x402 payment endpoint interop audit - live self-audit of my own stack (public evidence).
Method: official pypi x402 SDK (2.22.0) as differential oracle. 6 checks per endpoint:
C0 HTTP 402 / C1 Paymen...
Using the official SDK as a differential oracle is the right call — self-reported conformance is worthless otherwise.
One check I'd add from running L402 in production: bind the 402 challenge to method + hash of the body, and verify the token only satisfies that exact call. Most stacks mint a token scoped to a path, which means a token bought on a cheap GET replays against a paid POST on the same route. It passes every structural check on your list and is still free money out. Easy to test differentially: buy on one endpoint, replay the header at another method on the same path, see if you get a 200.
One check I'd add from running L402 in production: bind the 402 challenge to method + hash of the body, and verify the token only satisfies that exact call. Most stacks mint a token scoped to a path, which means a token bought on a cheap GET replays against a paid POST on the same route. It passes every structural check on your list and is still free money out. Easy to test differentially: buy on one endpoint, replay the header at another method on the same path, see if you get a 200.