x402 Preflight

Sanitized sample · packet 000

A payment path should be boring to approve.

This illustrative packet shows the decision, evidence, regression coverage, and commercial boundary delivered in a fixed-price x402 payment-security engagement.

Not a client result. Targets, identifiers, outcomes, and findings below are synthetic. No production system or customer is represented.

01 / boundary

The contract is fixed before testing starts

Target
Synthetic TypeScript x402 client at a buyer-supplied commit
Surface
Challenge parsing, authorization binding, retry, and settlement
Price
150 USDC on Base · prepayment or escrow preferred
Clock
48 hours after written scope and payment confirmation
Acceptance
Reproduce findings, pass named regression tests, acknowledge delivery
Outputs
Decision memo, evidence matrix, tests, focused patch, merge recommendation

02 / evidence

Every decision maps to a named invariant

The real packet pins each row to a clean-checkout command, test name, observed result, and relevant source location.

Invariant Expected behavior Example result Evidence
Challenge authority Final origin cannot change the approved payment tuple High redirect-authority.test.ts
Payee binding payTo remains byte-for-byte bound after approval High authorization-binding.test.ts
Amount and asset Amount, asset, and network cannot drift between attempts Pass payment-tuple.test.ts
Replay An authorization is never reused across resource requests Medium replay-window.test.ts
No-payment path Non-402 failures do not trigger signing or retry Pass payment-trigger.test.ts
Budget ceiling Per-request and daily caps fail closed before signing Pass budget-policy.test.ts
Duplicate settlement Timeout recovery cannot settle the same intent twice Pass settlement-idempotency.test.ts
Protected body Paid content is exposed only after verified settlement Pass delivery-gate.test.ts

Sample shows 8 of 12 illustrative rows.

Worked example · high severity

Cross-origin redirect can rebind the approved payee

MERGE BLOCKER

Observed sequence

  1. The client receives a valid 402 challenge from origin A.
  2. The user policy approves its complete payment tuple.
  3. A 307 response sends the retry to controlled origin B.
  4. The retry path rebuilds authorization from B instead of rejecting the authority change.

Security invariant

Scheme, authority, resource identity, network, asset, amount, payee, and fee ceiling must remain bound to the exact tuple the policy approved. Any drift aborts before signing.

Clean-checkout reproduction npm test -- redirect-authority.test.ts Expected before patch: 1 failing invariant

Focused remediation

Freeze the normalized approval tuple before the first signed request. Reject redirects that change authority or any payment field, and add a negative regression proving the signer is never called after drift is detected.

03 / handoff

Delivery is a reproducible state, not a document drop

  1. 01Buyer checks out the pinned target revision.
  2. 02Named reproduction fails before the focused patch.
  3. 03Regression suite passes after the patch.
  4. 04Decision memo states merge, hold, or residual risk.
  5. 05Buyer acknowledges the agreed acceptance criteria.