# V2-to-V3 Compatibility Matrix

Generated by `pr7/compat/build-v2-v3-compatibility-matrix.py`; do not hand-edit.

## Default and activation policy

| Control | Value |
|---|---|
| Default protocol | `v2` |
| V3 access | `explicit-opt-in-allowlist-only` |
| V2-to-V3 write redirect | `forbidden` |
| V3 default state | `fail-closed` |

## Version concepts remain distinct

| Concept | Value | Meaning |
|---|---|---|
| Vaultfire contract/API protocol | `v2` / `v3` | Namespace and compatibility version |
| x402 payment rail | `2` | Challenge, payment, and receipt message version |
| Coinbase Bazaar resource metadata | `v2` | Resource-description format; may describe protocol v2 or v3 |

## Exhaustive machine-readable inventory

- V2 deployed contract instances: **134**.
- V2 API inventory paths: **132**.
- Registry entries: **164** (**144 V2**, **20 V3**).
- Exact V2 response fixtures: **1**; unresolved: **131**.

Every contract instance, V2 API path, x402 route, request/price/payment metadata field, fixture state, ABI state, and extracted SDK declaration is in [`compatibility-discovery-v2-v3.json`](./compatibility-discovery-v2-v3.json). `null`, `unresolved`, and `blocked-unresolved` are intentional evidence states, not defaults.

## V3 allowlist

| Method | Path | Price state | Activation |
|---|---|---|---|
| `GET` | `/api/v3/contracts` | `free` | explicit opt-in, fail-closed until readiness evidence |
| `GET` | `/api/v3/contracts/:name` | `free` | explicit opt-in, fail-closed until readiness evidence |
| `GET` | `/api/v3/bonds` | `free` | explicit opt-in, fail-closed until readiness evidence |
| `GET` | `/api/v3/bonds/:bondId` | `free` | explicit opt-in, fail-closed until readiness evidence |
| `GET` | `/api/v3/disputes/:disputeId` | `free` | explicit opt-in, fail-closed until readiness evidence |
| `GET` | `/api/v3/evidence/:evidenceHash` | `free` | explicit opt-in, fail-closed until readiness evidence |
| `GET` | `/api/v3/tasks/:taskId` | `free` | explicit opt-in, fail-closed until readiness evidence |
| `GET` | `/api/v3/mandates/:mandateHash` | `free` | explicit opt-in, fail-closed until readiness evidence |
| `GET` | `/api/v3/mandate/:mandateHash` | `free` | explicit opt-in, fail-closed until readiness evidence |
| `GET` | `/api/v3/governance/proposals/:proposalId` | `free` | explicit opt-in, fail-closed until readiness evidence |
| `GET` | `/api/v3/pull-credits` | `free` | explicit opt-in, fail-closed until readiness evidence |
| `GET` | `/api/v3/migration/dispositions` | `free` | explicit opt-in, fail-closed until readiness evidence |
| `GET` | `/api/v3/protocol/status` | `free` | explicit opt-in, fail-closed until readiness evidence |
| `GET` | `/api/v3/protocol/solvency` | `free` | explicit opt-in, fail-closed until readiness evidence |
| `GET` | `/api/v3/x402/discovery` | `free` | explicit opt-in, fail-closed until readiness evidence |
| `GET` | `/api/v3/x402/challenge-status` | `free` | explicit opt-in, fail-closed until readiness evidence |
| `GET` | `/api/v3/x402/challenges/:challengeId` | `free` | explicit opt-in, fail-closed until readiness evidence |
| `GET` | `/api/v3/x402/receipts/:requestId` | `free` | explicit opt-in, fail-closed until readiness evidence |
| `GET` | `/api/v3/solana/health` | `free` | explicit opt-in, fail-closed until readiness evidence |
| `POST` | `/api/v3/x402/actions/create-partnership-bond` | `free` | explicit opt-in, fail-closed until readiness evidence |

## Payment and release state

The checked-in V2 verifier currently returns its release-closed 503 response before it parses or accepts a payment. The generated Bazaar artifacts are metadata candidates only (`metadata-candidates-not-live-validated`); they are not proof of a public challenge, settlement, receipt, or indexing.

## Canary gate

No paid retry is authorized. A paid retry requires owner approval of a public wallet and maximum budget, plus route-specific live 402 evidence and an approved controlled payment plan.

## Source URLs and evidence limits

Public read-only evidence and exact command results are retained in `audit-evidence/phase3-v2-compatibility-20260822/`. Public endpoints: https://theloopbreaker.com/.well-known/x402.json, https://theloopbreaker.com/.well-known/agent-card.json, https://theloopbreaker.com/api/x402/discovery, https://theloopbreaker.com/api/x402/agent-preflight, and https://theloopbreaker.com/api/contracts. The collected read tool did not expose HTTP status/headers or permit an OPTIONS method, so no live OPTIONS or 402-header claim is made.
