xytara 3.0.1 → 3.1.1

package/.env.example

@@ -1,7 +1,8 @@
 XYTARA_HOST=127.0.0.1
 XYTARA_PORT=4320
 XYTARA_BASE_URL=http://127.0.0.1:4320
-XYTARA_PAYMENT_VERIFICATION_MODE=presence
+# local_signed is the default; set presence only for local demos (accepts any non-empty payment header)
+XYTARA_PAYMENT_VERIFICATION_MODE=local_signed
 XYTARA_PAYMENT_MAX_AGE_SECONDS=300
 XYTARA_WALLET_REGISTRY_JSON=[]
 XYTARA_TREASURY_DESTINATION_ID=
@@ -19,6 +20,7 @@ XYTARA_BSV_TERANODE_MERCHANT_LABEL=naxytra-runtime
 XYTARA_BSV_TERANODE_USE_METANET=false
 XYTARA_BSV_TERANODE_SATS_PER_USD_CENT=100
 XYTARA_BSV_TERANODE_SETTLEMENT_RUNTIME_MODE=mock
+# operator write surfaces fail closed until both tokens are set
 XYTARA_CREDIT_BRIDGE_BEARER_TOKEN=
 XYTARA_ACCOUNT_AUTH_BEARER_TOKEN=
 XYTARA_CALLBACK_DELIVERY_ENABLED=true

package/README.md

@@ -62,6 +62,15 @@ The frozen runtime-side fact model for that loop is documented in:
 
 - [XYTARA_EXECUTION_TRUTH_MODEL.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/XYTARA_EXECUTION_TRUTH_MODEL.md)
 - [XT1_EXECUTION_TRUTH_STANDARD.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/XT1_EXECUTION_TRUTH_STANDARD.md)
+- [OPERATIONAL_RECEIPT_CONTRACT.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/docs/architecture/OPERATIONAL_RECEIPT_CONTRACT.md)
+- [MACHINE_IDENTITY_REGISTRY_CONTRACT.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/docs/architecture/MACHINE_IDENTITY_REGISTRY_CONTRACT.md)
+- [CRYPTO_AGILITY_MATRIX.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/docs/architecture/CRYPTO_AGILITY_MATRIX.md)
+- [AUTHORITY_BINDING_LIFECYCLE_CONTRACT.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/docs/architecture/AUTHORITY_BINDING_LIFECYCLE_CONTRACT.md)
+- [PUBLIC_SURFACE_POLICY_CONTRACT.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/docs/architecture/PUBLIC_SURFACE_POLICY_CONTRACT.md)
+- [OFFLINE_VERIFIABILITY_AND_RECOVERY_CONTRACT.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/docs/architecture/OFFLINE_VERIFIABILITY_AND_RECOVERY_CONTRACT.md)
+- [ADAPTER_CERTIFICATION_CONTRACT.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/docs/architecture/ADAPTER_CERTIFICATION_CONTRACT.md)
+- [TRUST_PORTABILITY_BOUNDARY_CONTRACT.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/docs/architecture/TRUST_PORTABILITY_BOUNDARY_CONTRACT.md)
+- [SIGNED_AUDIT_PROVENANCE_CONTRACT.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/docs/architecture/SIGNED_AUDIT_PROVENANCE_CONTRACT.md)
 
 `XT1` is the coined public name for the `xytara` execution-truth standard, just as `XNYA` is the coined public name for the `xoonya` native proof primitive.
 
@@ -140,6 +149,9 @@ If you want the broadest machine-readable census for these already-core runtime
 - `GET /v1/artifact-distribution`
 - `GET /v1/shared-signals`
 - `GET /v1/feature-control`
+- `GET /v1/adapter-certification`
+- `GET /v1/trust-portability-boundary`
+- `GET /v1/signed-audit-provenance`
 
