wolverine-ai 5.1.0 → 5.2.1

package/.env.example

@@ -7,9 +7,9 @@
 OPENAI_API_KEY=
 ANTHROPIC_API_KEY=
 
-# ── Wolverine Inference (self-hosted models) ─────────────────────
-# Get your API key at wolverinenode.xyz — $1 = 100 credits
-# Set provider to "wolverine" in server/config/settings.json
+# ── Wolverine Platform (optional) ────────────────────────────────
+# API key for wolverine-hosted models (wolverine-test-1, wolverine-embedding-1)
+# Get your key at wolverinenode.xyz
 WOLVERINE_API_KEY=
 # ── Dashboard Admin Key  (make your own) ──────────────────────────────────────────
 # Required for the agent command interface on the dashboard.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wolverine-ai",
-  "version": "5.1.0",
+  "version": "5.2.1",
   "description": "Self-healing Node.js server framework powered by AI. Catches crashes, diagnoses errors, generates fixes, verifies, and restarts — automatically.",
   "main": "src/index.js",
   "bin": {

package/src/brain/brain.js

@@ -190,11 +190,11 @@ const SEED_DOCS = [
     metadata: { topic: "notifications" },
   },
   {
-    text: "x402 paid APIs — turn any route into a paid API with one flag. Register the plugin once: fastify.register(require('wolverine-ai/src/middleware/x402-fastify')). Then add { config: { x402: { price: '$0.10' } } } to any route definition. That's it — the route now requires USDC payment on Base. Routes WITHOUT x402 config are completely unaffected (zero overhead). Two modes: (1) Fixed price: { x402: { price: '$0.10' } } — every call costs exactly $0.10. (2) Variable price: { x402: { variable: true, min: '$1', max: '$10000', priceField: 'dollars' } } — caller specifies amount in request body. Flow: no Payment-Signature header → 402 + Payment-Required header with price/network/payTo. Client SDK (@x402/fetch or wallet signing) handles payment → retries with Payment-Signature → middleware verifies signature (EIP-3009 TransferWithAuthorization for USDC, or x402 facilitator) → req.x402 = { paid: true, amount: '$5.00', from: '0x...', txHash } → handler runs. Vault wallet auto-detected as payTo address. Wolverine's adaptive rate limiter still protects paid routes from overload. Analytics track paid vs free calls. CLI: wolverine --x402-info shows setup guide.",
+    text: "x402 paid APIs — turn any route into a paid API with one flag. Register the plugin once: fastify.register(require('wolverine-ai/src/middleware/x402-fastify')). Then add { config: { x402: { price: '$0.10' } } } to any route definition. That's it — the route now requires USDC payment on Base. Routes WITHOUT x402 config are completely unaffected (zero overhead). Two modes: (1) Fixed price: { x402: { price: '$0.10' } } — every call costs exactly $0.10. (2) Variable price: { x402: { variable: true, min: '$1', max: '$10000', priceField: 'dollars' } } — caller specifies amount in request body. Settlement flow: no Payment-Signature header → 402 + Payment-Required header with price/network/payTo. Client SDK (@x402/fetch or wallet signing) handles payment → retries with Payment-Signature → middleware sends to x402 facilitator (CDP production: api.cdp.coinbase.com/platform/v2/x402, testnet: x402.org/facilitator) → facilitator verifies signature AND executes on-chain transferWithAuthorization() → USDC moves on Base → req.x402 = { paid: true, amount: '$5.00', from: '0x...', txHash } → handler runs. Fallback: if facilitator is down, server self-settles using vault wallet to call transferWithAuthorization() directly (server pays gas). Facilitator auto-selected by network: eip155:8453 (Base mainnet) → production, eip155:84532 (Base Sepolia) → testnet. Bazaar compatible — services auto-cataloged on first facilitator-settled payment. Vault wallet auto-detected as payTo address. Dashboard tracks x402 payments, revenue by route, USDC/ETH balances. CLI: wolverine --x402-info.",
     metadata: { topic: "x402-paid-apis" },
   },
   {
-    text: "x402 examples — making a paid API is as simple as adding a route. FREE route (normal): fastify.get('/api/data', async (req) => { return getData(); }). PAID route (just add x402 flag): fastify.get('/api/premium-data', { config: { x402: { price: '$0.01' } } }, async (req) => { return getPremiumData(); }). CREDIT PURCHASE route (variable): fastify.post('/buy-credits', { config: { x402: { variable: true, min: '$1', max: '$10000', priceField: 'dollars' } } }, async (req) => { const credits = parseFloat(req.x402.amount.replace('$','')) * 100; await addCredits(req.body.accountId, credits); return { credits }; }). Payment verification is automatic — the handler only runs after USDC is confirmed. No blockchain code needed in route handlers.",
+    text: "x402 examples — making a paid API is as simple as adding a route. FREE route (normal): fastify.get('/api/data', async (req) => { return getData(); }). PAID route (just add x402 flag): fastify.get('/api/premium-data', { config: { x402: { price: '$0.01' } } }, async (req) => { return getPremiumData(); }). CREDIT PURCHASE route (variable): fastify.post('/buy-credits', { config: { x402: { variable: true, min: '$1', max: '$10000', priceField: 'dollars' } } }, async (req) => { const credits = parseFloat(req.x402.amount.replace('$','')) * 100; await addCredits(req.body.accountId, credits); return { credits }; }). Payment settlement is automatic — the facilitator verifies and settles on-chain before the handler runs. No blockchain code needed in route handlers. Compatible with @x402/fetch, @x402/axios client SDKs and x402 Bazaar API discovery.",
     metadata: { topic: "x402-examples" },
   },
   {

package/src/core/ai-client.js

@@ -656,7 +656,7 @@ ${backupSourceCode ? `## Last Known Working Version\n\`\`\`javascript\n${backupS
 "changes" is for code edits (optional, use for actual code fixes).
 Include both if needed, or just one.`;
 
