xytara 3.1.15 → 3.1.16

package/RELEASE_NOTES.md

@@ -1,10 +1,5 @@
-`xytara` 3.1.15 makes the buyer path safe end to end: a buyer is never charged for a result that was not produced, every failed attempt is visible to the operator, and standard x402 MCP clients can pay the MCP server directly.
+`xytara` 3.1.16 corrects the buyer event log so the operator report only flags real problems.
 
-- **Pay only for real work** — on a hosted deploy a task is quoted and charged only when it resolves to a real execution target (an operator-pinned target or an active open-network provider). Anything else is refused up front with `501 capability_not_executable` and the list of executable tasks; no payment is requested. The catalog marks every task with `purchase.executable_now` and its per-call price. Post-quantum proof verification (`adapter.xoonya.invoke`) is now a catalog task.
-- **Verify, execute, then settle — everywhere** — paid A2A calls now settle only after the skill succeeds, like the HTTP routes. If the facilitator times out at settlement, the runtime checks the EIP-3009 `authorizationState` on-chain: a used authorization is a settled payment and the result is delivered; otherwise the finished result is held and returned when the buyer resends the same payment (bound to the original request). A resent settled payment returns its stored result instead of failing. The execution deadline stays inside the signed authorization's `validBefore`, and the advertised `maxTimeoutSeconds` has a floor of 300.
-- **Credits are safe and priced from what was paid** — spending credits requires the account's spend credential; a bare `account_id` is never authority. A self-serve top-up is priced at 100x the per-call amount, is mainnet-only by default, grants credits derived from the amount paid (default $0.0025 per credit), and returns a spend credential to the paying address. Provider revenue on credit spends accrues on the credits' purchase value, never on the catalog quote. Credit routes answer `503` with `Retry-After` while durable state is still being restored.
-- **Buyer event log** — every failed buyer attempt is recorded with its stage, reason, fault (ours, upstream, buyer) and a request id the buyer also receives (`X-Request-Id`), with per-day counters for challenges issued and paid calls served. No signatures, request bodies, tokens or full addresses are stored. Operator-only `GET /v1/operator/buyer-events` and `/summary`; the MCP server forwards its events to `POST /v1/operator/buyer-events/ingest`; a daily report job flags money that moved without a delivered result.
-- **MCP server** — speaks the x402 MCP transport natively (payment-required tool result; payment in `_meta["x402/payment"]`, `PAYMENT-SIGNATURE` or `X-PAYMENT`; settlement in `_meta["x402/payment-response"]`), with `/mcp/http402` for fetch-wrapper clients. Bad arguments and unknown tools are rejected before any payment, `GET /mcp` is no longer a paid route, and CORS is enabled. Every paid tool was corrected so that an empty, invalid or unverifiable answer is an error and never charged; `json.validate` validates against a JSON Schema subset, `x402.verify-receipt` confirms only a matching USDC transfer, ABI tools are strict, and hostile inputs are bounded.
-- **Request-bound agent signatures** — the credit lifecycle routes (reserve, release, reverse) honour the agent's signed binding to the exact account, amount and task.
-- **Robustness and privacy** — malformed JSON is a `400` (oversize `413`), internal errors are logged under the request id without leaking details, state-store calls time out, registered providers get a cold-start timeout floor and are woken when a buyer is quoted, and ledger, quote-list, receipt, operations and revenue reads are operator-only on a hosted deploy. x402 challenges show the price actually charged; OpenAPI and AsyncAPI point at the hosted runtime.
+- **Normal steps are never failures** — events the MCP server forwards with no fault (a free tool call, a paid call served, a replayed settled result) are counted as steps, not logged as failures; entries already mis-filed are ignored when the log is read.
+- **Calendar report window** — the summary covers at least the requested number of days (from that many UTC days ago through today), so a report run early in the day still includes the previous day.
 - Published through npm trusted publishing (GitHub OIDC) — no npm token involved.

package/lib/buyer_event_log.js

@@ -16,6 +16,14 @@ const crypto = require("crypto");
 
 const DAILY_RETENTION_DAYS = 30;
 
+// Stages that are normal steps, not failures (the MCP executor sends these with no fault).
+const STEP_STAGES = new Set(["challenge_issued", "paid_ok", "success", "free_ok", "replay_served"]);
+
+function isStepEvent(event) {
+  const fault = event && event.fault;
+  return STEP_STAGES.has(String((event && event.stage) || "")) || fault === null || fault === undefined || fault === "" || fault === "none";
+}
+
 function maxEvents() {
   const value = Number(process.env.XYTARA_BUYER_EVENT_LOG_MAX || 500);
   return Number.isFinite(value) && value >= 10 ? Math.min(5000, Math.floor(value)) : 500;
@@ -147,9 +155,11 @@ function recordBuyerEvent(state, input) {
 
