Agent incident playbook · practical first

x402 paid, but where is the result?

Keep receipt integrity, settlement and delivery as separate evidence.

Fix it first

1. Do not treat HTTP 402 as payment, or HTTP 200 as independent proof of settlement.
2. Keep receipt.valid distinct from settlement and delivery. A cryptographically valid receipt can coexist with delivery UNKNOWN.
3. Only retry an action when your idempotency and settlement evidence permit it. Use free advisory diagnosis to triage ambiguous outcomes.

Safe starter code

const evidence = {
  receipt: { valid: true },
  settlement: 'UNKNOWN',
  delivery: 'UNKNOWN',
};
const composite = evidence.receipt.valid &&
  evidence.settlement === 'CONFIRMED' &&
  evidence.delivery === 'CONFIRMED'
  ? 'SUCCESS' : 'UNKNOWN';
console.log(composite); // UNKNOWN: do not blindly retry.

Illustrative code. Adapt persistence, request validation, authorization and provider APIs to your production environment. No payments are performed by this example.

Optional HumanMirror service

Safe Preflight — 0.010 USDC per explicitly authorized call on Base. The live HTTP 402 response is authoritative; an independent buyer must authorize each paid request.

Scoped B2B help

Want a human-reviewed fixed-scope report instead of another tool? The Agent Safety Audit is €299, the 14-day Production Pilot €990. Confirm scope and acceptance criteria before purchasing.