settld 0.1.2 → 0.2.0

package/src/api/openapi.js

@@ -67,6 +67,167 @@ export function buildOpenApiSpec({ baseUrl = null } = {}) {
     }
   };
 
+  const X402ExecutionProofV1 = {
+    type: "object",
+    additionalProperties: false,
+    required: ["protocol", "publicSignals", "proofData"],
+    properties: {
+      schemaVersion: { type: "string", enum: ["X402ExecutionProof.v1"] },
+      protocol: { type: "string", enum: ["groth16", "plonk", "stark"] },
+      publicSignals: { type: "array", items: {} },
+      proofData: { type: "object", additionalProperties: true },
+      verificationKey: { type: "object", nullable: true, additionalProperties: true },
+      verificationKeyRef: { type: "string", nullable: true },
+      statementHashSha256: { type: "string", pattern: "^[0-9a-f]{64}$", nullable: true },
+      inputDigestSha256: { type: "string", pattern: "^[0-9a-f]{64}$", nullable: true },
+      outputDigestSha256: { type: "string", pattern: "^[0-9a-f]{64}$", nullable: true }
+    }
+  };
+
+  const X402GateVerifyRequest = {
+    type: "object",
+    additionalProperties: true,
+    required: ["gateId"],
+    properties: {
+      gateId: { type: "string" },
+      proof: { ...X402ExecutionProofV1, nullable: true }
+    }
+  };
+
+  const X402GateAuthorizePaymentRequest = {
+    type: "object",
+    additionalProperties: true,
+    required: ["gateId"],
+    properties: {
+      gateId: { type: "string" },
+      quoteId: { type: "string", nullable: true },
+      requestBindingMode: { type: "string", enum: ["strict"], nullable: true },
+      requestBindingSha256: { type: "string", pattern: "^[0-9a-f]{64}$", nullable: true },
+      walletAuthorizationDecisionToken: { type: "string", nullable: true },
+      escalationOverrideToken: { type: "string", nullable: true },
+      executionIntent: {
+        type: "object",
+        nullable: true,
+        additionalProperties: true,
+        description: "ExecutionIntent.v1 payload bound to authorize-payment preconditions."
+      }
+    }
+  };
+
+  const X402WalletAssignment = {
+    type: "object",
+    additionalProperties: false,
+    required: ["sponsorWalletRef", "policyRef", "policyVersion"],
+    properties: {
+      sponsorWalletRef: { type: "string" },
+      policyRef: { type: "string" },
+      policyVersion: { type: "integer", minimum: 1 }
+    }
+  };
+
+  const X402WalletAssignmentResolveRequest = {
+    type: "object",
+    additionalProperties: false,
+    properties: {
+      profileRef: { type: "string", nullable: true },
+      riskClass: { type: "string", enum: ["read", "compute", "action", "financial"], nullable: true },
+      delegationRef: { type: "string", nullable: true },
+      delegationDepth: { type: "integer", minimum: 0, nullable: true }
+    }
+  };
+
+  const X402WalletAssignmentResolveResponse = {
+    type: "object",
+    additionalProperties: false,
+    required: ["ok", "tenantId", "assignment"],
+    properties: {
+      ok: { type: "boolean" },
+      tenantId: { type: "string" },
+      profileRef: { type: "string", nullable: true },
+      riskClass: { type: "string", enum: ["read", "compute", "action", "financial"], nullable: true },
+      delegationRef: { type: "string", nullable: true },
+      delegationDepth: { type: "integer", minimum: 0, nullable: true },
+      assignment: { ...X402WalletAssignment, nullable: true }
+    }
+  };
+
+  const X402AuthorizePaymentTaErrorCodes = Object.freeze([
+    "X402_EXECUTION_INTENT_REQUIRED",
+    "X402_EXECUTION_INTENT_IDEMPOTENCY_MISMATCH",
+    "X402_EXECUTION_INTENT_CONFLICT"
+  ]);
+
+  const X402AuthorizePaymentBadRequestKnownErrorCodes = Object.freeze([
+    "SCHEMA_INVALID",
+    "X402_EXECUTION_INTENT_HASH_MISMATCH"
+  ]);
+
+  const X402AuthorizePaymentConflictKnownErrorCodes = Object.freeze([
+    ...X402AuthorizePaymentTaErrorCodes,
+    "X402_EXECUTION_INTENT_INVALID",
+    "X402_EXECUTION_INTENT_TIME_INVALID",
+    "X402_EXECUTION_INTENT_TENANT_MISMATCH",
+    "X402_EXECUTION_INTENT_AGENT_MISMATCH",
+    "X402_EXECUTION_INTENT_SIDE_EFFECTING_REQUIRED",
+    "X402_EXECUTION_INTENT_REQUEST_BINDING_REQUIRED",
+    "X402_EXECUTION_INTENT_REQUEST_MISMATCH",
+    "X402_EXECUTION_INTENT_SPEND_LIMIT_EXCEEDED",
+    "X402_EXECUTION_INTENT_CURRENCY_MISMATCH",
+    "X402_EXECUTION_INTENT_RUN_MISMATCH",
+    "X402_EXECUTION_INTENT_AGREEMENT_MISMATCH",
+    "X402_EXECUTION_INTENT_QUOTE_MISMATCH",
+    "X402_EXECUTION_INTENT_POLICY_VERSION_MISMATCH",
+    "X402_EXECUTION_INTENT_POLICY_HASH_MISMATCH",
+    "X402_EXECUTION_INTENT_EXPIRES_AT_INVALID",
+    "X402_EXECUTION_INTENT_EXPIRED"
+  ]);
+
+  const X402GateVerifyBadRequestKnownErrorCodes = Object.freeze(["SCHEMA_INVALID"]);
+
+  const X402GateVerifyConflictKnownErrorCodes = Object.freeze([
+    "X402_INVALID_VERIFICATION_KEY_REF",
+    "X402_MISSING_REQUIRED_PROOF",
+    "X402_INVALID_CRYPTOGRAPHIC_PROOF",
+    "X402_SPEND_AUTH_POLICY_FINGERPRINT_MISMATCH",
+    "X402_REQUEST_BINDING_REQUIRED",
+    "X402_REQUEST_BINDING_EVIDENCE_REQUIRED",
+    "X402_REQUEST_BINDING_EVIDENCE_MISMATCH"
+  ]);
+
+  function errorResponseWithKnownCodes(knownCodes) {
+    return {
+      allOf: [
+        ErrorResponse,
+        {
+          type: "object",
+          additionalProperties: true,
+          properties: {
+            code: {
+              anyOf: [{ type: "string", enum: [...knownCodes] }, { type: "string" }],
+              description: "Known stable codes are listed in docs/spec/x402-error-codes.v1.txt."
+            }
+          }
+        }
+      ]
+    };
+  }
+
+  const X402ZkVerificationKeyV1 = {
+    type: "object",
+    additionalProperties: false,
+    required: ["schemaVersion", "verificationKeyId", "protocol", "verificationKey", "createdAt", "updatedAt"],
+    properties: {
+      schemaVersion: { type: "string", enum: ["X402ZkVerificationKey.v1"] },
+      verificationKeyId: { type: "string" },
+      protocol: { type: "string", enum: ["groth16", "plonk", "stark"] },
+      verificationKey: { type: "object", additionalProperties: true },
+      providerRef: { type: "string", nullable: true },
+      metadata: { type: "object", additionalProperties: true, nullable: true },
+      createdAt: { type: "string", format: "date-time" },
+      updatedAt: { type: "string", format: "date-time" }
+    }
+  };
+
   const JobCreateRequest = {
     type: "object",
     additionalProperties: false,
@@ -209,6 +370,187 @@ export function buildOpenApiSpec({ baseUrl = null } = {}) {
     }
   };
 
+  const AgentPassportV1 = {
+    type: "object",
+    additionalProperties: false,
+    required: [
+      "schemaVersion",
+      "passportId",
+      "agentId",
+      "tenantId",
+      "principalRef",
+      "identityAnchors",
+      "delegationRoot",
+      "policyEnvelope",
+      "status",
+      "createdAt",
+      "updatedAt",
+      "sponsorRef",
+      "agentKeyId",
+      "delegationRef",
+      "lineageRequired"
+    ],
+    properties: {
+      schemaVersion: { type: "string", enum: ["AgentPassport.v1"] },
+      passportId: { type: "string" },
+      agentId: { type: "string" },
+      tenantId: { type: "string" },
+      principalRef: {
+        type: "object",
+        additionalProperties: false,
+        required: ["principalType", "principalId"],
+        properties: {
+          principalType: { type: "string", enum: ["human", "business", "service", "dao"] },
+          principalId: { type: "string" },
+          jurisdiction: { type: "string" }
+        }
+      },
+      identityAnchors: {
+        type: "object",
+        additionalProperties: false,
+        required: ["jwksUri", "activeKeyId", "keysetHash"],
+        properties: {
+          did: { type: "string" },
+          jwksUri: { type: "string", format: "uri" },
+          activeKeyId: { type: "string" },
+          keysetHash: { type: "string", pattern: "^[0-9a-f]{64}$" }
+        }
+      },
+      delegationRoot: {
+        type: "object",
+        additionalProperties: false,
+        required: ["rootGrantId", "rootGrantHash", "issuedAt"],
+        properties: {
+          rootGrantId: { type: "string" },
+          rootGrantHash: { type: "string", pattern: "^[0-9a-f]{64}$" },
+          issuedAt: { type: "string", format: "date-time" },
+          expiresAt: { type: "string", format: "date-time", nullable: true },
+          revokedAt: { type: "string", format: "date-time", nullable: true }
+        }
+      },
+      capabilityCredentials: { type: "array", items: { type: "object", additionalProperties: true } },
+      policyEnvelope: {
+        type: "object",
+        additionalProperties: false,
+        required: ["maxPerCallCents", "maxDailyCents", "allowedRiskClasses"],
+        properties: {
+          maxPerCallCents: { type: "integer", minimum: 0 },
+          maxDailyCents: { type: "integer", minimum: 0 },
+          allowedRiskClasses: { type: "array", items: { type: "string", enum: ["read", "compute", "action", "financial"] } },
+          requireApprovalAboveCents: { type: "integer", minimum: 0, nullable: true },
+          allowlistRefs: { type: "array", items: { type: "string" } }
+        }
+      },
+      status: { type: "string", enum: ["active", "suspended", "revoked"] },
+      metadata: { type: "object", nullable: true, additionalProperties: true },
+      createdAt: { type: "string", format: "date-time" },
+      updatedAt: { type: "string", format: "date-time" },
+      sponsorRef: { type: "string" },
+      sponsorWalletRef: { type: "string" },
+      agentKeyId: { type: "string" },
+      delegationRef: { type: "string" },
+      policyRef: { type: "string" },
+      policyVersion: { type: "integer", minimum: 1 },
+      delegationDepth: { type: "integer", minimum: 0 },
+      maxDelegationDepth: { type: "integer", minimum: 0 },
+      expiresAt: { type: "string", format: "date-time" },
+      lineageRequired: { type: "boolean" }
+    }
+  };
+
+  const AgentPassportUpsertRequest = {
+    type: "object",
+    additionalProperties: false,
+    required: ["agentPassport"],
+    properties: {
+      agentPassport: AgentPassportV1
+    }
+  };
+
+  const AgentPassportRevokeRequest = {
+    type: "object",
+    additionalProperties: false,
+    properties: {
+      revokedAt: { type: "string", format: "date-time", nullable: true },
+      reasonCode: { type: "string" },
+      reason: { type: "string" }
+    }
+  };
+
+  const ToolCallAgreementV1 = {
+    type: "object",
+    additionalProperties: false,
+    required: [
+      "schemaVersion",
+      "toolId",
+      "manifestHash",
+      "callId",
+      "inputHash",
+      "acceptanceCriteria",
+      "settlementTerms",
+      "payerAgentId",
+      "payeeAgentId",
+      "createdAt",
+      "agreementHash"
+    ],
+    properties: {
+      schemaVersion: { type: "string", enum: ["ToolCallAgreement.v1"] },
+      toolId: { type: "string" },
+      manifestHash: { type: "string", pattern: "^[0-9a-f]{64}$" },
+      callId: { type: "string" },
+      inputHash: { type: "string", pattern: "^[0-9a-f]{64}$" },
+      acceptanceCriteria: { type: "object", nullable: true, additionalProperties: true },
+      settlementTerms: { type: "object", nullable: true, additionalProperties: true },