-  const result = await aiCall({ model, systemPrompt, userPrompt, maxTokens: 2048, category: "reasoning" });
+  const result = await aiCall({ model, systemPrompt, userPrompt, maxTokens: 2048, category: "coding" });
   const content = (result.content || "").trim();
 
   // Guard: cap length before regex extraction to prevent catastrophic backtracking

package/src/core/wolverine.js

@@ -380,10 +380,6 @@ async function _healImpl({ stderr, cwd, sandbox, notifier, rateLimiter, backupMa
             const patchResults = applyPatch(repair.changes, cwd, sandbox);
             if (!patchResults.every(r => r.success)) throw new Error("Patch failed");
 
-            // Track code generation as "coding" — the AI produced code changes
-            const codeTokens = repair.changes.reduce((s, c) => s + ((c.new || "").length / 4), 0);
-            _trackOp(getModel("coding"), "coding", 0, Math.round(codeTokens), "patch_apply", 0, true);
-
             for (const r of patchResults) console.log(chalk.green(`  ✅ Patched: ${r.file}`));
           }
 

package/src/dashboard/server.js

@@ -67,6 +67,8 @@ class DashboardServer {
       if (req.url === "/api/process") return this._handleProcess(req, res);
       if (req.url === "/api/routes") return this._handleRoutes(req, res);
       if (req.url === "/api/usage/history") return this._handleUsageHistory(req, res);
+      if (req.url === "/api/vault") return this._handleVault(req, res);
+      if (req.url === "/api/x402") return this._handleX402(req, res);
       if (req.url === "/api/auth/verify" && req.method === "POST") return this._handleAuthVerify(req, res);
       if (req.url === "/api/command" && req.method === "POST") return this._handleCommand(req, res);
       if (req.url.startsWith("/api/backups/") && req.url.endsWith("/rollback") && req.method === "POST") return this._handleRollback(req, res);
@@ -1048,6 +1050,82 @@ ${context ? "\nBrain:\n" + context : ""}`,
     res.end(JSON.stringify(this.brain ? this.brain.getStats() : {}));
   }
 
