From f2fb563b275c57033b541c2c016f559446df582b Mon Sep 17 00:00:00 2001 From: TheAliphant <113637984+TheAliphant@users.noreply.github.com> Date: Wed, 7 Oct 2026 23:55:34 +0200 Subject: [PATCH 1/5] test(scf46): add non-settling x402 2.27.0 PR smoke gate --- .github/workflows/test.yml | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index e43cd3e..b8046f1 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -28,3 +28,37 @@ jobs: cache-dependency-path: spikes/stellar-x402/package-lock.json - run: npm ci - run: npm test + + # Additive, PR-only 2.27.0 import gate; preserve the pinned 2.26.0 baseline above. + stellar-x402-227-smoke: + if: github.event_name == 'pull_request' + runs-on: ubuntu-latest + defaults: + run: + working-directory: spikes/stellar-x402 + steps: + - uses: actions/checkout@v4 + - uses: actions/setup-node@v4 + with: + node-version: "22" + cache: npm + cache-dependency-path: spikes/stellar-x402/package-lock.json + - name: Install pinned baseline + run: npm ci + - name: Overlay aligned x402 2.27.0 for smoke test (no lockfile change) + run: npm install --no-save --package-lock=false --ignore-scripts @x402/core@2.27.0 @x402/mcp@2.27.0 @x402/stellar@2.27.0 + - name: Check actually installed package versions + run: | + node --input-type=module <<'NODE' + import assert from 'node:assert/strict'; + import { readFileSync } from 'node:fs'; + for (const name of ['core', 'mcp', 'stellar']) { + const pkg = JSON.parse(readFileSync(`node_modules/@x402/${name}/package.json`, 'utf8')); + assert.equal(pkg.version, '2.27.0', `${name} version mismatch`); + console.log(`@x402/${name}: ${pkg.version}`); + } + NODE + - name: Run non-settling official SDK import/readiness checks + run: npm test + - name: Ensure pinned 2.26 manifest and lock remain unchanged + run: git diff --exit-code -- package.json package-lock.json From 98a7093f25098b970519e10085e7127fe2902a61 Mon Sep 17 00:00:00 2001 From: TheAliphant <113637984+TheAliphant@users.noreply.github.com> Date: Wed, 7 Oct 2026 23:55:43 +0200 Subject: [PATCH 2/5] docs(scf46): document strict 2.27.0 smoke-evidence boundary --- spikes/stellar-x402/README.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/spikes/stellar-x402/README.md b/spikes/stellar-x402/README.md index e8f745e..c43c9e3 100644 --- a/spikes/stellar-x402/README.md +++ b/spikes/stellar-x402/README.md @@ -14,3 +14,17 @@ It does **not** implement the grant-funded facilitator or Bazaar. Those remain t npm ci npm test ``` + +## 2.27.0 PR smoke gate (separate from the pinned baseline) + +The repository's [pull-request CI](../../.github/workflows/test.yml) now adds a non-settling compatibility check for the npm-published **2.27.0** versions of `@x402/core`, `@x402/mcp`, and `@x402/stellar`. It starts with `npm ci` against the **unchanged 2.26.0 lockfile**, temporarily overlays aligned 2.27.0 packages without updating package/lock files, asserts the installed versions, and runs the existing readiness tests on Node 22. + +**Evidence boundary:** A green PR smoke check verifies only the tested exports/network constants and MCP primitives on 2.27.0. It **does not** verify deployed facilitator routes, `/supported`, Stellar testnet/pubnet payments, `payload: {transaction}` wire compatibility, the Bazaar, `upto`, security audit, or the canonical x402 E2E suite. Those remain separate gates in [the SCF conformance matrix](../../grants/stellar-rfp-conformance.md). Do **not** relabel the previous pinned 2.26.0 test as proof that 2.27.0 passed unless the new CI job has actually completed successfully. + +For a local equivalent with working npm registry access (without changing the tracked lockfile), run from this directory: + +```bash +npm ci +npm install --no-save --package-lock=false --ignore-scripts @x402/core@2.27.0 @x402/mcp@2.27.0 @x402/stellar@2.27.0 +npm test +``` From c33e1246b816ad2d9c25d09833a4a0e00a74b63c Mon Sep 17 00:00:00 2001 From: TheAliphant <113637984+TheAliphant@users.noreply.github.com> Date: Wed, 7 Oct 2026 23:56:56 +0200 Subject: [PATCH 3/5] docs(scf46): record verified 2.27.0 import-smoke CI receipt without inflating readiness --- grants/stellar-rfp-conformance.