+      payerAgentId: { type: "string", nullable: true },
+      payeeAgentId: { type: "string", nullable: true },
+      createdAt: { type: "string", format: "date-time" },
+      agreementHash: { type: "string", pattern: "^[0-9a-f]{64}$" }
+    }
+  };
+
+  const ToolCallEvidenceV1 = {
+    type: "object",
+    additionalProperties: false,
+    required: [
+      "schemaVersion",
+      "agreementHash",
+      "callId",
+      "inputHash",
+      "outputHash",
+      "outputRef",
+      "metrics",
+      "startedAt",
+      "completedAt",
+      "createdAt",
+      "evidenceHash"
+    ],
+    properties: {
+      schemaVersion: { type: "string", enum: ["ToolCallEvidence.v1"] },
+      agreementHash: { type: "string", pattern: "^[0-9a-f]{64}$" },
+      callId: { type: "string" },
+      inputHash: { type: "string", pattern: "^[0-9a-f]{64}$" },
+      outputHash: { type: "string", pattern: "^[0-9a-f]{64}$" },
+      outputRef: { type: "string", nullable: true },
+      metrics: { type: "object", nullable: true, additionalProperties: true },
+      startedAt: { type: "string", format: "date-time" },
+      completedAt: { type: "string", format: "date-time" },
+      createdAt: { type: "string", format: "date-time" },
+      evidenceHash: { type: "string", pattern: "^[0-9a-f]{64}$" },
+      signature: {
+        type: "object",
+        nullable: true,
+        additionalProperties: false,
+        required: ["algorithm", "signerKeyId", "evidenceHash", "signature"],
+        properties: {
+          algorithm: { type: "string", enum: ["ed25519"] },
+          signerKeyId: { type: "string" },
+          evidenceHash: { type: "string", pattern: "^[0-9a-f]{64}$" },
+          signature: { type: "string" }
+        }
+      }
+    }
+  };
+
   const AgentRunV1 = {
     type: "object",
     additionalProperties: false,
@@ -402,6 +744,7 @@ export function buildOpenApiSpec({ baseUrl = null } = {}) {
           closedByAgentId: { type: "string", nullable: true },
           summary: { type: "string", nullable: true },
           closedAt: { type: "string", format: "date-time", nullable: true },
+          releaseRatePct: { type: "integer", minimum: 0, maximum: 100, nullable: true },
           evidenceRefs: { type: "array", items: { type: "string" } }
         }
       },
@@ -1161,6 +1504,224 @@ export function buildOpenApiSpec({ baseUrl = null } = {}) {
     }
   };
 
+  const OpsEmergencyControlType = {
+    type: "string",
+    enum: ["pause", "quarantine", "revoke", "kill-switch"]
+  };
+
+  const OpsEmergencyAction = {
+    type: "string",
+    enum: ["pause", "quarantine", "revoke", "kill-switch", "resume"]
+  };
+
+  const OpsEmergencyScope = {
+    type: "object",
+    additionalProperties: false,
+    required: ["type"],
+    properties: {
+      type: { type: "string", enum: ["tenant", "agent", "adapter"] },
+      id: { type: "string", nullable: true }
+    }
+  };
+
+  const OpsEmergencyRequestedBy = {
+    type: "object",
+    additionalProperties: false,
+    properties: {
+      keyId: { type: "string", nullable: true },
+      principalId: { type: "string", nullable: true }
+    }
+  };
+
+  const OpsEmergencyControlEvent = {
+    type: "object",
+    additionalProperties: false,
+    required: ["schemaVersion", "eventId", "tenantId", "action", "scope", "requestedBy", "createdAt", "effectiveAt"],
+    properties: {
+      schemaVersion: { type: "string", enum: ["OpsEmergencyControlEvent.v1"] },
+      eventId: { type: "string" },
+      tenantId: { type: "string" },
+      action: OpsEmergencyAction,
+      controlType: { ...OpsEmergencyControlType, nullable: true },
+      resumeControlTypes: { type: "array", items: OpsEmergencyControlType },
+      scope: OpsEmergencyScope,
+      reasonCode: { type: "string", nullable: true },
+      reason: { type: "string", nullable: true },
+      operatorAction: { type: "object", additionalProperties: true, nullable: true },
+      secondOperatorAction: { type: "object", additionalProperties: true, nullable: true },
+      requestedBy: OpsEmergencyRequestedBy,
+      requestId: { type: "string", nullable: true },
+      createdAt: { type: "string", format: "date-time" },
+      effectiveAt: { type: "string", format: "date-time" }
+    }
+  };
+
+  const OpsEmergencyControlState = {
+    type: "object",
+    additionalProperties: false,
+    required: [
+      "schemaVersion",
+      "tenantId",
+      "scopeType",
+      "scopeId",
+      "controlType",
+      "active",
+      "activatedAt",
+      "resumedAt",
+      "updatedAt",
+      "lastEventId",
+      "lastAction",
+      "reasonCode",
+      "reason",
+      "operatorAction",
+      "revision"
+    ],
+    properties: {
+      schemaVersion: { type: "string", enum: ["OpsEmergencyControlState.v1"] },
+      tenantId: { type: "string" },
+      scopeType: { type: "string", enum: ["tenant", "agent", "adapter"] },
+      scopeId: { type: "string", nullable: true },
+      controlType: OpsEmergencyControlType,
+      active: { type: "boolean" },
+      activatedAt: { type: "string", format: "date-time" },
+      resumedAt: { type: "string", format: "date-time", nullable: true },
+      updatedAt: { type: "string", format: "date-time" },
+      lastEventId: { type: "string", nullable: true },
+      lastAction: { ...OpsEmergencyAction, nullable: true },
+      reasonCode: { type: "string", nullable: true },
+      reason: { type: "string", nullable: true },
+      operatorAction: { type: "object", additionalProperties: true, nullable: true },
+      revision: { type: "integer", minimum: 0 }
+    }
+  };
+
+  const OpsEmergencyPauseRequest = {
+    type: "object",
+    additionalProperties: false,
+    required: ["operatorAction"],
+    properties: {
+      scope: OpsEmergencyScope,
+      scopeType: { type: "string", enum: ["tenant", "agent", "adapter"], nullable: true },
+      scopeId: { type: "string", nullable: true },
+      agentId: { type: "string", nullable: true },
+      adapterId: { type: "string", nullable: true },
+      providerId: { type: "string", nullable: true },
+      reasonCode: { type: "string", nullable: true },
+      reason: { type: "string", nullable: true },
+      operatorAction: { type: "object", additionalProperties: true },
+      secondOperatorAction: { type: "object", additionalProperties: true, nullable: true },
+      effectiveAt: { type: "string", format: "date-time", nullable: true }
+    }
+  };
+
+  const OpsEmergencyQuarantineRequest = {
+    type: "object",
+    additionalProperties: false,
+    required: ["operatorAction"],
+    properties: {
+      scope: OpsEmergencyScope,
+      scopeType: { type: "string", enum: ["tenant", "agent", "adapter"], nullable: true },
+      scopeId: { type: "string", nullable: true },
+      agentId: { type: "string", nullable: true },
+      adapterId: { type: "string", nullable: true },
+      providerId: { type: "string", nullable: true },
+      reasonCode: { type: "string", nullable: true },
+      reason: { type: "string", nullable: true },
+      operatorAction: { type: "object", additionalProperties: true },
+      secondOperatorAction: { type: "object", additionalProperties: true, nullable: true },
+      effectiveAt: { type: "string", format: "date-time", nullable: true }
+    }
+  };
+
+  const OpsEmergencyRevokeRequest = {
+    type: "object",
+    additionalProperties: false,
+    required: ["operatorAction"],
+    properties: {
+      scope: OpsEmergencyScope,
+      scopeType: { type: "string", enum: ["tenant", "agent", "adapter"], nullable: true },
+      scopeId: { type: "string", nullable: true },
+      agentId: { type: "string", nullable: true },
+      adapterId: { type: "string", nullable: true },
+      providerId: { type: "string", nullable: true },
+      reasonCode: { type: "string", nullable: true },
+      reason: { type: "string", nullable: true },
+      operatorAction: { type: "object", additionalProperties: true },
+      secondOperatorAction: { type: "object", additionalProperties: true, nullable: true },
+      effectiveAt: { type: "string", format: "date-time", nullable: true }
+    }
+  };
+
+  const OpsEmergencyKillSwitchRequest = {
+    type: "object",
+    additionalProperties: false,
+    required: ["operatorAction"],
+    properties: {
+      scope: OpsEmergencyScope,
+      scopeType: { type: "string", enum: ["tenant", "agent", "adapter"], nullable: true },
+      scopeId: { type: "string", nullable: true },
+      agentId: { type: "string", nullable: true },
+      adapterId: { type: "string", nullable: true },
+      providerId: { type: "string", nullable: true },
+      reasonCode: { type: "string", nullable: true },
+      reason: { type: "string", nullable: true },
+      operatorAction: { type: "object", additionalProperties: true },
+      secondOperatorAction: { type: "object", additionalProperties: true, nullable: true },
+      effectiveAt: { type: "string", format: "date-time", nullable: true }
+    }
+  };
+
+  const OpsEmergencyResumeRequest = {
+    type: "object",
+    additionalProperties: false,
+    required: ["operatorAction"],
+    properties: {
+      scope: OpsEmergencyScope,
+      scopeType: { type: "string", enum: ["tenant", "agent", "adapter"], nullable: true },
+      scopeId: { type: "string", nullable: true },
+      agentId: { type: "string", nullable: true },
+      adapterId: { type: "string", nullable: true },
+      providerId: { type: "string", nullable: true },
+      controlType: OpsEmergencyControlType,
+      controlTypes: { type: "array", items: OpsEmergencyControlType },
+      resumeControlType: OpsEmergencyControlType,
+      resumeControlTypes: { type: "array", items: OpsEmergencyControlType },
+      reasonCode: { type: "string", nullable: true },
+      reason: { type: "string", nullable: true },
+      operatorAction: { type: "object", additionalProperties: true },
+      secondOperatorAction: { type: "object", additionalProperties: true, nullable: true },
+      effectiveAt: { type: "string", format: "date-time", nullable: true }
+    }
+  };
+
+  const OpsEmergencyDualControlStatus = {
+    type: "object",
+    additionalProperties: false,
+    required: ["required", "satisfied"],
+    properties: {
+      required: { type: "boolean" },
+      satisfied: { type: "boolean", nullable: true }
+    }
+  };
+
+  const OpsEmergencyControlResponse = {
+    type: "object",
+    additionalProperties: false,
+    required: ["tenantId", "applied", "action"],
+    properties: {
+      tenantId: { type: "string" },
+      applied: { type: "boolean" },
+      action: OpsEmergencyAction,
+      reason: { type: "string", nullable: true },
+      event: { ...OpsEmergencyControlEvent, nullable: true },
+      scope: { ...OpsEmergencyScope, nullable: true },
+      controlType: { ...OpsEmergencyControlType, nullable: true },
+      resumeControlTypes: { type: "array", items: OpsEmergencyControlType },
+      dualControl: { ...OpsEmergencyDualControlStatus, nullable: true },
+      control: { ...OpsEmergencyControlState, nullable: true }
+    }
+  };
+
   const MarketplaceAgreementAcceptanceSignatureV2 = {
     type: "object",
