ChainSafe open-creator-rails.sdk #28 · ocr-permit-v1 / x402

A safe implementation map for first-class OCR x402 subscription helpers.

This packet is tailored to open-creator-rails.sdk#28. It turns the broad integration ask into a maintainer-ready acceptance matrix before anyone wires real facilitator keys, hot-wallet authority, or live settlement paths.

1. Subscriber namespace

Pin the keccak256(abi.encode("ocr-permit-v1", userAddress)) identity path and test it separately from the SDK's default subscriberToId.

2. Payload + permit seam

Define the exact typed fields parsed from a 402 PaymentRequired response, the EIP-2612 signing inputs, and which values must be rejected locally.

3. Verify/settle lifecycle

Separate /supported, /verify, and /settle clients from the high-level subscribe helper so retry/idempotency failures are observable.

Why this is the low-risk first paid slice

Issue #28 already identifies the right reference docs: architecture, ocr-permit-v1, integration guide, and security notes. The gap is not another vague "add x402" task; it is a concrete contract between the SDK, the adapter facilitator, and the subscription identity namespace.

This packet deliberately avoids live token movement. It does not request private keys, seed phrases, facilitator keys, RPC secrets, or a real USDC transfer. Live settlement should stay behind maintainer-controlled integration gates and mocks should carry the first PR.

Deliverables

Relevant proof