[MPP 2/3] spike(x402): credit-card verifier seam — buildCardRequirement + Stripe cardSettleFunc

[bussyjd]

Stacked on #605 (the CRD + --pay-with card flag). Both land in integration/v0.11.0-rc1. Once #605 merges, this auto-retargets to the integration branch.

What

A spike showing how the MPP credit-card method (Stripe stripe.charge) plugs into the existing x402 verifier without disturbing the crypto path. Grounded on the real wire from github.com/cp0x-org/mppx/stripe (the community Go MPP SDK — verified it does implement Stripe charge).

• internal/x402/card.go (new):
  • buildCardRequirement() — emits the card option as a 402 accepts[] entry mirroring the MPP stripe.chargechallenge.request (amount in minor units + currency/decimals + methodDetails{networkId,paymentMethodTypes}).
  • cardSettleFunc + stripeCardSettler — charges a buyer's pre-authorized Shared Payment Token by creating+confirming a Stripe PaymentIntent (POST /v1/payment_intents, shared_payment_granted_token, confirm=true, Basic auth, idempotency key).
  • parseCardCredential() — decodes the base64 X-PAYMENT card payload {spt, externalId}.
  • serveCardGated() — in-process HandleProxy branch: 402 when unpaid, Stripe charge then proxy when paid, X-PAYMENT-RESPONSE receipt on success.
• internal/x402/config.go — RouteRule.Card (*CardRoute) marks a card route.
• internal/x402/verifier.go — matchPaidRouteFull + HandleProxy dispatch on rule.IsCard(), leaving the crypto path byte-for-byte.

Tests (card_test.go): requirement shape, credential parsing, Stripe form body, and the serveCardGated gate (402 unpaid / proxy on paid / 402 on settle failure) with a fake settler.

SPIKE scope — clearly marked inline, NOT production-wired

• RouteRule.Card is not yet populated by the ServiceOffer route source (serviceoffer_source.go) from spec.payment.card — the integration follow-up.
• Stripe secret key read from STRIPE_SECRET_KEY; production must read a per-offer Kubernetes Secret.
• Charges before serving (mppx Verify semantics); production should split authorize-before-serve from capture-after-success, add SPT replay defense, and persist references.

Adversarial review: 0 confirmed P0/P1; crypto path unchanged. The Stripe SPT field name (shared_payment_granted_token) matches the mppx reference — validate against a live Stripe "machine payments" account before productionizing.

[OisinKyne]

Can this close if hermes are gaining payments in their next version?

[bussyjd]

Superseded by #651, the clean MPP payments compatibility PR stacked on top of #649.

[bussyjd]

Stacked on #605 (the CRD + --pay-with card flag). Both land in integration/v0.11.0-rc1. Once #605 merges, this auto-retargets to the integration branch.

What

A spike showing how the MPP credit-card method (Stripe stripe.charge) plugs into the existing x402 verifier without disturbing the crypto path. Grounded on the real wire from github.com/cp0x-org/mppx/stripe (the community Go MPP SDK — verified it does implement Stripe charge).

• internal/x402/card.go (new):
  • buildCardRequirement() — emits the card option as a 402 accepts[] entry mirroring the MPP stripe.chargechallenge.request (amount in minor units + currency/decimals + methodDetails{networkId,paymentMethodTypes}).
  • cardSettleFunc + stripeCardSettler — charges a buyer's pre-authorized Shared Payment Token by creating+confirming a Stripe PaymentIntent (POST /v1/payment_intents, shared_payment_granted_token, confirm=true, Basic auth, idempotency key).
  • parseCardCredential() — decodes the base64 X-PAYMENT card payload {spt, externalId}.
  • serveCardGated() — in-process HandleProxy branch: 402 when unpaid, Stripe charge then proxy when paid, X-PAYMENT-RESPONSE receipt on success.
• internal/x402/config.go — RouteRule.Card (*CardRoute) marks a card route.
• internal/x402/verifier.go — matchPaidRouteFull + HandleProxy dispatch on rule.IsCard(), leaving the crypto path byte-for-byte.