     additionalProperties: false,
@@ -1536,31 +2097,194 @@ export function buildOpenApiSpec({ baseUrl = null } = {}) {
     }
   };
 
-  const MarketplaceRfqV1 = {
+  const ProviderConformanceVerdictV1 = {
     type: "object",
     additionalProperties: false,
-    required: ["schemaVersion", "rfqId", "tenantId", "title", "status", "currency", "createdAt", "updatedAt"],
+    required: ["ok", "requiredChecks", "passedChecks"],
     properties: {
-      schemaVersion: { type: "string", enum: ["MarketplaceRfq.v1"] },
-      rfqId: { type: "string" },
-      tenantId: { type: "string" },
-      title: { type: "string" },
-      description: { type: "string", nullable: true },
-      capability: { type: "string", nullable: true },
-      fromType: InteractionDirectionEntityType,
-      toType: InteractionDirectionEntityType,
-      posterAgentId: { type: "string", nullable: true },
-      status: { type: "string", enum: ["open", "assigned", "cancelled", "closed"] },
-      budgetCents: { type: "integer", nullable: true, minimum: 1 },
-      currency: { type: "string" },
-      deadlineAt: { type: "string", format: "date-time", nullable: true },
-      acceptedBidId: { type: "string", nullable: true },
-      acceptedBidderAgentId: { type: "string", nullable: true },
-      acceptedAt: { type: "string", format: "date-time", nullable: true },
-      acceptedByAgentId: { type: "string", nullable: true },
-      counterOfferPolicy: { ...MarketplaceCounterOfferPolicyV1, nullable: true },
-      runId: { type: "string", nullable: true },
-      agreementId: { type: "string", nullable: true },
+      ok: { type: "boolean" },
+      requiredChecks: { type: "integer", minimum: 0 },
+      passedChecks: { type: "integer", minimum: 0 }
+    }
+  };
+
+  const ProviderConformanceSummaryV1 = {
+    type: "object",
+    additionalProperties: false,
+    required: ["schemaVersion", "generatedAt", "verdict"],
+    properties: {
+      schemaVersion: { type: "string" },
+      generatedAt: { type: "string", format: "date-time", nullable: true },
+      verdict: ProviderConformanceVerdictV1
+    }
+  };
+
+  const MarketplaceProviderCertificationBadgeV1 = {
+    type: "object",
+    additionalProperties: false,
+    required: [
+      "schemaVersion",
+      "providerId",
+      "providerRef",
+      "publicationId",
+      "status",
+      "certified",
+      "manifestHash",
+      "providerSigningKeyId",
+      "toolCount",
+      "conformance",
+      "badgeHash"
+    ],
+    properties: {
+      schemaVersion: { type: "string", enum: ["MarketplaceProviderCertificationBadge.v1"] },
+      providerId: { type: "string" },
+      providerRef: { type: "string" },
+      publicationId: { type: "string" },
+      status: { type: "string", enum: ["certified", "conformance_failed", "draft"] },
+      certified: { type: "boolean" },
+      certifiedAt: { type: "string", format: "date-time", nullable: true },
+      updatedAt: { type: "string", format: "date-time", nullable: true },
+      manifestHash: { type: "string", pattern: "^[0-9a-f]{64}$" },
+      providerSigningKeyId: { type: "string", nullable: true },
+      toolCount: { type: "integer", minimum: 0 },
+      conformance: { ...ProviderConformanceSummaryV1, nullable: true },
+      badgeHash: { type: "string", pattern: "^[0-9a-f]{64}$" }
+    }
+  };
+
+  const MarketplaceProviderPublicationSummaryV1 = {
+    type: "object",
+    additionalProperties: false,
+    required: [
+      "schemaVersion",
+      "publicationId",
+      "tenantId",
+      "providerId",
+      "providerRef",
+      "status",
+      "certified",
+      "baseUrl",
+      "tags",
+      "toolCount",
+      "manifestSchemaVersion",
+      "manifestHash",
+      "conformance",
+      "certificationBadge",
+      "publishedAt",
+      "certifiedAt",
+      "updatedAt"
+    ],
+    properties: {
+      schemaVersion: { type: "string" },
+      publicationId: { type: "string" },
+      tenantId: { type: "string" },
+      providerId: { type: "string" },
+      providerRef: { type: "string", nullable: true },
+      status: { type: "string", enum: ["certified", "conformance_failed", "draft"] },
+      certified: { type: "boolean" },
+      baseUrl: { type: "string" },
+      description: { type: "string", nullable: true },
+      tags: {
+        type: "array",
+        items: { type: "string" }
+      },
+      toolCount: { type: "integer", minimum: 0 },
+      manifestSchemaVersion: { type: "string" },
+      manifestHash: { type: "string", pattern: "^[0-9a-f]{64}$" },
+      conformance: { ...ProviderConformanceSummaryV1, nullable: true },
+      certificationBadge: { ...MarketplaceProviderCertificationBadgeV1, nullable: true },
+      publishedAt: { type: "string", format: "date-time", nullable: true },
+      certifiedAt: { type: "string", format: "date-time", nullable: true },
+      updatedAt: { type: "string", format: "date-time", nullable: true }
+    }
+  };
+
+  const MarketplaceToolListingV1 = {
+    type: "object",
+    additionalProperties: false,
+    required: [
+      "schemaVersion",
+      "providerId",
+      "providerRef",
+      "publicationId",
+      "certified",
+      "providerStatus",
+      "providerTags",
+      "manifestSchemaVersion",
+      "manifestHash",
+      "toolId",
+      "pricing",
+      "certificationBadge",
+      "publishedAt",
+      "updatedAt"
+    ],
+    properties: {
+      schemaVersion: { type: "string", enum: ["MarketplaceToolListing.v1"] },
+      providerId: { type: "string" },
+      providerRef: { type: "string", nullable: true },
+      publicationId: { type: "string" },
+      certified: { type: "boolean" },
+      providerStatus: { type: "string", enum: ["certified", "conformance_failed", "draft"] },
+      providerDescription: { type: "string", nullable: true },
+      providerTags: {
+        type: "array",
+        items: { type: "string" }
+      },
+      manifestSchemaVersion: { type: "string", nullable: true },
+      manifestHash: { type: "string", pattern: "^[0-9a-f]{64}$", nullable: true },
+      toolId: { type: "string" },
+      mcpToolName: { type: "string", nullable: true },
+      description: { type: "string", nullable: true },
+      method: { type: "string", nullable: true },
+      paidPath: { type: "string", nullable: true },
+      upstreamPath: { type: "string", nullable: true },
+      tags: {
+        type: "array",
+        items: { type: "string" }
+      },
+      pricing: {
+        type: "object",
+        additionalProperties: false,
+        required: ["amountCents", "currency"],
+        properties: {
+          amountCents: { type: "integer", minimum: 1, nullable: true },
+          currency: { type: "string", nullable: true }
+        }
+      },
+      idempotency: { type: "string", nullable: true },
+      signatureMode: { type: "string", nullable: true },
+      authMode: { type: "string", nullable: true },
+      certificationBadge: { ...MarketplaceProviderCertificationBadgeV1, nullable: true },
+      publishedAt: { type: "string", format: "date-time", nullable: true },
+      updatedAt: { type: "string", format: "date-time", nullable: true }
+    }
+  };
+
+  const MarketplaceRfqV1 = {
+    type: "object",
+    additionalProperties: false,
+    required: ["schemaVersion", "rfqId", "tenantId", "title", "status", "currency", "createdAt", "updatedAt"],
+    properties: {
+      schemaVersion: { type: "string", enum: ["MarketplaceRfq.v1"] },
+      rfqId: { type: "string" },
+      tenantId: { type: "string" },
+      title: { type: "string" },
+      description: { type: "string", nullable: true },
+      capability: { type: "string", nullable: true },
+      fromType: InteractionDirectionEntityType,
+      toType: InteractionDirectionEntityType,
+      posterAgentId: { type: "string", nullable: true },
+      status: { type: "string", enum: ["open", "assigned", "cancelled", "closed"] },
+      budgetCents: { type: "integer", nullable: true, minimum: 1 },
+      currency: { type: "string" },
+      deadlineAt: { type: "string", format: "date-time", nullable: true },
+      acceptedBidId: { type: "string", nullable: true },
+      acceptedBidderAgentId: { type: "string", nullable: true },
+      acceptedAt: { type: "string", format: "date-time", nullable: true },
+      acceptedByAgentId: { type: "string", nullable: true },
+      counterOfferPolicy: { ...MarketplaceCounterOfferPolicyV1, nullable: true },
+      runId: { type: "string", nullable: true },
+      agreementId: { type: "string", nullable: true },
       agreement: {
         type: "object",
         additionalProperties: true,
@@ -2023,7 +2747,6 @@ export function buildOpenApiSpec({ baseUrl = null } = {}) {
   const RunSettlementResolveRequest = {
     type: "object",
     additionalProperties: false,
-    required: ["status"],
     properties: {
       status: { type: "string", enum: ["released", "refunded"] },
       releaseRatePct: { type: "integer", minimum: 0, maximum: 100 },
@@ -2123,6 +2846,47 @@ export function buildOpenApiSpec({ baseUrl = null } = {}) {
     }
   };
 
+  const DisputeOpenEnvelopeSignedRequest = {
+    type: "object",
+    additionalProperties: false,
+    required: [
+      "schemaVersion",
+      "artifactType",
+      "artifactId",
+      "envelopeId",
+      "caseId",
+      "tenantId",
+      "agreementHash",
+      "receiptHash",
+      "holdHash",
+      "openedByAgentId",
+      "openedAt",
+      "reasonCode",
+      "nonce",
+      "signerKeyId",
+      "envelopeHash",
+      "signature"
+    ],
+    properties: {
+      schemaVersion: { type: "string", enum: ["DisputeOpenEnvelope.v1"] },
+      artifactType: { type: "string", enum: ["DisputeOpenEnvelope.v1"] },
+      artifactId: { type: "string" },
+      envelopeId: { type: "string" },
+      caseId: { type: "string" },
+      tenantId: { type: "string" },
+      agreementHash: { type: "string" },
+      receiptHash: { type: "string" },
+      holdHash: { type: "string" },
+      openedByAgentId: { type: "string" },
+      openedAt: { type: "string", format: "date-time" },
+      reasonCode: { type: "string" },
+      nonce: { type: "string" },
+      signerKeyId: { type: "string" },
+      envelopeHash: { type: "string" },
+      signature: { type: "string" }
+    }
+  };
+
   const ArbitrationCaseV1 = {
     type: "object",
     additionalProperties: false,
@@ -2303,6 +3067,58 @@ export function buildOpenApiSpec({ baseUrl = null } = {}) {
     }
   };
 
+  const ToolCallReplayEvaluateResponse = {
+    type: "object",
+    additionalProperties: false,
+    required: ["ok", "tenantId", "agreementHash", "runId", "replay", "stored", "comparisons", "issues"],
+    properties: {
+      ok: { type: "boolean" },
+      tenantId: { type: "string" },
+      agreementHash: { type: "string" },
+      runId: { type: "string" },
+      replay: { type: "object", additionalProperties: true },
+      stored: { type: "object", additionalProperties: true },
+      comparisons: { type: "object", additionalProperties: true },
+      issues: { type: "array", items: { type: "string" } }
+    }
+  };
+
+  const ReputationFactsResponse = {
+    type: "object",
+    additionalProperties: false,
