[P0] Complete the x402 paid-resource round trip and capture devnet evidence

[TFT444]

Objective

Complete one disposable x402 paid-resource HTTP round trip on Solana devnet and package the resource, authorization, transaction, and independent RPC evidence as one coherent run.

Why this is required

The repository parses x402 v2, makes SolGuard decisions, prepares simulations, requests facilitator settlement, and validates returned transactions. It does not yet prove the full HTTP 402 -> authorize -> settle -> retry -> paid resource loop.

Parent tracking: #34. Depends on the isolated SDK signer bridge.

Scope

• Use or host a disposable resource returning an x402 v2 challenge for Solana devnet USDC.
• Validate the challenge before canonicalization.
• Route through authenticated decision and isolated signer paths.
• Submit only after ALLOW, then retry with the official payment header.
• Accept the resource only when payment response and RPC evidence match the canonical request.
• Capture a sanitized machine-readable bundle tied to the exact commit.
• Retain deterministic fallback.

Security invariants

• Unsupported network, mint, scheme, amount, recipient, facilitator, or expiry fails closed.
• Resource server cannot override mandate or decision.
• Facilitator response without matching RPC confirmation is not success.
• No key, raw signed payload, or credential enters logs or evidence.

Acceptance criteria

• One opt-in command completes the loop without per-payment human interaction.
• Output contains paid resource, authorization receipt, signature, RPC slot/status, mint, owners, token accounts, and atomic deltas.
• Values come from the run and label devnet tokens as having no real monetary value.
• Explorer link is derived from the signature and secondary to RPC.
• External failures exit non-zero without manufactured success.
• Exact command and source commit are included.
• Credential-free tests inject HTTP, facilitator, signer, and RPC boundaries.
• Offline fallback remains fully runnable.

Non-goals

Mainnet funds, production availability claims, GBP valuation of devnet tokens, or mandatory live settlement on stage.

Keywords

x402-paid-resource http-402 solana-devnet rpc-confirmation evidence-bundle