Tests (card_test.go): requirement shape, credential parsing, Stripe form body, and the serveCardGated gate (402 unpaid / proxy on paid / 402 on settle failure) with a fake settler.

SPIKE scope — clearly marked inline, NOT production-wired

• RouteRule.Card is not yet populated by the ServiceOffer route source (serviceoffer_source.go) from spec.payment.card — the integration follow-up.
• Stripe secret key read from STRIPE_SECRET_KEY; production must read a per-offer Kubernetes Secret.
• Charges before serving (mppx Verify semantics); production should split authorize-before-serve from capture-after-success, add SPT replay defense, and persist references.

Adversarial review: 0 confirmed P0/P1; crypto path unchanged. The Stripe SPT field name (shared_payment_granted_token) matches the mppx reference — validate against a live Stripe "machine payments" account before productionizing.

[OisinKyne]

Can this close if hermes are gaining payments in their next version?

[bussyjd]

Superseded by #651, the clean MPP payments compatibility PR stacked on top of #649.

[bussyjd]

Stacked on #605 (the CRD + --pay-with card flag). Both land in integration/v0.11.0-rc1. Once #605 merges, this auto-retargets to the integration branch.

What

A spike showing how the MPP credit-card method (Stripe stripe.charge) plugs into the existing x402 verifier without disturbing the crypto path. Grounded on the real wire from github.com/cp0x-org/mppx/stripe (the community Go MPP SDK — verified it does implement Stripe charge).

• internal/x402/card.go (new):
  • buildCardRequirement() — emits the card option as a 402 accepts[] entry mirroring the MPP stripe.chargechallenge.request (amount in minor units + currency/decimals + methodDetails{networkId,paymentMethodTypes}).
  • cardSettleFunc + stripeCardSettler — charges a buyer's pre-authorized Shared Payment Token by creating+confirming a Stripe PaymentIntent (POST /v1/payment_intents, shared_payment_granted_token, confirm=true, Basic auth, idempotency key).
  • parseCardCredential() — decodes the base64 X-PAYMENT card payload {spt, externalId}.
  • serveCardGated() — in-process HandleProxy branch: 402 when unpaid, Stripe charge then proxy when paid, X-PAYMENT-RESPONSE receipt on success.
• internal/x402/config.go — RouteRule.Card (*CardRoute) marks a card route.
• internal/x402/verifier.go — matchPaidRouteFull + HandleProxy dispatch on rule.IsCard(), leaving the crypto path byte-for-byte.

Tests (card_test.go): requirement shape, credential parsing, Stripe form body, and the serveCardGated gate (402 unpaid / proxy on paid / 402 on settle failure) with a fake settler.

SPIKE scope — clearly marked inline, NOT production-wired

• RouteRule.Card is not yet populated by the ServiceOffer route source (serviceoffer_source.go) from spec.payment.card — the integration follow-up.
• Stripe secret key read from STRIPE_SECRET_KEY; production must read a per-offer Kubernetes Secret.
• Charges before serving (mppx Verify semantics); production should split authorize-before-serve from capture-after-success, add SPT replay defense, and persist references.

Adversarial review: 0 confirmed P0/P1; crypto path unchanged. The Stripe SPT field name (shared_payment_granted_token) matches the mppx reference — validate against a live Stripe "machine payments" account before productionizing.

[OisinKyne]

Can this close if hermes are gaining payments in their next version?

[bussyjd]

Superseded by #651, the clean MPP payments compatibility PR stacked on top of #649.

[bussyjd]

Stacked on #605 (the CRD + --pay-with card flag). Both land in integration/v0.11.0-rc1. Once #605 merges, this auto-retargets to the integration branch.

What

A spike showing how the MPP credit-card method (Stripe stripe.charge) plugs into the existing x402 verifier without disturbing the crypto path. Grounded on the real wire from github.com/cp0x-org/mppx/stripe (the community Go MPP SDK — verified it does implement Stripe charge).

