Docs / Deep dive
Proofs and scenarios
Everything below has been run for real on the Stellar test network, with real x402 payments and real claims. The proofs page links each item to its transaction on a public explorer; the demo replays one claim step by step with its console output.
Warranty payouts after real payments
| Demonstrated | Result |
|---|---|
| P1 Equivocation: the seller signed two different receipts for one payment | Claim paid 5 USDC from stake |
| P2 Terms mismatch: the receipt cited different terms than the offer | Claim paid 5 USDC |
| P3 Stale data: data an hour old against a 10-minute promise | Claim paid 5 USDC |
| P4 Bad status: charged for HTTP 203 when only 200 was chargeable | Claim paid 1 USDC |
| P5 Size limit: response larger than the 4 KiB promised | Claim paid 1 USDC |
| P6 Oracle deviation: EUR/USD quoted 10% away from the oracle; the validator read the oracle on-chain | Claim paid 5 USDC |
| Honest response | Receipt verified, warranty kept, no claim |
| Tampered receipt signature | Flagged untrusted by the buyer SDK; no claim possible, no penalty |
| Payout took stake below the minimum | Service suspended automatically; agents stopped paying it |
Stake lifecycle
| Demonstrated | Result |
|---|---|
| Deposit 150 USDC activates a Pending service | State Active |
| Partial unbonding keeps the service Active | Pending withdrawal recorded with unlock time |
| Withdraw before the unlock time | Rejected: StillLocked |
| Cancel unbonding | Pending withdrawal cleared |
| Registration below the 100 USDC floor | Rejected: StakeBelowFloor |
Governance and safety
| Demonstrated | Result |
|---|---|
| Admin proposed a replacement Claims contract | Time-locked 26 hours; the monitor raised a critical alert within seconds; proposal cancelled |
| Oracle read charges | A contract-to-contract oracle read carried no fee beyond the normal transaction fee |
| Honest claim against an honest quote | Recorded as rejected, NotProven, no payout |
| Protocol fees: 1 USDC registration fee on each reference service | Fees reached the treasury account |
| Annual stake fee (1% a year) accrued per second and collected on demand | collect_fee moved the accrued amount to the treasury; FeeCollected indexed |
| Payment settled by a self-hosted x402 facilitator, then a P6 claim | Claim paid 5 USDC |
| Storage keeper extended the registry, claims and every service entry | All transactions succeeded |
| Property test: random deposits, slashes, fees, unbonding and withdrawals | The contract’s USDC balance equalled the sum of stakes after every step in 64 random sequences |
Automated test suites
| Suite | Tests | Covers |
|---|---|---|
| Soroban contracts (Rust) | 97 | Every registry state transition, slash rate limit, key retirement, admin time locks, launch limits, pause, allowlist, fees, a stake-accounting property test, all six validators, end-to-end claims with real signatures and a test USDC token |
| Protocol, buyer SDK, seller middleware (TypeScript) | 22 | Byte-for-byte test vectors shared with Rust, local predicate evaluation, policy refusals, receipt verification, durable receipt store, live test-network reads |
| Indexer, API, monitor (Go) | 11 | Event decoding, API pagination, errors, ETags, rate limits, OpenAPI coverage, alert rules including launch-configuration alerts |
Every push builds and tests all three: Rust (format, lint, tests, wasm build), TypeScript (build, type check, tests) and Go (format, vet, tests). Counts are those recorded on the proofs page.
The scheduled scenarios
Eleven named scenarios run on a schedule against the live reference services and are judged automatically: honest quote, each predicate’s breach, tampered signature, replay blocked, honest claim rejected and policy refusal. Each is written in plain language with why it matters:
| Scenario | Why it matters |
|---|---|
| Honest FX quote: warranty kept | The normal path must stay cheap and simple: one x402 payment, one receipt, no escrow, no extra transaction when the seller behaves. |
| Quote 10% off the oracle: P6 claim paid | The only predicate checked against evidence the seller does not control. A seller cannot lie about market data without paying for it. |
| Data older than promised: P3 claim paid | Freshness guarantees are enforceable without any oracle: the seller’s signed receipt is the evidence. |
| Receipt cites different terms: P2 claim paid | A seller cannot quietly swap the promise after payment: the receipt must name the exact terms the buyer paid under. |
| Two different receipts for one payment: P1 claim paid | Equivocation is the clearest proof of dishonesty, and the second receipt is all the evidence needed. |
| Broken receipt signature: untrusted, no claim, no penalty | An invalid signature proves nothing about the seller (anyone could forge one), so it is never slashable; the protocol must say so rather than guess. |
| Charged for an unpromised HTTP status: P4 claim paid | Sellers cannot bill for responses they promised not to bill for; the status is in the signed receipt. |
| Response larger than promised: P5 claim paid | Size limits protect agents from paying for padded or runaway responses. |
| Same claim filed twice: second one rejected | One payment can be compensated once. Replay protection is on-chain, keyed by service and payment. |
| Claim against an honest receipt: rejected, nothing paid | Anyone may submit a claim, so the protocol must produce no false positives: an honest seller is never slashed. |
| Agent policy refuses an under-staked seller: no payment made | The bond is readable before payment, so an agent can decline a seller it does not trust at zero cost. |
Run them yourself: Run the scenarios. Read the recorded runs: GET /v1/{network}/scenarios in the API.
Production network
No production-network deployment exists yet. When one does, its proofs are added to the proofs page under that network with the same explorer links, and the Stellar binding’s STELLAR_MAINNET entry receives its contract addresses.