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/grants/stellar-rfp-conformance.md b/grants/stellar-rfp-conformance.md index dd1199e..a33e252 100644 --- a/grants/stellar-rfp-conformance.md +++ b/grants/stellar-rfp-conformance.md @@ -5,7 +5,7 @@ Related drafts: [SCF #46 interest package](scf46-interest.md) and [full submissi **Reconciled:** 2026-10-07. **Status:** pre-award design and readiness mapping only. The 2026-09-18 interest form was submitted through the SCF UI, without a confirmation number; eligibility, invitation, full-submission acceptance and grant award are **not confirmed**. SCF #46's published Build deadline is **2026-11-08**; the handbook still labels this RFP as introduced for **SCF #45**. Its availability/eligibility for #46 requires an explicit SCF confirmation before filing this draft. -**Version truth:** `spikes/stellar-x402/package.json` pins `@x402/stellar`, `@x402/core` and `@x402/mcp` to **2.26.0** for limited import/readiness tests. [npm](https://www.npmjs.com/package/@x402/stellar) listed **2.27.0** as latest on 2026-10-07. This is **an upgrade/retest task**, not evidence that 2.27.0 is installed or that Stellar settlement/Bazaar works. Recheck the most recent stable compatible release at execution and before submission. +**Version truth (2026-10-07):** `spikes/stellar-x402/package.json` and its lockfile still pin `@x402/stellar`, `@x402/core` and `@x402/mcp` **2.26.0** for the original limited import/readiness spike. [npm](https://www.npmjs.com/package/@x402/stellar) lists **2.27.0** as latest. The [PR #4 Actions smoke run](https://github.com/TheAliphant/proofrail/actions/runs/37692829203) installed all three **2.27.0** packages temporarily on Node 22 and passed **3/3** import/network-constant/MCP-readiness tests (**0 failures**); the original pinned spike and Python jobs also passed. This is **limited import compatibility evidence only**, **not** a pinned production upgrade, live Stellar settlement, canonical wire/E2E conformance, or a completed Bazaar. Re-pin and audit the compatible stable dependency set and independently complete network-level acceptance before making any stronger claim. ## Requirement → existing evidence → funded work → proof From bad12de7cf7c9c2489cde2c57e09f8697e2dd37e Mon Sep 17 00:00:00 2001 From: TheAliphant <113637984+TheAliphant@users.noreply.github.com> Date: Wed, 7 Oct 2026 23:57:04 +0200 Subject: [PATCH 4/5] docs(scf46): add 2.27.0 CI result to interest evidence with explicit limitations --- grants/scf46-interest.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/grants/scf46-interest.md b/grants/scf46-interest.md index 08c4416..9c329dc 100644 --- a/grants/scf46-interest.md +++ b/grants/scf46-interest.md @@ -17,7 +17,7 @@ Build a production-ready, permissively licensed Stellar x402 facilitator and nat ProofRail is already public and working: deterministic economic-work receipts, SHA-256 tamper detection, CLI verification, x402 exact-payment challenge validation, and EVM/Base ERC-20 settlement verification. Separately, the private autonomous labour runtime already operates against real machine-executable work providers and a live Base USDC/x402 receive route. The grant project would not expose the private commercial routing engine; it would build the open Stellar infrastructure requested by the RFP. ## RFP implementation plan -The *proposed* work will build