{"criteria_id":"listing-consistency/v1","criteria_revision":"1.0.0","family":"listing-consistency/v1","family_note":"Criteria id listing-consistency/v1 is the coordinator's proposal in the M-33 brief, recorded as an interpretation in REGISTRY.md (the D1 scoping names no separate criteria id).","ops":["check","example","promise","bazaar"],"ops_not_offered":[],"corpus":{"id":"listing-consistency-corpus/v1","sha256":"7b78aeb01be7868c59ea985f41588c2b991f2c82d4cb04505e6fec497ef200b1"},"corpus_pin_definition":"The corpus pin is the SHA-256 of the corpus's canonical serialization (the corpus object excluding its sha256 field), computed and verifiable by the published harness (harness.mjs). Expected outputs inside corpus cases are derived from the criteria text by an independent implementation in gen-corpus.mjs (never the engine's code path), and each case labels its provenance (constructed from on-disk fleet records vs synthetic).","price":{"usdc_units_per_call":20000,"label":"$0.02","basis":"per listing check (per op call)"},"free_tier":{"per_day":100,"min_interval_ms":5000,"on_exhaustion":"402"},"input_contract":{"body":"One JSON request body carrying exactly one op payload (listing for check/example/promise; payload for bazaar) plus caller? on the free pre-check only.","caps":{"body_bytes":262144,"price_micro":1000000000000,"max_timeout_seconds":86400,"declared_delivery_seconds":2592000},"over_cap":"A request body over 262,144 bytes is a free pre-gate refusal naming the cap.","validation":"The submission is validated FREE, before any payment: shape, per-field rules, and (for op check) the target-URL policy. A malformed submission fails free, never consumes a payment, and never triggers a fetch. The live probe runs only after payment verification (or a verified-marker resume)."},"input_contract_text":"Input contract: the request body is one JSON object carrying exactly one op payload plus caller? (free pre-check only). The op is named by the route (POST /check, /example, /promise, /bazaar) and, on the free pre-check, by an op field with the same name. (check) { listing: { url (REQUIRED string, http/https, no embedded credentials), method (REQUIRED, one of GET/POST/PUT/PATCH/DELETE/HEAD), network (REQUIRED string, 1-64 chars), asset (REQUIRED string, 1-128 chars), price_micro (REQUIRED integer, 0 to 1,000,000,000,000 USDC micro-units — the listing's stated price in atomic units) } }. (example) { listing: { example_input (REQUIRED — any JSON value, present as a key), input_schema (REQUIRED plain object: the route's own declared input schema in the published subset — optional type, which must be 'object' when present; optional required array of field names; optional properties object mapping field names to { type (one of string/number/integer/boolean/object/array), enum (optional array of allowed values) }) } }. (promise) { listing: { max_timeout_seconds (REQUIRED integer 1 to 86,400 — the quoted maxTimeoutSeconds), declared_delivery_seconds (REQUIRED integer 0 to 2,592,000 — the seller's declared delivery time in seconds) } }. (bazaar) { payload (REQUIRED plain object — one captured payment payload), facilitator (optional string, 1-64 chars, recorded as submitted) }.","malformed_rule":"Malformed submissions (named FREE refusals, before any payment): body not a plain object or op payload missing (listing_required / payload_required); check — url missing or not a string (url_required), url failing the published target-URL policy (url_policy: scheme not http/https, embedded credentials, or unparseable), method missing (method_required) or outside the closed method list (method_unsupported), network missing/empty/over 64 chars (network_required), asset missing/empty/over 128 chars (asset_required), price_micro missing (price_required) or not an integer in range (price_malformed); example — example_input key absent (example_input_required), input_schema missing or not a plain object (input_schema_required), input_schema.type present and not 'object' or properties present and not a plain object (input_schema_malformed); promise — max_timeout_seconds missing (max_timeout_required) or not an integer in range (max_timeout_malformed), declared_delivery_seconds missing (declared_delivery_required) or not an integer in range (declared_delivery_malformed); bazaar — payload missing or not a plain object (payload_required), facilitator present but not a string of 1-64 chars (facilitator_malformed). A malformed submission fails free and never consumes a payment, and never triggers a