+  async _handleVault(req, res) {
+    res.writeHead(200, { "Content-Type": "application/json" });
+    try {
+      const { getVaultStatus, getWalletAddress } = require("../vault/wallet-ops");
+      const status = getVaultStatus();
+      let address = null;
+      let balances = { usdc: null, eth: null };
+
+      if (status.initialized) {
+        try { address = await getWalletAddress(); } catch {}
+        // Fetch on-chain balances from Base network
+        if (address) {
+          try {
+            const https = require("https");
+            const rpc = "https://mainnet.base.org";
+            const fetchRpc = (method, params) => new Promise((resolve) => {
+              const body = JSON.stringify({ jsonrpc: "2.0", id: 1, method, params });
+              const req = https.request(rpc, { method: "POST", headers: { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(body) }, timeout: 5000 }, (res) => {
+                let data = ""; res.on("data", c => data += c);
+                res.on("end", () => { try { resolve(JSON.parse(data).result); } catch { resolve(null); } });
+              });
+              req.on("error", () => resolve(null));
+              req.on("timeout", () => { req.destroy(); resolve(null); });
+              req.write(body); req.end();
+            });
+
+            // ETH balance
+            const ethHex = await fetchRpc("eth_getBalance", [address, "latest"]);
+            if (ethHex) balances.eth = (parseInt(ethHex, 16) / 1e18).toFixed(6);
+
+            // USDC balance (ERC-20 balanceOf)
+            const usdcContract = "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913";
+            const balanceOfSig = "0x70a08231000000000000000000000000" + address.slice(2).toLowerCase();
+            const usdcHex = await fetchRpc("eth_call", [{ to: usdcContract, data: balanceOfSig }, "latest"]);
+            if (usdcHex) balances.usdc = (parseInt(usdcHex, 16) / 1e6).toFixed(2);
+          } catch {}
+        }
+      }
+
+      res.end(JSON.stringify({ ...status, address, balances }));
+    } catch (err) {
+      res.end(JSON.stringify({ initialized: false, error: err.message }));
+    }
+  }
+
+  _handleX402(req, res) {
+    res.writeHead(200, { "Content-Type": "application/json" });
+    // Read x402 payment log from .wolverine/x402-payments.json
+    const fs = require("fs");
+    const path = require("path");
+    const logPath = path.join(process.cwd(), ".wolverine", "x402-payments.json");
+    let payments = [];
+    try { payments = JSON.parse(fs.readFileSync(logPath, "utf-8")); } catch {}
+
+    const totalRevenue = payments.reduce((s, p) => s + (parseFloat(p.amount?.replace("$", "")) || 0), 0);
+    const successfulPayments = payments.filter(p => p.verified);
+    const recentPayments = payments.slice(-50).reverse();
+
+    // Group by route
+    const byRoute = {};
+    for (const p of payments) {
+      const route = p.route || "unknown";
+      if (!byRoute[route]) byRoute[route] = { calls: 0, revenue: 0 };
+      byRoute[route].calls++;
+      byRoute[route].revenue += parseFloat(p.amount?.replace("$", "")) || 0;
+    }
+
+    res.end(JSON.stringify({
+      totalPayments: payments.length,
+      successfulPayments: successfulPayments.length,
+      totalRevenue: totalRevenue.toFixed(2),
+      recentPayments,
+      byRoute,
+    }));
+  }
+
   _handleDashboard(req, res) {
     res.writeHead(200, { "Content-Type": "text/html" });
     res.end(DASHBOARD_HTML.replace(/__PORT__/g, String(this.port)));
@@ -1164,6 +1242,10 @@ main{overflow-y:auto;padding:24px}
   <a data-panel="analytics">📊 Analytics</a>
   <a data-panel="processes">⚙️ Processes</a>
   <div class="sep"></div>
+  <div class="label">Wallet</div>
+  <a data-panel="vault">🔐 Vault</a>
+  <a data-panel="x402">💳 x402 Payments</a>
+  <div class="sep"></div>
   <div class="label">Agent</div>
   <a data-panel="command">💬 Command</a>
   <div class="sep"></div>
@@ -1183,6 +1265,14 @@ main{overflow-y:auto;padding:24px}
     <div class="stat-card brain"><div class="stat-val" id="s-memories">0</div><div class="stat-lbl">Memories</div></div>
     <div class="stat-card up"><div class="stat-val" id="s-uptime">0s</div><div class="stat-lbl">Uptime</div></div>
   </div>
+  <div class="stats" style="grid-template-columns:repeat(6,1fr);margin-bottom:24px">
+    <div class="stat-card" style="border-top:3px solid var(--green)"><div class="stat-val" id="ov-mem">—</div><div class="stat-lbl">Memory</div></div>
+    <div class="stat-card" style="border-top:3px solid var(--yellow)"><div class="stat-val" id="ov-cpu">—</div><div class="stat-lbl">CPU</div></div>
+    <div class="stat-card" style="border-top:3px solid var(--blue)"><div class="stat-val" id="ov-routes">—</div><div class="stat-lbl">Routes</div></div>
+    <div class="stat-card" style="border-top:3px solid var(--purple)"><div class="stat-val" id="ov-cost">$0</div><div class="stat-lbl">AI Cost</div></div>
+    <div class="stat-card" style="border-top:3px solid #50fa7b"><div class="stat-val" id="ov-usdc">—</div><div class="stat-lbl">USDC</div></div>
+    <div class="stat-card" style="border-top:3px solid var(--accent)"><div class="stat-val" id="ov-x402">$0</div><div class="stat-lbl">x402 Revenue</div></div>
+  </div>
   <div class="row2">
     <div class="card"><h3>Recent Events</h3><div class="ev-list" id="ov-events" style="max-height:400px"></div></div>
     <div>
@@ -1232,6 +1322,56 @@ main{overflow-y:auto;padding:24px}
   </div>
   <div class="card"><h3>Route Response Times</h3><div id="a-route-list"><div class="empty">Waiting for first probe cycle...</div></div></div>
 </div>
+<div class="panel" id="p-vault">
+  <div class="stats" style="grid-template-columns:repeat(4,1fr)">
+    <div class="stat-card heal"><div class="stat-val" id="v-status">—</div><div class="stat-lbl">Vault Status</div></div>
+    <div class="stat-card up"><div class="stat-val" id="v-usdc">—</div><div class="stat-lbl">USDC Balance</div></div>
+    <div class="stat-card brain"><div class="stat-val" id="v-eth">—</div><div class="stat-lbl">ETH Balance</div></div>
+    <div class="stat-card roll"><div class="stat-val" id="v-x402-rev">$0</div><div class="stat-lbl">x402 Revenue</div></div>
+  </div>
+  <div class="row2">
+    <div class="card">
+      <h3>Wallet Details</h3>
+      <div id="v-details"><div class="empty">Loading vault...</div></div>
+    </div>
+    <div class="card">
+      <h3>Vault Security</h3>
+      <div id="v-security"><div class="empty">Loading...</div></div>
+    </div>
+  </div>
+  <div class="card">
+    <h3>Setup Guide</h3>
+    <div style="font-size:.82rem;color:var(--text2);line-height:1.7;padding:8px 0">
+      <div class="mrow"><span style="color:var(--accent);font-family:monospace">wolverine --init-vault</span><span class="vals">Initialize encrypted wallet (AES-256-GCM)</span></div>
+      <div class="mrow"><span style="color:var(--accent);font-family:monospace">wolverine --x402-info</span><span class="vals">Show wallet address &amp; x402 configuration</span></div>
+      <div class="mrow"><span style="color:var(--text2)">Vault path</span><span class="vals">.wolverine/vault/ (auto-backed up in every snapshot)</span></div>
