test(scf46): revalidate x402 Stellar 2.27.0 imports without overstating evidence

.github/workflows/test.yml

@@ -28,3 +28,37 @@ jobs:
           cache-dependency-path: spikes/stellar-x402/package-lock.json
       - run: npm ci
       - run: npm test
+
+  # Additive, PR-only 2.27.0 import gate; preserve the pinned 2.26.0 baseline above.
+  stellar-x402-227-smoke:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: spikes/stellar-x402
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: npm
+          cache-dependency-path: spikes/stellar-x402/package-lock.json
+      - name: Install pinned baseline
+        run: npm ci
+      - name: Overlay aligned x402 2.27.0 for smoke test (no lockfile change)
+        run: npm install --no-save --package-lock=false --ignore-scripts @x402/core@2.27.0 @x402/mcp@2.27.0 @x402/stellar@2.27.0
+      - name: Check actually installed package versions
+        run: |
+          node --input-type=module <<'NODE'
+          import assert from 'node:assert/strict';
+          import { readFileSync } from 'node:fs';
+          for (const name of ['core', 'mcp', 'stellar']) {
+            const pkg = JSON.parse(readFileSync(`node_modules/@x402/${name}/package.json`, 'utf8'));
+            assert.equal(pkg.version, '2.27.0', `${name} version mismatch`);
+            console.log(`@x402/${name}: ${pkg.version}`);
+          }
+          NODE
+      - name: Run non-settling official SDK import/readiness checks
+        run: npm test
+      - name: Ensure pinned 2.26 manifest and lock remain unchanged
+        run: git diff --exit-code -- package.json package-lock.json

grants/scf46-interest.md

@@ -17,7 +17,7 @@ Build a production-ready, permissively licensed Stellar x402 facilitator and nat
 ProofRail is already public and working: deterministic economic-work receipts, SHA-256 tamper detection, CLI verification, x402 exact-payment challenge validation, and EVM/Base ERC-20 settlement verification. Separately, the private autonomous labour runtime already operates against real machine-executable work providers and a live Base USDC/x402 receive route. The grant project would not expose the private commercial routing engine; it would build the open Stellar infrastructure requested by the RFP.
 
 ## RFP implementation plan
-The *proposed* work will build on the official `@x402/stellar`, not reimplement Stellar settlement primitives. The public readiness spike pins/import-tests version **2.26.0** only; npm listed **2.27.0** as latest on 2026-10-07. Latest-compatible-stable repinning and full integration tests are still outstanding. No grant-funded Stellar infrastructure is claimed as deployed. Proposed scope:
+The *proposed* work will build on the official `@x402/stellar`, not reimplement Stellar settlement primitives. The public readiness spike and lockfile still pin **2.26.0**. npm lists **2.27.0** as latest on 2026-10-07. A separate [PR #4 CI run](https://github.com/TheAliphant/proofrail/actions/runs/37692829203) temporarily installed aligned official **2.27.0** packages and passed **3/3 limited import/network/MCP readiness tests** on Node 22, with no manifest/lockfile update. **A pinned SDK upgrade, dependency audit, deployed Stellar flows and full testnet/pubnet conformance remain outstanding.** No grant-funded Stellar infrastructure is claimed as deployed. Proposed scope:
 
 1. **Facilitator** — `/verify`, `/settle`, `/supported` on testnet and pubnet; strict Soroban auth-entry and `__check_auth` validation, ledger expiry, non-custodial exact settlement, SEP-41/USDC (7 decimals) and accurate `extra.areFeesSponsored`. Make testnet **free/frictionless**, mainnet operator fees **configurable including zero**, and caller auth/metering/rate limits **configurable and documented**. Package hosted, self-hosted and in-resource-server **self-facilitation** paths.
 2. **Stellar Bazaar** — `/discovery/resources` with `type`, `payTo`, `network`, `extensions`, `limit`, `offset`; natural-language `/discovery/search` with cursors, `partialResults` and published ranking evaluation. Automatically schema-validate/index discovery payloads for HTTP and MCP, verify seller identity/route templates, soft-drop poisoning, report indexing outcome/reason in **`EXTENSION-RESPONSES`**. Provide low-boilerplate seller helpers, including **per-parameter descriptions**, and interoperable off-chain metadata.

grants/stellar-rfp-conformance.md

@@ -5,7 +5,7 @@ Related drafts: [SCF #46 interest package](scf46-interest.md) and [full submissi
 
 **Reconciled:** 2026-10-07. **Status:** pre-award design and readiness mapping only. The 2026-09-18 interest form was submitted through the SCF UI, without a confirmation number; eligibility, invitation, full-submission acceptance and grant award are **not confirmed**. SCF #46's published Build deadline is **2026-11-08**; the handbook still labels this RFP as introduced for **SCF #45**. Its availability/eligibility for #46 requires an explicit SCF confirmation before filing this draft.
 
