41. X402

Decision

Toll is an optional economics Domain with two separated planes: a Counting House for quote handling and accounting, and an Irreversible Gate for one independently verified settlement effect. It is neither a mandatory wallet, global auto-payment interceptor, nor Agent authority.

HTTP 402, an invoice, or any provider quote is an untrusted proposal. It may describe terms; it cannot authorize signing, settlement, retry, identity, access, or a larger budget. x402, L402, Lightning invoices, Wallet Connect, Nostr Zaps, and future rails are distinct adapters, not aliases.

Remote casting and teaching a missing Spell are distinct purchased resources. They cannot share a quote or idempotency identity merely because one peer offers both. Payment satisfies neither peer authentication, task admission, teaching quarantine, publication, activation, nor authority.

The commitment before the signature

The Counting House may parse a versioned challenge, normalize integer monetary units, compare candidate costs, reserve a budget, and reconcile receipts. It holds no spend key. An authorization binds authenticated Principal and budget owner, merchant/service, method and canonical destination, request digest and purchased resource, asset/network, maximum amount including fees, expiry, redirect policy, and idempotency key.

The Dispatcher may consider an admitted quote only after capability, privacy, policy, and resource feasibility. Cheap is not eligible. Policy rejects it, applies one matching bounded low-risk standing authority, or parks the Run for live Magus consent over the exact terms. Novel or significant spend requires HitL. Consent means this exact maximum, never whatever a later challenge asks.

Accounting reserves worst-case exposure before signing. The isolated Irreversible Gate revalidates the pinned authorization and live reservation, enforces per-effect and rolling caps, atomically consumes the reservation, signs once, submits once, and records a stable external-effect identity. Unknown version, scheme, network, destination, amount, fee bound, changed quote, or expired authority fails closed. No model or ordinary tool receives a wallet or general signing surface.

One paid-request rite

destination-pinned request → quote → validate and reserve → reject / standing authority / live consent
→ revalidate → sign and submit once → one proof-bearing replay → reconcile settlement and delivery

After independently authorized settlement, the original connector can make at most one proof-bearing replay to the same pinned destination; that replay cannot begin another payment. Payment and delivery are not atomic. A settled charge can yield no useful result, and a successful response does not make content true. Refund, credit, dispute, expiry, paid-but-undelivered, and ambiguous outcomes are durable, visible states. An unknown settlement is investigated and reconciled—never answered with a second signature.

Budgets, effects, and restore

Tithe records currency-neutral tokens, generated media, concurrency, queue weight, and hardware time against a stable Principal or service grant even with every payment adapter disabled. A paid quota grant cannot mint or widen a Sigil, expose memory or tools, bypass consent, or displace protected local work. Currency-free Legion work still needs quotas, reservation, attribution, and evidence.

Quote, reservation, authorization, submission, settlement, delivery, refund, expiry, and ambiguity form a durable idempotent receipt chain. Keys, signatures, bearer proofs, preimages, invoices, and wallet credentials never enter prompts, ordinary projected configuration, logs, traces, or artifacts. Oculus can observe redacted transitions and reconciliation lag; a trace is not the financial ledger. Restore cannot rewind money: spending stays closed until external rail state reconciles.

Extensions may add bounded quote parsers, rails, signers, and paid Portal connectors, but not arbitrary global middleware, unrestricted keys, rival ledger truth, or a bypass of host authorization. The first implementation pins one exact protocol profile and conformance corpus.

Delivery and consequences

This Covenant is Designed, not payment capability. No Toll package, quote/budget ledger, reservation, authorization, signer, settlement path, safe 402 response, reconciliation, or budget enforcement ships. State of Work owns that public boundary; Toll owns operated doctrine.

Safe delivery begins with immutable financial identities and integer money types, then quote, budget, reservation, and receipt accounting without money movement; an isolated capped signer; one allowlisted test connector proven through crash/replay; and only then seller routes, metering, and optional rails.

Toll makes economic consequence attributable, bounded, interruptible, and reconcilable, while requiring durable accounting, key custody, explicit parked/ambiguous caller states, and later marketplace, refund, dispute, legal, and abuse domains.