Delegate once. Enforced before the payment exists.

Three engines and the shared core. MIT, on npm.

The shared core carries one credential, one rolling counter, and one append-only decision log. A 245-case parity harness keeps every engine identical on verdicts.

The budget is a design. The ceiling is a control.

These are different things, and this page previously ran them together.

The per-transaction ceiling, the counterparty set, the window and the rail list are enforced against signed mandate content. The agent holds a key that can spend inside the mandate and no key that can widen it. Rewriting those terms is not a permission it can escalate to; it is a signature it cannot produce. That is adversarially binding, and it is what every engine on this page does.

The cross-rail budget is not that. It is enforced against a counter the agent itself owns: a local append-only file at a path the caller supplies, opt-in per adapter; shared only by adapters running in one runtime, against one path, co-located in a single process — a requirement rather than a deployment preference, because the single-writer guard is a byte offset into that file; holding unsigned records; and agent-owned and resettable, so truncating the file starts the budget again.

It holds against an agent following its own rules, and against a hostile skill that never reaches the file. It does not hold against an agent that decides not to be bound. Enforced against mutable agent-owned state is a different claim from enforced against signed mandate content, and that difference is the one the rest of this site is built on.

The hosted evaluator does not implement it at all, so a payment evaluated there and a payment evaluated by a co-located adapter do not share a budget and cannot.

It has never run in production. As of 8 August 2026 there are no ledger rows on our infrastructure. Every row that exists — nine, across three files — was written on one workstation during demonstrations between 6 and 28 July 2026.

One mandate, three rails, denied on every rail.

Committed transcript, 2026-07-06. One $5.00 rolling-24h mandate, signed once. Consumed across three rails, to exactly $5.00. Then the next attempt on each rail was refused from the same shared counter.

These three adapters ran in one process, sharing one file. The Lightning and TRON legs were mainnet; the x402 leg settled on Base Sepolia, a testnet (eip155:84532). The transcript is exactly what it says it is, and it demonstrates the design rather than recording a deployed control.

Verified against the production x402.org facilitator; settled on-chain on Base Sepolia (blocks 43793016-43793058); the buyer wallet holds zero ETH. The Lightning legs exercise the engine's pre-payment hook in-process on a synthetic invoice: no LND node, no payment path in the engine. Conversion rates are attested inside the signed credential (USDC=1, USDT=1, sat=0.0005): no oracle anywhere in the flow.

To our knowledge, the first open enforcement layer spanning both 402 lineages (x402, L402) plus wallet-SDK signers under one credential.

Engines exist today for MPP/Tempo (mppx-op-account, public with its integration) and OWS (ows-op-policy), and the enforcement pattern is demonstrated on Liquid in an instrumented build of Aqua (the hook is not in shipped Aqua, and the Bitcoin path is not hooked); each joins Crossrail as its integration enters the public set. The Monetization Gateway's native cloudflare:402 scheme is a roadmap engine; we are waitlisted.