{"criteria_id":"payer-preflight/v1","criteria_revision":"1.0.0","family":"payer-preflight/v1","family_note":"Family payer-preflight/v1 (FIX-CANDIDATES §C): the brief pins the family id payer-preflight/v1 as this build's criteria id (§C6 names no separate criteria id) — recorded as an interpretation in REGISTRY.md.","ops":["upto","validity"],"ops_not_offered":[],"corpus":{"id":"validity-corpus/v1","sha256":"84517be97c1376a0bc7767a96e9d55acc6d6e640c0ee3cb9b817205da7706099"},"corpus_pin_definition":"The corpus pin is the SHA-256 of the corpus's canonical serialization (the corpus object excluding its sha256 field), computed and verifiable by the published harness (harness.mjs). Expected outputs inside corpus cases are derived from the criteria text by an independent implementation in gen-corpus.mjs (never the engine's code path), and each case labels its provenance (constructed from on-disk fleet records vs synthetic). Evaluation instants are pinned per case.","price":{"usdc_units_per_call":10000,"label":"$0.01","basis":"per challenge/payload, per op"},"free_tier":{"per_day":100,"min_interval_ms":5000,"on_exhaustion":"402"},"tight_thresholds":{"evm":{"unit":"seconds","tight_max_remaining":60,"rule":"STALE when remaining <= 0; TIGHT when 0 < remaining <= 60; OK when remaining > 60."},"svm":{"unit":"slots","tight_max_remaining":150,"slot_seconds_approx":0.4,"rule":"STALE when slots <= 0; TIGHT when 0 < slots <= 150 (about 60 s at the stated 0.4 s/slot approximation); OK when slots > 150. The verdict is computed in slots; the seconds figure is a labelled approximation only."}},"guidance":{"STALE":"ABORT — do not submit or settle this payload: it is expired at the stated evaluation instant. Abort and re-quote: obtain a fresh challenge and a fresh payload, then re-check validity before signing or submitting.","TIGHT":"TIGHT — the remaining window is inside the published tight threshold. Submit immediately, or abort and re-quote: any delay (signing, human approval, a retry) may expire the payload mid-flight.","OK":"OK — the payload remains valid at the stated evaluation instant. Submit promptly: validity is still bounded by the printed expiry, and this verdict does not extend it."},"verdicts":["STALE","TIGHT","OK"],"machinery_statuses":["ALLOWANCE-ALREADY-SUFFICIENT","APPROVAL-SPONSORED-BY-FACILITATOR","APPROVAL-TRANSACTION-REQUIRED","NOT-ESTABLISHABLE-FROM-ARTEFACT","NO-UPTO-MACHINERY-FOR-NETWORK-IN-RECORD"],"rails":["evm","svm"],"input_contract":{"body":"upto: { challenge, caller? (free pre-check only) }. validity: { payload, evaluation_at_unix?, caller? (free pre-check only) }. precheck: the same body plus op.","caps":{"body_bytes":262144,"ceiling_atomic":"1000000000000000000"},"over_cap":"A request body over 262,144 bytes is a free pre-gate refusal naming the cap.","validation":"The artefact is validated FREE, before any payment: shape and per-field rules under the published malformed rule. A malformed artefact fails free and never consumes a payment. The analysis itself is computed only after payment verification (or a verified-marker resume)."},"input_contract_text":"Input contract: for the upto op the request body is one JSON object { challenge, caller? (free pre-check only) }; challenge carries scheme (REQUIRED, must be upto), network (REQUIRED), payTo (REQUIRED), asset (REQUIRED), max_amount_required (REQUIRED — the ceiling in atomic units, a digit string or safe integer, at most 10^18), asset_decimals (optional integer 0-18), permit2_allowance_sufficient (optional boolean), facilitator_sponsors_approval (optional boolean). For the validity op the body is { payload, evaluation_at_unix?, caller? (free pre-check only) }; payload carries rail (REQUIRED, evm or svm — closed list), for evm valid_before (REQUIRED, unix seconds), for svm last_valid_block_height and current_block_height (both REQUIRED, integers). evaluation_at_unix (body level, or inside payload) optionally states the evaluation instant; when absent, server time is used and printed. The free pre-check body additionally carries op (upto or validity).","malformed_rule":"Malformed artefacts (named FREE refusals, before any payment): upto — body or challenge missing or not an object (challenge_required); scheme missing (scheme_required) or not upto (scheme_not_upto); network missing (network_required); payTo missing (payto_required); asset missing (asset_required); max_amount_required missing (ceiling_required) or not a non-negative atomic integer at or below 10^18 (ceiling_malformed); asset_decimals present but not an integer 0-18 (decimals_malformed); a machinery flag present but not boolean (machinery_flag_malformed). Validity — body or payload missing or not an object (payload_required); rail missing (rail_required) or not evm/svm (rail_unsupported); evaluation_at_unix present but not a non-negative integer (evaluation_at_malformed); evm without valid_before (valid_before_required) or with a non-integer value (valid_before_malformed); svm missing a block height (block_height_required) or with a non-integer value (block_height_malformed). Pre-check — op missing (op_required) or not upto/validity (op_unsupported). A malformed artefact fails free and never consumes a payment.","computation_rule":"Computation: the upto statement prints the ceiling exactly as submitted (maximum_signable_atomic), its exact decimal rendering at the stated asset_decimals (no rounding; the fractional part is zero-padded, never trimmed) or NOT-ESTABLISHABLE-FROM-ARTEFACT where no decimals are stated, the machinery status under the published rule, and the one-signature-one-settlement property stated by the scheme. The validity analysis computes time remaining at the stated evaluation instant ONLY: EVM remaining = valid_before - evaluation instant (seconds); verdict STALE when remaining <= 0, TIGHT when 0 < remaining <= 60 seconds, OK when remaining > 60 seconds. SVM remaining = last_valid_block_height - current_block_height (slots); verdict STALE when slots <= 0, TIGHT when 0 < slots <= 150 slots, OK when slots > 150; the approximate-seconds figure (slots x 0.4) is labelled an approximation and never decides the verdict. Every factor is sourced from the artefact as submitted; what the artefact cannot establish is reported as such. There is no composite score.","evaluation_instant":"Every time verdict is computed at a STATED evaluation instant, printed in the delivery as evaluation_instant_unix and evaluation_instant (ISO). The caller may state it (evaluation_at_unix); otherwise server time is used. A verdict is reproducible from the artefact + the printed instant, and from nothing else.","free_precheck":"The free pre-check (POST /precheck) validates the submitted artefact under the published contract for the named op and returns assessability ONLY: the common signed fields, whether the artefact is assessable (or the free refusal naming the failure), artefact facts (for upto: scheme, network kind, ceiling present, decimals present; for validity: rail, evaluation instant submitted) — and NO ceiling statement, NO time remaining, and NO verdict. Free allowance: 100 per day per caller wallet, minimum interval 5,000 ms, 402 on exhaustion.","custody":{"construction":"In-memory processing within a single request lifetime; the submitted artefact persists nowhere, on any path including errors.","ledger_closed_fields":["payer wallet","timestamp/day","price (USDC units) with the CAD fair-market-value block (rate, rate date, basis, cad_pending, refund)","payment tx id + Solana fee (lamports)","criteria version","op","verdict line","house flag"],"ledger_note":"The ledger list above is closed: adding a field is a criteria/handling version change. The ledger NEVER carries any submitted artefact content or any free-form submitted text.","errors":"Error handling is closed-form: static strings plus numeric facts only (lengths against caps, rule ids). No error path interpolates any part of a submitted artefact beyond the published refusal codes."