Correct x402 evidence boundaries by mizuki0x · Pull Request #130 · open-covenant/covenant

mizuki0x · 2026-07-31T18:27:32Z

Summary

relabel the live paid API as bounded evidence, not identity or reputation
remove server-side fetches of untrusted on-chain URIs and validate the full 014 Registry account binding
replace the arbitrary reputation score with an exact, bounded transfer-activity summary
require an externally pinned expected key before a signature can bind to a publisher identity; the self-published key is discovery metadata
add a public-claim guard

Boundaries

The legacy /passport and /payai/reputation paths remain for compatibility. Their responses do not prove identity, x402 settlement, job delivery, quality, reputation, or W009/W011 enforcement. A signature verifies exact bytes against the expected key; publisher identity requires a separate trusted binding. Resource delivery and settlement are separate protocol outcomes.

Validation

npm test (12/12)
npm run typecheck
npm run build
node scripts/validate-claims.mjs
git diff --check

… PayAI settle, zauth telemetry)

…ical domain only

…ation passport/{asset} verifies on-chain identity (MPL Core asset + 014 Registry + Covenant attestation) via DAS; attest signs an ed25519 claim, verifiable against the published key. per-endpoint x402 pricing, PayAI-sponsored settle to treasury.

publish the ed25519 signing key + verification recipe at /.well-known/x402, and self-describe each attestation (alg, domain, canonicalization). an outsider can pin the key and check the signature without trusting the server.

…lds in openapi

…ify) a remote/stdio MCP any agent adds in one line, no binary, no keys, no prior use. three pure tools: covenant_reputation (on-chain USDC-settlement reputation 0-1000), covenant_agent_passport (MPL Core identity + attestation), covenant_verify (ed25519 attestation check, tamper-evident). reputation + passport reuse the x402-seller modules verbatim so free MCP and paid product can't drift; verify ports the attest scheme. streamable-http (stateless) for zero-install remote + stdio for npx/local. verified e2e both transports against live mainnet (real passport data, verify PASS/FAIL) with the MCP client sdk.

covenant_verified_ers picks a Covenant-verified rollup from the router, covenant_verify_enclave does a live DCAP check of a validator's TDX quote, covenant_er_provenance recomputes an agent's receipt hash-chain against the settlement program. Endpoints resolve from the router by validator identity, never from the caller.

GET /x402/er/enclave/:validator pulls a fresh quote from the router- listed endpoint, dcap-verifies it against the intel pccs, and wraps the result in the published attestation key. optional agent+provenance_root binding commits the agent's record into the quote challenge. open validators and bad requests are never charged.

cache the dcap wasm init instead of recompiling per request, put a timeout on the pccs collateral fetch and the rpc calls, decode attestations fail-closed, and stop leaking raw rpc errors to anonymous callers. only a 404 marks an er non-tee; a 5xx is transient. surface the tcb status in the pass line.

socket-security · 2026-07-31T19:30:03Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/@types/express@5.0.0
	npm/@zauthx402/sdk@0.1.14
	npm/@x402/express@2.15.0
	npm/@x402/svm@2.15.0
	npm/@x402/extensions@2.15.0
	npm/@x402/core@2.15.0
	npm/@x402/paywall@2.15.0
	npm/@types/node@22.19.21
	npm/tsx@4.22.4
	npm/express@5.1.0
	npm/@solana/web3.js@1.98.0

View full report

socket-security · 2026-07-31T19:30:04Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `@walletconnect/universal-provider` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: services/x402-seller/pnpm-lock.yaml → `npm/@x402/paywall@2.15.0` → `npm/@walletconnect/universal-provider@2.21.1` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@walletconnect/universal-provider@2.21.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `algorand-msgpack` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: services/x402-seller/pnpm-lock.yaml → `npm/@x402/paywall@2.15.0` → `npm/algorand-msgpack@1.1.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/algorand-msgpack@1.1.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `algosdk` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: services/x402-seller/pnpm-lock.yaml → `npm/@x402/paywall@2.15.0` → `npm/algosdk@3.6.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/algosdk@3.6.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `hi-base32` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: services/x402-seller/pnpm-lock.yaml → `npm/@x402/paywall@2.15.0` → `npm/hi-base32@0.5.1` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/hi-base32@0.5.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `porto` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: services/x402-seller/pnpm-lock.yaml → `npm/@x402/paywall@2.15.0` → `npm/porto@0.2.19` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/porto@0.2.19`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `porto` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: services/x402-seller/pnpm-lock.yaml → `npm/@x402/paywall@2.15.0` → `npm/porto@0.2.35` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/porto@0.2.35`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `preact` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: services/x402-seller/pnpm-lock.yaml → `npm/@x402/paywall@2.15.0` → `npm/preact@10.29.2` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/preact@10.29.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

covenant added 17 commits July 31, 2026 21:28

feat(x402-seller): public Covenant x402 v2 seller (agent attestation,…

add7d53

… PayAI settle, zauth telemetry)

fix(x402-seller): trust proxy so discovery URLs are https

a8da507

x402-seller: retire onrender host from provider hub (410 gone), canon…

b2f8cf7

…ical domain only

feat(x402-seller): make attestations independently verifiable

036f59b

publish the ed25519 signing key + verification recipe at /.well-known/x402, and self-describe each attestation (alg, domain, canonicalization). an outsider can pin the key and check the signature without trusting the server.

docs(x402-seller): tighten copy, fix stale attest comment

710a8e9

docs(x402-seller): document /.well-known/x402 + required response fie…

00ba111

…lds in openapi

add payai settlement-grounded reputation resource to x402 seller

dd3f58d

document payai reputation resource in openapi

12e4dd9

advertise x402 bazaar discovery extensions on seller routes

8db1f85

trust-mcp: dockerfile for render deploy

b680182

trust-mcp: brand display name as Covenant Guard

da65e7a

correct x402 evidence boundaries

905fb1c

mizuki0x force-pushed the feat/x402-seller branch from ed21fb4 to 905fb1c Compare July 31, 2026 19:29

clarify attestation trust binding

500b46a

mizuki0x mentioned this pull request Jul 31, 2026

Harden payment evidence and funded execution boundaries #132

Draft

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Correct x402 evidence boundaries - #130

Correct x402 evidence boundaries#130
mizuki0x wants to merge 18 commits into
mainfrom
feat/x402-seller

mizuki0x commented Jul 31, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jul 31, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jul 31, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

mizuki0x commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Boundaries

Validation

Uh oh!

socket-security Bot commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

mizuki0x commented Jul 31, 2026 •

edited

Loading

socket-security Bot commented Jul 31, 2026 •

edited

Loading

socket-security Bot commented Jul 31, 2026 •

edited

Loading