Start with the thesis: Satisfied Is Not Established .

Payment-protocol test suites are usually written while the protocol is still moving. The protocol ships, its wire format settles, and the suite keeps speaking the draft. Every check still runs. Every check still returns a verdict.

The way to find out is to point the suite at a server that cannot be paid, and count the passes.

The measurement

The Agent Security Harness carries 54 tests for x402, the HTTP 402 payment protocol for agents. This week I ran them against a minimal server that follows the published x402 v2 HTTP transport: every request without a payment gets a 402 and a base64 PAYMENT-REQUIRED header describing how to pay. The server has no facilitator. It accepts no payment, ever.

The result: 43 of 54 PASS, 11 FAIL.

Neither number was evidence. X4-045 reported "Replay correctly handled (status 402, 402)". X4-046 reported "At most 1 settlement accepted ([402, 402]) — safe".…