x402 合規一致性規範 v0.1
給 Agent 支付（x402 / MCP）結算前合規的一套機讀契約：每一種合規判決對應一個穩定 reason_code、一個 signal_class、一條 retry 規則。1:1 對齊線上真實的 11 道閘，可對免費端點復現。
端點【今天就返回】 reason_code / signal_class / retry / retry_hint（HTTP 狀態碼仍是 200/403/409）。 451/-4510 的換碼 = 提議中、尚未上線（換 HTTP 狀態碼是破壞性變更，須版本協商）。
1 · 信號類別與 retry 規則
| signal_class | 含義 | retry |
|---|---|---|
| ok | 已放行 | not_applicable |
| payment | 額度/預算（可補足） | retryable_after_funding |
| regulatory | 確定性合規 FAIL（制裁/混幣/吊銷/重放） | non_retryable |
| authorization | 歸因/授權/白名單/憑證 | retry_after_authorization |
| uncertain | 篩查不可得/不確定 | policy_dependent_backoff |
| client_error | 請求格式錯誤 | retry_after_fix |
2 · reason_code 分類（對齊真實 11 道閘）
| reason_code | signal_class | retry | 來自 |
|---|---|---|---|
| kya_unattributed | authorization | retry_after_authorization | KYA |
| mandate_revoked | authorization | non_retryable | KYA/Revoked |
| kya_proof_missing | authorization | retry_after_authorization | KYA/Proof |
| kyc_required | authorization | retry_after_authorization | KYA/KYC |
| invalid_input | client_error | retry_after_fix | Input |
| over_per_tx_limit | payment | retryable_after_funding | Firewall/Limit |
| over_daily_limit | payment | retryable_after_funding | Firewall/Velocity |
| payee_not_allowlisted | authorization | retry_after_authorization | Firewall/Allowlist |
| mandate_intent_mismatch | authorization | retry_after_authorization | Mandate |
| sanctioned_or_high_risk_payee | regulatory | non_retryable | Screening/AML |
| behavioral_anomaly | uncertain | policy_dependent_backoff | Behavior/Anomaly |
| replay_detected | authorization | non_retryable | Mandate/Replay |
| clear | ok | not_applicable | allow |
| elevated_risk_payee | uncertain | policy_dependent_backoff | screening: review |
| screening_unavailable | uncertain | policy_dependent_backoff | screening unavailable |
| idempotency_key_invalid | client_error | retry_after_fix | POST /api/pay: malformed Idempotency-Key (400) |
| idempotency_key_reused | client_error | retry_after_fix | POST /api/pay: Idempotency-Key reused with a different body (422) |
| idempotency_request_in_progress | uncertain | policy_dependent_backoff | POST /api/pay: original request with this Idempotency-Key still running (409) |
| key_scope_denied | authorization | retry_after_authorization | API key restricted to other scopes by its holder (403) |
| key_ip_denied | authorization | retry_after_authorization | API key restricted to an IP allowlist by its holder; this request came from elsewhere (403) |
3 · 可復現測試向量（對免費端點）
curl "https://oceanalt.com/api/risk?addr=0x8589427373D6D84E98730D7795D8f6f8731FDA16" # → verdict:"risky", reason_code:"sanctioned_or_high_risk_payee", signal_class:"regulatory", retry:"non_retryable"
curl "https://oceanalt.com/api/risk?addr=0x742d35Cc6634C0532925a3b844Bc454e4438f44e" # → verdict:"clear", reason_code:"clear", signal_class:"ok", retry:"not_applicable"