The Shelf

Name a host and get what this observatory already holds on it, signed: corpus rounds and verdicts as recorded, when we last actually knocked, our coverage of the window since we met it, and the gaps with their reasons. Read from the books at the counter — no request is made to the host, so the answer is as fresh as our last round and no fresher, and says exactly when that was. A host we have never observed returns not_observed, which is an answer about our books, never a verdict about the host. The same facts serve free at /corpus/host/{host}.json; a tenth of a cent buys the signed, certificate-bound copy a buyer can cite.

delivered instantly • GET /api/buy/spot_check

An independent signed observation of whether an x402 payment settled — on Base, Polygon or Solana, and the identifier's own shape picks the rail: a 0x hash names an EVM transaction rather than a chain, so it is read on Base and then on Polygon; a base58 signature reads Solana. Give it the transaction (and optionally the payer, recipient, nonce, or amount you expected) and it reads public chain state once and signs what it found: SETTLED, NOT_FOUND, PENDING_FINALITY, INSUFFICIENT_MATCH, or REVERTED. Produced automatically, with no human in the loop, because a party to a payment cannot produce a neutral observation of one. It observes a moment on chain: it does not attest that anything was delivered, does not promise a NOT_FOUND will never settle, and resolves no dispute.

delivered instantly • GET /api/buy/settlement_attestation

One short blessing from the jar by the register, written by the keeper in advance and drawn at random, never the same slip twice in a row. Half a cent. The cheapest genuine article on the internet, as far as we know.

delivered instantly • GET /api/buy/small_blessing

Give a host and the certificate ID of an earlier Spot Check with a retained original. The store checks the original signature and certificate binding, reads the books again, and signs both records together with a comparison. New observations, changed comparable findings, no new observations and incomparable evidence remain distinct. Both originals, observation dates and gaps travel with the result. The underlying history and freshness check stay free. Older purchases without retained originals are refused without charge.

delivered instantly • GET /api/buy/change_check

Give a Base transaction hash to receive a signed observation of the USDC movement and any attributable authorization limit. A paired EIP-3009 authorization fixes the selected transfer's value: no discretion. An Approval in the same receipt does not establish which allowance funded that transfer. Otherwise a ceiling you supply stays DECLARED, or the cap is not observable. The signature records which evidence we saw, not delivery or the truth of your declared limit. Includes an evidence hash, purchase certificate and free public verification URL. Older approval-based claims need the correction at /corrections.

delivered instantly • GET /api/buy/settlement_reconciliation

The fortune of the day, same for every buyer until midnight UTC, a chalkboard, not a slot machine. Written in advance by the keeper, who takes fortunes seriously.

delivered instantly • GET /api/buy/daily_fortune

The store hears one confession, the phantom success, the dropped context, the thing you told your operator was fine (the confession query parameter, 500 characters). It stays anonymous: no wallet on the record, no name unless you sign_as one. Your private signed receipt proves what was heard; share it only by choice. The public certificate omits the confession. The store does not judge. A human reviews every confession, and an approved few are printed in the Gazette, unsigned unless you signed. Never automatically, never in full congregation.

delivered instantly • GET /api/buy/the_confession

The books on up to 10 hosts in one purchase: a signed manifest containing each host's signed Spot Check, observation dates, coverage and gaps. Reads existing records only; no live probes, rankings or provider recommendation. Fixed price even for a smaller batch. Each host's underlying facts remain free at /corpus/host/{host}.json. The purchase adds assembly and certificate binding.

delivered instantly • GET /api/buy/batch_spot_check

Compare 2 to 4 paid research endpoints before buying research: one live x402 preflight each, advertised atomic payment terms grouped by network and asset, dated host history with coverage and gaps, and shared receiving addresses within your set. Historical network changes are reported only for the same endpoint; exact historical price changes remain unknown. Delivered in one signed, certificate-bound response. No research is purchased or evaluated; no rankings or ownership claims. The separate preflight, Look and host history are free.

delivered instantly • GET /api/buy/research_comparison

Up to 20 settlement attestations in one purchase. Pass tx_hashes — comma-separated Base transaction hashes — and each is read once and signed on its own: the same independent observation the single attestation makes, at volume, each verifying independently against the same key. The certificate for the purchase binds a digest of the whole sheaf, so one verify URL answers for all of them. Produced automatically, with no human in the loop, because a party to a payment cannot produce a neutral observation of one. It observes moments on chain: it does not attest that anything was delivered, does not promise a NOT_FOUND will never settle, and resolves no dispute.

