v0.5.0 — First customer settle live

The first real customer-facing x402 settlement went through the self-serve proxy flow on 2026-05-31. A live third-party API (CoinGecko BTC/ETH price feed) is now wrapped behind suverse-pay's /v1/proxy/... endpoint, paid per call in USDC on Base mainnet, with on-chain settlement verified end-to-end.

This release marks the transition from "wired up against documented spec" to "settling real money for real callers."

Milestone — first customer settle

• 7 successful on-chain settlements on Base mainnet through the CoinGecko proxy.
• First settled tx hash: 0xded439c578f10c3b606264e7eec2ff691684d2c0a939b3d02cc86e0826394009 — block 46709549.
• End-to-end demonstrated using the published @suverselabs/x402-client@0.1.0 buyer SDK, not a workspace-symlinked dev build.
• Settled via the coinbase-cdp adapter; CDP facilitator integration verified.
• Payer balance moved $2.7465 → $2.6765 (−$0.07 over 7 settles), platform fee 30 bps withheld per row.
• Live endpoint: https://proxy.suverse.io/v1/proxy/reskey_1166628d/prices

Network status

Network	Mainnet	Verified by real settle
Base (Coinbase L2)	✅ live	✅ this release
Solana	✅ live	⏳ wired, not yet exercised by customer
Cosmos · Noble (noble-1)	✅ live	⏳ wired, not yet exercised by customer
SKALE Base	⏳ scaffolded	testnet-only smoke; mainnet routing not yet productized

What shipped since v0.4.0

Self-serve proxy flow (the headline path)

• feat(proxy) — wrap any HTTPS API behind a paid endpoint, the core proxy app.
• fix(proxy) — header hygiene on upstream call + downstream response. Strips x-forwarded-* / x-real-ip / nginx infra headers on the upstream call (Cloudflare-fronted APIs like CoinGecko 403'd otherwise) and strips content-encoding + content-length from upstream responses (undici was double-gunzipping and aborting the socket).
• fix(coinbase-cdp) — persist EIP-712 domain extras for EVM USDC capabilities. CDP's /supported often omits extra for EVM kinds; static EVM_USDC_EIP712_DOMAINS floor now backs the adapter so 402 challenges always carry the EIP-712 domain.
• feat(proxy) — upstream health-probe pipeline (HC1–HC8): probe before 402 challenge, return 503 upstream_unavailable on failure, HEALTH_CHECK_TIMEOUT_MS env override, full test coverage.
• fix(proxy) — per-VM scheme in 402 challenges so Cosmos challenges accept on the buyer side.

Buyer SDK + MCP

• feat(packages) — @suverselabs/x402-client@0.1.0 published. Unified fetch-shaped buyer SDK covering 21 EVM chains, Solana, Cosmos Noble, and TRON gasfree (TIP-712 PermitTransfer). 165 tests; Cosmos + Solana mainnet settles proven on the wire-format probe.
• feat(mcp) — @suverselabs/x402-mcp@0.0.1 published. stdio MCP server for Claude Desktop / Cursor with catalog_search, catalog_compare, buy_and_call, list_recent_purchases.

Dashboard, catalog, buyer-mode

• feat(dashboard) — buyer-mode foundation (Seller/Buyer mode toggle, separate landing shell), agent API keys (sup_agent_<32>), per-chain wallet registration with on-chain validation, spending-limits accounting model, paginated payments table + CSV export, spend overview cards.
• feat(catalog) — auto-create listing on proxy creation, slug-based detail routes with How-to-use code snippets, admin moderation queue gated by ADMIN_EMAILS, sitemap.xml + robots.txt + /.well-known/x402 for ecosystem crawlers.
• feat(mobile) — PWA manifest + icons, hamburger drawer + responsive header, bottom-nav tab bar in PWA standalone mode, responsive Settles table, iOS safe-area + tap polish (Tasks M1–M5).
• feat(dashboard) — welcome tour + 3-step onboarding tracker, OAuth profile capture, in-app Help page, inline tooltips on high-value form fields, success banner on proxy detail, empty-state CTAs.

Protocol surface

• feat(adapter-mpp) — Tempo Moderato direct-RPC verify+settle, MPP POST /mpp/charge route, payments.protocol + mpp_method/intent columns. Stripe's Machine Payments Protocol now alongside x402 in the same gateway.
• feat(signer) — SKALE Base mainnet + Sepolia chain entries (Bridged USDC v2, EIP-3009 typehash verified on-chain), routing config + facilitator wiring for SKALE Base via PayAI. Mainnet smoke still pending.