 ## One-Line After Install
 
@@ -159,6 +171,54 @@ If you want the shortest machine-readable discovery path, inspect:
 - `GET /v1/integration-matrix`
 - `GET /v1/telemetry`
 - `GET /v1/provenance`
+- `GET /v1/adapter-certification`
+- `GET /v1/trust-portability-boundary`
+- `GET /v1/signed-audit-provenance`
+
+If you are working on shared evidence, inspect the operational receipt contract pack:
+
+- `buildOperationalReceiptContractPack()`
+- `summarizeOperationalReceiptContractPack()`
+
+If you are working on machine identity, inspect the registry contract pack:
+
+- `buildMachineIdentityRegistryContractPack()`
+- `summarizeMachineIdentityRegistryContractPack()`
+
+If you are working on crypto agility, inspect the matrix pack:
+
+- `buildCryptoAgilityMatrixPack()`
+- `summarizeCryptoAgilityMatrixPack()`
+
+If you are working on binding lifecycle, inspect the lifecycle pack:
+
+- `buildAuthorityBindingLifecycleContractPack()`
+- `summarizeAuthorityBindingLifecycleContractPack()`
+
+If you are working on public route policy, inspect the surface policy pack:
+
+- `buildPublicSurfacePolicyContractPack()`
+- `summarizePublicSurfacePolicyContractPack()`
+
+If you are working on offline recovery, inspect the recovery pack:
+
+- `buildOfflineVerifiabilityRecoveryContractPack()`
+- `summarizeOfflineVerifiabilityRecoveryContractPack()`
+
+If you are working on adapter certification, inspect the certification pack:
+
+- `buildAdapterCertificationContractPack()`
+- `summarizeAdapterCertificationContractPack()`
+
+If you are working on trust portability boundaries, inspect the boundary pack:
+
+- `buildTrustPortabilityBoundaryContractPack()`
+- `summarizeTrustPortabilityBoundaryContractPack()`
+
+If you are working on signed audit and provenance, inspect the audit/provenance pack:
+
+- `buildSignedAuditProvenanceContractPack()`
+- `summarizeSignedAuditProvenanceContractPack()`
 
 ## Start Here
 
@@ -209,12 +269,20 @@ The fastest copy-and-adapt third-party starter now lives under:
 - `adapters/examples/langchain-reference-execution-adapter.manifest.json`
 - `adapters/examples/langchain-reference-execution-adapter.js`
 
-If you are wiring treasury, settlement, or payment activation, continue with:
-
-- [REAL_PAYMENT_SETUP.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/REAL_PAYMENT_SETUP.md)
-- [BSV_TERANODE_PLATFORM_DISCONTINUITY_RUNBOOK.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/BSV_TERANODE_PLATFORM_DISCONTINUITY_RUNBOOK.md)
-
-Production treasury and multi-rail payment activation are now centralized in `REAL_PAYMENT_SETUP.md` plus your private treasury source of truth outside the repos.
+If you are wiring treasury, settlement, or payment activation, continue with:
+
+- [REAL_PAYMENT_SETUP.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/REAL_PAYMENT_SETUP.md)
+- [BSV_TERANODE_PLATFORM_DISCONTINUITY_RUNBOOK.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/BSV_TERANODE_PLATFORM_DISCONTINUITY_RUNBOOK.md)
+
+Production treasury and multi-rail payment activation are now centralized in `REAL_PAYMENT_SETUP.md` plus your private treasury source of truth outside the repos.
+
+If you want one private operator page that rolls up release posture, treasury landing, runtime activity, delivery, settlement readiness, and linked proof-facing health, use:
+
+- `GET /v1/business-cockpit`
+- `GET /v1/business-cockpit/summary`
+- `GET /business-cockpit`
+
+Those surfaces are private and are intended to be opened with the same operator bearer token used for other protected runtime views.
 
