fix: widen Circle x402 user-wallet authorization window

[SuPuHe]

Summary

Widen the Circle Gateway user-wallet authorization window so human wallet approval is not rejected as too short. Strict payer, recipient, amount, asset, network, nonce, and validity checks remain enforced. Explicit pre-settlement Payment verification failed responses become FAILED_SAFE; ambiguous outcomes remain UNKNOWN.

The branch is synced with the latest develop, using its newer Privy implementation while retaining the shared validity-window constant and Circle adapter changes.

Scope and acceptance criteria

• Shared 605800-second validity window is used by browser signing and server validation.
• Exact-boundary validBefore is accepted; values beyond the bound are rejected before forwarding.
• Strict payment identity and validity checks remain enforced.
• Pre-settlement 402 refusal maps to FAILED_SAFE.
• Ambiguous, timeout, malformed, lost-response, and pending outcomes remain UNKNOWN.
• Latest develop implementation is retained; no unrelated cleanup is included.

Product and security invariants

• One intent / at-most-once settlement remains enforced.
• UNKNOWN reconciliation does not blindly retry or submit replacement payments.
• No secrets, tokens, private keys, production credentials, or personal data are included.

Invariant notes: the candidate delta is limited to web, contracts, supplier-adapter, tests, and context. Server, storage, and worker trees are unchanged from develop; PostgreSQL-gated tests are not applicable to this delta.

Validation

pnpm test: PASS — 82 files / 1089 tests
pnpm test:browser: PASS — 8/8
pnpm typecheck: PASS
pnpm lint: PASS
pnpm format:check: PASS
pnpm check:generated: PASS
git diff --check: PASS
Conflict-marker scan: PASS — none
Secret scan: PASS — no credential material

Independent review evidence

Gate A — exact candidate tree before push

• Base commit SHA: fd515729ddba8516073ac598cf588bedb9291500

• Candidate tree SHA: bc01869a0e7e844c8a11ba44b94ea939444a995d

• Candidate commit SHA: ba0afd496161466edc1a3f2f8d439c13158a2673

• Reviewer tool: free-pi-cli

• Reviewer model: deepseek-v4-flash

• Verdict: VERDICT: PASS

• Findings: no blocking findings. Non-blocking risks are documented in the reviewer verdict.

• The reviewed tree equals the committed tree.

Gate B — exact remote PR head

• Pull request URL/number: fix: widen Circle x402 user-wallet authorization window #110

• Remote head commit SHA: ba0afd496161466edc1a3f2f8d439c13158a2673

• Remote head tree SHA: bc01869a0e7e844c8a11ba44b94ea939444a995d

• Reviewer tool: free-pi-cli

• Reviewer model: pending Gate B

• Verdict: pending Gate B

• Findings or residual risks: pending Gate B

• Gate B reviewed the current remote head and matches Gate A's approved tree, or a fresh Gate A was run for the changed tree.

• Agent policy / repository-policy and all applicable CI checks pass.

Risk and rollback

• Residual risks: the 402 classification assumes seller x402 protocol conformance; Circle's minimum validity requirement is externally defined and mismatches fail closed without payment. The context record contains a documentation-only stale tree reference.
• Rollback or recovery plan: revert this PR. Do not blindly retry existing UNKNOWN intents.

Human merge

• A human owner has reviewed the evidence and will perform the merge.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	oneshot	ba0afd4	Sep 12 2026, 10:24 PM

[kapustazh]

WW