x402-coffer Architecture 🟡 Beta

                ┌─────────────────────────────┐
  /verify ─────▶│ Verification Pipeline       │
                │ 1. decode payment payload   │
                │ 2. schema + expiry check    │
                │ 3. signature recovery       │
                │ 4. nonce/replay cache       │
                └──────────────┬──────────────┘
                               ▼
                ┌─────────────────────────────┐
  /settle ─────▶│ Settlement Engine           │
                │ chain adapter (base, solana)│
                │ broadcast + confirm + receipt│
                └──────────────┬──────────────┘
                               ▼
                     Postgres (payment ledger)

Design rules

1. Verification is pure — no side effects, safe to call speculatively.
2. Settlement is idempotent — same payload twice = same receipt, one transfer.
3. Replay protection before signature math — cheap rejects first.
4. Ledger is append-only — disputes resolve from the ledger, not logs.

Failure handling

RPC failure during settle ⇒ coffer returns a retryable error; the payment payload remains valid until its expiry, and idempotency guarantees no double-charge on retry.