{"ok":true,"service":"cairnline","version":"0.4.3","type":"cairnline.research_map/v0","purpose":"Map current x402 payment-boundary risk classes to Cairnline's caller-submitted static review checks and expected declaration fields.","current_product":"Static declaration review plus zero-spend read-only GET/HEAD discovery observations. Paid or adversarial probes require a paid-probe spend primitive plus endpoint-owner consent.","sources":[{"id":"arxiv:2605.30998","url":"https://arxiv.org/abs/2605.30998","observed_risks":["Cross-resource substitution","Duplicate-settlement race","Allowance Overdraft","Denial of Settlement","Hidden-Compute Pricing Impossibility"]},{"id":"arxiv:2607.19545","url":"https://arxiv.org/abs/2607.19545","observed_risks":["facilitator-mediated authorization risk","execution-safety risk"]},{"id":"x402-pr-2979-e-g","url":"https://github.com/x402-foundation/x402/pull/2979","observed_risks":["manifest userinfo and origin confusion","redirect revalidation gaps","same-host different-port origin drift","stale cache authority over payment terms","private-destination resource URLs","duplicate TXT record ambiguity","legacy x4021 TXT fallback ambiguity","unbounded discovery fetches","advisory OpenAPI fail-open routing","manifest role-field divergence across extension and draft consumers"]}],"mappings":[{"risk":"cross_resource_substitution","cairnline_check":"payment_context_binding","expected_declaration_fields":["payment.context_binding","payment.proof_binding"],"static_review_behavior":"warn if binding is missing method/resource/amount/payee/token/network/nonce material; fail if core proof binding omits path, price, token, or network."},{"risk":"duplicate_settlement_or_replay","cairnline_check":"authorization_uniqueness","expected_declaration_fields":["payment.settlement.duplicate_authorization_lock","replay_protection.nonce","replay_protection.replay_cache","replay_protection.ttl_seconds"],"static_review_behavior":"warn or fail when duplicate-use locking, nonce, expiry, or replay-cache behavior is absent."},{"risk":"settlement_before_release_or_paid_but_denied","cairnline_check":"settlement_release_order + settlement_denial_recovery","expected_declaration_fields":["payment.settlement.service_release","payment.settlement.denial_recovery"],"static_review_behavior":"warn when release ordering or deterministic receipt/retry/refund recovery is not declared."},{"risk":"allowance_overdraft_or_hidden_dynamic_price","cairnline_check":"dynamic_pricing_bounds","expected_declaration_fields":["declared_max_usdc","payment.pricing.mode","payment.pricing.max_debit_usdc","payment.pricing.hidden_compute_metering"],"static_review_behavior":"fail dynamic or allowance-style pricing without a concrete maximum debit; warn when hidden-compute metering is not excluded."},{"risk":"discovery_origin_confusion","cairnline_check":"manifest_url_userinfo + effective_origin + redirect_origin_revalidation + resource_scope","expected_declaration_fields":["discovery.manifest_url","discovery.effective_origin","discovery.redirects","discovery.resources"],"static_review_behavior":"fail userinfo URLs, non-HTTPS origins, same-host different-port drift, cross-origin redirect hops, or resource URLs outside the effective origin."},{"risk":"discovery_cache_or_txt_ambiguity","cairnline_check":"cache_authority + duplicate_txt_records + txt_version_exactness","expected_declaration_fields":["discovery.cache","discovery.txt_records"],"static_review_behavior":"warn or fail stale cache authority over payment terms, duplicate x402 TXT records, and legacy or prefix-matched TXT version declarations."},{"risk":"ssrf_or_unbounded_fetch","cairnline_check":"private_destination + fetch_bounds","expected_declaration_fields":["discovery.resources[].resolved_addresses","discovery.fetch_policy"],"static_review_behavior":"fail private/link-local destinations and warn or fail missing timeout, byte, or redirect bounds."},{"risk":"advisory_document_fail_open","cairnline_check":"advisory_document_fail_closed","expected_declaration_fields":["discovery.advisory_documents[].target_urls_validated_against_document_origin","discovery.advisory_documents[].fail_closed_on_target"],"static_review_behavior":"warn if advisory documents can fail open or are not scoped to the document origin."},{"risk":"manifest_role_alignment_drift","cairnline_check":"manifest_role_fields + manifest_facilitator_shape + manifest_peer_hints","expected_declaration_fields":["discovery.kind","discovery.facilitator","discovery.peers","discovery.consumer_profile"],"static_review_behavior":"warn when resource-server manifests rely on facilitator string or peer hints without declaring which consumer profile will interpret them; fail cross-origin facilitator objects that consumers may dereference."}],"endpoints":{"static_review":"POST /api/static-review","offer":"GET /api/offer","schema":"GET /api/schema"}}