ChainGraph · agentic payments · x402

Closing AgentCore's settlement_verified=false

The OpenAI×AWS AgentCore Payments cookbook [7] ships an agent that mints an x402 payment proof, gets a merchant receipt, and then reports settlement_verified=false by its own design: the cookbook's own words are that independent settlement and transaction finality require separate evidence. This page runs the cookbook's field shapes through the existing AINumbers nodes and the x402 Spend Evidence Pack chain that already exist to produce that separate evidence: a finality-classified, hash-bound receipt. It does not integrate with AgentCore, Bedrock, or any x402 facilitator; it maps their field names onto verifiers that already run entirely offline.

The gap

Two vendor statements, one shared boundary

AgentCore names the gap it leaves open. Circle, in the same week, names the same boundary from the settlement side: an onchain event proves occurrence, not quality or finality class. That is precisely the line art-492 draws between finality models.

“Merchant acceptance establishes that the paid request completed. Independent settlement and transaction finality require separate evidence.” The cookbook's own example therefore reports settlement_verified=false.
OpenAI×AWS AgentCore Payments cookbook [7]
“Onchain settlement proves that a transaction occurred and can contribute useful evidence, but payment volume alone does not prove quality and can be manipulated.”
Circle, “Building the open agentic economy,” 2026-08-12 [8]

Occurrence is not finality. Both vendors say the same thing from opposite sides of the transaction: a payment event happening is a different claim from that event being settled, final, and classifiable by evidentiary weight. art-492-classify-settlement-finality exists to make that distinction explicit and vendor-neutral rather than leave it implicit in a boolean flag.

Flow

Where the AINumbers nodes attach to the cookbook's own flow

Approval, proof, merchant, receipt, audit sequence: every stage in the cookbook has a corresponding node below. The evidence pack this page builds sits directly after the point where the cookbook itself stops and asks for separate evidence.

ApprovalGrant art-01 / art-476 x402 payment proof art-26 decoder Merchant Receipt + audit execution_hash on every step, art-513 settlement_verified=false stops here Cookbook boundary "independent settlement and finality require separate evidence" x402 Spend Evidence Pack art-590/591/592, then art-492 finality class Teal = where an AINumbers node attaches, hash-bound. Red = the boundary the cookbook itself names, honestly, as unclosed.
Nodes exercised

Cookbook field shapes, run through existing verifiers

Every node below is unmodified. Nothing here changes a kernel or its digest; this page runs the cookbook's own field names through what already exists and cites the resulting execution_hash.

art-01-ap2-mandate-chain-validator

Mandate-chain signature, scope, and limit-consistency integrity across an Intent→Cart→Payment trio: the shape ApprovalGrant maps onto.

art-16-google-ap2-mandate-builder

Builds an AP2 mandate from caller-declared terms.

art-17-ap2-mcp-policy-validator

Validates an AP2 mandate against an MCP-declared policy.

art-274-compile-work-mandate

Compiles a work mandate from caller-declared scope and constraints.

art-476-map-agent-payment-mandate

Translates a mandate declared under one protocol into another protocol's fields.

art-26-x402-payload-decoder-flow-simulator

Decodes and lints a base64 or JSON x402 PaymentPayload, the shape a PurchaseRequest/payment proof takes on the wire.

chain: x402 Spend Evidence Pack

art-590 EIP-712 digest recomputation → art-591 signer recovery → art-592 domain/nonce/window check. An evidence bundle, not a settlement proof.

art-513-public-money-settlement-receipt

Turns one caller-transcribed payment event into settlement evidence an audit authority can check: the Receipt shape's downstream landing point.

art-492-classify-settlement-finality

Classifies which of three settlement-finality models applies and its evidentiary weight, vendor-neutral. This is where “occurred” becomes “final, by which model.”

art-03-x402-settlement-modeler

Recommends a settlement rail based on finality needs across x402/Stripe-USDC/card/ACH/SWIFT.

art-394-x402-deferred-handshake-validator

Validates the shape of a Cloudflare deferred x402 handshake.

art-02-agent-spend-policy-simulator

Simulates synthetic agent transactions against a spend policy: the offline analog of the cookbook's policy.per_run_limit.

Worked examples

Three cookbook fields, run through their nodes, with the resulting execution_hash

Each example below is an existing, golden-parity-clean conformance vector for the node named, reused rather than freshly invented. Its output_payload was independently recomputed against the live kernel for this page and confirmed byte-identical before publishing; its execution_hash is computed the one canonical way, via chaingraph/kernels/_hash.mjs. No kernel or fixture file changes to any node ship with this page.

