STANDARD CONTRIBUTION · REPRODUCIBLE

x402 Compliance Conformance Pack v0.1

A machine-readable contract for pre-settlement compliance in agent payments (x402 / MCP): every compliance outcome maps to a stable reason_code, a signal_class, and a retry rule. Grounded 1:1 in our live 11-gate gateway, reproducible against a free endpoint.

STATUS — HONEST

Endpoints return reason_code / signal_class / retry / retry_hint today (HTTP status stays 200/403/409). 451/-4510 wire mapping = proposed, not yet shipped (changing a live status code is breaking; needs versioned negotiation).

1 · Signal classes & retry rules

signal_class	meaning	retry
ok	cleared	not_applicable
payment	budget / limit (fundable)	retryable_after_funding
regulatory	deterministic compliance FAIL	non_retryable
authorization	attribution / mandate / allowlist	retry_after_authorization
uncertain	screening unavailable / inconclusive	policy_dependent_backoff
client_error	malformed request	retry_after_fix

The point: a budget refusal, a regulatory refusal, and a temporary infra failure can look identical to an autonomous client yet each needs different handling. Standardizing retry per class prevents both silent PASS-through and infinite retry loops (LangChain/AutoGen/CrewAI).

2 · reason_code taxonomy (mapped to real gates)

reason_code	signal_class	retry	from
kya_unattributed	authorization	retry_after_authorization	KYA
mandate_revoked	authorization	non_retryable	KYA/Revoked
kya_proof_missing	authorization	retry_after_authorization	KYA/Proof
kyc_required	authorization	retry_after_authorization	KYA/KYC
invalid_input	client_error	retry_after_fix	Input
over_per_tx_limit	payment	retryable_after_funding	Firewall/Limit
over_daily_limit	payment	retryable_after_funding	Firewall/Velocity
payee_not_allowlisted	authorization	retry_after_authorization	Firewall/Allowlist
mandate_intent_mismatch	authorization	retry_after_authorization	Mandate
sanctioned_or_high_risk_payee	regulatory	non_retryable	Screening/AML
behavioral_anomaly	uncertain	policy_dependent_backoff	Behavior/Anomaly
replay_detected	authorization	non_retryable	Mandate/Replay
clear	ok	not_applicable	allow
elevated_risk_payee	uncertain	policy_dependent_backoff	screening: review
screening_unavailable	uncertain	policy_dependent_backoff	screening unavailable

Single source: lib/conformance.ts + lib/gates.ts.

3 · Reproducible test vectors (free endpoint)

① Sanctioned payee → regulatory / non_retryable

curl "https://oceanalt.com/api/risk?addr=0x8589427373D6D84E98730D7795D8f6f8731FDA16"
# → verdict:"risky", reason_code:"sanctioned_or_high_risk_payee", signal_class:"regulatory", retry:"non_retryable"

② Clear payee → ok / not_applicable

curl "https://oceanalt.com/api/risk?addr=0x742d35Cc6634C0532925a3b844Bc454e4438f44e"
# → verdict:"clear", reason_code:"clear", signal_class:"ok", retry:"not_applicable"

Machine-readable (JSON) ↗

/api/x402/conformance — same source, for other implementations

The standard behind it: RAP →

Responsible Agentic Payments

Provenance & non-claims: reason_code and retry are produced by the live gateway (/api/pay, /api/x402/decision, /api/risk); this page and the JSON are generated from the same source. Multi-transport (stdio/SSE/streamable) wire observations and the 451/-4510 mapping are not yet implemented — listed as proposed, to be contributed as reproducible vectors after they run, never as forward-looking claims. Compliance screening ≠ full/licensed AML compliance; clear/allow ≠ absolute safety.