fetch.","check_rule":"Op check grading: the live endpoint is probed once (the listing's method, no body, no credentials, no payment; 5-second timeout; 65,536-byte body cap; redirects not followed). Live values are read from the 402 challenge body accepts[0] and, where the body leg lacks a field, from the base64-decoded PAYMENT-REQUIRED header's accepts[0]. Grades: url_form — MATCH when the listing URL is concrete (no '{' or '}' or '*' anywhere and no path segment starting with ':'), else MISMATCH; method_402 — NOT-OBSERVABLE when the probe did not complete, else MATCH when the live status is 402, else MISMATCH (live status printed); resource_url — NOT-OBSERVABLE when no live resource is present, else MATCH when the live resource.url (or body resource string) equals the called URL exactly, else MISMATCH; price — NOT-OBSERVABLE when no live amount is present, else MATCH when the live amount (amount, falling back to maxAmountRequired; digits only) equals price_micro numerically, else MISMATCH; asset_form — MATCH when the listing asset is a contract address (a Solana base58 string decoding to 32 bytes, or an EVM 0x-prefixed 40-hex-character address), else MISMATCH (a ticker or name string is MISMATCH); asset_live — NOT-OBSERVABLE when no live asset is present, else MATCH/MISMATCH on exact equality; network_live — NOT-OBSERVABLE when no live network is present, else MATCH/MISMATCH after the published normalisation (the slug 'solana' and the CAIP-2 'solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp' name the same network; 'solana-devnet' and 'solana:EtWTRABZaYq6iMfeYKouRu166VU2xqa1' likewise; every other value compares byte-for-byte). Outcome state: UNREACHABLE when the probe did not complete; INCONSISTENT when any grade is MISMATCH; PARTIALLY-OBSERVABLE when no grade is MISMATCH but at least one is NOT-OBSERVABLE; CONSISTENT otherwise. An over-cap live body is graded as observed: body fields are NOT-OBSERVABLE and the over-cap factor is printed.","example_rule":"Op example grading (mechanical, published subset): the declared example input is validated against the route's own declared input schema as submitted. If the schema declares no required fields and no properties, the outcome is NOT-ASSESSABLE. If the example input is not a plain object while the schema declares required fields or properties, the outcome is INVALID with every declared field graded MISSING. Otherwise each required field grades PRESENT or MISSING, and each property present in the example grades TYPE-MATCH or TYPE-MISMATCH against its declared type (integer requires a whole number; number accepts integers; enum, when declared, grades ENUM-MATCH or ENUM-MISMATCH). Fields present in the example but not declared in properties are counted as undeclared_fields and never fail the check. Outcome VALID when no field fails, else INVALID. This check makes NO payment to and does NOT execute the listed route; it validates the declared example against the declared schema only.","promise_rule":"Op promise grading: quoted maxTimeoutSeconds and the seller's declared delivery time are compared as stated fields, in seconds. Outcome CONSISTENT when declared_delivery_seconds <= max_timeout_seconds, else INCONSISTENT; the margin (max_timeout_seconds - declared_delivery_seconds, negative when inconsistent) is printed. Nothing is probed, timed, or measured — the comparison is of the two stated fields only.","bazaar_rule":"Op bazaar grading (the bazaar-echo check): one submitted payment payload is inspected in memory. Factors: resource_present — PRESENT when payload.resource is a plain object or a non-empty string, else ABSENT; resource_url — PRESENT when resource is a plain object with a non-empty string url, else ABSENT; bazaar_present — PRESENT when payload.extensions is a plain object whose bazaar entry is a plain object, else ABSENT; bazaar_output_schema — PRESENT when the bazaar object carries an outputSchema plain object, else ABSENT. Outcome: ABSENT when bazaar_present is ABSENT; COMPLETE when bazaar is present and every published expected key (outputSchema) is present; INCOMPLETE otherwise. The facilitator, when submitted, is printed as submitted; the expected-key list is the same for every facilitator in v1. The payload is never forwarded, verified, or settled by this op.","target_url_policy":"Target-URL policy (A1 / payability/v1 §5, applied exactly): the submitted URL must use http or https; must carry no embedded credentials (no userinfo); and is fetched once with a 5-second timeout, a response-body cap of 65,536 