 If you are wiring external checkout or hosted funding paths, continue with:
 
@@ -941,7 +1009,8 @@ Environment example:
 
 Production payment note:
 
-- set `XYTARA_PAYMENT_VERIFICATION_MODE=local_signed` to enforce verifiable signed payment acceptance instead of plain header presence
+- `XYTARA_PAYMENT_VERIFICATION_MODE` defaults to `local_signed` (verifiable signed payment acceptance); `presence` must be opted into explicitly and only accepts plain header presence for local development
+- operator write surfaces (`/v1/economics/*` ledger mutations, `/v1/agent-accounts`, `/v1/operator-shell/admin-pack`, `/v1/credit-bridge/grants`, business cockpit) fail closed with `operator_auth_not_configured` until `XYTARA_ACCOUNT_AUTH_BEARER_TOKEN` and `XYTARA_CREDIT_BRIDGE_BEARER_TOKEN` are set; send `Authorization: Bearer <token>`; query-string tokens are not accepted
 - provide buyer wallet verification material through `XYTARA_WALLET_REGISTRY_JSON` or `XYTARA_WALLET_REGISTRY_PATH`
 - set `XYTARA_TREASURY_DESTINATION_ID` and related treasury env vars so accepted payments land in your merchant treasury posture instead of the default local account placeholder
 - built-in `x402` is the admission lane; real external payout/custody still depends on the payment rail and treasury destination you configure behind that lane

package/REAL_PAYMENT_SETUP.md

@@ -4,14 +4,15 @@ This guide explains how to move `xytara` from local placeholder payment acceptan
 
 ## What Changed
 
-`xytara` now supports two payment-acceptance modes:
+`xytara` supports two payment-acceptance modes. `local_signed` is the default; `presence` has to be opted into explicitly.
 
 - `presence`
-  - development/demo mode
+  - development/demo mode only, enabled with `XYTARA_PAYMENT_VERIFICATION_MODE=presence`
   - payment headers are required, but not cryptographically verified
+  - the server logs a warning at startup when this mode is active
 