ApprovalGrant → mandate-chain integrity

art-01-ap2-mandate-chain-validator
cookbook: ApprovalGrant{approval_id, request_id, resource_url, purpose, maximum_amount, approved_by, approved_at, expires_at, currency}

A bounded pre-authorization, expressed as an AP2 Intent→Cart→Payment mandate trio with matching parent hashes and a scope ceiling, validates PASS across all 8 checks the node runs (signature-chain linkage, scope containment, expiry ordering, currency and merchant consistency).

execution_hashsha256:effeb3f1b34144404a0a97690595dfcbac32611eef034e0c7c091cb08eaf54b7existing vector, unchanged

PurchaseRequest / payment proof → payload lint

art-26-x402-payload-decoder-flow-simulator
cookbook: PurchaseRequest{request_id, resource_url, purpose, idempotency_key} · x402 PAYMENT-SIGNATURE header

A minimal x402 PaymentPayload ({"scheme":"exact","network":"base-sepolia","payload":{"signature":"0xabc123"}}) decodes cleanly and lints to a score of 92/100: two warnings (missing x402Version, missing payload.authorization), zero errors, three passes.

execution_hashsha256:4fd194704afe533c10ecaf0e6842b0fd7e41c4ac67e612eeb6e458903888e07aexisting vector, unchanged

Receipt → settlement evidence, single rail, at par

art-513-public-money-settlement-receipt
cookbook: Receipt{receipt_id, amount, currency, network, reused} · audit {sequence, event_type}

A $1,000 collection with a $2.50 itemised fee, credited at $997.50 through exactly one declared RTGS rail leg with its own finality basis, reconciles: expected credit matches amount credited (at-par, zero discrepancy), single-settlement status is SINGLE, and revenue-code attribution resolves against the caller's own table, with zero exceptions.

execution_hashsha256:2616ecae20c7cc4699d96a6b81ca09b9e93e660e33744616d1338381adc993bbexisting vector, unchanged
Verifiable compute

What “verifiable compute” means here, and what it does not

Circle's own market map names “attestations and verifiable compute, including trusted execution environments” [8] as a validation input. We ship the first half and not the second: 97% of our live deterministic nodes (605 of 619, re-derived from chaingraph.json on every build) carry a real risc0 groth16-bn254 zero-knowledge proof that the published output came from the published kernel, independently replayable offline by anyone. We do not run or attest to any trusted execution environment; TEE-based attestation is outside our scope, and this table makes no claim that our compute_proof and Circle's TEE mention are the same mechanism.

Scope

What this page does not do, stated plainly:

  • No custody. No node here holds, moves, or has ever held funds.
  • No settlement. Nothing on this page independently observes on-chain confirmation for a specific transaction; that is the same gap AgentCore names with settlement_verified=false, and it remains open here too.
  • No AgentCore, Bedrock, Agents SDK, or x402-facilitator integration. This is a field-mapping and verification page rather than a service dependency (Standing Orders #0).
  • No new kernels, no kernel edits, and no node fixture files were changed to build this page. The worked examples above cite existing, unmodified conformance vectors.

For the full field-by-field map across AgentCore, x402 v2, VPSF/STARK, ACP, AP2, ERC-8004, and MPP, including where our nodes assert nothing and say so, see the Agentic Payments Cookbook Map.

Agentic Payments Cookbook Map → VPSF Claim Algebra Verifier → How AIN Bridge Works → x402 Spend Evidence Pack chain →
Sources

Pinned snapshots cited above

  • [1] x402 v2 spec, §5.3.2 SettleResponse.transaction: “Blockchain transaction hash (empty string if settlement failed)”
  • [2] draft-vauban-x402-vpsf-algebra-01, §3.2 SettlementReceipt
  • [3] draft-vauban-x402-stark-receipts-00, line 17: “reference but does not provide a self-contained, offline-verifiable [receipt]”
  • [7] OpenAI×AWS AgentCore Payments cookbook plus AWS announcement: field shapes and the settlement_verified=false passage quoted above
  • [8] Circle, “Building the open agentic economy,” 2026-08-12/13

Full index with sha256, retrieval date, and section refs: research/AGENTIC-PAY-SNAPSHOT-INDEX-2026-08-17.md (workspace-root, not published). Numbering matches the Agentic Payments Cookbook Map's source list.