Stability

• fix(mobile) — drawer panel createPortal out of backdrop-blur containing block; stop dragging pg into client bundle via the async header.
• fix(dashboard) — qualify proxy SELECT columns to avoid 42702 in JOIN; admin bypass for key + probe rate limits.

Try it

```bash

Pay-per-call against the live customer endpoint with the published SDK

npm install @suverselabs/x402-client

Browse the catalog

open https://suverse-pay.suverse.io/catalog

Wrap your own HTTPS API behind a paid endpoint

open https://suverse-pay.suverse.io/dashboard
```

Links

• Dashboard: https://suverse-pay.suverse.io/dashboard
• Public catalog: https://suverse-pay.suverse.io/catalog
• Facilitator: https://facilitator.suverse.io
• Buyer SDK: https://www.npmjs.com/package/@suverselabs/x402-client
• MCP server: https://www.npmjs.com/package/@suverselabs/x402-mcp

v0.3.1 — Real EVM smoke

Phase 3 patch. Closes Sub-task 4 — Coinbase CDP real-network smoke
on Base Sepolia, the last remaining deferred item from v0.3.0.

Added

• scripts/smoke/real-evm/ — 7-step real-network smoke suite
  for Coinbase CDP settlement on Base Sepolia (eip155:84532). Each
  04-settle / 06-facilitator-settle run broadcasts a real
  transferWithAuthorization to Base Sepolia via CDP and asserts
  the on-chain receipt status (eth_getTransactionReceipt) is
  0x1 within ~60 seconds. Exercises both the internal /settle
  admin surface AND the public /facilitator/settle surface, so
  the multi-chain facilitator surface is now real-tested on both
  Cosmos and EVM.
• Base Sepolia (eip155:84532) network support:
  • @suverse-pay/signer-evm — Circle's test USDC at
    0x036CbD53842c5426634e7929541eC2318f3dCF7e added to the
    trusted domain table. Note: the test contract's on-chain
    EIP-712 domain name() is "USDC" (not "USD Coin" like
    Base mainnet) — verified via eth_call.
  • @suverse-pay/adapter-coinbase-cdp — Base Sepolia capability
    registered alongside the mainnet EVM entries; CDP advertises
    eip155:84532 (exact / upto / batch-settlement) on
    /supported.
  • apps/api — Base Sepolia added to the production CDP
    capability set.
  • services/facilitator — eip155:84532:exact routes to
    coinbase-cdp in the facilitator routing config.

Fixed

• CDP wire-format envelope translation in the
  coinbase-cdp adapter. CDP's hosted facilitator implements
  x402V2PaymentRequirements with amount (not the spec's
  maxAmountRequired) AND requires an accepted field embedded
  inside the paymentPayload carrying the same requirements. The
  rest of the codebase uses canonical spec field names; the
  adapter's toCdpRequest now translates. Without this, the
  adapter's /verify / /settle against the real CDP endpoint
  always returned HTTP 400 with
  x402V2PaymentPayload requires 'accepted'. Caught by Sub-task 4
  on the first end-to-end attempt; covered by a new unit test
  (translates the spec wire format to CDP's internal x402V2 shape)
  to prevent silent regression.
• scripts/smoke/mocked/ — hard-pinned API_PORT=3333 in
  00-setup.sh and 07-settle-fallback.sh. The previous
  API_PORT="${API_PORT:-3333}" deferred to the caller's env; once
  a long-running dev gateway started using .env's API_PORT=3000,
  the mocked smoke would collide with EADDRINUSE 0.0.0.0:3000.
  Mocked smoke is a sandbox and must never use the prod port.
• scripts/smoke/facilitator-mocked/04-verify-evm.sh — added
  a fourth accepted outcome (HTTP 502 whose
  error.details.providerId == "coinbase-cdp"). Once CDP is wired
  with credentials, the synthetic test payload now reaches CDP,
  which rejects it at HTTP 400 (invalid signature: R is 0);
  httpJson throws on 4xx and the gateway surfaces this as 502
  with CDP attribution. This still proves the routing layer
  reached CDP — what the test was meant to check.

Verified

• Real Base Sepolia on-chain USDC settle via Coinbase CDP.
  Inaugural txs (txHashes recorded in the v0.3.1 GitHub release):
  • internal /settle path:
    0x618913...c74abfd
  • public /facilitator/settle path:
    0xac4ca1...39e21
• Idempotency on real CDP: replaying /settle with the same
  Idempotency-Key AND the same signed payload returns the same
  paymentId + same txHash, with exactly one row in
  payment_attempts — proven by an independent
  GET /payments/:id lookup after the replay.
• Both /verify and /settle paths against real CDP on Base
  Sepolia. Verify returns {isValid: true, payer}; settle returns
  a 32-byte txHash that subsequently lands on-chain.
• All 7 smoke suites green: mocked (10), real (9),
  mcp-mocked (7), mcp-real (4), facilitator-mocked (10),
  mcp-solana (5), real-evm (7 — new).
• CDP minimum settle amount on Base Sepolia is 1000 atomic
  USDC (= $0.001). Below that CDP returns
  {invalidReason: "amount_too_low"}; the smoke default is now
  set there.