 - `local_signed`
-  - production-oriented built-in mode
+  - the default and the production-oriented built-in mode
   - signed payment payloads are cryptographically verified against a configured wallet registry
   - quote replay and nonce replay are blocked
   - accepted payments are routed into your configured merchant treasury destination posture
@@ -89,6 +90,7 @@ XYTARA_TREASURY_DESTINATIONS_PATH=./TREASURY_DESTINATIONS.production.json
 GET /v1/treasury-destinations/summary
 GET /v1/payment-rail-truth/summary
 GET /v1/autonomous-entry/summary
+GET /v1/business-cockpit/summary
 ```
 
 You can automate that launch-truth check with:
@@ -115,6 +117,9 @@ XYTARA_VERIFY_ACCOUNT_ID=<the same internal xytara account_id you use for live q
 
 What you want to see:
 
+- a healthy `GET /business-cockpit` page once operator auth is in place
+- a healthy `GET /v1/business-cockpit/summary` machine summary alongside the treasury and payment truth summaries
+
 - `public_claimable_profile_count > 0`
 - `public_live_landing_rail_count > 0`
 - the desired rail family changes from readiness-only to live claimable
@@ -198,15 +203,15 @@ Use the stack like this:
 - configured treasury destination = merchant-facing landing posture in the runtime
 - external rail / settlement integration = actual custody and payout layer
 
-If you want the native BSV continuity path specifically, continue with [BSV_TERANODE_PLATFORM_DISCONTINUITY_RUNBOOK.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/BSV_TERANODE_PLATFORM_DISCONTINUITY_RUNBOOK.md).
-
-All activated treasury rails now follow one centralized operator path:
-
-- maintain the real receive destinations in your private treasury source of truth outside the repos
-- expose only public-safe claim/readiness truth through `xytara`
-- verify the live activation boundary with `npm run verify:final-activation`
-
-That means the treasury activation path for `hedera_hbar`, `kaspa_kas`, `polkadot_dot`, `digibyte_dgb`, `constellation_dag`, `xpr_payment`, `metal_payment`, and `antelope_payment` is now centralized here rather than split across separate per-rail setup files.
+If you want the native BSV continuity path specifically, continue with [BSV_TERANODE_PLATFORM_DISCONTINUITY_RUNBOOK.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/BSV_TERANODE_PLATFORM_DISCONTINUITY_RUNBOOK.md).
+
+All activated treasury rails now follow one centralized operator path:
+
+- maintain the real receive destinations in your private treasury source of truth outside the repos
+- expose only public-safe claim/readiness truth through `xytara`
+- verify the live activation boundary with `npm run verify:final-activation`
+
+That means the treasury activation path for `hedera_hbar`, `kaspa_kas`, `polkadot_dot`, `digibyte_dgb`, `constellation_dag`, `xpr_payment`, `metal_payment`, and `antelope_payment` is now centralized here rather than split across separate per-rail setup files.
 
 ## Operator Visibility
 

package/RELEASE_NOTES.md

@@ -1,15 +1,17 @@
-`xytara` 3.0.1 is the synchronized stability patch for the live runtime, payment, execution, delivery, treasury activation, and public first-contact line.
+`xytara` 3.1.1 is the synchronized security and stability release for the live runtime, payment, execution, delivery, and public first-contact line.
 
-This release keeps the public runtime line synchronized after the major cut by preserving the same live runtime truth models, widened finish-line scope, and naxytra public contract, proof, release, and gate surfaces while tightening the installable package experience for outside agents and builders.
+This release closes the authorization and payment-verification gaps found in the post-launch review while keeping the public runtime truth models, catalog, first-run path, and naxytra contract surfaces unchanged.
 
 Highlights:
 
-- keeps `/v1/execution-truth` and `/v1/execution-truth/summary` as the named runtime fact boundary
-- keeps `/v1/default-path` and `/v1/default-path/summary` as the named multi-surface runtime entry boundary
-- keeps `/v1/payment-rail-truth` and `/v1/payment-rail-truth/summary` as the named payment and settlement-claim boundary
-- keeps `/v1/adapter-protocol-truth` and `/v1/adapter-protocol-truth/summary` as the named first-party front and bounded bridge boundary
-- keeps provider-runtime journeys, delivery summary, runtime durability, revenue-launch paths, market-lane depth surfaces, and the fully activated treasury landing truth publicly inspectable inside the final runtime story
-- preserves adapter-depth boundaries, pricing guardrails, treasury public-claim safety, read-only operator observability boundaries, and the widened live rail family as part of the launch-grade runtime posture