on the official `@x402/stellar`, not reimplement Stellar settlement primitives. The public readiness spike pins/import-tests version **2.26.0** only; npm listed **2.27.0** as latest on 2026-10-07. Latest-compatible-stable repinning and full integration tests are still outstanding. No grant-funded Stellar infrastructure is claimed as deployed. Proposed scope: +The *proposed* work will build on the official `@x402/stellar`, not reimplement Stellar settlement primitives. The public readiness spike and lockfile still pin **2.26.0**. npm lists **2.27.0** as latest on 2026-10-07. A separate [PR #4 CI run](https://github.com/TheAliphant/proofrail/actions/runs/37692829203) temporarily installed aligned official **2.27.0** packages and passed **3/3 limited import/network/MCP readiness tests** on Node 22, with no manifest/lockfile update. **A pinned SDK upgrade, dependency audit, deployed Stellar flows and full testnet/pubnet conformance remain outstanding.** No grant-funded Stellar infrastructure is claimed as deployed. Proposed scope: 1. **Facilitator** — `/verify`, `/settle`, `/supported` on testnet and pubnet; strict Soroban auth-entry and `__check_auth` validation, ledger expiry, non-custodial exact settlement, SEP-41/USDC (7 decimals) and accurate `extra.areFeesSponsored`. Make testnet **free/frictionless**, mainnet operator fees **configurable including zero**, and caller auth/metering/rate limits **configurable and documented**. Package hosted, self-hosted and in-resource-server **self-facilitation** paths. 2. **Stellar Bazaar** — `/discovery/resources` with `type`, `payTo`, `network`, `extensions`, `limit`, `offset`; natural-language `/discovery/search` with cursors, `partialResults` and published ranking evaluation. Automatically schema-validate/index discovery payloads for HTTP and MCP, verify seller identity/route templates, soft-drop poisoning, report indexing outcome/reason in **`EXTENSION-RESPONSES`**. Provide low-boilerplate seller helpers, including **per-parameter descriptions**, and interoperable off-chain metadata. From 5e1c3512824e8fd912b6da5efeb3a4f813458c99 Mon Sep 17 00:00:00 2001 From: TheAliphant <113637984+TheAliphant@users.noreply.github.com> Date: Wed, 7 Oct 2026 23:57:13 +0200 Subject: [PATCH 5/5] docs(scf46): synchronize draft's version evidence with successful limited 2.27.0 smoke --- grants/stellar-scf46-full-submission.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/grants/stellar-scf46-full-submission.md b/grants/stellar-scf46-full-submission.md index ec4919f..3cb9ffc 100644 --- a/grants/stellar-scf46-full-submission.md +++ b/grants/stellar-scf46-full-submission.md @@ -34,7 +34,7 @@ Public readiness today: - CLI verification; - x402 exact-payment challenge validation; - Base/EVM ERC-20 settlement verification; -- `@x402/stellar`, `@x402/mcp`, and `@x402/core` **2.26.0 pinned and import-tested** in a limited public readiness spike, **not** facilitator/Bazaar integration. As checked 2026-10-07, npm listed `@x402/stellar` **2.27.0** as latest. A compatible stable upgrade, lockfile/license audit and rerun are still pending; +- The public lockfile still pins `@x402/stellar`, `@x402/mcp` and `@x402/core` **2.26.0** (limited import tests only). npm lists **2.27.0** as latest on 2026-10-07; [PR #4 CI run](https://github.com/TheAliphant/proofrail/actions/runs/37692829203) temporarily installed all three at **2.27.0** and passed **3/3 import/network/MCP-readiness tests** on Node 22, without modifying the lockfile. A permanent compatible version upgrade, dependency/license audit, canonical both-network E2E and settlement evidence are **still pending**; - Filecoin Open Grant proposal #2194 for a separate archival adapter; - requirement-by-requirement Stellar RFP conformance matrix.