Deferred

• CDP 4xx-as-verify-result handling. CDP returns
  {isValid: false, invalidReason, ...} as HTTP 400 (not 200), so
  the adapter's verify currently throws on every CDP rejection
  instead of returning a normalized {valid: false, errorCode}
  response. The CDP-attribution case is handled gracefully end to
  end, but the adapter should parse CDP 4xx bodies. Not in v0.3.1
  because the fix touches the common httpJson retry/throw path
  and warrants its own test surface.

v0.3.0 — Phase 3 stable

Phase 3 stable. Solana support across signer, PayAI adapter, MCP,
and a public x402 facilitator surface. Verified real on-chain on
both Noble grand-1 (Cosmos) and Solana devnet.

Added

• @suverse-pay/signer-solana — SPL transferChecked payload
  signing for the exact scheme on Solana mainnet (solana:5eykt4...)
  and devnet (solana:EtWTRABZ...). Builds a v0 VersionedTransaction
  with the required instruction layout (ComputeBudget × 2, then
  transferChecked, then Memo for uniqueness), partial-signs as the
  payer, and emits the canonical v2 {paymentPayload, paymentRequirements} envelope. Round-trip ed25519 verification
  asserted by the signer test suite.
• @suverse-pay/adapter-payai — PayAI facilitator adapter at
  https://facilitator.payai.network, registered alongside
  cosmos-pay and coinbase-cdp. Supports Solana mainnet
  (solana:5eykt4...) and devnet (solana:EtWTRABZ...) via the
  v2 schema (PayAI's wire format puts accepted and resource
  inside paymentPayload, distinct from the v1 envelope; the
  adapter handles the translation).
• Coinbase CDP Solana support in the existing coinbase-cdp
  adapter — declarative addition only, the wire format is
  identical to the EVM path. (network, asset, scheme) = (solana:5eykt4..., USDC, exact) is the primary route on Solana
  mainnet with PayAI as failover.
• Public x402 facilitator surface at /facilitator/* on
  apps/api:
  • GET /facilitator/health — liveness, no auth
  • GET /facilitator/supported — x402 spec §7.3 SupportedResponse
  • POST /facilitator/verify — x402 spec §7.1, no auth
  • POST /facilitator/settle — x402 spec §7.2, Bearer
    <resource-key> auth, rate-limited per key, idempotency-key
    derived from (payer, payload-hash, hourBucket). Routes across
    cosmos-pay, Coinbase CDP, and PayAI based on (network, scheme)
    with per-route failover.
• MCP Solana support: init_session accepts a BIP-39 mnemonic
  and derives the Solana base58 address alongside the existing
  Cosmos bech32 and EVM 0x-hex addresses; pay_and_call selects
  the signer-solana for solana:* networks via the
  selectSigner(network) dispatch and fetches a fresh devnet /
  mainnet blockhash at sign time (the signer doesn't cache them —
  Solana drops them after ~150 slots).
• scripts/smoke/mcp-solana/ — 5-step smoke that broadcasts a
  real SPL transferChecked on Solana devnet via PayAI. Includes a
  Node-only mock-x402-devnet resource server (no external deps —
  built on node:http) that emits 402 with v2 Solana
  PaymentRequirements and forwards PAYMENT-SIGNATURE to PayAI
  using the correct v2 envelope. Asserts a real devnet
  txSignature and idempotent replay.
• scripts/smoke/facilitator-mocked/ — 10-step smoke for the
  public /facilitator/* surface against a mocked gateway. Covers
  supported / health / verify (Cosmos + EVM) / settle (Cosmos) /
  settle without auth / settle with bad auth / rate limit /
  idempotency.