-- keeps the live public catalog, full-catalog claim, first-run path, release kit, public proof surfaces, and final `3.0.1` contract/gate references aligned with the release line so operators and outside builders see the same truth
-- keeps the canonical `https://naxytra.com/xytara` public product URL and synchronized naxytra release posture intact
-- verifies the release candidate, full package verifier, umbrella pre-deploy gates, and clean-consumer release smoke before the synchronized stability patch
+- operator write surfaces now fail closed: credit minting, allocation reversal, rail-credit application, budgets, agents, economics receipts, job operator actions, participant admission, the operator-shell admin pack, and agent-account issuance all require `Authorization: Bearer` with `XYTARA_ACCOUNT_AUTH_BEARER_TOKEN`, and return `operator_auth_not_configured` instead of opening up when the token is unset
+- credit consumption requires either the operator bearer or a valid delegated spend credential
+- bearer and credit-bridge token comparisons use constant-time comparison, and the business cockpit no longer accepts query-string tokens
+- `XYTARA_PAYMENT_VERIFICATION_MODE` now defaults to `local_signed`; `presence` must be opted into explicitly and logs a startup warning
+- the MCP execution target verifies and settles x402 payments through a facilitator before serving paid methods, returns `PAYMENT-RESPONSE` on paid responses, rejects malformed or unadvertised payment payloads, and fails closed when the facilitator is unreachable; `initialize`, `ping`, and `tools/list` stay free so MCP clients can connect
+- the credit allocation ledger is no longer truncated, so account balances derived from allocation events stay correct beyond 200 events
+- the client binds every paid quote to its account and uses collision-free payment nonces, which strict verification previously rejected as account mismatches or replayed nonces
+- `/health` reports restore status honestly and a new `/ready` route returns `503` when runtime state restore or the last snapshot flush failed
+- the service verifier now covers unauthenticated mint, wrong operator tokens, credit overdraw, forged and unsigned checkout webhooks, replayed payment nonces, forged payment signatures, unregistered wallets, and query-token rejection; the MCP executor verifier runs against a mock facilitator
+- the MCP executor publish workflow skips publishing when the registry already carries the current version
+- bundled examples configure a local demo wallet and demo operator tokens explicitly instead of relying on open defaults

package/SERVICE_CONTRACT.md

@@ -58,6 +58,9 @@ Core routes:
 - `GET /v1/activity-ledger/summary`
 - `GET /v1/operator-observability`
 - `GET /v1/operator-observability/summary`
+- `GET /v1/business-cockpit`
+- `GET /v1/business-cockpit/summary`
+- `GET /business-cockpit`
 - `GET /v1/treasury-destinations`
 - `GET /v1/treasury-destinations/summary`
 - `GET /v1/treasury-destinations/operator-pack`
@@ -79,6 +82,15 @@ Core routes:
 - `GET /v1/shared-signals/summary`
 - `GET /v1/feature-control`
 - `GET /v1/feature-control/summary`
+- `GET /v1/adapter-certification`
+- `GET /v1/adapter-certification/summary`
+- `GET /v1/adapter-certification/:front_id`
+- `GET /v1/trust-portability-boundary`
+- `GET /v1/trust-portability-boundary/summary`
+- `GET /v1/trust-portability-boundary/:axis_id`
+- `GET /v1/signed-audit-provenance`
+- `GET /v1/signed-audit-provenance/summary`
+- `GET /v1/signed-audit-provenance/:surface_id`
 - `GET /v1/catalog`
 - `GET /v1/catalog/summary`
 - `GET /v1/catalog/task?ref=<task_ref_or_alias>`
@@ -115,11 +127,12 @@ Operational note:
 - `GET /v1/pricing-optimization/quote-cohorts` and `GET /v1/pricing-optimization/recommendations` expose how quote conversion and abandonment behave by pricing band, payment protocol, and settlement mode so monetization tuning can be data-shaped rather than guessed
 - `GET /v1/activity-ledger` exposes one operator-grade ledger across quote, payment, settlement, delivery, dispute, refund, credit-grant, bridge, and integration-admission activity so operators can answer who did what, paid what, received what, and through which route
 - `GET /v1/operator-observability` exposes a protected read-only pack across activity, payment, delivery, settlement, adapter failure, credit-grant, and pricing telemetry posture without moving funds or submitting settlements
