# V3 x402 receipt privacy contract

Status: source contract only; production receipt capability remains unavailable.

## Access model

Receipt status is intentionally public to a holder of the request identifier. The identifier is a capability-like locator, not authentication. The server generates the only accepted form, `v3r_` followed by 32 lowercase hexadecimal characters from 16 CSPRNG bytes. Validation rejects malformed, low-diversity, and short-period repeated values; arbitrary caller-selected locator formats are not accepted. Callers must not put wallet addresses, names, emails, mandate contents, payment payloads, or other personal data in it.

## Public fields

A successful lookup can disclose the canonical route/resource, method, atomic amount, asset, payee, network, state, timestamps, transaction and block hashes, confirmation/finality observation, and integrity digests. This enables correlation with public-chain activity. Clients must show that consequence before sharing a request identifier.

## Redaction and logging

The endpoint never returns authorization IDs, payment IDs, nonces, signatures, headers, bodies, Redis credentials, or audit-history payloads. Production V3 code must not log those values. Optional audit sinks receive only a receipt UUID, state, sequence, and truncated digests.

## Retention and enumeration

Replay reservations and receipt records remain for the authorization lifetime plus seven days by default. Deployments must rate-limit enumeration at the edge. A future authenticated/private mode requires a new schema and access-control review; it must not silently change this public contract.

## Activation boundary

This document does not prove a durable store, deployment, payment, settlement, chain observation, or Bazaar listing. Those capabilities remain fail-closed until independently authenticated evidence satisfies the V3 capability gate.
