fix: AgentPay product-completion — recipient, spend ceiling, honest claims - #250
Merged
Conversation
USDC intents now fail closed instead of returning a null Solana recipient. Launch/Builder keys get a server-side spend ceiling. Public copy drops UPI and Open Banking until those rails settle. CORS no longer lists agentpay.gg. Builder $39 checkout is wired to the existing Stripe price when STRIPE_SECRET_KEY is present. Co-authored-by: Rumblingb <Rumblingb@users.noreply.github.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
1 Skipped Deployment
|
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
Live QA: register 201 hid the key when Resend succeeded, and GET /api/receipt/:id 500'd on the agents join. The 201 body now always includes apk_ once. Receipt lookup uses payment_intents only and returns 404/503 instead of 500. Co-authored-by: Rumblingb <Rumblingb@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Product lock
AgentPay stays guardrails + payment authority for agents. Ace and RCM stay dark. Locked H1 is unchanged:
H1 stays because the crypto (x402/USDC) path is real in code once a recipient exists. Card is real in code via Stripe Checkout when
STRIPE_SECRET_KEYis set. UPI and Open Banking were advertised and are not settled rails — they are stripped from public copy.Live QA (6 Sep 2026 Europe/London) — production still on pre-deploy #247
Production has #247 merged but not published/deployed. This PR is the deploy candidate for the leftover gaps.
A. Register now always returns
apk_. Live 201 hid the key when Resend succeeded (emailDelivery: sent, noapiKey,returnApiKey:trueignored). The 201 body now always includesapk_once, whether email sent or failed.B. Receipt no longer 500s. Live
GET /api/receipt/:intentId500'd on a LEFT JOIN toagents. Lookup now readspayment_intentsonly. Invalid IDs are 404. DB failure is 503RECEIPT_UNAVAILABLE, not 500./api/receipt/demostays 200.C. USDC recipient. Intents never emit
solana:null. Merchant wallet orPLATFORM_TREASURY_WALLET, else 503RECIPIENT_NOT_CONFIGURED.D. CORS.
agentpay.gg/dashboard.agentpay.ggremoved fromwrangler.toml.E. Spend ceiling. Launch default $25, Builder $250, overridable via
spendLimitUsd. Over-limit is 403SPEND_LIMIT_EXCEEDED.F. Copy. Landing tree still drops IRCTC / National Rail / UPI / Open Banking. Worker is not deployed yet — that is why live
//start/docsstill name the rails.G. Health. API health no longer claims operational for unimplemented services. Edge note says it is not an operational claim.
H. MCP. No new package bump. 0.2.1 is already on main from #247. npm still serving 0.2.0 until someone publishes.
I. Builder $39.
POST /api/billing/plans/builderusesprice_1U9CNjPXcf9g8qGxzygstusB.collection.availableis true only withSTRIPE_SECRET_KEY.Pay-for bar (code vs deploy)
/startregister returns usableapk_keyapk_apps/api-edgenpm publish --access publicof@agentpayxyz/mcp-server@0.2.1apps/api-edgePLATFORM_TREASURY_WALLET; deploy api-edgeSPEND_LIMIT_EXCEEDEDapps/api-edgeworkers/agentpay-landingSecrets still required
PLATFORM_TREASURY_WALLETSTRIPE_SECRET_KEYcollection.availableand card checkoutSTRIPE_SUCCESS_URL/STRIPE_CANCEL_URLhttps://agentpay.so/start?builder=…RESEND_API_KEYapps/api-edgeworkers/agentpay-landing//start/docsstill show old IRCTC/National Rail copy until this worker shipsnpm publish@agentpayxyz/mcp-server@0.2.1Not an H1 blocker unless both card and crypto are unconfigured after deploy. Open Banking has no implementation. UPI stays unpublished until it settles with a receipt.
Tests / repro
After deploy: register 201 must include
apk_even when email sends.GET /api/receipt/<uuid>must not 500. A $40 Launch intent against a $25 ceiling must 403.Do not merge. Do not deploy. Do not npm publish from this PR.