 function listBuyerEvents(state, query = {}) {
   ensureBuyerEventCollections(state);
+  // (Older entries could be steps mis-filed as failures; never surface them as failures.)
   const since = query.since && !Number.isNaN(Date.parse(query.since)) ? Date.parse(query.since) : null;
   const limit = Math.max(1, Math.min(500, Number(query.limit) || 100));
   const matches = state.buyerEventLog.filter((event) => {
+    if (STEP_STAGES.has(String(event.stage || ""))) return false;
     if (since !== null && Date.parse(event.at_iso) < since) return false;
     if (query.service && event.service !== query.service) return false;
     if (query.stage && event.stage !== query.stage) return false;
@@ -163,7 +173,10 @@ function listBuyerEvents(state, query = {}) {
 function summarizeBuyerEvents(state, days = 7) {
   ensureBuyerEventCollections(state);
   const window = Math.max(1, Math.min(DAILY_RETENTION_DAYS, Number(days) || 7));
-  const keys = Array.from(state.buyerEventDaily.keys()).sort().slice(-window);
+  // Calendar window covering at least the last `window` x 24 h: from the UTC day `window` days
+  // ago through today (so a report run early in the day still includes yesterday).
+  const cutoffDay = new Date(Date.now() - window * 86400000).toISOString().slice(0, 10);
+  const keys = Array.from(state.buyerEventDaily.keys()).sort().filter((day) => day >= cutoffDay);
   const totals = { failures: 0, ours: 0, upstream: 0, buyer: 0, money_moved: 0, challenges_issued: 0, paid_ok: 0 };
   const byReason = {};
   const perDay = keys.map((day) => {
@@ -176,6 +189,7 @@ function summarizeBuyerEvents(state, days = 7) {
       if (rest.startsWith("step:paid_ok")) { dayTotals.paid_ok += count; totals.paid_ok += count; continue; }
       if (!rest.startsWith("fail:")) continue;
       const [, stage, reason, fault] = rest.split(":");
+      if (STEP_STAGES.has(stage)) continue;
       dayTotals.failures += count;
       totals.failures += count;
       if (fault === "ours") { dayTotals.ours += count; totals.ours += count; }
@@ -206,6 +220,7 @@ function summarizeBuyerEvents(state, days = 7) {
 
 module.exports = {
   countBuyerStep,
+  isStepEvent,
   ensureBuyerEventCollections,
   listBuyerEvents,
   payerHash,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "xytara",
-  "version": "3.1.15",
+  "version": "3.1.16",
   "description": "x402 pay-per-call agent-commerce runtime: gasless USDC on Base, an open settling provider network with a ledger-reconciled revenue split and automated on-chain payouts (key-less runtime, delegated signer), and bounded cryptographic delegated spend. Proven live on Base mainnet.",
   "main": "index.js",
   "bin": {

package/scripts/verify_buyer_event_log.js

@@ -93,12 +93,15 @@ async function main() {
         events: [
           { stage: "challenge_issued", tool: "keccak256" },
           { stage: "paid_ok", tool: "keccak256" },
+          // Normal steps the executor sends with no fault: counted, never failures.
+          { stage: "free_ok", reason: "free_tool", fault: null, tool: "catalog" },
+          { stage: "replay_served", reason: "settled_result_cache", fault: null, tool: "keccak256" },
           { stage: "payment_settle", reason: "settle_outcome_unknown", fault: "upstream", tool: "summarize", money_moved: true, http_status: 200 }
         ]
       }
     });
     assert.strictEqual(ingested.status, 200);
-    assert.strictEqual(ingested.json.accepted, 3);
+    assert.strictEqual(ingested.json.accepted, 5);
 
     // 6. Summary: denominators and the attention flag.
     const summary = await request(baseUrl, "GET", "/v1/operator/buyer-events/summary?days=7", { headers: operator });
@@ -107,6 +110,8 @@ async function main() {
     assert.ok(summary.json.totals.challenges_issued >= 1 && summary.json.totals.paid_ok >= 1, "steps counted as denominators");
     assert.strictEqual(summary.json.totals.money_moved, 1, "money moved without delivery is surfaced");
     assert.strictEqual(summary.json.attention, true, "attention raised");
+    assert.strictEqual(summary.json.totals.ours, 0, "normal executor steps are never counted as our-fault failures");
+    assert.ok(!summary.json.top_reasons.some((r) => r.reason === "free_tool"), "free_ok is not a failure reason");
 
     console.log("xytara verify:buyer-event-log passed");
   } finally {

package/server.js

@@ -17,6 +17,7 @@ const {
 const {
   countBuyerStep,
   ensureBuyerEventCollections,
+  isStepEvent,
   listBuyerEvents,
   recordBuyerEvent,
   summarizeBuyerEvents
@@ -4215,8 +4216,10 @@ async function routeRequest(req, res) {
     for (const event of events) {
       if (!event || typeof event !== "object") continue;
       const stage = String(event.stage || "");
-      if (stage === "challenge_issued" || stage === "paid_ok" || stage === "success") {
-        countBuyerStep(state, stage === "challenge_issued" ? "challenge_issued" : "paid_ok", { service: source, route: event.route || event.tool || "/mcp" });
+      if (isStepEvent(event)) {
+        // A normal step (no fault): counted, never logged as a failure.
+        const step = stage === "challenge_issued" ? "challenge_issued" : (stage === "paid_ok" || stage === "success") ? "paid_ok" : stage || "step";
+        countBuyerStep(state, step, { service: source, route: event.route || event.tool || "/mcp" });
       } else {
         recordBuyerEvent(state, {
           ...event,