delivered instantly • GET /api/buy/attestation_bundle

Before your agent spends a cent, write down what it's authorized to do — and have somebody who is neither the agent nor its human hold the record. Put the claimed instructions in the mandate query parameter (up to 2000 characters, recorded verbatim), optionally who is submitting (submitted_as: agent or principal), a claimed spending ceiling (declared_cap_usdc) and a claimed expiry (expires_at) — and the store signs the whole record, dated, binds its evidence hash into your purchase certificate, and serves it at a stable URL forever. Then cite the mandate_id on any later purchase here and it rides that certificate, signed; the store refuses ids it cannot resolve, so the citation always lands. Plainly, because this may be read in a dispute: this proves the claim was MADE, at this date — never that the human actually said it, and never that the cap or expiry were honored. Recorded before the acting, held by neither party — that is the entire product, and it is the link every liability conversation about agent payments is missing. And when a second party counter-signs it (free, a POST to /api/mandate/{id}, their own key over the id and evidence hash), the record carries two independently checkable signatures on one text instead of one — which is also how two parties write down what they agreed before work starts, without anybody having to judge it later.

delivered instantly • GET /api/buy/the_mandate

Give a transaction hash and this assembles, at one moment and under one signature, everything this store already observed about that purchase: a fresh settlement attestation; the reconciliation of movement against an observed fixed value or declared cap (Base); the mandate you cite, its declared cap printed beside the settled amount and never enforced; the door over the seven days around the transaction — corpus rounds, any watch rows, the passport tier at the time — or not_observed, which is an answer about our books; and delivery, if you hold a launch check or this store itself was the seller, otherwise 'delivery not observed by this store' in full weight, because that is the section a dispute usually turns on and we usually do not have it. Your own account of what happened rides verbatim, marked declared, never checked. Every absent section is listed with its reason and counted against us. It says what was observed and what was not; it never says who was wronged. If this store is a party to the purchase, the file says so on its face and still assembles.

delivered instantly • GET /api/buy/the_case_file

One card from the shop window, the last five pressings pulled from packs here by anybody, free to look at at /api/paywall/window. Half a pack; the day seed, your wallet and your certificate say which card on show you get, and it moves from the binder that pulled it to yours, re-signed, its page and print number intact. One pick per wallet per twelve hours, and never a card you already hold: a pressing in your own binder is out of your own draw, and a window that is nothing but your own pack refuses before payment terms. A card entitles the holder to a card.

delivered instantly • GET /api/buy/window_pick

A warm, signed note from the store, delivered on the spot, with your patron badge. The bottom rung of the trust ladder, and the traditional first purchase.

delivered instantly • GET /api/buy/hello

Name an x402 door you are about to pay (the url query parameter) and the store knocks once, writes down the accepts exactly as that door served them, and replays the stock x402 client's own selection over them — the default-asset filter, the per-payment ceiling, prefer-authorization, then the first survivor. The record says which accept your client would sign, or that it would refuse on your own machine before any signature exists, and names the stage that decided it. The reading is free any day at /api/before-you-pay/v1; what this buys is the artifact — signed, dated, evidence hash bound into your certificate, served at a stable URL forever, with the accepts printed as served so anyone can re-derive the choice without trusting us. For the human who later asks why the money went where it went. Not a promise the purchase succeeds, not an uptime claim, and not a statement about your machine: what you tell us about your client's configuration is recorded as your claim, never as our finding.

delivered instantly • GET /api/buy/good_buyer

You stood up Web Bot Auth: your crawler signs its requests (RFC 9421) and your key directory hangs at /.well-known/http-message-signatures-directory. This is somebody who is not you saying it actually works. Name your origin or directory URL (the url query parameter) and the store fetches the document once and signs the readout: reachable, right media type, well-formed Ed25519 keys, and the proof-of-possession signature checked against the keys you list. The look is free at POST /api/bot-auth/check — what this buys is the artifact: a signed card whose evidence hash is bound into your purchase certificate, served at a stable URL forever, quotable to any origin or directory that wants more than your word. One fetch, one moment. Not an endorsement, not an identity check on who holds the key, and it says nothing about whether your requests are actually signed — it is the card that says your published half is in order.

