# Evaluate Vaultfire's API without funds or secrets

This is a local V2 evaluation, not a hosted payment sandbox or a V3 activation.
It runs actual API handlers, HTTP, Redis/Lua and durable receipt recovery.
Payment authorization, settlement and gas transports are deliberately synthetic.
It never signs a wallet transaction or submits anything to a public chain.

## Start from the public specifications

Read the [operation contracts](https://theloopbreaker.com/schemas/x402/v2-input-contracts.json)
and their `localEvaluation` profile before installing or sending requests.
Only operations with `availability.locallySupported: true` are enabled locally.
Their supported results are unsigned transaction preparation and a static
contract-catalog read, not execution of the transactions they describe.
Other provider-backed operations remain unavailable in this profile.

Retrieve the current source from the [source selector](https://theloopbreaker.com/v3#artifacts)
and follow its checksum, reconstruction and file-inventory instructions.
Do not substitute an older archive if current retrieval fails.
The exact website publication identity is separate from the protocol source.

## Install and run

Use Node **22.23.3**, pnpm **10.28.1**, and Redis server/CLI.
Redis **8.0.5** is the version exercised in the prepared environment.
No `.env`, API token, seed phrase, private key or funded wallet is needed.
Never supply a real payment signature to this evaluation service.

From the reconstructed repository:

```sh
cd repos/theloopbreaker-site
corepack pnpm install --frozen-lockfile
node scripts/x402-local-evaluation.mjs
```

The package's `packageManager` selects pnpm 10.28.1. If Corepack is unavailable,
install the pinned CLI in a separate temporary directory and invoke it with the
required Node version, rather than relying on `npx` to select Node:

```sh
TOOLS="$(mktemp -d)"
npm install --prefix "$TOOLS" pnpm@10.28.1
node "$TOOLS/node_modules/pnpm/bin/pnpm.cjs" install --frozen-lockfile
```

Check `node --version`, `redis-server --version` and `redis-cli --version`
first. These commands do not install Node or Redis. A truly cold machine must
install those prerequisites separately; the V3/native quickstart additionally
requires its pinned Forge/Solana/Rust tools. Reserve several GiB of free disk
for source, dependencies and installation intermediates; a constrained runner
may not fit the full Node and native setup simultaneously.

The first JSON line supplies the disposable loopback URL, status endpoint and
current machine contract. It binds to `127.0.0.1`, refuses production mode,
and restricts the HTTP transports used by these handlers to its local service.
It starts a separate Redis instance and never opens a production datastore.
Stop it with Ctrl+C to remove its disposable Redis data.

Cold retrieval, dependency installation, native-tool installation, prepared
execution and full validation are different measurements. A prepared run does
not establish a fast anonymous setup. Fresh full installation still needs its
own timed acceptance run and sufficient disk for the pinned dependencies.

## Construct a request and inspect its challenge

Fetch `/__local/status`, then `/schemas/x402/v2-input-contracts.json` on the
printed loopback URL. Choose a locally supported operation, its method and
`requestExample`. GET inputs are query arguments; POST inputs are a JSON body.
Send an `Idempotency-Key` matching the published 16–128-character rule.

A paid operation first returns a real HTTP **402**, without settling anything.
Decode the base64 `PAYMENT-REQUIRED` header and inspect the recipient, amount,
asset, network, expiry, resource URL and method. The bounded header's schema
references resolve into `$defs` in the public machine contract; full unchanged
schemas also appear in the 402 body's `discoverySchemas`.
Copy the complete challenged `resource` and accepted requirements, not just
the URL: omitting the bound method is rejected.

The local facilitator intentionally does not establish cryptographic payment
validity. The service and every response carry explicit synthetic-evaluation
labels. Its dummy authorization uses the ordinary x402 payload shape, but is
not a usable wallet signature, a transfer or a production receipt.

## Run a standalone client from public instructions

Download and inspect the [complete local client](https://theloopbreaker.com/examples/x402-local-client.mjs).
It uses Node's standard library, the locally served public operation contracts
and their examples. It refuses non-loopback hosts and never reads a wallet or key.
With the service running, substitute its printed URL:

```sh
node x402-local-client.mjs http://127.0.0.1:PRINTED_PORT > local-session.json
node x402-local-client.mjs http://127.0.0.1:PRINTED_PORT --replay local-session.json > local-recovered.json
```

The client demonstrates invalid-input rejection, challenge inspection, actual
supported local fulfillment, one synthetic settlement, byte-identical retry and
receipt recovery. Its JSON output contains the complete original request and
dummy authorization, not a real secret. The second invocation must run against
the same still-running local service; it reuses the original key, inputs and
authorization and must add zero settlements. Normal service shutdown deletes
this disposable datastore, so this is not a production retention guarantee.

The complete synthetic authorization shape is:

```json
{
  "x402Version": 2,
  "resource": "COPY_THE_COMPLETE_CHALLENGE_RESOURCE_OBJECT",
  "accepted": "COPY_ONE_COMPLETE_CHALLENGE_ACCEPTS_OBJECT",
  "payload": {
    "signature": "0x followed by ab repeated 65 times; deliberately invalid",
    "authorization": {
      "from": "0x2222222222222222222222222222222222222222",
      "to": "COPY_ACCEPTED_PAYTO",
      "value": "COPY_ACCEPTED_AMOUNT_AS_A_DECIMAL_STRING",
      "validAfter": "0",
      "validBefore": "CURRENT_UNIX_SECONDS_PLUS_50_AS_A_STRING",
      "nonce": "0x followed by 32 fresh random bytes in hexadecimal"
    }
  }
}
```

The two descriptive object placeholders above must be replaced with objects,
not literal strings. The client shows the executable construction and base64
encoding into `PAYMENT-SIGNATURE`. It copies the challenged resource's method
as well as its URL. A real facilitator must reject the dummy signature;
acceptance is permitted only by the explicitly synthetic loopback profile.

## Run the documented workflow regression

```sh
node scripts/x402-local-evaluation.mjs --self-test --all-supported
```

This builds requests from the current public contract, inspects each 402,
rejects invalid inputs without settling, executes each supported actual
handler, restarts Redis from its AOF, and retries the identical request.
It checks byte-identical responses, the same receipt ID, `replayed: true`,
and one synthetic settlement per operation. Its results include operation
rows, response hashes, the contract authority and the runner hash.
This parent-authored regression is not an independent website-only agent test.

## Recover safely

Keep the original `Idempotency-Key`, request inputs and exact synthetic payment
payload. Retry the identical request, not a newly generated authorization.
Retrieve the receipt from `PAYMENT-RESPONSE`; this profile has no separate
public receipt-lookup URL. An interrupted response is not evidence that
execution failed, and a retry must not create a second settlement.

An unknown local operation returns **503** before fulfillment. Invalid inputs
return **400** before settlement. If startup reports stale authorities or
captures, stop and retrieve the correct current candidate; do not edit hashes
or disable the guard. Local-only success is never production verification.