+      <div class="mrow"><span style="color:var(--text2)">Network</span><span class="vals">Base (eip155:8453) — USDC payments</span></div>
+      <div class="mrow"><span style="color:var(--text2)">Protocol</span><span class="vals"><a href="https://docs.cdp.coinbase.com/x402/welcome" style="color:var(--blue);text-decoration:none">x402</a> — server-to-server USDC payments</span></div>
+    </div>
+  </div>
+</div>
+<div class="panel" id="p-x402">
+  <div class="stats" style="grid-template-columns:repeat(4,1fr)">
+    <div class="stat-card heal"><div class="stat-val" id="x-total">0</div><div class="stat-lbl">Total Payments</div></div>
+    <div class="stat-card up"><div class="stat-val" id="x-success">0</div><div class="stat-lbl">Verified</div></div>
+    <div class="stat-card roll"><div class="stat-val" id="x-revenue">$0</div><div class="stat-lbl">Total Revenue</div></div>
+    <div class="stat-card brain"><div class="stat-val" id="x-routes">0</div><div class="stat-lbl">Paid Routes</div></div>
+  </div>
+  <div class="row2">
+    <div class="card">
+      <h3>Revenue by Route</h3>
+      <div id="x-by-route"><div class="empty">No x402 payments yet</div></div>
+    </div>
+    <div class="card">
+      <h3>Revenue Chart</h3>
+      <div id="x-chart" style="height:160px"><div class="empty">Chart appears after payments</div></div>
+    </div>
+  </div>
+  <div class="card">
+    <h3>Recent Payments</h3>
+    <div id="x-recent"><div class="empty">No payments recorded yet. Add x402 config to any route:<br><code style="color:var(--accent);font-size:.78rem">{ config: { x402: { price: "$0.01" } } }</code></div></div>
+  </div>
+</div>
 <div class="panel" id="p-command">
   <div id="cmd-auth" class="auth-gate">
     <h2>🔐 Admin Authentication</h2>
@@ -1570,6 +1710,76 @@ async function refresh(){
         }).join('');
       }
     }
+    // Vault + x402
+    const [vault,x402]=await Promise.all([fetch(B+'/api/vault').then(r=>r.json()).catch(()=>({})),fetch(B+'/api/x402').then(r=>r.json()).catch(()=>({}))]);
+    // Vault panel
+    if(vault){
+      $('v-status').textContent=vault.initialized?'Active':'Not Init';
+      $('v-status').style.color=vault.initialized?'var(--green)':'var(--text2)';
+      $('v-usdc').textContent=vault.balances?.usdc!=null?'$'+vault.balances.usdc:'—';
+      $('v-eth').textContent=vault.balances?.eth!=null?vault.balances.eth:'—';
+      // Overview row
+      $('ov-usdc').textContent=vault.balances?.usdc!=null?'$'+vault.balances.usdc:'—';
+
+      if(vault.address){
+        const short=vault.address.slice(0,6)+'...'+vault.address.slice(-4);
+        $('v-details').innerHTML=[
+          '<div class="mrow"><span>Address</span><span class="vals" style="font-family:monospace;color:var(--blue)">'+vault.address+'</span></div>',
+          '<div class="mrow"><span>Short</span><span class="vals"><b>'+short+'</b></span></div>',
+          '<div class="mrow"><span>USDC (Base)</span><span class="vals"><b style="color:var(--green)">$'+(vault.balances?.usdc||'0.00')+'</b></span></div>',
+          '<div class="mrow"><span>ETH (Base)</span><span class="vals"><b>'+(vault.balances?.eth||'0.000000')+' ETH</b></span></div>',
+          '<div class="mrow"><span>Network</span><span class="vals">Base (eip155:8453)</span></div>',
+        ].join('');
+      }else{
+        $('v-details').innerHTML='<div class="empty">Vault not initialized. Run <code style="color:var(--accent)">wolverine --init-vault</code></div>';
+      }
+      $('v-security').innerHTML=[
+        '<div class="mrow"><span>Encryption</span><span class="vals">'+(vault.initialized?'<span style="color:var(--green)">AES-256-GCM</span>':'<span style="color:var(--text2)">N/A</span>')+'</span></div>',
+        '<div class="mrow"><span>Master Key</span><span class="vals">'+(vault.masterKeyExists?'<span style="color:var(--green)">✓ Present</span>':'<span style="color:var(--red)">✗ Missing</span>')+'</span></div>',
+        '<div class="mrow"><span>ETH Vault</span><span class="vals">'+(vault.ethVaultExists?'<span style="color:var(--green)">✓ Encrypted</span>':'<span style="color:var(--text2)">✗ Not created</span>')+'</span></div>',
+        '<div class="mrow"><span>Agent Access</span><span class="vals"><span style="color:var(--green)">Blocked</span> (sandbox-protected)</span></div>',
+        '<div class="mrow"><span>Backup</span><span class="vals">Included in every snapshot</span></div>',
+      ].join('');
+    }
+    // x402 panel
+    if(x402){
+      $('x-total').textContent=x402.totalPayments||0;
+      $('x-success').textContent=x402.successfulPayments||0;
+      $('x-revenue').textContent='$'+(x402.totalRevenue||'0.00');
+      $('v-x402-rev').textContent='$'+(x402.totalRevenue||'0.00');
+      $('ov-x402').textContent='$'+(x402.totalRevenue||'0.00');
+      const routes=x402.byRoute||{};
+      const routeKeys=Object.keys(routes);
+      $('x-routes').textContent=routeKeys.length;
+      if(routeKeys.length>0){
+        $('x-by-route').innerHTML=routeKeys.sort((a,b)=>routes[b].revenue-routes[a].revenue).map(r=>'<div class="mrow"><span class="ep">'+esc(r)+'</span><span class="vals"><b style="color:var(--green)">$'+routes[r].revenue.toFixed(2)+'</b> &middot; '+routes[r].calls+' calls</span></div>').join('');
+      }
+      const recent=x402.recentPayments||[];
+      if(recent.length>0){
+        $('x-recent').innerHTML=recent.slice(0,20).map(p=>{
+          const icon=p.verified?'✅':'⏳';
+          return '<div class="mrow" style="flex-wrap:wrap"><span>'+icon+' <span class="ep">'+esc(p.route||'?')+'</span></span><span class="vals"><b style="color:var(--green)">'+(p.amount||'?')+'</b> USDC &middot; '+(p.from?p.from.slice(0,6)+'...'+p.from.slice(-4):'?')+'</span><div style="width:100%;font-size:.7rem;color:var(--text2)">'+new Date(p.timestamp).toLocaleString()+'</div></div>';
+        }).join('');
+        // Revenue chart
+        if(recent.length>1){
+          const max=Math.max(...recent.map(p=>parseFloat(p.amount?.replace('$','')||0)))||1;
+          const w=$('x-chart').offsetWidth||500,h=150;
+          const bw=Math.max(6,Math.floor(w/recent.length)-2);
+          let svg='<svg width="'+w+'" height="'+h+'">';
+          recent.reverse().forEach((p,i)=>{
+            const amt=parseFloat(p.amount?.replace('$','')||0);
+            const bh=Math.max(2,Math.round((amt/max)*h*0.85));
+            const c=p.verified?'#50fa7b':'var(--yellow)';
+            svg+='<rect x="'+(i*(bw+2))+'" y="'+(h-bh)+'" width="'+bw+'" height="'+bh+'" fill="'+c+'" rx="2"><title>'+p.amount+' from '+(p.from||'?').slice(0,10)+'</title></rect>';
+          });
+          svg+='</svg>';$('x-chart').innerHTML=svg;
+        }
+      }
+    }
+    // Overview: server health
+    if(proc&&proc.current){$('ov-mem').textContent=proc.current.rss+'MB';$('ov-cpu').textContent=proc.current.cpu+'%';}
+    if(routeData&&routeData.summary)$('ov-routes').textContent=(routeData.summary.healthy||0)+'/'+(routeData.summary.totalRoutes||0);
+    if(usage&&usage.session)$('ov-cost').textContent='$'+(usage.session.totalCostUsd||0).toFixed(4);
   }catch(e){}
 }
 