Verified

• Real Solana devnet settlement through MCP: agent → MCP →
  402 → MCP signs SPL transferChecked with CU limit 20_000 (the
  cap PayAI enforces; the previous default of 200_000 was rejected)
  → mock x402 forwards PAYMENT-SIGNATURE to PayAI /settle →
  PayAI co-signs and broadcasts to Solana devnet → real
  txSignature returned to the agent. Tx queryable on
  https://explorer.solana.com/tx/<sig>?cluster=devnet.
• Real Cosmos settlement (regression — unchanged from v0.2.0):
  MsgExec(MsgSend) on Noble grand-1 still passes the mcp-real
  suite end-to-end.
• Idempotent replay on Solana: a second pay_and_call with the
  same (payer, network, url, body, hourBucket) returns
  idempotentReplay: true with the same paymentId and
  txSignature — no second on-chain transaction.
• All 6 smoke suites green: mocked (10), real (9),
  mcp-mocked (7), mcp-real (4), facilitator-mocked (10),
  mcp-solana (5).

Deferred

• Coinbase CDP real-network smoke remains gated on a CDP API
  key. Static config + adapter unit tests cover the wire format;
  real settle awaits credentials.
• PayAI mainnet smoke — devnet is the only on-chain smoke that
  runs by default. Mainnet costs real money and is captured as
  IDEAS.md entry 8 for future scheduled runs.
• Self-serve resource-key issuance for the public
  /facilitator/* surface — keys are admin-bootstrapped today
  (IDEAS.md entries 9, 10).

v0.2.0 — Phase 2 stable: MCP server with real on-chain pay_and_call

Phase 2 stable. MCP server with multi-network signing and verified
real on-chain payment through the agent flow.

Added

• MCP server at apps/mcp exposing the suverse-pay x402 gateway
  to AI agents over the Model Context Protocol streamable-HTTP
  transport. Seven tools: init_session, list_providers,
  discover_endpoints, get_quote, pay_and_call,
  get_payment_status, end_session.
• Zero-custody session management: signing secrets held in
  per-process Buffer only, zeroed on Session.destroy(), never
  logged (pino redact list), never persisted, never transmitted.
  Idle sessions are swept every 60s.
• TypeScript signing packages:
  • @suverse-pay/signer-cosmos — ADR-036 PaymentPayload signing
    for the exact_cosmos_authz scheme on cosmos:grand-1.
    Byte-compatible with the cosmos-pay Go reference fixture.
  • @suverse-pay/signer-evm — EIP-3009 transferWithAuthorization
    signing for the exact scheme on Base, Polygon, and Arbitrum
    (USDC + Base EURC). Round-trip self-consistency verified via
    recoverTypedDataAddress for every (network, token) pair.
• Discovery aggregator @suverse-pay/discovery combining
  Coinbase Bazaar (live GET /v2/x402/discovery/search) and a
  cosmos catalog placeholder. Dedup by (resource, network, asset)
  tuple so the same URL with multiple payment options is preserved
  as separate entries.
• MCP-side idempotency cache keyed by
  sha256(payerAddress | network | url | sha256(body) | hourBucket).
  A replay of the same call within the same wall-clock hour returns
  the cached result without re-signing or re-submitting; the cache
  key explicitly excludes sessionId so a fresh MCP session for the
  same wallet still dedupes.
• Smoke suites:
  • scripts/smoke/mcp-mocked/ (7 steps) drives the MCP HTTP
    transport against a mock x402 endpoint + mock gateway with the
    real signers in the loop.
  • scripts/smoke/mcp-real/ (4 steps) reuses
    /home/govhub/x402-cosmos/examples/server as the paid endpoint
    and broadcasts a real MsgExec(MsgSend) on Noble testnet
    grand-1 through the MCP pay_and_call flow.
• Comprehensive apps/mcp/README.md with tool reference, env vars,
  Claude Desktop / Cursor config, and architecture diagram.

Verified

• End-to-end MCP pay-and-call on a live chain: agent → MCP →
  402 → ADR-036 sign → POST PAYMENT-SIGNATURE → cosmos-pay
  facilitator → on-chain MsgExec(MsgSend) on Noble grand-1 →
  retry response. Real txHash returned to the agent in the same
  tool result.
• Idempotency on-chain proof: two pay_and_call invocations
  with the same (sessionId, url, body) within an hour return the
  same paymentId and txHash with idempotentReplay: true; the
  mock x402 server's call counter shows exactly one paid request
  (no second on-chain broadcast).
• Cosmos signer byte-compatible with the cosmos-pay Go fixture:
  direct /verify against the live facilitator returns
  isValid: true for the TS-signed payload.
• EVM signing self-consistent via recoverTypedDataAddress
  round-trip for every trusted (network, token) pair.
• Zero-custody assertion: the canonical BIP-39 test mnemonic
  word "abandon" never appears in any surfaced error message
  across the 40-test MCP suite.
• x402 wire-format dual-mode: pay_and_call parses 402
  responses from both the v2 spec PAYMENT-REQUIRED header
  (base64 {accepts: [...]} envelope) AND the cosmos-pay
  middleware flat shape ({scheme, network, asset, ...} directly).
  Outbound PAYMENT-SIGNATURE is written in the cosmos-pay /
  x402-py compatible flat shape with scheme and network at the
  top level.
• All four smoke suites green: mocked (10/10), real (9/9),
  mcp-mocked (7/7), mcp-real (4/4).