-**Version truth:** `spikes/stellar-x402/package.json` pins `@x402/stellar`, `@x402/core` and `@x402/mcp` to **2.26.0** for limited import/readiness tests. [npm](https://www.npmjs.com/package/@x402/stellar) listed **2.27.0** as latest on 2026-10-07. This is **an upgrade/retest task**, not evidence that 2.27.0 is installed or that Stellar settlement/Bazaar works. Recheck the most recent stable compatible release at execution and before submission.
+**Version truth (2026-10-07):** `spikes/stellar-x402/package.json` and its lockfile still pin `@x402/stellar`, `@x402/core` and `@x402/mcp` **2.26.0** for the original limited import/readiness spike. [npm](https://www.npmjs.com/package/@x402/stellar) lists **2.27.0** as latest. The [PR #4 Actions smoke run](https://github.com/TheAliphant/proofrail/actions/runs/37692829203) installed all three **2.27.0** packages temporarily on Node 22 and passed **3/3** import/network-constant/MCP-readiness tests (**0 failures**); the original pinned spike and Python jobs also passed. This is **limited import compatibility evidence only**, **not** a pinned production upgrade, live Stellar settlement, canonical wire/E2E conformance, or a completed Bazaar. Re-pin and audit the compatible stable dependency set and independently complete network-level acceptance before making any stronger claim.
 
 ## Requirement → existing evidence → funded work → proof
 

grants/stellar-scf46-full-submission.md

@@ -34,7 +34,7 @@ Public readiness today:
 - CLI verification;
 - x402 exact-payment challenge validation;
 - Base/EVM ERC-20 settlement verification;
-- `@x402/stellar`, `@x402/mcp`, and `@x402/core` **2.26.0 pinned and import-tested** in a limited public readiness spike, **not** facilitator/Bazaar integration. As checked 2026-10-07, npm listed `@x402/stellar` **2.27.0** as latest. A compatible stable upgrade, lockfile/license audit and rerun are still pending;
+- The public lockfile still pins `@x402/stellar`, `@x402/mcp` and `@x402/core` **2.26.0** (limited import tests only). npm lists **2.27.0** as latest on 2026-10-07; [PR #4 CI run](https://github.com/TheAliphant/proofrail/actions/runs/37692829203) temporarily installed all three at **2.27.0** and passed **3/3 import/network/MCP-readiness tests** on Node 22, without modifying the lockfile. A permanent compatible version upgrade, dependency/license audit, canonical both-network E2E and settlement evidence are **still pending**;
 - Filecoin Open Grant proposal #2194 for a separate archival adapter;
 - requirement-by-requirement Stellar RFP conformance matrix.
 

spikes/stellar-x402/README.md

@@ -14,3 +14,17 @@ It does **not** implement the grant-funded facilitator or Bazaar. Those remain t
 npm ci
 npm test
 ```
+
+## 2.27.0 PR smoke gate (separate from the pinned baseline)
+
+The repository's [pull-request CI](../../.github/workflows/test.yml) now adds a non-settling compatibility check for the npm-published **2.27.0** versions of `@x402/core`, `@x402/mcp`, and `@x402/stellar`. It starts with `npm ci` against the **unchanged 2.26.0 lockfile**, temporarily overlays aligned 2.27.0 packages without updating package/lock files, asserts the installed versions, and runs the existing readiness tests on Node 22.
+
+**Evidence boundary:** A green PR smoke check verifies only the tested exports/network constants and MCP primitives on 2.27.0. It **does not** verify deployed facilitator routes, `/supported`, Stellar testnet/pubnet payments, `payload: {transaction}` wire compatibility, the Bazaar, `upto`, security audit, or the canonical x402 E2E suite. Those remain separate gates in [the SCF conformance matrix](../../grants/stellar-rfp-conformance.md). Do **not** relabel the previous pinned 2.26.0 test as proof that 2.27.0 passed unless the new CI job has actually completed successfully.
+
+For a local equivalent with working npm registry access (without changing the tracked lockfile), run from this directory:
+
+```bash
+npm ci
+npm install --no-save --package-lock=false --ignore-scripts @x402/core@2.27.0 @x402/mcp@2.27.0 @x402/stellar@2.27.0
+npm test
+```