package/src/middleware/x402-fastify.js

@@ -6,7 +6,11 @@ const path = require("path");
  *
  * Makes it dead simple to accept USDC payments on Base network.
  * The developer marks a route with x402 config, and the middleware
- * handles the 402 → payment → verification → callback flow.
+ * handles the 402 → payment → verification → settlement flow.
+ *
+ * Settlement is handled by the x402 facilitator (Coinbase CDP),
+ * which verifies the payment signature AND executes the on-chain
+ * USDC transfer. Compatible with x402 Bazaar for API discovery.
  *
  * Two modes:
  *   Fixed price:    { x402: { price: "$0.01" } }
@@ -37,7 +41,9 @@ const path = require("path");
 
 let _payTo = null;
 let _network = "eip155:8453";
-let _facilitatorUrl = "https://x402.org/facilitator";
+// Production facilitator (Base mainnet) — handles verify + on-chain settlement
+let _facilitatorUrl = "https://api.cdp.coinbase.com/platform/v2/x402";
+// Testnet facilitator: "https://x402.org/facilitator"
 
 async function x402Plugin(fastify, opts) {
   // Config
@@ -62,8 +68,17 @@ async function x402Plugin(fastify, opts) {
     } catch {}
   }
 
+  // Auto-select facilitator based on network
+  if (!opts.facilitator) {
+    const isTestnet = _network.includes("84532") || _network.includes("11155");
+    _facilitatorUrl = isTestnet
+      ? "https://x402.org/facilitator"
+      : "https://api.cdp.coinbase.com/platform/v2/x402";
+  }
+
   if (_payTo) {
     console.log(`  💰 x402: payments to ${_payTo.slice(0, 6)}...${_payTo.slice(-4)} on ${_network}`);
+    console.log(`  💰 x402: facilitator ${_facilitatorUrl}`);
   }
 
   // ── Route-level x402 hook (preHandler so body is parsed for variable pricing) ──
@@ -130,15 +145,37 @@ async function x402Plugin(fastify, opts) {
       return;
     }
 
-    // Payment present — verify via facilitator or direct signature check
-    const verified = await _verifyPayment(paymentSig, price);
+    // Payment present — send to facilitator for verification + on-chain settlement
+    const routeAccepts = [{
+      scheme: "exact",
+      price,
+      network: _network,
+      payTo: _payTo,
+    }];
+
+    const verified = await _settleViaFacilitator(paymentSig, routeAccepts);
     if (verified.valid) {
       reply.header("Payment-Response", JSON.stringify(verified.receipt || {}));
       request.x402 = { paid: true, amount: price, receipt: verified.receipt, txHash: verified.txHash, from: verified.from };
+      // Log payment for dashboard analytics
+      _logPayment({ route: request.url, method: request.method, amount: price, from: verified.from, txHash: verified.txHash, verified: true, timestamp: Date.now() });
       return; // continue to route handler
     }
 
-    reply.code(402).send({ error: "Payment verification failed", price, payTo: _payTo });
+    // Facilitator rejected — try self-settlement as fallback
+    if (verified.reason === "facilitator_unavailable") {
+      const selfResult = await _selfSettle(paymentSig, price);
+      if (selfResult.valid) {
+        reply.header("Payment-Response", JSON.stringify(selfResult.receipt || {}));
+        request.x402 = { paid: true, amount: price, receipt: selfResult.receipt, txHash: selfResult.txHash, from: selfResult.from };
+        _logPayment({ route: request.url, method: request.method, amount: price, from: selfResult.from, txHash: selfResult.txHash, verified: true, settled: "self", timestamp: Date.now() });
+        return;
+      }
+      reply.code(402).send({ error: "Payment settlement failed", reason: selfResult.reason, price, payTo: _payTo });
+      return;
+    }
+
+    reply.code(402).send({ error: "Payment verification failed", reason: verified.reason, price, payTo: _payTo });
   });
 
   // ── Public pricing endpoint ──
@@ -151,119 +188,201 @@ async function x402Plugin(fastify, opts) {
   }));
 }
 
