Fixed-scope x402 assurance audit

Find the payment failure before your buyer does.

A seven-business-day review of discovery, payment requirements, buyer policy, and delivery evidence across a bounded paid-agent surface.

What is included

A bounded test surface and a decision-ready evidence pack.

Scope is confirmed before checkout. Tests are read-only and no-payment by default. Any paid-call execution requires a separate written spend cap.

Workstream	Included test	Delivered evidence
Route inventory	Up to 12 public HTTP routes on at most two domains; method, path, discovery source, expected price, network, and response shape.	Versioned route inventory in Markdown and CSV.
Discovery + schema	Manifest reachability, required x402 fields, content type, method/path agreement, schema references, and duplicate or stale entries.	Validation register with source URLs and captured timestamps.
Unpaid 402 behavior	Three no-payment probes per route, bounded to 12 seconds each; status, requirements, price, network, pay-to, and error behavior.	Price/network/failure map with eligible denominators.
Buyer policy	One policy matrix covering allow/deny/review rules for price, network, domain, pay-to, schema, and settlement requirement.	Recommended buyer-policy configuration and exceptions.
Paid-call plan	Test cases, maximum approved spend, expected output, stop conditions, and evidence capture. Execution is excluded until separately approved.	Reviewable paid-call plan; no wallet access requested.
Outcome evidence	Receipt fields, response hash, delivery-state logic, and failure escalation path against the frozen MAKO receipt contract.	Redacted signed evidence-pack structure and gap analysis.

Delivery plan

The clock begins when the route list, expected behavior, and technical owner are confirmed.

30-minute kickoff. Confirm the 12-route ceiling, domains, expected price/network, required response shape, and exclusions.

Freeze the route inventory, validate public manifests, and establish the source-linked test matrix.

Run bounded no-payment tests, map mismatches and failure states, and draft buyer-policy recommendations.

Assemble the evidence pack, classify findings, and prepare any separately approved paid-call plan.

45-minute review with go/no-go decisions, remediation order, and one written factual-correction window within three business days.

Sample deliverable

The sample is redacted and illustrative. Findings are tied to captured evidence, not generic risk scores.

Finding A-03 · high

Route:

Observed: Directory record declared eip155:; three timestamped 402 responses required a different network.

Buyer impact: A policy that trusts discovery alone can prepare the wrong asset or reject a valid route late.

Acceptance test: Discovery and live requirements agree for three consecutive no-payment probes after remediation.

Evidence: Source URL, request timestamp, response hash, parsed requirement fields, and screenshot-free machine record.

Operating boundaries

This is an evidence and decision engagement. It is not penetration testing, code remediation, custody, insurance, or an uptime guarantee.

Client responsibilities	Provide the final public route list, expected behavior, a technical owner, known maintenance windows, and written approval for any paid-call spend.
Acceptance criteria	All in-scope routes appear in the inventory; every included test has a result or documented blocker; findings contain evidence, severity, owner recommendation, and retest condition; both review sessions are delivered.
Exclusions	Source-code review, exploit testing, wallet/key access, private-data collection, production changes, remediation implementation, legal/compliance opinions, recovery, and ongoing monitoring.
Serious failure	MAKO freezes the evidence, stops the affected test path, and notifies the named technical owner within one business day. No destructive validation or public disclosure occurs. A remediation retest is scoped separately unless it fits the original unused route budget.
Monitoring follow-up	An optional recurring service can re-run the agreed no-payment probes, track price/network/schema drift, and issue a bounded evidence digest. Cadence, route ceiling, and price require a separate proposal.