# x402 v2 / Coinbase Bazaar readiness

This directory separates three version axes that must never be conflated:

- **Vaultfire contract protocol:** a route's `protocolVersion` remains `v2` or `v3`.
- **Bazaar resource metadata:** `bazaarResourceVersion` is **`v2`**.
- **x402 payment rail:** `x402Version` is **`2`**.

`generated/coinbase-bazaar-v2.json` and `generated/well-known-x402.json` are
reproducible **metadata candidates**, not proof that an endpoint is deployed,
returns HTTP 402, or is indexed.

## Static gate

From `pr7`:

```text
SOURCE_DATE_EPOCH=0 python3 registry/build_full_registry.py
python3 registry/validate_bazaar_v2.py
```

The static validator requires every candidate to have an absolute HTTPS
resource URL, explicit method and route template, an x402 v2 payment option,
and an `extensions.bazaar` block with explicit `method`, `path`, HTTP input
metadata, JSON Schema, and an output example.  Input routes without a source
JSON Schema are emitted as `blocked-input-schema-unresolved`, rather than
being published with guessed request fields.

## Base and Solana truthfulness

All candidate resources retain a Base option (`eip155:8453`).  A Solana option
is emitted only where the historical source entry already contains a concrete
Solana USDC mint and a concrete Solana `payTo`; it is normalized to the current
mainnet CAIP-2 identifier `solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp`.  A route
without that source-backed pair is labeled
`read-only-api-no-solana-settlement`; it must not be represented as accepting
Base payment on behalf of Solana.

## Owner-approved live gate (intentionally fails closed)

`python3 registry/validate_bazaar_readiness.py` makes **no network request**.
It blocks while any paid route has unresolved input metadata, and then until an owner adds an uncommitted
`evidence/bazaar-live-evidence.json` that covers every generated candidate.
Use `evidence/bazaar-live-evidence.example.json` only as a shape template; it
is not evidence and cannot satisfy the gate.

The owner must separately approve and perform these live actions:

1. Deploy the exact generated metadata with the public HTTPS routes, returning
   an x402 v2 `402 Payment Required` response with `extensions.bazaar`.
2. Use CDP's read-only `POST /platform/v2/x402/validate` for every candidate;
   record `valid: true`, `statusCode: 402`, `x402Version: 2`, required
   preflights passing, and `simulation.outcome: accepted`.
3. After approval, complete at least one genuine paid settlement whose
   `paymentPayload.resource` is the candidate URL, then record an accepted
   Bazaar extension response (`success` or `processing`).  Validation alone
   does not index a resource.
4. Inspect the discovery status later; do not claim live indexing merely from
   this repository or from validation output.

Do not commit payment credentials, wallet material, production receipts that
contain restricted data, or an assertion that a resource is indexed.