bytes, and redirects NOT followed (a redirect response is graded as received). Malformed URLs and policy violations are free refusals before any payment. An unreachable endpoint or a timeout is a paid check outcome (UNREACHABLE, graded as observed), never an error or a crash. Validate-before-the-gate: URL validation runs free in both the pre-check and the paid op, before the payment gate; the target fetch itself runs only after payment verification (or on a verified-marker resume with no second charge).","methods":["GET","POST","PUT","PATCH","DELETE","HEAD"],"grades":["MATCH","MISMATCH","NOT-OBSERVABLE"],"check_states":["CONSISTENT","INCONSISTENT","PARTIALLY-OBSERVABLE","UNREACHABLE"],"example_states":["VALID","INVALID","NOT-ASSESSABLE"],"promise_states":["CONSISTENT","INCONSISTENT"],"bazaar_states":["COMPLETE","INCOMPLETE","ABSENT"],"bazaar_expected_keys":["outputSchema"],"probe":{"timeout_ms":5000,"body_cap_bytes":65536,"redirects":"not followed","credentials":"none","payment":"none"},"verdict_grammar":{"line":"LISTING CONSISTENCY — op: <op> · outcome: <outcome state> · matches: <n> · mismatches: <n> · not-observable: <n> — <check-end UTC>","vocabulary":"Per-op outcome states are the published closed lists (check_states / example_states / promise_states / bazaar_states). The counts in the line are the census of the op's graded factors (for example: field grades; for bazaar: PRESENT counted as matches, ABSENT as mismatches, with not-observable 0). There is no composite score, grade, or band anywhere in this service."},"free_precheck":"The free pre-check (POST /precheck) validates the submitted op payload under the published contract (including the target-URL policy for op check) and returns assessability ONLY: the common signed fields, whether the submission is assessable (or the free refusal naming the failure), the op, and NO grades, NO live values, and NO probe (the endpoint is NOT fetched). Free allowance: 100 per day per caller wallet, minimum interval 5,000 ms, 402 on exhaustion.","custody":{"construction":"In-memory processing within a single request lifetime; submissions and probed challenges persist nowhere, on any path including errors.","ledger_closed_fields":["payer wallet","timestamp/day","price (USDC units) with the CAD fair-market-value block (rate, rate date, basis, cad_pending, refund)","payment tx id + Solana fee (lamports)","criteria version","verdict line","op","outcome state","house flag"],"ledger_note":"The ledger list above is closed: adding a field is a criteria/handling version change. The ledger NEVER carries the listing URL, any listing field value, any live challenge value, or any hash of them.","errors":"Error handling is closed-form: static strings plus numeric facts only (lengths against caps, rule ids). No error path interpolates any part of a submission beyond the published refusal codes."},"forbidden":"Forbidden in every surface of this service (report, pre-check, errors, ledger, metrics): any composite score or grade; any guessed or inferred field value (unobserved fields are NOT-OBSERVABLE); any fetch before the payment gate or outside the target-URL policy; any payment to, or execution of, a listed route by the example op; any forwarding, verification, or settlement of a payload submitted to the bazaar op.","reconciliation_boundary":"MANDATORY RECONCILIATION — published boundary against the presence cluster (FIX-CANDIDATES §D1; MASTER-QUEUE row M-33): Q-10 (F2 Listing-Presence Verdict, master queue M-10, $0.01 per target) returns coarse presence states for a submitted target (x402 endpoint / MCP server / A2A agent) including CHALLENGE-MISMATCH and a listing-claim comparison at probe level; it does not grade field-level equality and does not compare price. Q-28 (B2 Seller-Side Discoverability Audit, master queue M-38, $0.05) is a signed report over the seller's OWN artefacts (agents.json / well-known / OpenAPI / llms.txt consistency) plus presence and accuracy on venues the seller claims; it does not probe a third-party listing against live behaviour. Q-29 (Combined MCP Presence + Discovery-Conformance, master queue M-39, $0.02) grades MCP servers: presence in enumerated registries plus server/discover and tools/list conformance against a named spec version; it covers no non-MCP 402 surface and grades no listing field. D1 (this service) has distinct ground none of the three grades: FIELD-LEVEL EQUALITY between a third-party catalogue listing claim and the endpoint's live behaviour — called URL vs resource.url, listing price vs the live 402 