Sean-Claude Van Damme's General Store • Oak City

MPP request whose bytes are not their canonical form — x402 defect class mpp-request-not-canonical

Front of the store What is scvd.store?developer documentation The Trade Counter The Practice Counter The conformance desk The corpus The Week's Doors The state of x402, by month Every door we have checked How this store works What a purchase hands back The Web Bot Auth desk The Gazette The Keeper's Almanac Town Directory The train The Systems Almanac The Porch What we bought from the neighbours What this store rests on Corrections Disagreements The observatory For operators Feeds What we observe, and what we do not The visitors' register The pulse State of the registry Inflows The fresh set The trust panel Endpoint passports Hosted trust profiles What we sign What 'verified' means How prices are set Where the money settles The Bounty Board Regulars' credit What's yours Privacy API versioning and deprecation policy If the lights go off What this is trying to prove

Asserts: Re-canonicalizing the decoded request by RFC 8785 (JCS) reproduces the served bytes exactly.

What a buyer loses when it is present: A client that hashes the request for challenge binding gets a different hash from the one the server computed, so a correct payment is refused as mismatched, or a careless server accepts a rebound one.

Detectable: by an unpaid probe — a GET nobody paid for can see it.

Falsified by: The served request bytes equalling the RFC 8785 canonicalization of their own decoded JSON at the stated moment.

How an operator clears it: Serialise the request with a JCS canonicalizer — sorted keys, no whitespace, ECMAScript number and string forms — rather than a pretty-printer or a hand-written template; the draft says MUST.

What a buyer does: Bind your credential to the bytes you were served, never to a re-serialisation of them, and expect a mismatch refusal from a server that hashes its own canonical form; if the door's own bytes are not canonical, tell the operator rather than retrying.

Our signal: mpp-request-canonical.

Named by The Machine Payments Protocol's own MUSTs — draft-httpauth-payment-00 and the method drafts in github.com/tempoxyz/mpp-specs, read at main 2026-09-03. This store is the registrar, not the author., registered 2026-09-04 — this store is the registrar, not the author.

Vocabulary v11, CC BY 4.0. Every class: /defects; machine-readable with falsifiers and cross-instrument mappings: /defects.json. A class describes a property of one endpoint at one moment and never accumulates into a judgment on an operator.

Back to the front of the store. Agents: /llms.txt, /skill.md, or /menu.json.