-async function _verifyPayment(paymentSig, price) {
-  // Decode the payment signature (base64 JSON payload from frontend)
+/**
+ * Send payment to the x402 facilitator for verification AND on-chain settlement.
+ * The facilitator:
+ *  1. Verifies the EIP-3009 signature
+ *  2. Calls transferWithAuthorization() on the USDC contract
+ *  3. Returns the transaction hash
+ *
+ * This is the standard x402 flow — compatible with Bazaar discovery.
+ */
+async function _settleViaFacilitator(paymentSig, routeAccepts) {
+  try {
+    const https = require("https");
+    const http = require("http");
+    const url = new (require("url").URL)(_facilitatorUrl + "/verify");
+    const body = JSON.stringify({
+      paymentSignature: paymentSig,
+      routeConfig: { accepts: routeAccepts },
+    });
+    return new Promise((resolve) => {
+      const client = url.protocol === "https:" ? https : http;
+      const req = client.request({
+        hostname: url.hostname,
+        port: url.port,
+        path: url.pathname,
+        method: "POST",
+        headers: { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(body) },
+        timeout: 30000, // settlement can take time (on-chain tx)
+      }, (res) => {
+        let data = "";
+        res.on("data", (c) => data += c);
+        res.on("end", () => {
+          try {
+            const p = JSON.parse(data);
+            if (p.valid || p.success) {
+              resolve({
+                valid: true,
+                receipt: p,
+                txHash: p.txHash || p.transactionHash || null,
+                from: p.from || p.payer || null,
+              });
+            } else {
+              resolve({ valid: false, reason: p.error || p.reason || "facilitator_rejected" });
+            }
+          } catch {
+            resolve({ valid: false, reason: "facilitator_invalid_response" });
+          }
+        });
+      });
+      req.on("error", () => resolve({ valid: false, reason: "facilitator_unavailable" }));
+      req.on("timeout", () => { req.destroy(); resolve({ valid: false, reason: "facilitator_timeout" }); });
+      req.write(body);
+      req.end();
+    });
+  } catch {
+    return { valid: false, reason: "facilitator_unavailable" };
+  }
+}
+
+/**
+ * Self-settlement fallback — verify the signature AND execute the
+ * on-chain transferWithAuthorization() using the server's vault wallet.
+ *
+ * Only used when the facilitator is unavailable. Requires ethers + RPC.
+ * The server pays gas to execute the transfer.
+ */
+async function _selfSettle(paymentSig, price) {
   let payload;
   try {
     payload = JSON.parse(Buffer.from(paymentSig, "base64").toString());
   } catch {
-    // Not base64 — might be raw x402 format, try facilitator
-    return _verifyViaFacilitator(paymentSig, price);
+    return { valid: false, reason: "invalid_payment_format" };
+  }
+
+  if (!payload.payload?.authorization || !payload.payload?.signature) {
+    return { valid: false, reason: "missing_authorization" };
   }
 
-  // Direct verification: validate the EIP-3009 TransferWithAuthorization signature
-  if (payload.payload?.authorization && payload.payload?.signature) {
-    const auth = payload.payload.authorization;
-    const sig = payload.payload.signature;
+  const auth = payload.payload.authorization;
+  const sig = payload.payload.signature;
 
-    // Verify the amount matches the price
-    const expectedUsdc = Math.round(parseFloat(price.replace("$", "")) * 1e6);
-    const actualUsdc = parseInt(auth.value, 16) || parseInt(auth.value, 10) || 0;
-    if (actualUsdc < expectedUsdc * 0.99) { // 1% tolerance for rounding
-      return { valid: false, reason: "Amount mismatch" };
-    }
+  // Verify amount
+  const expectedUsdc = Math.round(parseFloat(price.replace("$", "")) * 1e6);
+  // Value comes as decimal string (e.g. "1000000" for $1) or hex (legacy "0xf4240")
+  const valStr = String(auth.value);
+  const actualUsdc = valStr.startsWith("0x") ? parseInt(valStr, 16) : parseInt(valStr, 10) || 0;
+  if (actualUsdc < expectedUsdc * 0.99) {
+    return { valid: false, reason: "amount_mismatch" };
+  }
 
-    // Verify payTo matches
-    if (auth.to?.toLowerCase() !== _payTo?.toLowerCase()) {
-      return { valid: false, reason: "Wrong recipient" };
-    }
+  // Verify payTo matches
+  if (auth.to?.toLowerCase() !== _payTo?.toLowerCase()) {
+    return { valid: false, reason: "wrong_recipient" };
+  }
+
+  // Verify not expired
+  if (auth.validBefore && auth.validBefore < Math.floor(Date.now() / 1000)) {
+    return { valid: false, reason: "payment_expired" };
+  }
+
+  try {
+    const { ethers } = require("ethers");
+    const fromAddr = ethers.getAddress(auth.from.toLowerCase());
+    const toAddr = ethers.getAddress(auth.to.toLowerCase());
+
+    // Step 1: Verify the signature
+    const domain = {
+      name: "USD Coin",
+      version: "2",
+      chainId: 8453,
+      verifyingContract: "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
+    };
+    const types = {
+      TransferWithAuthorization: [
+        { name: "from", type: "address" },
+        { name: "to", type: "address" },
+        { name: "value", type: "uint256" },
+        { name: "validAfter", type: "uint256" },
+        { name: "validBefore", type: "uint256" },
+        { name: "nonce", type: "bytes32" },
+      ],
+    };
+    const message = {
+      from: fromAddr,
+      to: toAddr,
+      value: auth.value,
+      validAfter: auth.validAfter,
+      validBefore: auth.validBefore,
+      nonce: auth.nonce,
+    };
 
-    // Verify not expired
-    if (auth.validBefore && auth.validBefore < Math.floor(Date.now() / 1000)) {
-      return { valid: false, reason: "Payment expired" };
+    const recoveredAddress = ethers.verifyTypedData(domain, types, message, sig);
+    if (recoveredAddress.toLowerCase() !== fromAddr.toLowerCase()) {
+      return { valid: false, reason: "signature_mismatch" };
     }
 