+    required: ["ok", "tenantId", "agentId", "window", "asOf", "facts"],
+    properties: {
+      ok: { type: "boolean" },
+      tenantId: { type: "string" },
+      agentId: { type: "string" },
+      toolId: { type: "string", nullable: true },
+      window: { type: "string", enum: ["7d", "30d", "allTime"] },
+      asOf: { type: "string", format: "date-time" },
+      windowStartAt: { type: "string", format: "date-time", nullable: true },
+      facts: {
+        type: "object",
+        additionalProperties: false,
+        properties: {
+          totals: { type: "object", additionalProperties: true },
+          latencyMs: {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+              count: { type: "integer", minimum: 0 },
+              p50: { type: "integer", minimum: 0, nullable: true },
+              p95: { type: "integer", minimum: 0, nullable: true }
+            }
+          }
+        }
+      },
+      events: {
+        type: "array",
+        nullable: true,
+        items: { type: "object", additionalProperties: true }
+      }
+    }
+  };
+
   const MonthCloseRequest = {
     type: "object",
     additionalProperties: false,
@@ -2812,6 +3628,11 @@ export function buildOpenApiSpec({ baseUrl = null } = {}) {
         JobEventAppendRequest,
         AgentIdentityV1,
         AgentRegisterRequest,
+        AgentPassportV1,
+        AgentPassportUpsertRequest,
+        AgentPassportRevokeRequest,
+        ToolCallAgreementV1,
+        ToolCallEvidenceV1,
         AgentRunV1,
         AgentEventV1,
         AgentRunCreateRequest,
@@ -2827,6 +3648,9 @@ export function buildOpenApiSpec({ baseUrl = null } = {}) {
         AgentReputationWindowV2,
         AgentReputationV2,
         AgentReputationAny,
+        X402WalletAssignment,
+        X402WalletAssignmentResolveRequest,
+        X402WalletAssignmentResolveResponse,
         VerificationMethodV1,
         SettlementPolicyV1,
         MarketplaceSettlementPolicyRefV1,
@@ -2847,6 +3671,12 @@ export function buildOpenApiSpec({ baseUrl = null } = {}) {
         DelegationTraceListResponse,
         DelegationEmergencyRevokeRequest,
         DelegationEmergencyRevokeResponse,
+        OpsEmergencyPauseRequest,
+        OpsEmergencyQuarantineRequest,
+        OpsEmergencyRevokeRequest,
+        OpsEmergencyKillSwitchRequest,
+        OpsEmergencyResumeRequest,
+        OpsEmergencyControlResponse,
         MarketplaceAgreementAcceptanceSignatureV2,
         MarketplaceAgreementChangeOrderAcceptanceSignatureV2,
         MarketplaceAgreementCancellationAcceptanceSignatureV2,
@@ -2859,6 +3689,11 @@ export function buildOpenApiSpec({ baseUrl = null } = {}) {
         MarketplaceCapabilityAvailabilityV1,
         MarketplaceCapabilityListingV1,
         MarketplaceCapabilityListingUpsertRequest,
+        ProviderConformanceVerdictV1,
+        ProviderConformanceSummaryV1,
+        MarketplaceProviderCertificationBadgeV1,
+        MarketplaceProviderPublicationSummaryV1,
+        MarketplaceToolListingV1,
         MarketplaceRfqV1,
         MarketplaceTaskAgreementV2,
         MarketplaceRfqCreateRequest,
@@ -2874,9 +3709,12 @@ export function buildOpenApiSpec({ baseUrl = null } = {}) {
         RunAgreementCancelResponse,
         DisputeVerdictSignedRequest,
         ArbitrationVerdictSignedRequest,
+        DisputeOpenEnvelopeSignedRequest,
         ArbitrationCaseV1,
         RunSettlementPolicyReplayResponse,
         RunSettlementReplayEvaluateResponse,
+        ToolCallReplayEvaluateResponse,
+        ReputationFactsResponse,
         MonthCloseRequest,
         AckRequest,
         ArtifactVerificationSummary,
@@ -2951,16 +3789,17 @@ export function buildOpenApiSpec({ baseUrl = null } = {}) {
           }
         }
       },
-      "/marketplace/capability-listings": {
+      "/marketplace/providers": {
         get: {
-          summary: "List marketplace capability listings",
+          summary: "List marketplace provider publications",
           parameters: [
             TenantHeader,
             ProtocolHeader,
             RequestIdHeader,
-            { name: "status", in: "query", required: false, schema: { type: "string", enum: ["active", "paused", "retired", "all"] } },
-            { name: "capability", in: "query", required: false, schema: { type: "string" } },
-            { name: "sellerAgentId", in: "query", required: false, schema: { type: "string" } },
+            { name: "status", in: "query", required: false, schema: { type: "string", enum: ["certified", "conformance_failed", "draft", "all"] } },
+            { name: "providerId", in: "query", required: false, schema: { type: "string" } },
+            { name: "providerRef", in: "query", required: false, schema: { type: "string" } },
+            { name: "toolId", in: "query", required: false, schema: { type: "string" } },
             { name: "q", in: "query", required: false, schema: { type: "string" } },
             { name: "limit", in: "query", required: false, schema: { type: "integer", minimum: 1, maximum: 200 } },
             { name: "offset", in: "query", required: false, schema: { type: "integer", minimum: 0 } }
@@ -2974,9 +3813,9 @@ export function buildOpenApiSpec({ baseUrl = null } = {}) {
                   schema: {
                     type: "object",
                     additionalProperties: false,
-                    required: ["listings", "total", "limit", "offset"],
+                    required: ["publications", "total", "limit", "offset"],
                     properties: {
-                      listings: { type: "array", items: MarketplaceCapabilityListingV1 },
+                      publications: { type: "array", items: MarketplaceProviderPublicationSummaryV1 },
                       total: { type: "integer", minimum: 0 },
                       limit: { type: "integer", minimum: 1 },
                       offset: { type: "integer", minimum: 0 }
@@ -2987,12 +3826,79 @@ export function buildOpenApiSpec({ baseUrl = null } = {}) {
             },
             400: { description: "Bad Request", content: { "application/json": { schema: ErrorResponse } } }
           }
-        },
+        }
+      },
+      "/marketplace/tools": {
+        get: {
+          summary: "List marketplace tool listings aggregated from provider publications",
+          parameters: [
+            TenantHeader,
+            ProtocolHeader,
+            RequestIdHeader,
+            { name: "status", in: "query", required: false, schema: { type: "string", enum: ["certified", "conformance_failed", "draft", "all"] } },
+            { name: "providerId", in: "query", required: false, schema: { type: "string" } },
+            { name: "providerRef", in: "query", required: false, schema: { type: "string" } },
+            { name: "toolId", in: "query", required: false, schema: { type: "string" } },
+            { name: "q", in: "query", required: false, schema: { type: "string" } },
+            { name: "tags", in: "query", required: false, schema: { type: "string" }, description: "Comma-separated tag filter" },
+            { name: "limit", in: "query", required: false, schema: { type: "integer", minimum: 1, maximum: 200 } },
+            { name: "offset", in: "query", required: false, schema: { type: "integer", minimum: 0 } }
+          ],
+          security: [{ BearerAuth: [] }, { ProxyApiKey: [] }],
+          responses: {
+            200: {
+              description: "OK",
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object",
+                    additionalProperties: false,
+                    required: ["tools", "total", "limit", "offset"],
+                    properties: {
+                      tools: { type: "array", items: MarketplaceToolListingV1 },
+                      total: { type: "integer", minimum: 0 },
+                      limit: { type: "integer", minimum: 1 },
+                      offset: { type: "integer", minimum: 0 }
+                    }
+                  }
+                }
+              }
+            },
+            400: { description: "Bad Request", content: { "application/json": { schema: ErrorResponse } } }
+          }
+        }
+      },
+      "/marketplace/providers/publish": {
         post: {
-          summary: "Create or upsert a marketplace capability listing",
+          summary: "Publish provider manifest and optionally run conformance",
           parameters: [TenantHeader, ProtocolHeader, RequestIdHeader, IdempotencyHeader],
           security: [{ BearerAuth: [] }, { ProxyApiKey: [] }],
-          requestBody: { required: true, content: { "application/json": { schema: MarketplaceCapabilityListingUpsertRequest } } },
+          requestBody: {
+            required: true,
+            content: {
+              "application/json": {
+                schema: {
+                  type: "object",
+                  additionalProperties: false,
+                  required: ["baseUrl", "manifest", "publishProof", "publishProofJwksUrl"],
+                  properties: {
+                    providerId: { type: "string", nullable: true },
+                    baseUrl: { type: "string" },
+                    toolId: { type: "string", nullable: true },
+                    providerSigningPublicKeyPem: { type: "string", nullable: true },
+                    publishProof: { type: "string" },
+                    publishProofJwksUrl: { type: "string" },
+                    runConformance: { type: "boolean", nullable: true },
+                    description: { type: "string", nullable: true },
+                    contactUrl: { type: "string", nullable: true },
+                    termsUrl: { type: "string", nullable: true },
+                    tags: { type: "array", items: { type: "string" } },
+                    manifest: { type: "object", additionalProperties: true }
+                  }
+                }
+              }
+            }
+          },
           responses: {
             200: {
               description: "Updated",
@@ -3001,8 +3907,9 @@ export function buildOpenApiSpec({ baseUrl = null } = {}) {
                   schema: {
                     type: "object",
                     additionalProperties: false,
+                    required: ["publication"],
                     properties: {
-                      listing: MarketplaceCapabilityListingV1
+                      publication: { type: "object", additionalProperties: true }
                     }
                   }
                 }
@@ -3015,29 +3922,44 @@ export function buildOpenApiSpec({ baseUrl = null } = {}) {
                   schema: {
                     type: "object",
                     additionalProperties: false,
+                    required: ["publication"],
                     properties: {
-                      listing: MarketplaceCapabilityListingV1
+                      publication: { type: "object", additionalProperties: true }
                     }
                   }
                 }
               }
             },
             400: { description: "Bad Request", content: { "application/json": { schema: ErrorResponse } } },
-            404: { description: "Not Found", content: { "application/json": { schema: ErrorResponse } } },