• internal/x402/card.go (new):
  • buildCardRequirement() — emits the card option as a 402 accepts[] entry mirroring the MPP stripe.chargechallenge.request (amount in minor units + currency/decimals + methodDetails{networkId,paymentMethodTypes}).
  • cardSettleFunc + stripeCardSettler — charges a buyer's pre-authorized Shared Payment Token by creating+confirming a Stripe PaymentIntent (POST /v1/payment_intents, shared_payment_granted_token, confirm=true, Basic auth, idempotency key).
  • parseCardCredential() — decodes the base64 X-PAYMENT card payload {spt, externalId}.
  • serveCardGated() — in-process HandleProxy branch: 402 when unpaid, Stripe charge then proxy when paid, X-PAYMENT-RESPONSE receipt on success.
• internal/x402/config.go — RouteRule.Card (*CardRoute) marks a card route.
• internal/x402/verifier.go — matchPaidRouteFull + HandleProxy dispatch on rule.IsCard(), leaving the crypto path byte-for-byte.

Tests (card_test.go): requirement shape, credential parsing, Stripe form body, and the serveCardGated gate (402 unpaid / proxy on paid / 402 on settle failure) with a fake settler.

SPIKE scope — clearly marked inline, NOT production-wired

• RouteRule.Card is not yet populated by the ServiceOffer route source (serviceoffer_source.go) from spec.payment.card — the integration follow-up.
• Stripe secret key read from STRIPE_SECRET_KEY; production must read a per-offer Kubernetes Secret.
• Charges before serving (mppx Verify semantics); production should split authorize-before-serve from capture-after-success, add SPT replay defense, and persist references.

Adversarial review: 0 confirmed P0/P1; crypto path unchanged. The Stripe SPT field name (shared_payment_granted_token) matches the mppx reference — validate against a live Stripe "machine payments" account before productionizing.

[OisinKyne]

Can this close if hermes are gaining payments in their next version?

[bussyjd]

Superseded by #651, the clean MPP payments compatibility PR stacked on top of #649.

[bussyjd]

Stacked on #605 (the CRD + --pay-with card flag). Both land in integration/v0.11.0-rc1. Once #605 merges, this auto-retargets to the integration branch.

What

A spike showing how the MPP credit-card method (Stripe stripe.charge) plugs into the existing x402 verifier without disturbing the crypto path. Grounded on the real wire from github.com/cp0x-org/mppx/stripe (the community Go MPP SDK — verified it does implement Stripe charge).

• internal/x402/card.go (new):
  • buildCardRequirement() — emits the card option as a 402 accepts[] entry mirroring the MPP stripe.chargechallenge.request (amount in minor units + currency/decimals + methodDetails{networkId,paymentMethodTypes}).
  • cardSettleFunc + stripeCardSettler — charges a buyer's pre-authorized Shared Payment Token by creating+confirming a Stripe PaymentIntent (POST /v1/payment_intents, shared_payment_granted_token, confirm=true, Basic auth, idempotency key).
  • parseCardCredential() — decodes the base64 X-PAYMENT card payload {spt, externalId}.
  • serveCardGated() — in-process HandleProxy branch: 402 when unpaid, Stripe charge then proxy when paid, X-PAYMENT-RESPONSE receipt on success.
• internal/x402/config.go — RouteRule.Card (*CardRoute) marks a card route.
• internal/x402/verifier.go — matchPaidRouteFull + HandleProxy dispatch on rule.IsCard(), leaving the crypto path byte-for-byte.

Tests (card_test.go): requirement shape, credential parsing, Stripe form body, and the serveCardGated gate (402 unpaid / proxy on paid / 402 on settle failure) with a fake settler.

SPIKE scope — clearly marked inline, NOT production-wired

• RouteRule.Card is not yet populated by the ServiceOffer route source (serviceoffer_source.go) from spec.payment.card — the integration follow-up.
• Stripe secret key read from STRIPE_SECRET_KEY; production must read a per-offer Kubernetes Secret.
• Charges before serving (mppx Verify semantics); production should split authorize-before-serve from capture-after-success, add SPT replay defense, and persist references.

