feat: add Checkout Pilot hackathon submission

submissions/mcp-hackathon/mosesfawole-checkout-pilot/RIGHTS.md

@@ -0,0 +1,14 @@
+# Submission rights declaration
+
+Project: `Checkout Pilot`
+Submission slug: `mosesfawole-checkout-pilot`
+Submitter: `Moses Fawole`
+Date: `2026-09-12`
+
+The submitter confirms that they own, or have sufficient authorization for, the source code, dependencies, service, data, branding, and other materials submitted in this pull request.
+
+Subject to the official program terms, the submitter authorizes X-Agent to retain, reproduce, audit, test, archive, and publish the submitted program artifact for judging, fraud prevention, dispute handling, ecosystem submission, and post-award accountability.
+
+Third-party components and their licenses: Node.js platform dependencies are listed in `source/package.json` and are used under their respective licenses.
+
+Exceptions or restrictions: None.

submissions/mcp-hackathon/mosesfawole-checkout-pilot/SUBMISSION.md

@@ -0,0 +1,45 @@
+# Checkout Pilot
+
+Checkout Pilot is a hosted payment-link and settlement demo for small merchants. It lets an agent create a payable link, inspect its status, and simulate settlement without handling private keys or moving funds.
+
+## Capability
+
+- **One-line description:** Create and manage payment links through a safe demo or server-side Moove Receive API adapter.
+- **Who it helps:** Freelancers, tutors, consultants, event organizers, and small digital sellers.
+- **Capability boundary:** Creates links and reads/settles demo records; live mode only calls Moove Receive payment-link endpoints. It does not custody keys, swap, bridge, stake, withdraw, or manufacture volume.
+
+## Live API
+
+- **API base URL:** https://checkout-pilot.onrender.com/v1
+- **Health-check URL:** https://checkout-pilot.onrender.com/health
+- **Authentication:** None in demo mode.
+- **Rate limits / known limits:** Render free instances may cold-start; demo state is in-memory and resets on restart.
+- **API contract:** `source/openapi.json`
+
+## Source and reproducibility
+
+- **Source repository:** https://github.com/mosesfawole/checkout-pilot
+- **Review commit:** `1c4740857de59595f8d2bb4501f6e44d00a160f4`
+- **Source submitted in this PR:** `source/`
+- **Run tests:** `npm test`
+- **Run locally:** `node server.mjs`
+- **Deploy:** Use the included `Dockerfile` or `render.yaml`.
+- **Version binding:** `SOURCE_COMMIT` is set to the review commit and is exposed by `/health` and `/.well-known/xagent-verification.json`.
+
+## Verification
+
+See `verification/README.md` for reproducible calls and expected responses.
+
+## Security and data handling
+
+- **Data collected:** Demo payment-link metadata and optional payer/merchant labels supplied in requests.
+- **Purpose and retention:** In-memory demo operation only; no durable retention is intended.
+- **Third parties / outbound network calls:** Live mode optionally calls the configured Moove Receive API over HTTPS.
+- **Secrets:** No secrets are committed; Moove credentials remain server-side environment variables.
+- **Known risks / restrictions:** Demo state is not production accounting. Reviewers should use test values and leave live credentials unset.
+
+## Support
+
+- **Team / builder:** Moses Fawole
+- **Contact:** GitHub: https://github.com/mosesfawole
+- **License / rights:** MIT; submitter can authorize review and deployment.

submissions/mcp-hackathon/mosesfawole-checkout-pilot/source/.dockerignore

@@ -0,0 +1,7 @@
+.git
+.env
+.env.*
+!.env.example
+node_modules
+test
+*.log

submissions/mcp-hackathon/mosesfawole-checkout-pilot/source/.env.example

@@ -0,0 +1,9 @@
+# Leave both values unset for the local demo. The app then never calls Moove.
+# For live mode, copy the exact API host shown beside the key in the Moove dashboard.
+MOOVE_API_BASE_URL=https://api.moove.xyz
+MOOVE_API_KEY=mk_live_replace_me
+PORT=8787
+
+# Required by the public X-Agent deployment. Set these after the source commit exists.
+SOURCE_COMMIT=0000000000000000000000000000000000000000
+XAGENT_SUBMISSION_SLUG=mosesfawole-checkout-pilot