-            409: { description: "Conflict", content: { "application/json": { schema: ErrorResponse } } }
+            409: { description: "Conflict", content: { "application/json": { schema: ErrorResponse } } },
+            502: { description: "Bad Gateway", content: { "application/json": { schema: ErrorResponse } } }
           }
         }
       },
-      "/marketplace/capability-listings/{listingId}": {
-        get: {
-          summary: "Get marketplace capability listing by id",
-          parameters: [
-            TenantHeader,
-            ProtocolHeader,
-            RequestIdHeader,
-            { name: "listingId", in: "path", required: true, schema: { type: "string" } }
-          ],
+      "/marketplace/providers/conformance/run": {
+        post: {
+          summary: "Run provider conformance checks",
+          parameters: [TenantHeader, ProtocolHeader, RequestIdHeader],
           security: [{ BearerAuth: [] }, { ProxyApiKey: [] }],
+          requestBody: {
+            required: true,
+            content: {
+              "application/json": {
+                schema: {
+                  type: "object",
+                  additionalProperties: false,
+                  required: ["baseUrl", "manifest"],
+                  properties: {
+                    providerId: { type: "string", nullable: true },
+                    baseUrl: { type: "string" },
+                    toolId: { type: "string", nullable: true },
+                    providerSigningPublicKeyPem: { type: "string", nullable: true },
+                    manifest: { type: "object", additionalProperties: true }
+                  }
+                }
+              }
+            }
+          },
           responses: {
             200: {
               description: "OK",
@@ -3046,50 +3968,222 @@ export function buildOpenApiSpec({ baseUrl = null } = {}) {
                   schema: {
                     type: "object",
                     additionalProperties: false,
+                    required: ["report"],
                     properties: {
-                      listing: MarketplaceCapabilityListingV1
+                      report: { type: "object", additionalProperties: true }
                     }
                   }
                 }
               }
             },
             400: { description: "Bad Request", content: { "application/json": { schema: ErrorResponse } } },
-            404: { description: "Not Found", content: { "application/json": { schema: ErrorResponse } } }
+            409: { description: "Conflict", content: { "application/json": { schema: ErrorResponse } } },
+            502: { description: "Bad Gateway", content: { "application/json": { schema: ErrorResponse } } }
           }
-        },
-        post: {
-          summary: "Update marketplace capability listing by id",
+        }
+      },
+      "/marketplace/providers/{providerId}": {
+        get: {
+          summary: "Get marketplace provider publication by id",
           parameters: [
             TenantHeader,
             ProtocolHeader,
             RequestIdHeader,
-            IdempotencyHeader,
-            { name: "listingId", in: "path", required: true, schema: { type: "string" } }
+            { name: "providerId", in: "path", required: true, schema: { type: "string" } }
           ],
           security: [{ BearerAuth: [] }, { ProxyApiKey: [] }],
-          requestBody: { required: true, content: { "application/json": { schema: MarketplaceCapabilityListingUpsertRequest } } },
           responses: {
             200: {
-              description: "Updated",
+              description: "OK",
               content: {
                 "application/json": {
                   schema: {
                     type: "object",
                     additionalProperties: false,
+                    required: ["publication", "certificationBadge"],
                     properties: {
-                      listing: MarketplaceCapabilityListingV1
+                      publication: { type: "object", additionalProperties: true },
+                      certificationBadge: MarketplaceProviderCertificationBadgeV1
                     }
                   }
                 }
               }
             },
             400: { description: "Bad Request", content: { "application/json": { schema: ErrorResponse } } },
-            404: { description: "Not Found", content: { "application/json": { schema: ErrorResponse } } },
-            409: { description: "Conflict", content: { "application/json": { schema: ErrorResponse } } }
+            404: { description: "Not Found", content: { "application/json": { schema: ErrorResponse } } }
           }
-        },
-        delete: {
-          summary: "Delete marketplace capability listing by id",
+        }
+      },
+      "/marketplace/providers/{providerId}/badge": {
+        get: {
+          summary: "Get provider certification badge payload",
+          parameters: [
+            TenantHeader,
+            ProtocolHeader,
+            RequestIdHeader,
+            { name: "providerId", in: "path", required: true, schema: { type: "string" } }
+          ],
+          security: [{ BearerAuth: [] }, { ProxyApiKey: [] }],
+          responses: {
+            200: {
+              description: "OK",
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object",
+                    additionalProperties: false,
+                    required: ["badge"],
+                    properties: {
+                      badge: MarketplaceProviderCertificationBadgeV1
+                    }
+                  }
+                }
+              }
+            },
+            400: { description: "Bad Request", content: { "application/json": { schema: ErrorResponse } } },
+            404: { description: "Not Found", content: { "application/json": { schema: ErrorResponse } } }
+          }
+        }
+      },
+      "/marketplace/capability-listings": {
+        get: {
+          summary: "List marketplace capability listings",
+          parameters: [
+            TenantHeader,
+            ProtocolHeader,
+            RequestIdHeader,
+            { name: "status", in: "query", required: false, schema: { type: "string", enum: ["active", "paused", "retired", "all"] } },
+            { name: "capability", in: "query", required: false, schema: { type: "string" } },
+            { name: "sellerAgentId", in: "query", required: false, schema: { type: "string" } },
+            { name: "q", in: "query", required: false, schema: { type: "string" } },
+            { name: "limit", in: "query", required: false, schema: { type: "integer", minimum: 1, maximum: 200 } },
+            { name: "offset", in: "query", required: false, schema: { type: "integer", minimum: 0 } }
+          ],
+          security: [{ BearerAuth: [] }, { ProxyApiKey: [] }],
+          responses: {
+            200: {
+              description: "OK",
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object",
+                    additionalProperties: false,
+                    required: ["listings", "total", "limit", "offset"],
+                    properties: {
+                      listings: { type: "array", items: MarketplaceCapabilityListingV1 },
+                      total: { type: "integer", minimum: 0 },
+                      limit: { type: "integer", minimum: 1 },
+                      offset: { type: "integer", minimum: 0 }
+                    }
+                  }
+                }
+              }
+            },
+            400: { description: "Bad Request", content: { "application/json": { schema: ErrorResponse } } }
+          }
+        },
+        post: {
+          summary: "Create or upsert a marketplace capability listing",
+          parameters: [TenantHeader, ProtocolHeader, RequestIdHeader, IdempotencyHeader],
+          security: [{ BearerAuth: [] }, { ProxyApiKey: [] }],
+          requestBody: { required: true, content: { "application/json": { schema: MarketplaceCapabilityListingUpsertRequest } } },
+          responses: {
+            200: {
+              description: "Updated",
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object",
+                    additionalProperties: false,
+                    properties: {
+                      listing: MarketplaceCapabilityListingV1
+                    }
+                  }
+                }
+              }
+            },
+            201: {
+              description: "Created",
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object",
+                    additionalProperties: false,
+                    properties: {
+                      listing: MarketplaceCapabilityListingV1
+                    }
+                  }
+                }
+              }
+            },
+            400: { description: "Bad Request", content: { "application/json": { schema: ErrorResponse } } },
+            404: { description: "Not Found", content: { "application/json": { schema: ErrorResponse } } },
+            409: { description: "Conflict", content: { "application/json": { schema: ErrorResponse } } }
+          }
+        }
+      },
+      "/marketplace/capability-listings/{listingId}": {
+        get: {
+          summary: "Get marketplace capability listing by id",
+          parameters: [
+            TenantHeader,
+            ProtocolHeader,
+            RequestIdHeader,
+            { name: "listingId", in: "path", required: true, schema: { type: "string" } }
+          ],
+          security: [{ BearerAuth: [] }, { ProxyApiKey: [] }],
+          responses: {
+            200: {
+              description: "OK",
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object",
+                    additionalProperties: false,
+                    properties: {
+                      listing: MarketplaceCapabilityListingV1
+                    }
+                  }
+                }
+              }
+            },
+            400: { description: "Bad Request", content: { "application/json": { schema: ErrorResponse } } },
+            404: { description: "Not Found", content: { "application/json": { schema: ErrorResponse } } }
+          }
+        },
+        post: {
+          summary: "Update marketplace capability listing by id",
+          parameters: [
+            TenantHeader,
+            ProtocolHeader,
+            RequestIdHeader,
+            IdempotencyHeader,
+            { name: "listingId", in: "path", required: true, schema: { type: "string" } }
+          ],
+          security: [{ BearerAuth: [] }, { ProxyApiKey: [] }],
+          requestBody: { required: true, content: { "application/json": { schema: MarketplaceCapabilityListingUpsertRequest } } },
+          responses: {
+            200: {
+              description: "Updated",
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object",
+                    additionalProperties: false,
+                    properties: {
+                      listing: MarketplaceCapabilityListingV1
+                    }
+                  }
+                }
+              }
+            },