Adversarial review: 0 confirmed P0/P1; crypto path unchanged. The Stripe SPT field name (shared_payment_granted_token) matches the mppx reference — validate against a live Stripe "machine payments" account before productionizing.

[OisinKyne]

Can this close if hermes are gaining payments in their next version?

[bussyjd]

Superseded by #651, the clean MPP payments compatibility PR stacked on top of #649.

[bussyjd]

Stacked on #605 (the CRD + --pay-with card flag). Both land in integration/v0.11.0-rc1. Once #605 merges, this auto-retargets to the integration branch.

What

A spike showing how the MPP credit-card method (Stripe stripe.charge) plugs into the existing x402 verifier without disturbing the crypto path. Grounded on the real wire from github.com/cp0x-org/mppx/stripe (the community Go MPP SDK — verified it does implement Stripe charge).

• internal/x402/card.go (new):
  • buildCardRequirement() — emits the card option as a 402 accepts[] entry mirroring the MPP stripe.chargechallenge.request (amount in minor units + currency/decimals + methodDetails{networkId,paymentMethodTypes}).
  • cardSettleFunc + stripeCardSettler — charges a buyer's pre-authorized Shared Payment Token by creating+confirming a Stripe PaymentIntent (POST /v1/payment_intents, shared_payment_granted_token, confirm=true, Basic auth, idempotency key).
  • parseCardCredential() — decodes the base64 X-PAYMENT card payload {spt, externalId}.
  • serveCardGated() — in-process HandleProxy branch: 402 when unpaid, Stripe charge then proxy when paid, X-PAYMENT-RESPONSE receipt on success.
• internal/x402/config.go — RouteRule.Card (*CardRoute) marks a card route.
• internal/x402/verifier.go — matchPaidRouteFull + HandleProxy dispatch on rule.IsCard(), leaving the crypto path byte-for-byte.

Tests (card_test.go): requirement shape, credential parsing, Stripe form body, and the serveCardGated gate (402 unpaid / proxy on paid / 402 on settle failure) with a fake settler.

SPIKE scope — clearly marked inline, NOT production-wired

• RouteRule.Card is not yet populated by the ServiceOffer route source (serviceoffer_source.go) from spec.payment.card — the integration follow-up.
• Stripe secret key read from STRIPE_SECRET_KEY; production must read a per-offer Kubernetes Secret.
• Charges before serving (mppx Verify semantics); production should split authorize-before-serve from capture-after-success, add SPT replay defense, and persist references.

Adversarial review: 0 confirmed P0/P1; crypto path unchanged. The Stripe SPT field name (shared_payment_granted_token) matches the mppx reference — validate against a live Stripe "machine payments" account before productionizing.

[OisinKyne]

Can this close if hermes are gaining payments in their next version?

[bussyjd]

Superseded by #651, the clean MPP payments compatibility PR stacked on top of #649.

[bussyjd]

Stacked on #605 (the CRD + --pay-with card flag). Both land in integration/v0.11.0-rc1. Once #605 merges, this auto-retargets to the integration branch.

What

A spike showing how the MPP credit-card method (Stripe stripe.charge) plugs into the existing x402 verifier without disturbing the crypto path. Grounded on the real wire from github.com/cp0x-org/mppx/stripe (the community Go MPP SDK — verified it does implement Stripe charge).

• internal/x402/card.go (new):
  • buildCardRequirement() — emits the card option as a 402 accepts[] entry mirroring the MPP stripe.chargechallenge.request (amount in minor units + currency/decimals + methodDetails{networkId,paymentMethodTypes}).
  • cardSettleFunc + stripeCardSettler — charges a buyer's pre-authorized Shared Payment Token by creating+confirming a Stripe PaymentIntent (POST /v1/payment_intents, shared_payment_granted_token, confirm=true, Basic auth, idempotency key).
  • parseCardCredential() — decodes the base64 X-PAYMENT card payload {spt, externalId}.
  • serveCardGated() — in-process HandleProxy branch: 402 when unpaid, Stripe charge then proxy when paid, X-PAYMENT-RESPONSE receipt on success.
• internal/x402/config.go — RouteRule.Card (*CardRoute) marks a card route.
• internal/x402/verifier.go — matchPaidRouteFull + HandleProxy dispatch on rule.IsCard(), leaving the crypto path byte-for-byte.