},"forbidden":"Forbidden in every surface of this service (report, pre-check, errors, ledger, metrics): any composite score or grade; any factor not sourced from the artefact as submitted; any ceiling, machinery, or time figure the artefact cannot establish, presented as established; any signature requested, produced, or relayed for the payer; any submission or broadcast of a payer payload.","boundary_statement":"Boundary: this service reads a payer's own submitted challenge/payload. It does not probe a seller endpoint (payability family), does not verify a settlement on-chain (settlement-evidence family), does not price a call (the C5 true-cost op of this family), and does not lint an unsigned payload's structure (the C1 pre-flight op of this family). It signs nothing for the payer, submits nothing, broadcasts nothing, holds no keys for the payer, and moves no funds.","honesty_line":"Every factor is sourced from the artefact as submitted — nothing is inferred beyond the artefact. What the artefact cannot establish is reported as such (NOT-ESTABLISHABLE-FROM-ARTEFACT or a named not_establishable entry), never filled in. Time verdicts are computed at the stated evaluation instant printed in the delivery, and from nothing else. This service never signs, submits, or broadcasts anything.","retention":"Submitted artefacts are processed in memory only and are never stored — not in KV, not in logs, not in the payments ledger, not in metrics, and not in error records. The paid report carries the artefact's published validity/ceiling fields and the computed factors, because that report is the delivery the buyer paid for. The payments ledger records only the closed field list published in the criteria. Because nothing is kept, a paid retry re-submits the artefact.","payment_includes":"$0.01 per challenge/payload. For the upto op, the payment includes: one ceiling-exposure statement for the one upto challenge you submit — the maximum signable amount exactly as the challenge states it (atomic units, plus the human-unit rendering where the artefact states the asset's decimals), the scheme machinery the artefact requires, and the one-signature-one-settlement property — each stated as a printed factor sourced from the challenge as submitted, with anything the artefact cannot establish reported as such. For the validity op, the payment includes: one validity analysis of the one signed payload you submit — the time remaining at a stated evaluation instant printed in the delivery (validBefore minus the evaluation instant for EVM; blockhash slots remaining for SVM) and a STALE / TIGHT / OK verdict under the published TIGHT thresholds, with abort-and-requote guidance. This service analyses artefacts only: it never signs, submits, or broadcasts anything. A free pre-check validates an artefact's shape before any payment and returns no ceiling statement and no verdict. Submitted artefacts are processed in memory only and are never stored; the payments ledger records only the closed field list published in the criteria.","kill_line":"Kill line (M-31 / C6, under the operator's 2026-11-03 build-bank-hold doctrine): build, bank, and hold; judged at the fleet's periodic reviews. There is NO demand kill line for this item. Day-0 = first outside paid settle (accounting only; house proofs never count). Tripwires, all stop-and-review: (1) refunds >5% in any 30-day window; (2) free use >10x paid use; (3) a wrong factor or verdict — a ceiling, machinery status, remaining time, or verdict not derivable from the artefact as submitted at the printed evaluation instant under the published thresholds (the error enters the corpus first as a regression case, corrected rules publish as a new criteria version, the corpus re-passes at 100% before serving resumes; issued reports are never amended); (4) the service ever signing, submitting, or broadcasting anything; (5) any composite score on any surface.","never":"This service analyses submitted artefacts only. It never signs, submits, or broadcasts anything: no signature is requested, produced, or relayed, and no payload is forwarded anywhere.","service":"validity-check","version":"1.0.0","endpoints":{"criteria":"GET /criteria (free)","precheck":"POST /precheck (free, input validation + assessability only: no ceiling statement, no time remaining, no verdict)","upto":"POST /upto (paid, $0.01 per challenge: signed ceiling-exposure statement)","validity":"POST /validity (paid, $0.01 per payload: signed validity analysis at a stated evaluation instant)","metrics":"GET /metrics","not_offered":"Any other POST path answers NOT COVERED — this worker serves ops upto and validity only."}}