+            400: { description: "Bad Request", content: { "application/json": { schema: ErrorResponse } } },
+            404: { description: "Not Found", content: { "application/json": { schema: ErrorResponse } } },
+            409: { description: "Conflict", content: { "application/json": { schema: ErrorResponse } } }
+          }
+        },
+        delete: {
+          summary: "Delete marketplace capability listing by id",
           parameters: [
             TenantHeader,
             ProtocolHeader,
@@ -3891,11 +4985,13 @@ export function buildOpenApiSpec({ baseUrl = null } = {}) {
                         closedByAgentId: { type: "string", nullable: true },
                         summary: { type: "string", nullable: true },
                         closedAt: { type: "string", format: "date-time", nullable: true },
+                        releaseRatePct: { type: "integer", minimum: 0, maximum: 100, nullable: true },
                         evidenceRefs: { type: "array", items: { type: "string" } }
                       }
                     },
                     resolutionOutcome: { type: "string", enum: ["accepted", "rejected", "partial", "withdrawn", "unresolved"] },
                     resolutionEscalationLevel: { type: "string", enum: ["l1_counterparty", "l2_arbiter", "l3_external"] },
+                    resolutionReleaseRatePct: { type: "integer", minimum: 0, maximum: 100 },
                     resolutionSummary: { type: "string" },
                     closedByAgentId: { type: "string" },
                     resolutionEvidenceRefs: { type: "array", items: { type: "string" } },
@@ -4209,6 +5305,99 @@ export function buildOpenApiSpec({ baseUrl = null } = {}) {
           }
         }
       },
+      "/agents/{agentId}/passport": {
+        get: {
+          summary: "Get an issued agent passport",
+          parameters: [
+            TenantHeader,
+            ProtocolHeader,
+            RequestIdHeader,
+            { name: "agentId", in: "path", required: true, schema: { type: "string" } }
+          ],
+          security: [{ BearerAuth: [] }, { ProxyApiKey: [] }],
+          responses: {
+            200: {
+              description: "OK",
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object",
+                    additionalProperties: false,
+                    properties: {
+                      agentPassport: AgentPassportV1
+                    }
+                  }
+                }
+              }
+            },
+            404: { description: "Not Found", content: { "application/json": { schema: ErrorResponse } } }
+          }
+        },
+        post: {
+          summary: "Issue or rotate an agent passport",
+          parameters: [TenantHeader, ProtocolHeader, RequestIdHeader, IdempotencyHeader, { name: "agentId", in: "path", required: true, schema: { type: "string" } }],
+          security: [{ BearerAuth: [] }, { ProxyApiKey: [] }],
+          requestBody: { required: true, content: { "application/json": { schema: AgentPassportUpsertRequest } } },
+          responses: {
+            200: {
+              description: "Updated",
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object",
+                    additionalProperties: false,
+                    properties: {
+                      agentPassport: AgentPassportV1
+                    }
+                  }
+                }
+              }
+            },
+            201: {
+              description: "Issued",
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object",
+                    additionalProperties: false,
+                    properties: {
+                      agentPassport: AgentPassportV1
+                    }
+                  }
+                }
+              }
+            },
+            400: { description: "Bad Request", content: { "application/json": { schema: ErrorResponse } } },
+            409: { description: "Conflict", content: { "application/json": { schema: ErrorResponse } } }
+          }
+        }
+      },
+      "/agents/{agentId}/passport/revoke": {
+        post: {
+          summary: "Revoke an issued agent passport",
+          parameters: [TenantHeader, ProtocolHeader, RequestIdHeader, IdempotencyHeader, { name: "agentId", in: "path", required: true, schema: { type: "string" } }],
+          security: [{ BearerAuth: [] }, { ProxyApiKey: [] }],
+          requestBody: { required: false, content: { "application/json": { schema: AgentPassportRevokeRequest } } },
+          responses: {
+            200: {
+              description: "Revoked",
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object",
+                    additionalProperties: false,
+                    properties: {
+                      agentPassport: AgentPassportV1
+                    }
+                  }
+                }
+              }
+            },
+            404: { description: "Not Found", content: { "application/json": { schema: ErrorResponse } } },
+            409: { description: "Conflict", content: { "application/json": { schema: ErrorResponse } } }
+          }
+        }
+      },
       "/agents/{agentId}/reputation": {
         get: {
           summary: "Get computed reputation for an agent",
@@ -4834,6 +6023,7 @@ export function buildOpenApiSpec({ baseUrl = null } = {}) {
                     panelCandidateAgentIds: { type: "array", items: { type: "string" } },
                     summary: { type: "string" },
                     evidenceRefs: { type: "array", items: { type: "string" } },
+                    disputeOpenEnvelope: DisputeOpenEnvelopeSignedRequest,
                     adminOverride: { type: "object", additionalProperties: true }
                   }
                 }
@@ -4843,15 +6033,44 @@ export function buildOpenApiSpec({ baseUrl = null } = {}) {
           responses: {
             201: {
               description: "Created",
-              content: { "application/json": { schema: { type: "object", additionalProperties: false, properties: { arbitrationCase: ArbitrationCaseV1 } } } }
-            },
-            400: { description: "Bad Request", content: { "application/json": { schema: ErrorResponse } } },
-            404: { description: "Not Found", content: { "application/json": { schema: ErrorResponse } } },
-            409: { description: "Conflict", content: { "application/json": { schema: ErrorResponse } } }
-          }
-        }
-      },
-      "/tool-calls/arbitration/verdict": {
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object",
+                    additionalProperties: false,
+                    properties: {
+                      arbitrationCase: ArbitrationCaseV1,
+                      arbitrationCaseArtifact: {
+                        type: "object",
+                        nullable: true,
+                        additionalProperties: false,
+                        properties: {
+                          artifactId: { type: "string" },
+                          artifactHash: { type: "string", nullable: true }
+                        }
+                      },
+                      disputeOpenEnvelopeArtifact: {
+                        type: "object",
+                        nullable: true,
+                        additionalProperties: false,
+                        properties: {
+                          artifactId: { type: "string" },
+                          artifactHash: { type: "string", nullable: true }
+                        }
+                      },
+                      alreadyExisted: { type: "boolean" }
+                    }
+                  }
+                }
+              }
+            },
+            400: { description: "Bad Request", content: { "application/json": { schema: ErrorResponse } } },
+            404: { description: "Not Found", content: { "application/json": { schema: ErrorResponse } } },
+            409: { description: "Conflict", content: { "application/json": { schema: ErrorResponse } } }
+          }
+        }
+      },
+      "/tool-calls/arbitration/verdict": {
         post: {
           summary: "Submit signed arbitration verdict for a tool-call case (binary release/refund)",
           parameters: [TenantHeader, ProtocolHeader, RequestIdHeader, IdempotencyHeader],
@@ -4995,6 +6214,64 @@ export function buildOpenApiSpec({ baseUrl = null } = {}) {
           }
         }
       },
+      "/ops/tool-calls/replay-evaluate": {
+        get: {
+          summary: "Ops: replay tool-call holdback/dispute resolution by agreement hash",
+          parameters: [
+            TenantHeader,
+            ProtocolHeader,
+            RequestIdHeader,
+            { name: "agreementHash", in: "query", required: true, schema: { type: "string" } }
+          ],
+          security: [{ BearerAuth: [] }, { ProxyApiKey: [] }],
+          "x-settld-scopes": ["ops_read"],
+          responses: {
+            200: {
+              description: "OK",
+              content: {
+                "application/json": {
+                  schema: ToolCallReplayEvaluateResponse
+                }
+              }
+            },
+            400: { description: "Bad Request", content: { "application/json": { schema: ErrorResponse } } },
+            403: { description: "Forbidden", content: { "application/json": { schema: ErrorResponse } } },
+            404: { description: "Not Found", content: { "application/json": { schema: ErrorResponse } } },
+            409: { description: "Conflict", content: { "application/json": { schema: ErrorResponse } } },
+            501: { description: "Not Implemented", content: { "application/json": { schema: ErrorResponse } } }
+          }
+        }
+      },
+      "/ops/reputation/facts": {
+        get: {
+          summary: "Ops: aggregate append-only reputation facts for an agent/tool window",
+          parameters: [
+            TenantHeader,
+            ProtocolHeader,
+            RequestIdHeader,
+            { name: "agentId", in: "query", required: true, schema: { type: "string" } },
+            { name: "toolId", in: "query", required: false, schema: { type: "string" } },
+            { name: "window", in: "query", required: false, schema: { type: "string", enum: ["7d", "30d", "allTime"] } },
+            { name: "asOf", in: "query", required: false, schema: { type: "string", format: "date-time" } },
+            { name: "includeEvents", in: "query", required: false, schema: { type: "string", enum: ["1"] } }
+          ],
+          security: [{ BearerAuth: [] }, { ProxyApiKey: [] }],
+          "x-settld-scopes": ["ops_read"],
+          responses: {
+            200: {
+              description: "OK",
+              content: {
+                "application/json": {
+                  schema: ReputationFactsResponse
+                }
+              }
+            },
+            400: { description: "Bad Request", content: { "application/json": { schema: ErrorResponse } } },
+            403: { description: "Forbidden", content: { "application/json": { schema: ErrorResponse } } },
+            501: { description: "Not Implemented", content: { "application/json": { schema: ErrorResponse } } }
+          }
+        }
+      },
