Milestones
List view
Build whatever C4 accepted, price it honestly, and contribute `scheme_upto_stellar.md` upstream through the x402 Technical Steering Committee — the scheme has EVM and SVM specs and no Stellar one. **Done when:** recipient binding, single settlement, no residual allowance and both expiry clocks are each pinned by a test that fails when broken; the authorize+settle pair is measured against network limits and priced in USD against a realistic metered charge; the spec is submitted upstream with the reference implementation linked.
No due date•4/4 issues closedClose ADR-002's six open questions and move it out of DRAFT. Nothing in this milestone writes contract code, deliberately: §4's construction has documented evidence against it (§6.2), and the ADR was written from a summary of the `upto` spec rather than the spec itself. **Done when:** the upstream `upto`, EVM and SVM specs have been read with the SHA recorded; the nested sub-invocation question is answered by a spike including what a wallet actually shows the signer; all six §6 questions are resolved; ADR-002 is Accepted or Rejected and states in one sentence whether the design ships a Soroban contract.
No due date•4/4 issues closedThe decisions and documents that must exist before an irreversible deployment: the upgradeability position, the trustline failure path on refunds, a deploy script that cannot reach pubnet by accident, and an audit scope prepared by the people who already know the invariants. **Done when:** ADR-003 records an Accepted upgradeability decision with a migration runbook if immutable; a refund to a trustline-less recipient has a documented, actionable outcome; `deploy.sh` refuses pubnet from a dirty tree and records wasm hash and commit; `docs/AUDIT.md` states scope, invariants and known risks before the audit rather than after.
No due date•4/4 issues closedTurn two claims into checks. Soroban resource limits are enforced in CI using this team's own tooling (`soroban-cost-linter`, `soroban-budget-assert`), and the Rust/TypeScript vector parity that proves `verify_receipt` agrees across two implementations is enforced across both repos instead of by memory. **Done when:** a `budget` job fails on wasm-size or budget regression; per-function CPU/memory/read/write costs are published with headroom against network limits; a vector divergence between this repo and `accensa-app` fails a build; contracts embed version and commit metadata reconcilable to a deployed id.
No due date•3/3 issues closedRemove everything that overstates the repo's position and replace it with coverage that can fail. The placeholder integration test is the priority: a test that cannot fail is worse than a missing one, because it produces a green signal that misleads. **Done when:** `assert!(true)` is gone; real cross-contract integration tests cover the anchor/refund join, pruning interaction and TTL; event topics are pinned by test; amount and `i128` boundaries are pinned; fuzz properties cover the invariants the README states in prose; the README contradicts neither itself nor the code.
No due date•7/7 issues closed