Deferred to v0.3+

• EVM real-network smoke (requires a Coinbase CDP API key).
  EVM signing math is verified offline today.
• Solana signing and adapter — leading Phase 3 candidate given
  Solana's share of live x402 volume. See IDEAS.md item 4.
• PayAI adapter as a third facilitator across cosmos-pay /
  Coinbase CDP. See IDEAS.md item 5.
• Permit2 fallback for ERC-20s that don't implement EIP-3009
  (e.g., USDT, DAI).
• Cosmos mainnet (cosmos:noble-1) — requires a funded
  mainnet facilitator.
• Stdio MCP transport — only streamable HTTP is wired up.
• Resource-server facilitator mode — let an x402 middleware
  configure suverse-pay as its facilitator URL. See IDEAS.md
  item 6 for the architectural sketch.

v0.1.0 — Phase 1 stable

Phase 1 stable. Real-network smoke gate is green.

Added

• scripts/smoke/real/ — 9-step end-to-end suite that exercises the
  gateway against a live cosmos-pay facilitator on Cosmos testnet
  grand-1. Each 05-settle.sh run broadcasts a real
  MsgExec(MsgSend) and asserts the on-chain txHash round-trips
  through /settle and /payments/:id.
• Fixture generator at x402-cosmos/tools/fixture/ produces a fresh
  ADR-036-signed PaymentPayload + matching PaymentRequirements
  per invocation. Cross-repo, referenced over HTTP; no vendored Go
  code lands in this TypeScript monorepo.

Verified

• Idempotency invariant under real on-chain conditions: a duplicate
  /settle with the same Idempotency-Key returns the same
  paymentId and the same on-chain txHash, and /payments/:id
  reports exactly one attempt (no second broadcast).
• cosmos-pay HTTP integration via real /verify and /settle.
  /providers reports cosmos-pay healthy when the facilitator is
  reachable, and runtime capability discovery correctly supersedes
  the adapter's static mainnet capability with the testnet one
  the facilitator actually offers.

Deferred to v0.2+

• Coinbase CDP real-network smoke (requires CDP API key).
• Cross-provider fallback under real conditions (requires a second
  reachable facilitator).
• Race-replay terminal state polish (see "Known limitations" in
  README — duplicate /settle may transiently surface as pending).
• SIGHUP-style admin api_key rotation without server restart.

Phase 1 release candidate (v0.1.0-rc.1)

Phase 1 release candidate. All mocked Phase-1-done acceptance
criteria from TASK.md §"Required for Phase 1 done" are green:

• pnpm install && pnpm build exits 0 (7 packages).
• pnpm test exits 0 (284 unit tests, 1 documented skip).
• pnpm test:integration exits 0 (25 end-to-end tests against the
  live Docker Postgres + Redis with nock-intercepted provider HTTP).
• docker compose up -d && pnpm db:migrate && pnpm db:bootstrap
  applies the schema and seeds the admin api_key end-to-end against
  Postgres 15.
• bash scripts/smoke/mocked/run-all.sh PASSes all 10 endpoint
  scenarios from TASK.md §"Required for Phase 1 done" item 4, plus a
  bonus /verify step.
• README has a copy-paste runnable quick start (clone → docker compose
  → migrate → bootstrap → smoke).

Known limitations carried into Phase 2

• Race-replay of /settle may surface a payment in pending state.
  Exactly one row and one adapter HTTP call still happen (verified by
  the integration Promise.all test); clients should GET /payments/:id to see the terminal state. Phase 2 will hold the
  Redis lock through finalization.
• pnpm db:bootstrap --force rotation updates the on-disk hash; the
  running server keeps the prior hash in memory until restart.
  Documented in README; Phase 2 will add SIGHUP-style rotation.
• One vitest case (services/orchestrator/src/health-check.test.ts:177)
  is it.skipped because the 175ms wait + 50ms tick assertion is
  flaky under parallel test load. Phase 2 will rewrite with
  vi.useFakeTimers().

Release gate (NOT in this RC)

• Real-network smoke against a deployed cosmos-pay Cosmos testnet
  facilitator.
• Real-network smoke against Coinbase CDP x402 with a real API key.

Both are documented in TASK.md §"Required for v0.1.0 release tag".
The full v0.1.0 tag depends on at least item #7 (cosmos-pay
testnet) passing.