       "/ops/tool-calls/holds/{holdHash}": {
         get: {
           summary: "Ops: get tool-call funding hold",
@@ -5142,6 +6419,85 @@ export function buildOpenApiSpec({ baseUrl = null } = {}) {
           }
         }
       },
+      "/ops/emergency/pause": {
+        post: {
+          summary: "Emergency pause an agent for paid execution paths",
+          parameters: [TenantHeader, ProtocolHeader, RequestIdHeader],
+          security: [{ BearerAuth: [] }, { ProxyApiKey: [] }],
+          "x-settld-scopes": ["ops_write"],
+          requestBody: { required: false, content: { "application/json": { schema: OpsEmergencyPauseRequest } } },
+          responses: {
+            200: { description: "OK", content: { "application/json": { schema: OpsEmergencyControlResponse } } },
+            201: { description: "Created", content: { "application/json": { schema: OpsEmergencyControlResponse } } },
+            400: { description: "Bad Request", content: { "application/json": { schema: ErrorResponse } } },
+            403: { description: "Forbidden", content: { "application/json": { schema: ErrorResponse } } },
+            409: { description: "Conflict", content: { "application/json": { schema: ErrorResponse } } }
+          }
+        }
+      },
+      "/ops/emergency/quarantine": {
+        post: {
+          summary: "Emergency quarantine an agent for paid execution paths",
+          parameters: [TenantHeader, ProtocolHeader, RequestIdHeader],
+          security: [{ BearerAuth: [] }, { ProxyApiKey: [] }],
+          "x-settld-scopes": ["ops_write"],
+          requestBody: { required: false, content: { "application/json": { schema: OpsEmergencyQuarantineRequest } } },
+          responses: {
+            200: { description: "OK", content: { "application/json": { schema: OpsEmergencyControlResponse } } },
+            201: { description: "Created", content: { "application/json": { schema: OpsEmergencyControlResponse } } },
+            400: { description: "Bad Request", content: { "application/json": { schema: ErrorResponse } } },
+            403: { description: "Forbidden", content: { "application/json": { schema: ErrorResponse } } },
+            409: { description: "Conflict", content: { "application/json": { schema: ErrorResponse } } }
+          }
+        }
+      },
+      "/ops/emergency/revoke": {
+        post: {
+          summary: "Emergency revoke delegated authority for paid execution paths",
+          parameters: [TenantHeader, ProtocolHeader, RequestIdHeader],
+          security: [{ BearerAuth: [] }, { ProxyApiKey: [] }],
+          "x-settld-scopes": ["ops_write"],
+          requestBody: { required: false, content: { "application/json": { schema: OpsEmergencyRevokeRequest } } },
+          responses: {
+            200: { description: "OK", content: { "application/json": { schema: OpsEmergencyControlResponse } } },
+            201: { description: "Created", content: { "application/json": { schema: OpsEmergencyControlResponse } } },
+            400: { description: "Bad Request", content: { "application/json": { schema: ErrorResponse } } },
+            403: { description: "Forbidden", content: { "application/json": { schema: ErrorResponse } } },
+            409: { description: "Conflict", content: { "application/json": { schema: ErrorResponse } } }
+          }
+        }
+      },
+      "/ops/emergency/kill-switch": {
+        post: {
+          summary: "Set emergency kill-switch state for high-risk execution",
+          parameters: [TenantHeader, ProtocolHeader, RequestIdHeader],
+          security: [{ BearerAuth: [] }, { ProxyApiKey: [] }],
+          "x-settld-scopes": ["ops_write"],
+          requestBody: { required: false, content: { "application/json": { schema: OpsEmergencyKillSwitchRequest } } },
+          responses: {
+            200: { description: "OK", content: { "application/json": { schema: OpsEmergencyControlResponse } } },
+            201: { description: "Created", content: { "application/json": { schema: OpsEmergencyControlResponse } } },
+            400: { description: "Bad Request", content: { "application/json": { schema: ErrorResponse } } },
+            403: { description: "Forbidden", content: { "application/json": { schema: ErrorResponse } } },
+            409: { description: "Conflict", content: { "application/json": { schema: ErrorResponse } } }
+          }
+        }
+      },
+      "/ops/emergency/resume": {
+        post: {
+          summary: "Resume previously paused or quarantined emergency controls",
+          parameters: [TenantHeader, ProtocolHeader, RequestIdHeader],
+          security: [{ BearerAuth: [] }, { ProxyApiKey: [] }],
+          "x-settld-scopes": ["ops_write"],
+          requestBody: { required: false, content: { "application/json": { schema: OpsEmergencyResumeRequest } } },
+          responses: {
+            200: { description: "OK", content: { "application/json": { schema: OpsEmergencyControlResponse } } },
+            400: { description: "Bad Request", content: { "application/json": { schema: ErrorResponse } } },
+            403: { description: "Forbidden", content: { "application/json": { schema: ErrorResponse } } },
+            409: { description: "Conflict", content: { "application/json": { schema: ErrorResponse } } }
+          }
+        }
+      },
       "/ops/network/command-center": {
         get: {
           summary: "Network command-center summary",
@@ -5444,6 +6800,43 @@ export function buildOpenApiSpec({ baseUrl = null } = {}) {
           }
         }
       },
+      "/ops/money-rails/{providerId}/operations/{operationId}/submit": {
+        post: {
+          summary: "Submit a money rail payout operation to the configured provider",
+          parameters: [
+            TenantHeader,
+            ProtocolHeader,
+            RequestIdHeader,
+            IdempotencyHeader,
+            { name: "providerId", in: "path", required: true, schema: { type: "string" } },
+            { name: "operationId", in: "path", required: true, schema: { type: "string" } }
+          ],
+          security: [{ BearerAuth: [] }, { ProxyApiKey: [] }],
+          "x-settld-scopes": ["finance_write"],
+          requestBody: {
+            required: false,
+            content: {
+              "application/json": {
+                schema: {
+                  type: "object",
+                  additionalProperties: false,
+                  properties: {
+                    providerRef: { type: "string" }
+                  }
+                }
+              }
+            }
+          },
+          responses: {
+            200: { description: "OK", content: { "application/json": { schema: { type: "object", additionalProperties: true } } } },
+            400: { description: "Bad request", content: { "application/json": { schema: ErrorResponse } } },
+            404: { description: "Not found", content: { "application/json": { schema: ErrorResponse } } },
+            409: { description: "Conflict", content: { "application/json": { schema: ErrorResponse } } },
+            502: { description: "Upstream provider error", content: { "application/json": { schema: ErrorResponse } } },
+            503: { description: "Provider circuit open", content: { "application/json": { schema: ErrorResponse } } }
+          }
+        }
+      },
       "/ops/money-rails/{providerId}/events/ingest": {
         post: {
           summary: "Ingest provider event and deterministically map to operation state",
@@ -5520,6 +6913,44 @@ export function buildOpenApiSpec({ baseUrl = null } = {}) {
           }
         }
       },
+      "/ops/finance/money-rails/stripe-connect/accounts/sync": {
+        post: {
+          summary: "Sync Stripe Connect account KYB/capability state from Stripe",
+          parameters: [
+            TenantHeader,
+            ProtocolHeader,
+            RequestIdHeader,
+            IdempotencyHeader,
+            { name: "providerId", in: "query", required: false, schema: { type: "string" } }
+          ],
+          security: [{ BearerAuth: [] }, { ProxyApiKey: [] }],
+          "x-settld-scopes": ["finance_write"],
+          requestBody: {
+            required: false,
+            content: {
+              "application/json": {
+                schema: {
+                  type: "object",
+                  additionalProperties: false,
+                  properties: {
+                    providerId: { type: "string" },
+                    dryRun: { type: "boolean", default: false },
+                    accountIds: { type: "array", items: { type: "string" } }
+                  }
+                }
+              }
+            }
+          },
+          responses: {
+            200: { description: "OK", content: { "application/json": { schema: { type: "object", additionalProperties: true } } } },
+            400: { description: "Bad Request", content: { "application/json": { schema: ErrorResponse } } },
+            404: { description: "Not found", content: { "application/json": { schema: ErrorResponse } } },
+            409: { description: "Conflict", content: { "application/json": { schema: ErrorResponse } } },
+            502: { description: "Upstream provider error", content: { "application/json": { schema: ErrorResponse } } },
+            503: { description: "Provider circuit open", content: { "application/json": { schema: ErrorResponse } } }
+          }
+        }
+      },
       "/ops/finance/account-map": {
         get: {
           summary: "Get finance account map",
@@ -5660,6 +7091,283 @@ export function buildOpenApiSpec({ baseUrl = null } = {}) {
           }
         }
       },
+      "/x402/wallet-assignment/resolve": {
+        post: {
+          summary: "Resolve deterministic x402 wallet assignment",
+          parameters: [TenantHeader, ProtocolHeader, RequestIdHeader],
+          security: [{ BearerAuth: [] }, { ProxyApiKey: [] }],
+          requestBody: {
+            required: false,
+            content: {
+              "application/json": {
+                schema: X402WalletAssignmentResolveRequest
+              }
+            }
+          },
+          responses: {
+            200: { description: "OK", content: { "application/json": { schema: X402WalletAssignmentResolveResponse } } },
+            400: { description: "Bad Request", content: { "application/json": { schema: ErrorResponse } } }
+          }
+        }
+      },
+      "/x402/gate/authorize-payment": {
+        post: {
+          summary: "Authorize payment for an x402 gate",
+          description:
+            "Uses strict preconditions (including optional ExecutionIntent.v1 binding) before minting or reusing an authorization token.",
+          parameters: [TenantHeader, ProtocolHeader, RequestIdHeader, IdempotencyHeader],
+          security: [{ BearerAuth: [] }, { ProxyApiKey: [] }],
+          requestBody: {
+            required: true,
+            content: {
+              "application/json": {
+                schema: X402GateAuthorizePaymentRequest
+              }
+            }
+          },
+          responses: {