price, method answering 402, asset form and equality, network — plus the example-validity, promise-consistency, and bazaar-echo legs. The fleet never sells the same probe twice: presence is Q-10's ground, owned-artefact consistency is Q-28's, MCP presence/conformance is Q-29's, and field-level listing-vs-live equality including price is D1's alone.","honesty_line":"Every field is graded as observed: a field the live endpoint does not expose is NOT-OBSERVABLE, never guessed, inferred, or filled from the listing. Listing value and live value are both printed for every graded field. There is no composite score, grade, or band anywhere in this service.","retention":"Submissions and probed challenges are processed in memory only and are never stored — not in KV, not in logs, not in the payments ledger, not in metrics, and not in error records. The paid report carries the listing values and live values it graded, because that report is the delivery the buyer paid for. The payments ledger records only the closed field list published in the criteria. Because nothing is kept, a paid retry re-submits the listing.","payment_includes":"$0.02 per listing check. The fee is per op call: each listing (or payment payload, for the bazaar op) you submit to one op is charged at $0.02. The payment includes exactly one of: (check) one live probe of the listing's URL — fetched once, unauthenticated, with no payment, under the published target-URL policy — and a signed report grading each published field MATCH, MISMATCH (listing value vs live value printed), or NOT-OBSERVABLE: called URL vs the live challenge's resource.url, listing price vs the live 402 price, whether the listing's method answers 402 at all, whether the listing's asset is a contract address rather than a string (and whether it equals the live asset), the live network, and whether the listing URL is concrete rather than a route template; (example) a mechanical validation of the listing's declared example input against the route's own declared input schema — this check makes no payment to and does not execute the listed route; (promise) a comparison, as stated fields, of the quoted maxTimeoutSeconds against the seller's declared delivery time; (bazaar) an inspection of one submitted payment payload for resource and extensions.bazaar presence and schema completeness. Factors are printed for every field; no composite score is computed. A free pre-check validates the submission's shape before any payment, fetches nothing, and returns no grades. Submissions are processed in memory only and are never stored; the payments ledger records only the payer, the time, the price, the op, the outcome state, and the verdict line.","kill_line":"Kill line (M-33 / D1, under the operator's 2026-11-03 build-bank-hold doctrine): build, bank, and hold; judged at the fleet's periodic reviews. There is NO demand kill line for this item. Day-0 = first outside paid settle (accounting only; house proofs never count). Tripwires, all stop-and-review: (1) refunds >5% in any 30-day window; (2) free use >10x paid use; (3) a wrong grade — a grade not derivable from the submitted listing and the observed live response under the published rules (the error enters the corpus first as a regression case, corrected rules publish as a new criteria version, the corpus re-passes at 100% before serving resumes; issued reports are never amended); (4) any fetch outside the published target-URL policy, or any fetch before the payment gate; (5) any composite score on any surface.","never":"This service never fetches a target before the payment gate; never follows redirects; never sends credentials or payment to a probed target; never guesses an unobserved field; never computes a composite score; never stores a submission or a probed challenge.","service":"listing-check","version":"1.0.0","endpoints":{"criteria":"GET /criteria (free)","precheck":"POST /precheck (free, input validation + assessability only: no grades, no probe)","check":"POST /check (paid, $0.02 per listing: live probe + field-level listing-vs-live comparison)","example":"POST /example (paid, $0.02 per listing: example-validity — no payment to and no execution of the listed route)","promise":"POST /promise (paid, $0.02 per listing: promise-consistency of the two stated time fields)","bazaar":"POST /bazaar (paid, $0.02 per payload: resource + extensions.bazaar presence and schema completeness)","metrics":"GET /metrics","not_offered":"Any other POST path answers NOT COVERED. No best-effort result is produced."}}