# Vaultfire V3 x402 request-ID OpenAPI parity closure

Date: 2026-08-25

Audit addressed: `/home/user/workspace/VAULTFIRE_V3_X402_POSTFIX_REAUDIT_20260825.md`

Result: the remaining 0C / 0H / 0M / 1L finding is closed in source and local tests.

This is unauthenticated local evidence only. It is not deployment, settlement, wallet, RPC, or Bazaar-listing evidence. V3 payment activation and publication remain fail-closed.

## L-01 — standard OpenAPI and runtime request-ID mismatch

Closed.

The canonical `requestId` schema is now a standard JSON Schema/OpenAPI string constraint:

- fixed `v3r_` prefix;
- exactly 32 lowercase hexadecimal characters after the prefix;
- at least eight distinct hexadecimal symbols;
- no complete repetition with period 1, 2, 4, or 8.

Those periods are exactly the possible divisors rejected by the prior runtime check over candidate periods 1 through 8 for a 32-character payload. The representation uses the standard `pattern`, `minLength`, and `maxLength` keywords only. It does not depend on a vendor validation extension.

`isValidV3RequestId` consumes that same schema directly, so runtime and published schema have one semantic source. Server-side generation remains `randomBytes(16).toString('hex')`: a 16-byte CSPRNG draw and therefore the existing 128-bit generation contract is not weakened.

The generated OpenAPI operation for `/api/v3/x402/receipts/{requestId}` contains the exact shared schema. The existing anti-drift test also compares all 10 V3 path-parameter occurrences to their shared runtime schemas.

## Exploit regression and independent parity

The request-ID regression uses the repository's standards-only JSON Schema 2020-12 subset validator, independently of `isValidV3RequestId`, against positive and negative corpora.

Negative cases cover:

- repeated periods 1, 2, 4, and 8;
- a non-periodic payload with only seven distinct symbols;
- wrong length;
- uppercase hexadecimal;
- a legacy noncanonical identifier.

All positives are accepted by both validators and all negatives are rejected by both validators.

The original independent auditor harness was reproduced unchanged. It reports:

`STANDARD_OPENAPI_RUNTIME_MISMATCHES 0`

Its process exit is 1 because the supplied harness explicitly sets `process.exitCode = 1` when the mismatch count is zero; this is a closure sentinel in that harness, not a validation failure.

## Validation results

- full `npm test`: PASS — 20 files, 129 tests;
- direct `vitest run`: PASS — 20 files, 129 tests;
- PR7 `tsc --noEmit`: PASS;
- narrow V3 site TypeScript check: PASS;
- dedicated disabled-route/V2-isolation suite: PASS — 4 files, 18 tests;
- deterministic registry check: PASS — 9 generated files;
- V2/V3 compatibility check: PASS;
- recovered route-disposition check: PASS;
- V2 compatibility fixture/source/input checks: PASS;
- V2 Bazaar metadata validation: PASS — 76 candidates, 29 with Solana options;
- OpenAPI path-parameter anti-drift: PASS — 10 occurrences, 0 mismatches;
- protected V2 tracked and untracked diff checks: PASS — empty;
- `git diff --check`: PASS;
- V3 Bazaar candidate count: 0;
- V3 publication eligibility: false;
- live-readiness gate: expected fail-closed exit 1 because owner evidence is absent.

Validation logs:

- `/home/user/workspace/vaultfire_v3_x402_request_id_final_npm_test_20260825.log`
- `/home/user/workspace/vaultfire_v3_x402_request_id_final_direct_vitest_20260825.log`
- `/home/user/workspace/vaultfire_v3_x402_request_id_final_typecheck_20260825.log`
- `/home/user/workspace/vaultfire_v3_x402_request_id_final_site_typecheck_20260825.log`
- `/home/user/workspace/vaultfire_v3_x402_request_id_final_generators_20260825.log`
- `/home/user/workspace/vaultfire_v3_x402_request_id_final_compatibility_20260825.log`
- `/home/user/workspace/vaultfire_v3_x402_request_id_final_no_payment_20260825.log`
- `/home/user/workspace/vaultfire_v3_x402_request_id_final_v2_protection_20260825.log`
- `/home/user/workspace/vaultfire_v3_x402_request_id_final_bazaar_20260825.log`
- `/home/user/workspace/vaultfire_v3_x402_request_id_final_publication_gate_20260825.log`
- `/home/user/workspace/vaultfire_v3_x402_request_id_final_auditor_harness_20260825.log`

## Files changed for this closure

1. `repos/theloopbreaker-site/app/api/v3/_lib/path-parameter-schemas.json`
2. `repos/theloopbreaker-site/app/api/v3/_lib/validation.ts`
3. `repos/theloopbreaker-site/app/api/v3/_lib/http.ts`
4. `pr7/registry/build_full_registry.py`
5. `pr7/generated/openapi.json`
6. `pr7/tests/api/v3-read-only-catalog.spec.ts`
7. `pr7/tests/x402/json-schema-2020-subset.ts`
8. `pr7/evidence/v3-x402-foundation-validation-20260825.json`
9. `pr7/docs/V3_X402_REQUEST_ID_OPENAPI_PARITY_CLOSURE_20260825.md`

The `http.ts` adjustment removes a stale import of an SDK task model that the current SDK no longer exports and types the unavailable canonical task model as `never`; it is confined to the permitted V3 site path and was required for the narrow and PR7 TypeScript checks to remain truthful.

## External blockers

No local source test supplies production storage credentials, deployment/code-identity evidence, payment configuration, chain-finality observations, settlement, fulfillment, signed audit anchoring, objective listing receipt IDs, or external Bazaar indexing. Those remain mandatory external gates. No live V3 listing or settlement is claimed.