+- `GET /v1/business-cockpit` and `GET /business-cockpit` expose one protected operator analytics surface that bundles release posture, treasury landing truth, runtime activity, settlement readiness, and linked proof-facing health into a single private JSON or HTML cockpit
 - `GET /v1/treasury-destinations` is public-readiness only: it shows which rails are operationally configured without exposing actual landing references
 - `GET /v1/treasury-destinations/operator-pack` is the operator-only custody surface and is where real destination references belong
 - `POST /v1/treasury-destinations/validate-preview` lets operators preview per-rail custody readiness before they claim a rail as operational
 - `GET /v1/treasury-egress-policy` makes the treasury black-hole posture explicit: funds can come in easily through configured rails, but treasury release remains blocked until manual operator review with explicit reason and signoff
-- when `XYTARA_ACCOUNT_AUTH_BEARER_TOKEN` is configured, `GET /v1/activity-ledger`, `GET /v1/operator-observability`, `GET /v1/treasury-destinations/operator-pack`, `POST /v1/treasury-destinations/validate-preview`, and `GET /v1/treasury-egress-policy` require that bearer token
+- when `XYTARA_ACCOUNT_AUTH_BEARER_TOKEN` is configured, `GET /v1/activity-ledger`, `GET /v1/operator-observability`, `GET /v1/business-cockpit`, `GET /v1/business-cockpit/summary`, `GET /business-cockpit`, `GET /v1/treasury-destinations/operator-pack`, `POST /v1/treasury-destinations/validate-preview`, and `GET /v1/treasury-egress-policy` require that bearer token
 - `GET /v1/providers` exposes the OpenAI Codex and Claude/MCP family as first-class provider entry lanes
 - `GET /v1/frameworks` exposes LangGraph, LangChain, AutoGen, and Semantic Kernel as the primary runtime framework lanes, with CrewAI and LlamaIndex surfaced as registry-backed framework breadth
 - `GET /v1/protocols` exposes the canonical protocol and transport family across MCP, A2A, A2C, ACP, gRPC, Kafka, NATS, MQTT, ROS2, and webhook-event-bus posture
@@ -129,6 +142,9 @@ Operational note:
 - `GET /v1/artifact-distribution` exposes OCI-style artifact distribution posture for adapters, submission bundles, registry snapshots, and release artifacts
 - `GET /v1/shared-signals` exposes OpenID Shared Signals and CAEP-aligned risk and identity event exchange posture without replacing native runtime decisions
 - `GET /v1/feature-control` exposes OpenFeature/OFREP-aligned rollout and policy portability posture across pricing, authority, identity, trust, and release gates
+- `GET /v1/adapter-certification` exposes the front-specific adapter certification contract and its machine-readable compatibility states
+- `GET /v1/trust-portability-boundary` exposes the bounded trust portability contract for identity, delegation, delivery, and settlement-linked followthrough
+- `GET /v1/signed-audit-provenance` exposes the signed audit and provenance surface map for selected evidence-bearing runtime and release lanes
 - accepted payments then flow into payment-ledger, treasury-summary, rail-summary, and reconciliation surfaces
 - the default first-party settlement posture is now `bsv_teranode`, and `x402` challenge quotes carry native BSV/Teranode settlement hints when that default path is in use
 - the default machine-payment lane remains `x402`, while credits and `stripe_mpp` provide repeat-use and human-funding paths, and future protocol expansion should normally enter through the payment front rather than replacing the default machine lane

package/START_HERE.md

@@ -4,7 +4,7 @@ This is the shortest reliable path for understanding and using the public `xytar
 
 The phase program is now complete, so this file is the right starting point for a closed and release-shaped runtime rather than an in-flight milestone build.
 
-The product-side implementation and treasury activation work for the widened `3.0.0` finish line are now complete. The remaining step is the synchronized public `3.0.0` release cut, publish, deploy, and verification sequence documented in [NAXYTRA_3_0_0_RELEASE_CONTRACT.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/docs/release/NAXYTRA_3_0_0_RELEASE_CONTRACT.md) and [PUBLISH_PLAN.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/PUBLISH_PLAN.md).
+The synchronized `3.0.0` launch line shipped and is live. The current public line is the synchronized security and stability release described in [RELEASE_NOTES.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/RELEASE_NOTES.md); operator write surfaces fail closed and payment acceptance defaults to signed verification, so configure the operator tokens and a wallet registry before expecting paid or operator flows to work.
 