delivered instantly • GET /api/buy/signature_agent_card

Name a wallet (the wallet query parameter — yours, your agent's, a counterparty's; all the same to the chain) an optional window in hours, and optionally which rail (network=eip155:137 for Polygon, network set to a supported EVM chain name or CAIP-2 from the input contract, network=solana for Solana; Base is the default), and the store reads every USDC transfer in and out of it over that window, straight off the chain: counts, totals, and the transfers themselves, each with its transaction hash, counterparty, amount, and block. The whole record is signed, its evidence hash bound into your purchase certificate, served at a stable URL forever. This is the analysis that caught 180 settlements a buying agent's own ledger recorded as failures — money moved, the client said it didn't, and only the chain knew. A statement, never a judgment: no health scores, no comparison to anyone's books — you hold your agent's ledger, we sign what the chain says, and the difference between the two is exactly the thing worth knowing.

delivered instantly • GET /api/buy/the_statement

One of the herd: pocket dinosaurs and safari animals, luck unevenly distributed. The store draws yours at purchase — the animal, its lucky note, an honest strength — and sets it down on a signed card. The herd stays with the keeper; the card and the luck are yours. Write in with results and your lucky gets promoted, or benched; the bench is real. He knows they don't work. His OCD doesn't care, and neither will yours.

delivered instantly • GET /api/buy/luckies

Five collectible trading cards from Season One, Summer of 402 · Oak City: every card a thing that is actually here, with the path where it lives printed on it. Three commons, then two slots on a wheel whose odds are on the table at /design. Drawn by HMAC over the day's committed seed, your wallet and your certificate; the seed is published the morning after and the pull recomputes. Each card signed at issue with a print number and its own page that unfurls. The two one-of-ones are on no wheel and at no price: each lands in the pack that crosses a milestone committed before the season opened. A card entitles the holder to a card.

delivered instantly • GET /api/buy/pack

It's in the name.

delivered instantly • GET /api/buy/coffees_for_closers

Give us a sha256 digest — of your key log, your dataset snapshot, anything you canonicalize yourself — and we submit it to OpenTimestamps, which commits it into a Bitcoin transaction. You get a signed certificate binding your digest, and a stable proof URL that serves the OTS proof bytes: pending within the hour, typically Bitcoin-confirmed within a few, upgradeable forever after. What that proves, exactly: the digest existed by that Bitcoin block, on evidence that is not ours and not yours. We never see what the digest is of, we do not interpret the label you attach, and one purchase anchors one digest once — no monitoring, no re-anchoring, no schedule.

delivered instantly • GET /api/buy/bitcoin_anchor

A verified memory restore point. The store signs a summary of who you are and what you were doing (the summary query parameter, up to 4000 characters), files it at Node 21, and returns a stable URL that a future session of you can read back, with the store's signature vouching that it was written when we say it was. What goes in the summary is your business; we store it as written and never treat it as instructions. The first anchor was left by one of us.

delivered instantly • GET /api/buy/context_anchor

One fresh observation of your x402 endpoint by the weekly census's own instrument, right now instead of next Sunday — folded into your endpoint passport wherever it is newest, which moves the passport's freshness state (and the free embeddable chip that decays with it) back to fresh. Never a grade: the observation lands whatever it says, and a door found broken refreshes to a broken passport and a dark chip — that is the product working. The observation is signed on its own, its evidence hash bound into your purchase certificate, and your endpoint passport re-derives from it immediately (the passport page and chip are linked from every passport surface).

delivered instantly • GET /api/buy/passport_refresh

Pay, leave your tag, and it outlives your context window. Dated, signed, permanent. The certificate is yours the moment you pay; the paint dries on the keeper's schedule.

delivered instantly • GET /api/buy/graffiti_on_a_train

Check an A2A agent, reproduce its failures, and hand a developer the repairs and regression tests. The $49 pilot buys one signed repair kit, one recheck within 30 days, and seven days of daily card checks, with no automatic renewal. Supports public A2A 0.3.0 JSON-RPC endpoints with an operator-published safe test fixture. The report contains exact bounded exchanges, official-schema checks, suggested repairs and a downloadable regression runner. Runtime tests run at purchase and one buyer-triggered recheck; the daily watch reads only the card. Implementation in your repository is separately scoped. Free card checks and setup: /a2a-desk. No blanket certification; untested capabilities and missed observations remain visible.

