# Public Read-Only Evidence and Recovery Results

## Collection method and limits

All public collection used `pplx_sdk.content.fetch` with `cache_enabled=False`; retained raw result envelopes are in `public-readonly-evidence/`. This read tool supports URL reads but did not expose an HTTP method selector or raw response headers for these results. Therefore:

- GET discovery/read evidence was collected.
- An actual `OPTIONS` preflight was **not attempted** because the permitted collection interface could not select `OPTIONS`.
- No statement is made about CORS, `Allow`, payment challenge headers, exact HTTP status, or settlement unless the collected result explicitly exposed it.
- No payment credential, wallet, or paid retry was used.

## Public endpoint observations

| URL | Safe operation | Direct observation | Evidence file |
|---|---|---|---|
| https://theloopbreaker.com/.well-known/x402.json | GET discovery | Returned manifest content claiming `endpointCount: 88`, `pricedEndpointCount: 75`, Base USDC `payTo` `0xfA15Ee28939B222B0448261A22156070f0A7813C`, and Solana `payToSolana` `6KpXaFmaR8WPWr79qzsMBvwDbDzYFErwNoWxfwqDr8JU`. The tool did not provide a status or headers. | `discovery-and-read-responses.json` |
| https://theloopbreaker.com/.well-known/agent-card.json | GET discovery | Returned an agent-card document that describes `VaultfireTrustAttestation` and lists its Base address. This is an application claim, not authoritative source/ABI proof. | `discovery-and-read-responses.json` |
| https://theloopbreaker.com/api/x402/discovery | GET discovery | Returned a body that declares `x402Version: 1`, 97 endpoint entries, and Base/Avalanche/Arbitrum/Polygon networks. This conflicts with the local generated candidate metadata’s x402 rail version 2 and proves that the checked-in generated metadata must remain labeled non-live-validated. | `discovery-and-read-responses.json` |
| https://theloopbreaker.com/api/x402/agent-preflight | GET discovery | Returned usage/help content stating the route is free. It did not provide a status or headers. | `discovery-and-read-responses.json` |
| https://theloopbreaker.com/api/contracts | GET discovery | Returned contract inventory content that includes 134 contracts and the four `VaultfireTrustAttestation` addresses. It did not provide a status or headers. | `discovery-and-read-responses.json` |
| https://theloopbreaker.com/api/x402/trust/bonds | Unpaid GET | The permitted reader reported `http_code_client_error`; it did not expose a 402 body, status, or headers. No retry or payment followed. | `unpaid-priced-read-attempt.json` |
| https://theloopbreaker.com/api/x402/trust/agent-status | Unpaid GET | The permitted reader reported `http_code_client_error`; it did not expose a 402 body, status, or headers. No retry or payment followed. | `unpaid-priced-read-attempt.json` |

## Authoritative ABI/source recovery attempt

| Exact deployed address | Read-only authority URL | Result |
|---|---|---|
| Base `0xc0f8704EF84Ca58Fa0AF4836669d358574FFE1f4` | https://base.blockscout.com/api?module=contract&action=getsourcecode&address=0xc0f8704EF84Ca58Fa0AF4836669d358574FFE1f4 | Response was reported as `status: "1"` / `message: "OK"` but the extraction found no exact contract name, verified source, or ABI. |
| Avalanche `0x5F7680a9a720c03812532A735D1165D9f97c0Cd1` | https://api.routescan.io/v2/network/mainnet/evm/43114/etherscan/api?module=contract&action=getsourcecode&address=0x5F7680a9a720c03812532A735D1165D9f97c0Cd1 | The response explicitly reported an empty `SourceCode` and ABI `Contract source code not verified`. |
| Base, Avalanche, Arbitrum, Polygon exact deployments | https://repo.sourcify.dev/contracts/full_match/8453/0xc0f8704EF84Ca58Fa0AF4836669d358574FFE1f4/metadata.json ; https://repo.sourcify.dev/contracts/full_match/43114/0x5F7680a9a720c03812532A735D1165D9f97c0Cd1/metadata.json ; https://repo.sourcify.dev/contracts/full_match/42161/0x1a7391DD19Dadab89757E58F4Cf988455263533e/metadata.json ; https://repo.sourcify.dev/contracts/full_match/137/0x1a7391DD19Dadab89757E58F4Cf988455263533e/metadata.json | Each read returned `http_code_client_error`; no source was recovered. |
| Arbitrum `0x1a7391DD19Dadab89757E58F4Cf988455263533e` | https://arbiscan.io/address/0x1a7391DD19Dadab89757E58F4Cf988455263533e#code | Reader blocked by robots; no result inferred. |
| Polygon `0x1a7391DD19Dadab89757E58F4Cf988455263533e` | https://polygonscan.com/address/0x1a7391DD19Dadab89757E58F4Cf988455263533e#code | Reader blocked by robots; no result inferred. |

The repository does contain two byte-identical TypeScript ABI candidates at `repos/theloopbreaker-site/app/lib/abis/VaultfireTrustAttestation.ts` and `repos/theloopbreaker-site/app/app/lib/abis/VaultfireTrustAttestation.ts` (SHA-256 `b3e9fed35ff8c2fa657bce9ebc9f450a3155da57596e8288028cdc7b2ca80cc2`). They do not have provenance binding them to the exact deployments, so they were **not** promoted into `legacy/v2`, were not treated as an ABI recovery, and the strict V2 ABI gate remains correctly blocked.

## Safe negative-flow conclusion

The local V2 server source `repos/theloopbreaker-site/app/api/x402/trust/_lib/verify-payment.ts` immediately returns `x402ReleaseGateClosed()` before header parsing. Its companion release-gate source returns a 503 JSON error with code `x402_release_gate_closed`. Consequently, checked-in source is fail-closed for payment processing. The deterministic PR7 sandbox, not public production evidence, verifies malformed, wrong signer, expired, wrong amount/token/network/payee, request-binding/replay, finality, idempotency, and receipt behavior for all 77 generated priced routes without touching a wallet or real settlement.