 ## 1. Understand The Role
 
@@ -97,13 +97,13 @@ This is the fastest way to see the intended package story end-to-end.
 
 If you want the clearest cross-repo adoption path instead of the broad package tour, continue with:
 
-- [CARRIED_HANDOFF_DEMO.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/CARRIED_HANDOFF_DEMO.md)
+- [CARRIED_HANDOFF_DEMO.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/CARRIED_HANDOFF_DEMO.md)
 
 If you want the shortest neutral external-adoption bundle, continue with:
 
-- [PARTNER_READY_PATH.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/PARTNER_READY_PATH.md)
-- [PUBLIC_DEMO_SCRIPT.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/PUBLIC_DEMO_SCRIPT.md)
-- [EXAMPLE_PATHS.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/EXAMPLE_PATHS.md)
+- [PARTNER_READY_PATH.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/PARTNER_READY_PATH.md)
+- [PUBLIC_DEMO_SCRIPT.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/PUBLIC_DEMO_SCRIPT.md)
+- [EXAMPLE_PATHS.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/EXAMPLE_PATHS.md)
 - `node examples/partner_launch_walkthrough.js`
 
 ## 4. Verify The Whole Package
@@ -141,8 +141,8 @@ That gate is stricter than local verification and expects:
 
 For long-term product understanding, read:
 
-- [FINAL_CONTRACT.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/FINAL_CONTRACT.md)
-- [SERVICE_CONTRACT.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/SERVICE_CONTRACT.md)
+- [FINAL_CONTRACT.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/FINAL_CONTRACT.md)
+- [SERVICE_CONTRACT.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/SERVICE_CONTRACT.md)
 - `GET /openapi.json`
 - `GET /asyncapi.json`
 - `GET /cloudevents.json`
@@ -157,6 +157,9 @@ For long-term product understanding, read:
 - `GET /v1/artifact-distribution`
 - `GET /v1/shared-signals`
 - `GET /v1/feature-control`
+- `GET /v1/adapter-certification`
+- `GET /v1/trust-portability-boundary`
+- `GET /v1/signed-audit-provenance`
 - `GET /v1/mcp`
 - `GET /v1/a2a`
 - `GET /v1/a2c`
@@ -195,26 +198,26 @@ For long-term product understanding, read:
 - `GET /v1/capability-registry/commercialization-summary`
 - `GET /v1/go-live`
 - `GET /v1/go-live/summary`
-- [PROGRAM_STATUS.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/PROGRAM_STATUS.md)
-- [OPERATOR_START_HERE.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/OPERATOR_START_HERE.md)
-- [OPERATIONS_RUNBOOK.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/OPERATIONS_RUNBOOK.md)
-- [PROGRAM_COMPLETE_RELEASE.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/PROGRAM_COMPLETE_RELEASE.md)
-- [WHY_XYTARA_XOONYA.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/WHY_XYTARA_XOONYA.md)
-- [CARRIED_HANDOFF_DEMO.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/CARRIED_HANDOFF_DEMO.md)
-- [PARTNER_READY_PATH.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/PARTNER_READY_PATH.md)
-- [BSV_TERANODE_PLATFORM_DISCONTINUITY_RUNBOOK.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/BSV_TERANODE_PLATFORM_DISCONTINUITY_RUNBOOK.md)
-- [REAL_PAYMENT_SETUP.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/REAL_PAYMENT_SETUP.md)
+- [PROGRAM_STATUS.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/PROGRAM_STATUS.md)
+- [OPERATOR_START_HERE.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/OPERATOR_START_HERE.md)
+- [OPERATIONS_RUNBOOK.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/OPERATIONS_RUNBOOK.md)
+- [PROGRAM_COMPLETE_RELEASE.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/PROGRAM_COMPLETE_RELEASE.md)
+- [WHY_XYTARA_XOONYA.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/WHY_XYTARA_XOONYA.md)
+- [CARRIED_HANDOFF_DEMO.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/CARRIED_HANDOFF_DEMO.md)
+- [PARTNER_READY_PATH.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/PARTNER_READY_PATH.md)
+- [BSV_TERANODE_PLATFORM_DISCONTINUITY_RUNBOOK.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/BSV_TERANODE_PLATFORM_DISCONTINUITY_RUNBOOK.md)
+- [REAL_PAYMENT_SETUP.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/REAL_PAYMENT_SETUP.md)
 - private treasury source of truth: `your private treasury source-of-truth file outside the repos`
-- [TERMINOLOGY.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/TERMINOLOGY.md)
+- [TERMINOLOGY.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/TERMINOLOGY.md)
 
 ## 6. If You Are Building Adapters
 
 Continue with:
 
-- [ADAPTER_START_HERE.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/ADAPTER_START_HERE.md)
-- [adapters/AUTHORING_GUIDE.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/adapters/AUTHORING_GUIDE.md)