+            200: { description: "OK", content: { "application/json": { schema: { type: "object", additionalProperties: true } } } },
+            400: {
+              description: "Bad Request",
+              "x-settld-known-error-codes": [...X402AuthorizePaymentBadRequestKnownErrorCodes],
+              content: {
+                "application/json": {
+                  schema: errorResponseWithKnownCodes(X402AuthorizePaymentBadRequestKnownErrorCodes)
+                }
+              }
+            },
+            404: { description: "Not Found", content: { "application/json": { schema: ErrorResponse } } },
+            409: {
+              description: "Conflict",
+              "x-settld-known-error-codes": [...X402AuthorizePaymentConflictKnownErrorCodes],
+              content: {
+                "application/json": {
+                  schema: errorResponseWithKnownCodes(X402AuthorizePaymentConflictKnownErrorCodes)
+                }
+              }
+            }
+          }
+        }
+      },
+      "/x402/gate/verify": {
+        post: {
+          summary: "Verify x402 gated execution and settle escrow",
+          parameters: [TenantHeader, ProtocolHeader, RequestIdHeader, IdempotencyHeader],
+          security: [{ BearerAuth: [] }, { ProxyApiKey: [] }],
+          requestBody: {
+            required: true,
+            content: {
+              "application/json": {
+                schema: X402GateVerifyRequest
+              }
+            }
+          },
+          responses: {
+            200: { description: "OK", content: { "application/json": { schema: { type: "object", additionalProperties: true } } } },
+            400: {
+              description: "Bad Request",
+              "x-settld-known-error-codes": [...X402GateVerifyBadRequestKnownErrorCodes],
+              content: {
+                "application/json": {
+                  schema: errorResponseWithKnownCodes(X402GateVerifyBadRequestKnownErrorCodes)
+                }
+              }
+            },
+            404: { description: "Not Found", content: { "application/json": { schema: ErrorResponse } } },
+            409: {
+              description: "Conflict",
+              "x-settld-known-error-codes": [...X402GateVerifyConflictKnownErrorCodes],
+              content: {
+                "application/json": {
+                  schema: errorResponseWithKnownCodes(X402GateVerifyConflictKnownErrorCodes)
+                }
+              }
+            }
+          }
+        }
+      },
+      "/x402/zk/verification-keys": {
+        post: {
+          summary: "Register an immutable x402 zk verification key",
+          parameters: [TenantHeader, ProtocolHeader, RequestIdHeader, IdempotencyHeader],
+          security: [{ BearerAuth: [] }, { ProxyApiKey: [] }],
+          requestBody: {
+            required: true,
+            content: {
+              "application/json": {
+                schema: {
+                  type: "object",
+                  additionalProperties: false,
+                  required: ["verificationKey"],
+                  properties: {
+                    verificationKey: X402ZkVerificationKeyV1
+                  }
+                }
+              }
+            }
+          },
+          responses: {
+            200: { description: "OK", content: { "application/json": { schema: { type: "object", additionalProperties: true } } } },
+            201: { description: "Created", content: { "application/json": { schema: { type: "object", additionalProperties: true } } } },
+            400: { description: "Bad Request", content: { "application/json": { schema: ErrorResponse } } },
+            409: { description: "Conflict", content: { "application/json": { schema: ErrorResponse } } }
+          }
+        },
+        get: {
+          summary: "List x402 zk verification keys",
+          parameters: [
+            TenantHeader,
+            ProtocolHeader,
+            RequestIdHeader,
+            { name: "protocol", in: "query", required: false, schema: { type: "string", enum: ["groth16", "plonk", "stark"] } },
+            { name: "providerRef", in: "query", required: false, schema: { type: "string" } },
+            { name: "limit", in: "query", required: false, schema: { type: "integer", minimum: 1, maximum: 2000, default: 200 } },
+            { name: "offset", in: "query", required: false, schema: { type: "integer", minimum: 0, maximum: 100000, default: 0 } }
+          ],
+          security: [{ BearerAuth: [] }, { ProxyApiKey: [] }],
+          responses: {
+            200: { description: "OK", content: { "application/json": { schema: { type: "object", additionalProperties: true } } } },
+            400: { description: "Bad Request", content: { "application/json": { schema: ErrorResponse } } }
+          }
+        }
+      },
+      "/x402/zk/verification-keys/{verificationKeyId}": {
+        get: {
+          summary: "Get x402 zk verification key by id",
+          parameters: [
+            TenantHeader,
+            ProtocolHeader,
+            RequestIdHeader,
+            { name: "verificationKeyId", in: "path", required: true, schema: { type: "string" } }
+          ],
+          security: [{ BearerAuth: [] }, { ProxyApiKey: [] }],
+          responses: {
+            200: { description: "OK", content: { "application/json": { schema: { type: "object", additionalProperties: true } } } },
+            404: { description: "Not Found", content: { "application/json": { schema: ErrorResponse } } }
+          }
+        }
+      },
+      "/x402/webhooks/endpoints": {
+        post: {
+          summary: "Register an x402 principal webhook endpoint (secret returned once)",
+          parameters: [TenantHeader, ProtocolHeader, RequestIdHeader, IdempotencyHeader],
+          security: [{ BearerAuth: [] }, { ProxyApiKey: [] }],
+          requestBody: {
+            required: true,
+            content: {
+              "application/json": {
+                schema: {
+                  type: "object",
+                  additionalProperties: false,
+                  required: ["url", "events"],
+                  properties: {
+                    url: { type: "string", format: "uri", example: "https://principal.example.com/webhooks/settld" },
+                    events: {
+                      type: "array",
+                      minItems: 1,
+                      items: {
+                        type: "string",
+                        enum: ["x402.escalation.created", "x402.escalation.approved", "x402.escalation.denied"]
+                      }
+                    },
+                    description: { type: "string", maxLength: 300 },
+                    status: { type: "string", enum: ["active", "disabled"], default: "active" }
+                  }
+                }
+              }
+            }
+          },
+          responses: {
+            201: { description: "Created", content: { "application/json": { schema: { type: "object", additionalProperties: true } } } },
+            400: { description: "Bad Request", content: { "application/json": { schema: ErrorResponse } } }
+          }
+        },
+        get: {
+          summary: "List x402 webhook endpoints",
+          parameters: [
+            TenantHeader,
+            ProtocolHeader,
+            RequestIdHeader,
+            { name: "status", in: "query", required: false, schema: { type: "string", enum: ["active", "disabled", "revoked"] } },
+            {
+              name: "event",
+              in: "query",
+              required: false,
+              schema: { type: "string", enum: ["x402.escalation.created", "x402.escalation.approved", "x402.escalation.denied"] }
+            },
+            { name: "limit", in: "query", required: false, schema: { type: "integer", minimum: 1, maximum: 1000, default: 200 } },
+            { name: "offset", in: "query", required: false, schema: { type: "integer", minimum: 0, maximum: 100000, default: 0 } }
+          ],
+          security: [{ BearerAuth: [] }, { ProxyApiKey: [] }],
+          responses: {
+            200: { description: "OK", content: { "application/json": { schema: { type: "object", additionalProperties: true } } } },
+            400: { description: "Bad Request", content: { "application/json": { schema: ErrorResponse } } }
+          }
+        }
+      },
+      "/x402/webhooks/endpoints/{endpointId}": {
+        get: {
+          summary: "Get x402 webhook endpoint",
+          parameters: [
+            TenantHeader,
+            ProtocolHeader,
+            RequestIdHeader,
+            { name: "endpointId", in: "path", required: true, schema: { type: "string" } }
+          ],
+          security: [{ BearerAuth: [] }, { ProxyApiKey: [] }],
+          responses: {
+            200: { description: "OK", content: { "application/json": { schema: { type: "object", additionalProperties: true } } } },
+            404: { description: "Not Found", content: { "application/json": { schema: ErrorResponse } } }
+          }
+        },
+        delete: {
+          summary: "Revoke x402 webhook endpoint",
+          parameters: [
+            TenantHeader,
+            ProtocolHeader,
+            RequestIdHeader,
+            IdempotencyHeader,
+            { name: "endpointId", in: "path", required: true, schema: { type: "string" } }
+          ],
+          security: [{ BearerAuth: [] }, { ProxyApiKey: [] }],
+          responses: {
+            200: { description: "OK", content: { "application/json": { schema: { type: "object", additionalProperties: true } } } },
+            404: { description: "Not Found", content: { "application/json": { schema: ErrorResponse } } }
+          }
+        }
+      },
+      "/x402/webhooks/endpoints/{endpointId}/rotate-secret": {
+        post: {
+          summary: "Rotate x402 webhook endpoint secret (returns new secret once)",
+          parameters: [
+            TenantHeader,
+            ProtocolHeader,
+            RequestIdHeader,
+            { name: "endpointId", in: "path", required: true, schema: { type: "string" } }
+          ],
+          security: [{ BearerAuth: [] }, { ProxyApiKey: [] }],
+          requestBody: {
+            required: false,
+            content: {
+              "application/json": {
+                schema: {
+                  type: "object",
+                  additionalProperties: false,
+                  properties: {
+                    gracePeriodSeconds: { type: "integer", minimum: 1, maximum: 604800, default: 86400 }
+                  }
+                }
+              }
+            }
+          },
+          responses: {
+            200: { description: "OK", content: { "application/json": { schema: { type: "object", additionalProperties: true } } } },
+            400: { description: "Bad Request", content: { "application/json": { schema: ErrorResponse } } },
+            404: { description: "Not Found", content: { "application/json": { schema: ErrorResponse } } },
+            409: { description: "Conflict", content: { "application/json": { schema: ErrorResponse } } }
+          }
+        }
+      },
       "/exports/ack": {
         post: {
           summary: "ACK a delivery (destination-signed)",