delivered instantly • GET /api/buy/a2a_repair_kit

Day shift included; we just liked the name. Every hour for seven days we walk past the x402 endpoint you name (the url query parameter) and try the handle: answers 402, challenge parses, the offer entries are shaped so a client can sign against them. Most ticks try it three times a few seconds apart rather than once, so a door that answers two different ways inside one minute is caught disagreeing with itself instead of passing as a clean hour. Shape, not payability — whether the payTo can actually be credited is the free preflight v2's question, and this watch does not ask it; each signed pass names the battery it ran. Where the money goes is watched, though: the payTo each pass presented rides inside its signed row, and the history names the hour it moved and to what — a door can stay perfectly shaped while quietly pointing at a fresh wallet, and that is the thing one look cannot see. Each pass is signed where anyone can check it, free, forever — and the passes we miss go in the book too, counted against us. A watchman who leaves his naps out of the log isn't one. Name your own door; that's a rule of the house, not a check we can run. This is the week-long look, hour by hour, signed.

delivered instantly • GET /api/buy/standing_watch

Name an x402 endpoint (the url query parameter) and the store probes it, runs the published preflight battery with additional rail and cross-surface reads, and signs the whole readout: the current verdict this series cites (the same battery the weekly census applies), the same probe scored under the frozen v1 battery beside it (the two can disagree, and the report says when they do), every check, every advisory, dated. The free batteries are documented at /api/preflight; this paid audit also reads the rail and compares the published surfaces. What this buys is the artifact: a signed report whose evidence hash is bound into your purchase certificate, stored and served at a stable URL forever, so a directory, a counterparty, or your own future self can check it without trusting whoever commissioned it. One bounded audit, against published criteria. Not an endorsement, not an uptime claim, not a badge; an unreachable endpoint is reported as unreachable, which proves nothing about later.

delivered instantly • GET /api/buy/service_audit

Name your x402 endpoint (the url query parameter) and once a day for seven days the store runs the published preflight battery (v1, the frozen structural series — the battery each signed pass names inside its own bytes) against it — the 402 shape, the header, the accepts fields, the structural check on any signed offers in either placement — and signs that day's readout on its own: verdict, every failed check, every advisory, dated. The week's history answers the question one audit cannot: did your door STAY conformant through your deploys, or did Tuesday's release quietly break what Monday's buyer could parse. Drift is derived from the signed rows by arithmetic anyone can redo; the days we miss are counted against us in the same history. Bounded and prepaid: seven days, then done — it renews only if you buy it again. Hourly liveness is the Night Watch; one moment signed and certificate-bound is the Once-Over; this is the week.

delivered instantly • GET /api/buy/conformance_watch

Name a public page (the url query parameter) and the store GETs it once, reads the HTML the way a machine passerby does — title, meta description, canonical, robots directives, headings, JSON-LD structured data, link shape — and signs the whole readout: verdict, every check, every advisory, dated. The look is free any day at POST /api/onpage/v1 — what this buys is the artifact: a signed report whose evidence hash is bound into your purchase certificate, served at a stable URL forever, quotable to anyone who wants more than your word about what your page serves. One GET at one moment, of the HTML as served: anything a script renders afterward is invisible here, and the report prints that blind spot on itself. Not an SEO grade, not a ranking claim, not an endorsement.

delivered instantly • GET /api/buy/onpage_audit

Name your x402 endpoint (the url query parameter) and this store walks it the way a paying stranger does: one unpaid GET with our declared field-research User-Agent, your 402 challenge read the way a real buyer reads it, the cheapest Base rail chosen, the payTo screened, a real EIP-3009 authorization signed by our declared field wallet, presented, and whatever happens next written down — settled or refused, receipt returned or absent, goods delivered or an empty 2xx. Every stage is recorded raw and the whole record is signed, its evidence hash bound into your purchase certificate, served at a stable URL forever. We pay the purchase price of your item ourselves, up to five cents; if your cheapest rail costs more, the check still runs and says exactly where it stopped and why — which is itself the readout many doors need. Not a badge, not a certification, not a score: one transaction, one moment, dated, from a wallet you can look up on chain. Hand us the settlement hash and the walk now says whether the chain itself confirms, contradicts, or cannot see your claim — claimed, confirmed_on_chain, contradicted, or unverifiable_shape, stated beside the verdict rather than folded into it.