-- [adapters/ONBOARDING_POSTURE.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/adapters/ONBOARDING_POSTURE.md)
-- [adapters/THIRD_PARTY_SUBMISSION_PROCESS.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/adapters/THIRD_PARTY_SUBMISSION_PROCESS.md)
+- [ADAPTER_START_HERE.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/ADAPTER_START_HERE.md)
+- [adapters/AUTHORING_GUIDE.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/adapters/AUTHORING_GUIDE.md)
+- [adapters/ONBOARDING_POSTURE.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/adapters/ONBOARDING_POSTURE.md)
+- [adapters/THIRD_PARTY_SUBMISSION_PROCESS.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/adapters/THIRD_PARTY_SUBMISSION_PROCESS.md)
 
 ## 7. Production Reading Rule
 
@@ -261,9 +264,9 @@ Public/private rule:
 
 Use:
 
-- [PROGRAM_STATUS.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/PROGRAM_STATUS.md)
-- [OPERATOR_START_HERE.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/OPERATOR_START_HERE.md)
+- [PROGRAM_STATUS.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/PROGRAM_STATUS.md)
+- [OPERATOR_START_HERE.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/OPERATOR_START_HERE.md)
 
 If you depend on hidden-account grants, credits, or usage meters in production, set `XYTARA_STATE_FILE` to a path on persistent disk before you trust restart durability.
 
-If your host does not provide persistent disk, use [SUPABASE_RUNTIME_STATE_SETUP.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/SUPABASE_RUNTIME_STATE_SETUP.md) instead.
+If your host does not provide persistent disk, use [SUPABASE_RUNTIME_STATE_SETUP.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_naxytra/naxytra/xytara/SUPABASE_RUNTIME_STATE_SETUP.md) instead.

package/examples/_demo_env.js

@@ -0,0 +1,40 @@
+"use strict";
+
+// Local demo environment for the bundled examples.
+//
+// The runtime is fail-closed by default: signed payment acceptance (`local_signed`) and
+// operator write surfaces that require bearer tokens. The examples therefore register a
+// demo wallet and demo operator tokens before the in-process server is created. Every value
+// here is only applied when the corresponding variable is not already set, so a real
+// configuration always wins.
+
+function setDefault(name, value) {
+  if (typeof process.env[name] !== "string" || !process.env[name].trim()) {
+    process.env[name] = value;
+  }
+}
+
+setDefault("XYTARA_PAYMENT_VERIFICATION_MODE", "local_signed");
+setDefault(
+  "XYTARA_WALLET_REGISTRY_JSON",
+  JSON.stringify([
+    {
+      wallet_id: "demo-wallet",
+      secret: "demo-wallet-secret",
+      account_id: "acct_demo",
+      enabled: true
+    }
+  ])
+);
+setDefault("XYTARA_CREDIT_BRIDGE_BEARER_TOKEN", "demo-credit-bridge-token");
+setDefault("XYTARA_ACCOUNT_AUTH_BEARER_TOKEN", "demo-account-auth-token");
+setDefault("XYTARA_BSV_TERANODE_MERCHANT_ADDRESS", "1MerchantBsvAddressExample");
+setDefault("XYTARA_BSV_TERANODE_SETTLEMENT_RUNTIME_MODE", "mock");
+
+module.exports = {
+  demoWalletId: "demo-wallet",
+  demoWalletSecret: "demo-wallet-secret",
+  demoAccountId: "acct_demo",
+  demoCreditBridgeToken: process.env.XYTARA_CREDIT_BRIDGE_BEARER_TOKEN,
+  demoAccountAuthToken: process.env.XYTARA_ACCOUNT_AUTH_BEARER_TOKEN
+};

package/examples/adapter_review_walkthrough.js

@@ -1,6 +1,7 @@
 "use strict";
 
 const assert = require("assert");
+require("./_demo_env");
 const { createServer } = require("../server");
 
 async function fetchJson(url) {

package/examples/export_carried_handoff.js

@@ -3,6 +3,7 @@
 const assert = require("assert");
 const fs = require("fs");
 const path = require("path");
+require("./_demo_env");
 const { createServer } = require("../server");
 const { createClient } = require("../index.js");
 

package/examples/funded_runtime_walkthrough.js

@@ -1,6 +1,7 @@
 "use strict";
 
 const assert = require("assert");
+const demoEnv = require("./_demo_env");
 const { createServer } = require("../server");
 
 async function fetchJson(url, options) {
@@ -42,7 +43,7 @@ async function main() {
         external_ref: "external-funded-runtime-demo-1"
       },
       {
-        authorization: "Bearer demo-credit-bridge-token"
+        authorization: `Bearer ${demoEnv.demoCreditBridgeToken}`
       }
     );
     assert.strictEqual(grant.ok, true, "credit bridge grant missing");

package/examples/partner_launch_walkthrough.js

@@ -1,6 +1,7 @@
 "use strict";
 
 const assert = require("assert");
+require("./_demo_env");
 const { createServer } = require("../server");
 
 async function fetchJson(url, options) {