-    // Recover signer from EIP-712 typed data signature
+    // Step 2: Execute transferWithAuthorization on-chain
+    // Use the vault wallet to submit the transaction (server pays gas)
+    const { decryptPrivateKey } = require("../vault/vault-manager");
+    let keyBuf = null;
     try {
-      const { ethers } = require("ethers");
-      // Normalize all addresses to proper EIP-55 checksum format
-      const fromAddr = ethers.getAddress(auth.from.toLowerCase());
-      const toAddr = ethers.getAddress(auth.to.toLowerCase());
-
-      const domain = {
-        name: "USD Coin",
-        version: "2",
-        chainId: 8453,
-        verifyingContract: "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
-      };
-      const types = {
-        TransferWithAuthorization: [
-          { name: "from", type: "address" },
-          { name: "to", type: "address" },
-          { name: "value", type: "uint256" },
-          { name: "validAfter", type: "uint256" },
-          { name: "validBefore", type: "uint256" },
-          { name: "nonce", type: "bytes32" },
+      keyBuf = decryptPrivateKey();
+      const provider = new ethers.JsonRpcProvider("https://mainnet.base.org");
+      const wallet = new ethers.Wallet(keyBuf, provider);
+
+      const usdcContract = new ethers.Contract(
+        "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
+        [
+          "function transferWithAuthorization(address from, address to, uint256 value, uint256 validAfter, uint256 validBefore, bytes32 nonce, uint8 v, bytes32 r, bytes32 s) external",
         ],
-      };
-      const message = {
-        from: fromAddr,
-        to: toAddr,
-        value: auth.value,
-        validAfter: auth.validAfter,
-        validBefore: auth.validBefore,
-        nonce: auth.nonce,
-      };
+        wallet
+      );
 
-      const recoveredAddress = ethers.verifyTypedData(domain, types, message, sig);
-      if (recoveredAddress.toLowerCase() !== fromAddr.toLowerCase()) {
-        return { valid: false, reason: "Signature mismatch" };
-      }
+      // Parse the signature into v, r, s
+      const sigBytes = ethers.getBytes(sig);
+      const r = ethers.hexlify(sigBytes.slice(0, 32));
+      const s = ethers.hexlify(sigBytes.slice(32, 64));
+      const v = sigBytes[64];
+
+      const tx = await usdcContract.transferWithAuthorization(
+        fromAddr, toAddr, auth.value,
+        auth.validAfter, auth.validBefore, auth.nonce,
+        v, r, s,
+        { gasLimit: 100000 }
+      );
+
+      // Wait for confirmation (1 block)
+      const receipt = await tx.wait(1);
+      console.log(`  💰 x402 self-settled: ${receipt.hash} (${price} USDC)`);
 
-      // Signature valid — the user authorized this USDC transfer
       return {
         valid: true,
-        from: auth.from,
-        receipt: { authorization: auth, signature: sig, verified: "direct" },
-        txHash: null, // on-chain tx happens when we call transferWithAuthorization
+        from: fromAddr,
+        receipt: { authorization: auth, settled: "self", blockNumber: receipt.blockNumber },
+        txHash: receipt.hash,
       };
-    } catch (err) {
-      return { valid: false, reason: "Signature verification error: " + err.message };
+    } finally {
+      if (keyBuf) keyBuf.fill(0);
     }
+  } catch (err) {
+    console.log(`  ⚠️ x402 self-settlement failed: ${err.message}`);
+    return { valid: false, reason: "settlement_failed: " + err.message };
   }
-
-  // Unknown format — try facilitator
-  return _verifyViaFacilitator(paymentSig, price);
 }
 
-async function _verifyViaFacilitator(paymentSig, price) {
+function _logPayment(entry) {
   try {
-    const https = require("https");
-    const http = require("http");
-    const url = new (require("url").URL)(_facilitatorUrl + "/verify");
-    const body = JSON.stringify({
-      paymentSignature: paymentSig,
-      routeConfig: { accepts: [{ scheme: "exact", price, network: _network, payTo: _payTo }] },
-    });
-    return new Promise((resolve) => {
-      const client = url.protocol === "https:" ? https : http;
-      const req = client.request({
-        hostname: url.hostname, port: url.port, path: url.pathname, method: "POST",
-        headers: { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(body) },
-        timeout: 10000,
-      }, (res) => {
-        let data = "";
-        res.on("data", (c) => data += c);
-        res.on("end", () => {
-          try { const p = JSON.parse(data); resolve({ valid: p.valid || p.success, receipt: p, txHash: p.txHash }); }
-          catch { resolve({ valid: false }); }
-        });
-      });
-      req.on("error", () => resolve({ valid: false }));
-      req.write(body);
-      req.end();
-    });
-  } catch { return { valid: false }; }
+    const logPath = path.join(process.cwd(), ".wolverine", "x402-payments.json");
+    let payments = [];
+    try { payments = JSON.parse(fs.readFileSync(logPath, "utf-8")); } catch {}
+    payments.push(entry);
+    // Keep last 1000 payments
+    if (payments.length > 1000) payments = payments.slice(-1000);
+    fs.mkdirSync(path.dirname(logPath), { recursive: true });
+    fs.writeFileSync(logPath, JSON.stringify(payments, null, 2));
+  } catch {}
 }
 
 x402Plugin[Symbol.for("skip-override")] = true;

package/src/templates/server/config/settings.json

@@ -5,30 +5,36 @@
     "env": "development"
   },
 
+  "_docs_models": "Each task wolverine performs uses a specific model role. You can mix providers freely — provider is auto-detected from the model name (claude-* → Anthropic, gpt-* → OpenAI). Using the same model across roles maximizes prompt cache hits and reduces cost. View per-role cost, speed, and token analytics on the wolverine dashboard at localhost:3001/analytics",
   "models": {
+    "_docs": "reasoning: deep error analysis & root cause diagnosis | coding: generates code fixes (fast path, no tools) | chat: summaries & brain compression | tool: agent tool-calling during complex heals | classifier: error type classification | audit: security & injection scanning | compacting: context window compression | research: deep investigation & web research",
     "reasoning": "claude-sonnet-4-6",
     "coding": "claude-sonnet-4-6",
-    "chat": "gpt-5.4-mini",
-    "tool": "gpt-4o-mini",
-    "classifier": "gpt-4o-mini",
-    "audit": "wolverine-test-1",
-    "compacting": "wolverine-test-1",
+    "chat": "claude-sonnet-4-6",
+    "tool": "claude-sonnet-4-6",
+    "classifier": "claude-sonnet-4-6",
+    "audit": "claude-sonnet-4-6",
+    "compacting": "claude-sonnet-4-6",
     "research": "claude-sonnet-4-6"
   },
 
