my 402 right\" but \"what do the rating surfaces say about me, and what does my endpoint actually answer\". They serve stored daily observations and fetch nothing at request time. GET /monitor is free and explains the wing; GET /monitor/{host} is the free one-day snapshot for one host; the history and the dispute receipt are what is sold.","checks_run in a report is how many checks APPLIED — a v1-only endpoint legitimately skips every v2 check.","A report carries TWO verdicts. `grade` answers \"can I be paid\" from payment-regime findings only; `summary.bazaar_ready` answers \"can I be found\" from bazaar-regime errors, and names its blockers. An endpoint can be grade A and bazaar_ready false — that is the commonest interesting report this service produces.","Every check publishes its `sources`. A rule with no citation is a rule this service will not sell you.","POST /lint sends exactly one unauthenticated request to the URL you name, follows no redirects, and reads at most 256 KB.","POST /lint/envelope fetches nothing, so it works on staging, on localhost and on an endpoint that is not deployed yet.","The two /one routes answer about exactly ONE check you name in a required `check` field, taken from checks[] below. An unknown id is a 400 that lints nothing and charges nothing.","A single-check answer distinguishes THREE outcomes: passed true, passed false with the finding and its fix, and applied false — the named check did not run against this response, which is not a pass and is never reported as one."]}