submissions/mcp-hackathon/mosesfawole-checkout-pilot/source/.gitignore

@@ -0,0 +1,5 @@
+.env
+.env.*
+!.env.example
+node_modules/
+*.log

submissions/mcp-hackathon/mosesfawole-checkout-pilot/source/Dockerfile

@@ -0,0 +1,13 @@
+FROM node:22-alpine
+
+WORKDIR /app
+COPY package.json ./
+COPY server.mjs ./
+COPY public ./public
+
+ENV NODE_ENV=production
+ENV PORT=8787
+EXPOSE 8787
+
+USER node
+CMD ["node", "server.mjs"]

submissions/mcp-hackathon/mosesfawole-checkout-pilot/source/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Checkout Pilot contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

submissions/mcp-hackathon/mosesfawole-checkout-pilot/source/README.md

@@ -0,0 +1,77 @@
+# Checkout Pilot
+
+Checkout Pilot is a demo-first payment-request dashboard built around Moove's current Receive API. It creates one-off hosted checkout links, keeps a merchant reference on every request, and reads settlement status without exposing an API key to the browser.
+
+## Run the demo
+
+Requirements: Node.js 20 or newer.
+
+```powershell
+npm start
+```
+
+Open `http://127.0.0.1:8787`. Demo mode stores links in memory, moves no money, and clears all records when the process stops.
+
+## Connect Moove later
+
+1. Claim a Moove Handle and configure a default settlement wallet.
+2. Create a Receive-scoped key at <https://www.moove.xyz/dashboard/api-keys>.
+3. Set both values in the server environment. Use the exact base URL displayed beside the key.
+
+```powershell
+$env:MOOVE_API_BASE_URL = "https://api.moove.xyz"
+$env:MOOVE_API_KEY = "your-key-from-the-dashboard"
+npm start
+```
+
+Do not paste the key into this repository or send it in a chat message. Live mode calls only:
+
+- `POST /v1/payment-link`
+- `GET /v1/payment-link`
+- `GET /v1/payment-link/{id}`
+
+The app does not send, swap, bridge, stake, withdraw, or connect a payer wallet.
+
+## X-Agent deployment contract
+
+The public deployment exposes:
+
+- `GET /health`: returns `status: "ok"` and the deployed source commit.
+- `GET /.well-known/xagent-verification.json`: binds the deployment to the submission slug and source commit.
+- `GET /api/capabilities`: documents operations, inputs, side effects, and constraints for agent productization.
+- `GET /openapi.json`: machine-readable OpenAPI 3.1 contract.
+
+Set `SOURCE_COMMIT` to the exact 40-character commit pushed to the public source repository and set `XAGENT_SUBMISSION_SLUG` to the final `<builder>-checkout-pilot` directory name. The verification endpoint refuses to claim a development or placeholder commit.
+
+## Container deployment
+
+```powershell
+docker build -t checkout-pilot .
+docker run --rm -p 8787:8787 `
+  -e SOURCE_COMMIT=<40-character-public-commit> `
+  -e XAGENT_SUBMISSION_SLUG=mosesfawole-checkout-pilot `
+  checkout-pilot
+```
+
+For the hackathon's public capability review, demo mode is enough to exercise the API without credentials or financial activity. Moove live mode is a separate configuration and should be enabled only when a real pilot is ready.
+
+### Render
+
+The included `render.yaml` is a Blueprint deployment. Create a Render service from the public GitHub repository, set `SOURCE_COMMIT` to the deployed Git commit, and leave the Moove variables blank for demo mode. Render will expose `/health` and the X-Agent verification endpoint over HTTPS.
+
+## Verify
+
+```powershell
+npm test
+```
+
+## Product wedge
+
+The next defensible step is a merchant pilot: embed the link creator in Telegram or Discord, recruit one real seller, and measure genuine orders, settlement completion, and time saved. Those records become evidence for the Moove Developer Program and material for a Decentralize AI technical article.
+
+## Current constraints
+
+- Moove Receive is live; the public Send, Swap, Bridge, Stake, and Ramp APIs are not.
+- Moove currently has no webhooks, so status checks use polite polling.
+- Demo records are in-memory only.
+- USD labels in this prototype are display labels; settlement behavior is controlled by the merchant's Moove account.

submissions/mcp-hackathon/mosesfawole-checkout-pilot/source/package.json

@@ -0,0 +1,14 @@
+{
+  "name": "checkout-pilot",
+  "version": "0.1.0",
+  "private": true,
+  "description": "A server-side, demo-first agentic checkout pilot for Moove Receive payments.",
+  "type": "module",
+  "scripts": {
+    "start": "node server.mjs",
+    "test": "node --test"
+  },
+  "engines": {
+    "node": ">=20"
+  }
+}