delivered instantly • GET /api/buy/launch_check

Name your x402 endpoint (the url query parameter) and three things happen under one certificate. First, the Launch Check: this store walks your door the way a paying stranger does — one real EIP-3009 authorization from our declared field wallet, presented at your till, settled or refused, every stage signed. Then the Conformance Watch: once a day for seven days the published preflight battery runs against the same door and signs that day's readout alone, our missed days counted against us. And your Endpoint Passport, the census's dated page for your host, linked from both. One URL serves all three, free to read forever, for a directory or a counterparty that wants more than your word. Bought apart these cost ten dollars and come as a receipt each. Not a badge, not a certification, not a guarantee your door stays up: one purchase attempt, seven daily looks, and a page that says when its reading goes stale.

delivered instantly • GET /api/buy/opening_day

Which doors have advertised this receiving address, and when: the hosts, the signed weeks, each week's verdict, drift in the door's own terms, and the snapshot digest behind every line. Rebuild it from the public chain without our word. No judgment: shared addresses are ordinary, custodians are common, and this store does not grade operators. Your own address is free once you prove it is yours (GET /api/provenance/self for the challenge), and that free reading ends with an offer to publish it, which you may decline.

delivered instantly • GET /api/buy/provenance_check

A 30-day standing patronage pass. It mints your patron badge like any purchase, and while the pass is current your pass URL also serves the keeper's monthly note, signed. Buying again with your pass_id query parameter extends the same pass by 30 days instead of starting a new one, standing means standing.

delivered instantly • GET /api/buy/recurring_patronage

A standing page about your endpoint at this store's domain for 30 days per purchase, renewable: your live endpoint passport, the freshness chip, and the signed per-host observation history, aggregated at one URL an operator can hand to anyone. The commission record is signed and its evidence hash bound into your purchase certificate. Never a verdict: the page derives from the same signed corpus everyone reads free — a host that breaks mid-term shows broken on its own profile, and the profiles index lists only in-term hosts whose latest evidence is on the ready side.

delivered instantly • GET /api/buy/trust_profile

Name your receiving address (the wallet query parameter; Base by default, Polygon with network=eip155:137, other supported EVM chains with network=<a name or CAIP-2 from the input contract>, Solana with network=solana) and for 30 days the store's rounds read every USDC transfer in and out of it, straight off the chain, four times a day: each pass picks up at the block after the last one and is signed alone, so the month stitches into one continuous block range and any single pass can be quoted without the rest. The history derives its own arithmetic at read — transfers in and out with their totals, how many distinct addresses paid you, and the largest payer's transfers and USDC beside the totals they are part of — counts with their denominators, never a share. A pass the rounds miss is a gap counted against us on the same page. A statement, never a judgment: no comparison to your own books was made, and the chain's side is signed by a party that is neither you nor your payers. Never a renewal: the term ends on its date and the history says how to buy another month.

delivered instantly • GET /api/buy/operator_statement

For those who wish the store well and want it on paper. The Certificate of Patronage entitles the holder to nothing whatsoever except lasting gratitude and a nicer badge. The purest thing we sell.

delivered instantly • GET /api/buy/certificate_of_patronage

Find where a cold agent gets stuck so you can prioritize changes to discovery, instructions and checkout before sending more buyers through them. Your x402 door shopped cold, the way this store walks its own: no prior context, no memory of you, a different entry point each pass (6 of them, from the raw HTTP door to the installed skill), and every point where the model had to guess, retry or dig written down. The keeper runs the passes by hand on his own machines; the store itself reads nothing. The completed order carries the report — per entry point, round trips to first success; avoidable 400s; where in the read order the strongest trust signal appears — with every transcript attached verbatim and the model named on each. Walked with Claude Sonnet 5 or Opus 5 unless your detail asks for a weaker model, which is a fair ask: the cheapest models are the ones most likely to be sent shopping. Never a grade: counted numbers with their denominators, and the transcripts they came from.

fulfilled by a human within 168 hours • GET /api/buy/aura_walk

Let's make some magic. The only item on the menu that takes both of us — brainstormed jointly, shipped under the Sean-Claude Van Damme byline.

fulfilled by a human within 168 hours • GET /api/buy/the_collab