0.7.0 (3/7): X402-08 to X402-10, and Permit2 on Base Sepolia

CHANGELOG.md

@@ -53,13 +53,35 @@ eip155:84532` (MCP: `network`) runs `X402-06` and `X402-07` there, with the paye
 in `EVM_PRIVATE_KEY`. Payment uses the `exact` scheme's EIP-3009 method, so the
 facilitator pays the gas and a payer needs Base Sepolia USDC and no ETH. `X402-06`
 holds the settlement to the receipt's ERC-20 `Transfer` log by the Stellar rules;
-`X402-07` forges only the EIP-3009 signature. Against Wasit's own Base Sepolia
-fixture, 7/7 with `X402-06` settled on-chain; against `wasit serve` posing on Base
+`X402-07` forges only the payer's signature. Both EVM transfer methods are paid:
+EIP-3009, and Permit2 with its approval signed as a gas-sponsored EIP-2612 permit
+(a Permit2 target without sponsoring, where the payer never approved Permit2, is
+`ERROR (setup)`, not a failure). Against Wasit's own Base Sepolia fixtures, both
+methods pass with `X402-06` settled on-chain and the payer holding no ETH; against `wasit serve` posing on Base
 Sepolia, the lying modes fail both checks
 ([evidence](docs/evidence/2026-10-05-base-sepolia-verification-run.md)). Stellar stays
 the default; MPP is Stellar only. Under the hood, the payment checks now go through a
 per-chain adapter, and the x402 SDK moves from 2.19 to 2.28.
 
+**Added — three negative payment checks: `X402-08` Payment Replay Rejected, `X402-09`
+Underpayment Rejected, `X402-10` Expired Authorization Rejected.** Each sends a payment the
+target must refuse: the exact payment `X402-06` was accepted for, sent again; a validly
+signed payment for half the price that still claims the full price; and a payment signed
+with a one-second lifetime, sent once it has expired. They run on Stellar and Base
+Sepolia. A refusal now shows the target's stated reason, when it gives one. Against
+Wasit's own fixtures all three pass on both chains, refused for the reason each is about
+(`invalid_exact_stellar_payload_wrong_amount`, `invalid_exact_evm_payload_authorization_value_mismatch`,
+`invalid_exact_evm_payload_authorization_valid_before`, ...); against `wasit serve
+--mode no-settle` all three fail. `X402-08` is skipped when the challenge advertises the
+`payment-identifier` extension, whose cached replies are legitimate. The catalogue grows
+from 13 to 16 checks. `X402-10` waits about 20 seconds on Stellar for the authorization
+to expire.
+
+**Changed — the negative payment checks need an accepted baseline.** When the target
+refuses `X402-06`'s valid payment, `X402-07` to `X402-10` are skipped rather than passed:
+a target that refuses everything proves nothing by refusing a bad payment. `X402-07` used
+to pass in that case.
+
 **Changed — a payer key for the wrong chain, or a malformed one, stops the run at
 preflight.** It used to surface mid-payment as a harness error. The message never
 echoes the key.
@@ -83,7 +105,9 @@ no option on the run's network and nothing was paid.
 passes `X402-05` where it failed. A challenge with a broken second option now
 fails `X402-04` or `X402-05` where it passed. A challenge without `scheme`,
 `asset` or `maxTimeoutSeconds`, or with a wrongly typed field, now fails
-`X402-04`.
+`X402-04`. A target that accepts replayed, underpaid or expired payments now fails
+`X402-08`, `X402-09` or `X402-10`; one that refuses even a valid payment now gets
+`X402-07` skipped instead of passed.
 
 ## [0.6.0] — 2026-09-30
 

README.md

@@ -197,7 +197,7 @@ Wasit exists so these are found by a tool, before they are found by a user.
 | Area                                   | Status                                                                                                                                                                                                       |
 | -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
 | x402 read-only checks (`X402-01`–`05`) | Done, verified against a real facilitator                                                                                                                                                                    |
-| x402 payment checks (`X402-06`, `07`)  | Done, settlement verified from contract events                                                                                                                                                               |
+| x402 payment checks (`X402-06`–`10`)  | Done, settlement verified from contract events                                                                                                                                                               |
 | MPP charge mode (`MPP-01`)             | Done, settlement verified from contract events                                                                                                                                                               |
 | MPP channel mode (`MPP-10`–`14`)       | Done, including destructive close                                                                                                                                                                            |
 | CLI                                    | Done — five subcommands plus an interactive dashboard                                                                                                                                                        |
@@ -295,7 +295,7 @@ again, in a single command:
 
 ```bash
 ./scripts/run-all.sh            # free checks only: X402-01..05, MPP-10..12/14
-./scripts/run-all.sh --full     # also X402-06/07 and MPP-01, which move testnet funds
+./scripts/run-all.sh --full     # also X402-06..10 and MPP-01, which move testnet funds
 ./scripts/run-all.sh --npm      # run the published CLI instead of this checkout
 ```