Tests (card_test.go): requirement shape, credential parsing, Stripe form body, and the serveCardGated gate (402 unpaid / proxy on paid / 402 on settle failure) with a fake settler.

SPIKE scope — clearly marked inline, NOT production-wired

• RouteRule.Card is not yet populated by the ServiceOffer route source (serviceoffer_source.go) from spec.payment.card — the integration follow-up.
• Stripe secret key read from STRIPE_SECRET_KEY; production must read a per-offer Kubernetes Secret.
• Charges before serving (mppx Verify semantics); production should split authorize-before-serve from capture-after-success, add SPT replay defense, and persist references.

Adversarial review: 0 confirmed P0/P1; crypto path unchanged. The Stripe SPT field name (shared_payment_granted_token) matches the mppx reference — validate against a live Stripe "machine payments" account before productionizing.

[OisinKyne]

Can this close if hermes are gaining payments in their next version?

[bussyjd]

Superseded by #651, the clean MPP payments compatibility PR stacked on top of #649.

[bussyjd]

Stacked on #605 (the CRD + --pay-with card flag). Both land in integration/v0.11.0-rc1. Once #605 merges, this auto-retargets to the integration branch.

What

A spike showing how the MPP credit-card method (Stripe stripe.charge) plugs into the existing x402 verifier without disturbing the crypto path. Grounded on the real wire from github.com/cp0x-org/mppx/stripe (the community Go MPP SDK — verified it does implement Stripe charge).

• internal/x402/card.go (new):
  • buildCardRequirement() — emits the card option as a 402 accepts[] entry mirroring the MPP stripe.chargechallenge.request (amount in minor units + currency/decimals + methodDetails{networkId,paymentMethodTypes}).
  • cardSettleFunc + stripeCardSettler — charges a buyer's pre-authorized Shared Payment Token by creating+confirming a Stripe PaymentIntent (POST /v1/payment_intents, shared_payment_granted_token, confirm=true, Basic auth, idempotency key).
  • parseCardCredential() — decodes the base64 X-PAYMENT card payload {spt, externalId}.
  • serveCardGated() — in-process HandleProxy branch: 402 when unpaid, Stripe charge then proxy when paid, X-PAYMENT-RESPONSE receipt on success.
• internal/x402/config.go — RouteRule.Card (*CardRoute) marks a card route.
• internal/x402/verifier.go — matchPaidRouteFull + HandleProxy dispatch on rule.IsCard(), leaving the crypto path byte-for-byte.

Tests (card_test.go): requirement shape, credential parsing, Stripe form body, and the serveCardGated gate (402 unpaid / proxy on paid / 402 on settle failure) with a fake settler.

SPIKE scope — clearly marked inline, NOT production-wired

• RouteRule.Card is not yet populated by the ServiceOffer route source (serviceoffer_source.go) from spec.payment.card — the integration follow-up.
• Stripe secret key read from STRIPE_SECRET_KEY; production must read a per-offer Kubernetes Secret.
• Charges before serving (mppx Verify semantics); production should split authorize-before-serve from capture-after-success, add SPT replay defense, and persist references.

Adversarial review: 0 confirmed P0/P1; crypto path unchanged. The Stripe SPT field name (shared_payment_granted_token) matches the mppx reference — validate against a live Stripe "machine payments" account before productionizing.

[OisinKyne]

Can this close if hermes are gaining payments in their next version?

[bussyjd]

Superseded by #651, the clean MPP payments compatibility PR stacked on top of #649.