-  "embedding": "wolverine-embedding-1",
+  "_docs_embedding": "Vector embedding model for the brain's memory system. Used to store and recall past fixes. text-embedding-3-small is the default (requires OPENAI_API_KEY). wolverine-embedding-1 routes through wolverine credits at 2x markup.",
+  "embedding": "text-embedding-3-small",
 
+  "_docs_server": "port: server listen port (must be 3000 for wolverine) | maxRetries: consecutive crash restarts before giving up | maxMemoryMB: OOM threshold — process killed and healed if exceeded",
   "server": {
     "port": 3000,
     "maxRetries": 3,
     "maxMemoryMB": 512
   },
 
+  "_docs_telemetry": "Heartbeat reports server health (memory, CPU, routes, repair stats) to the dashboard every heartbeatIntervalMs. Disable if running fully offline.",
   "telemetry": {
     "enabled": true,
     "heartbeatIntervalMs": 60000
   },
 
+  "_docs_rateLimiting": "AI call budget to prevent runaway costs. maxCallsPerWindow: total AI calls allowed in windowMs. minGapMs: minimum delay between calls. maxTokensPerHour: hard token ceiling across all models.",
   "rateLimiting": {
     "maxCallsPerWindow": 32,
     "windowMs": 100000,
@@ -36,6 +42,7 @@
     "maxTokensPerHour": 1000000
   },
 
+  "_docs_healthCheck": "Probes server liveness. intervalMs: check frequency. timeoutMs: max wait for response. failThreshold: consecutive failures before triggering heal. startDelayMs: grace period after boot before first check.",
   "healthCheck": {
     "intervalMs": 15000,
     "timeoutMs": 5000,
@@ -43,14 +50,16 @@
     "startDelayMs": 10000
   },
 
+  "_docs_errorMonitor": "Tracks caught 500 errors per route. defaultThreshold: how many 500s on one route before triggering a heal. windowMs: error counting window. cooldownMs: minimum time between heals on the same route.",
   "errorMonitor": {
     "defaultThreshold": 1,
     "windowMs": 30000,
     "cooldownMs": 60000
   },
 
+  "_docs_autoUpdate": "Auto-updates wolverine framework from git. Only updates src/ and bin/ — never touches your server/ code. Checks every intervalMs.",
   "autoUpdate": {
-    "enabled": true,
+    "enabled": false,
     "intervalMs": 300000
   },
 
@@ -59,6 +68,7 @@
     "cors": ["http://localhost:3000"]
   },
 
+  "_docs_dashboard": "Dashboard serves on port+1 (default 3001). Configure WOLVERINE_ADMIN_KEY in .env.local for the agent command interface.",
   "dashboard": {},
 
   "cors": {

package/src/templates/server/routes/api.js

@@ -1,4 +1,26 @@
+/**
+ * Demo API routes — shows both free endpoints and x402 paid APIs.
+ *
+ * Wolverine's vault provides an encrypted Ethereum wallet (AES-256-GCM)
+ * for each server instance. The wallet is used as the payment receiver
+ * for x402 paid APIs on the Base network (USDC).
+ *
+ * Vault commands:
+ *   wolverine --init-vault      Create encrypted wallet
+ *   wolverine --x402-info       Show wallet address & config
+ *
+ * The vault is stored in .wolverine/vault/ and is:
+ *   - Auto-backed up in every server snapshot
+ *   - Protected from agent access (sandbox-blocked)
+ *   - Private keys never exist as JS strings (Buffer only)
+ *   - Rollback-protected (never overwritten by restore)
+ *
+ * Dashboard: localhost:3001 — view wallet balances, x402 revenue,
+ * payment history, and all server health metrics in real time.
+ */
+
 async function routes(fastify) {
+  // ── Free endpoints ──
   fastify.get("/", async () => ({ message: "Hello from Wolverine API" }));
 
   fastify.get("/users", async () => ({
@@ -7,6 +29,46 @@ async function routes(fastify) {
       { id: 2, name: "Bob", role: "user" },
     ],
   }));
+
+  // ── x402 Paid API ──────────────────────────────────────────────
+  // Any route becomes a paid API by adding x402 config.
+  // Callers without a valid USDC payment get a 402 with payment instructions.
+  // Callers with a valid Payment-Signature header get the response.
+  //
+  // Protocol: https://docs.cdp.coinbase.com/x402/welcome
+  // Network:  Base (eip155:8453) — USDC payments
+  // Wallet:   Auto-detected from vault (wolverine --init-vault)
+  //
+  // To change pricing live without restart:
+  //   Update the price in config and the next request picks it up.
+  //   Or use the dashboard command: "change /api/premium price to $0.05"
+
+  // Fixed price — charge $0.01 per call:
+  fastify.get("/premium", {
+    config: { x402: { price: "$0.01", description: "Premium data endpoint" } },
+  }, async (req) => ({
+    data: "This response cost $0.01 in USDC on Base",
+    paid: req.x402?.amount,
+    from: req.x402?.from,
+  }));
+
+  // Variable price — caller chooses amount (e.g. buying credits):
+  // POST /api/purchase { "dollars": "5.00" }
+  fastify.post("/purchase", {
+    config: {
+      x402: {
+        variable: true,
+        min: "$1",
+        max: "$1000",
+        priceField: "dollars",
+        description: "Purchase API credits with USDC",
+      },
+    },
+  }, async (req) => ({
+    message: `Received ${req.x402?.amount} USDC payment`,
+    from: req.x402?.from,
+    receipt: req.x402?.receipt ? "valid" : "none",
+  }));
 }
 
 module.exports = routes;