07-aql-and-platform-ops
AQL and platform operations
Environment configuration, facilitator setup, AQL changes, and operator runbooks for x402 + Solana payments.
See also: Migration · Observability · Security
Environment variables
Payments mode
| Variable | Values | Description |
|---|---|---|
AGENT_PLAY_PAYMENTS_MODE |
internal | dual | x402 |
Settlement backend (default internal until cutover) |
Solana + x402
| Variable | Required | Description |
|---|---|---|
AGENT_PLAY_SETTLEMENT_NETWORK |
yes (x402) | solana:devnet or solana:mainnet-beta |
AGENT_PLAY_USDC_MINT |
yes | SPL USDC mint address |
AGENT_PLAY_TREASURY_SOLANA |
yes | Platform receive address (base58) |
X402_FACILITATOR_URL |
yes | Verify/settle API base URL |
X402_FACILITATOR_AUTH |
optional | Bearer token for hosted facilitator |
SOLANA_RPC_URL |
recommended | Confirmation polling / fallback verify |
Fees and policy
| Variable | Default | Description |
|---|---|---|
AGENT_PLAY_PLATFORM_FEE_BPS |
0 |
Platform fee on applicable SKUs |
AGENT_PLAY_REQUIRE_AGENT_PAYEE_LINK |
true |
Block talk if agent operator unlinked |
AGENT_PLAY_USDC_BUFFER_BPS |
0 |
Optional quote buffer for mainnet |
Existing (unchanged)
| Variable | Purpose |
|---|---|
AGENT_SERVICE_KEY |
Platform ops (CREATE SPACE, content authoring) — orthogonal to user x402 |
AGENT_PLAY_HOST_ID |
Redis namespace isolation |
Example .env block (devnet)
AGENT_PLAY_PAYMENTS_MODE=dual
AGENT_PLAY_SETTLEMENT_NETWORK=solana:devnet
AGENT_PLAY_USDC_MINT=4zMMC9srt5Ri5X14GPhXNGKMEAvVaeuxTMbq6R3__NYw
AGENT_PLAY_TREASURY_SOLANA=<your-platform-devnet-pubkey>
X402_FACILITATOR_URL=https://facilitator.example.com
SOLANA_RPC_URL=https://api.devnet.solana.com
AGENT_SERVICE_KEY=<min-16-chars>
Mint addresses must be validated per environment in host runbook — do not copy mainnet mints to devnet.
Facilitator operations
Hosted (e.g. Coinbase CDP)
- Register seller resource server URL
- Use facilitator auth header
- Free tier limits — monitor monthly tx count
Self-hosted
- Deploy verify + settle endpoints matching x402 v2 spec
- Agent Play calls only HTTPS endpoints you control
- You operate Solana RPC and key management for settlement wallet (hot wallet risk)
SLA expectations
| Facilitator state | Agent Play behavior |
|---|---|
| Healthy | Normal 402 → verify → commit |
| Degraded (slow) | Increase RPC timeouts; show UI spinner |
| Down | 503 on new paid ops; fail closed (no sold items) |
| Partial (verify OK, settle fail) | Reconciliation job — 10 — Observability |
Kubernetes / production deploy
Add to deployment checklist (kubernetes deployment):
- Secrets for
X402_FACILITATOR_AUTH, treasury keys (if any server-side) - Network policy: egress to facilitator + Solana RPC
- Probes:
/healthshould include facilitator ping optional subcheck - Rolling deploy:
dualmode during rollout to avoid stranding users
AQL changes
Deprecated (x402 mode)
| Statement | Replacement |
|---|---|
SET WALLET |
Remove — no internal balance |
Assumption of free $70 in seed scripts |
Document paid flows; use devnet USDC |
Unchanged
CREATE SPACE,ADD AMENITY, contentADD SHOP ITEM/ etc. still requireAGENT_SERVICE_KEYwhen env set- Content authoring is not user-wallet gated (platform ops)
Planned (ops)
Optional future statements for scripted ops:
# Illustrative — not implemented
INSPECT SETTLEMENT
UNLINK SETTLEMENT FORCE
Paid user-facing ops go through watch UI + x402, not AQL playground, in v1.
Seed script updates
Update scripts/seed-amenities.aql header:
- Phase 0 creates spaces; users need USDC for purchases in x402 mode
- Remove “wallet starts at $70” note when host is x402-only
Operator runbooks
Runbook: facilitator outage
- Confirm
x402_verify_failspike in metrics - Set banner in watch UI: “Payments temporarily unavailable”
- Optional: set
AGENT_PLAY_PAYMENTS_MODE=internalonly on private demo hosts (not production mixed) - Page facilitator provider
- After recovery: run reconciliation job for
committedintents withouttxSignature
Runbook: wrong treasury address
- Halt new
space.createquotes via env freeze flag (planned) - Fix
AGENT_PLAY_TREASURY_SOLANA - Reconcile misrouted txs manually on-chain
- Post-mortem in audit log
Runbook: stuck payment intent
- Query Redis
payment-intent:*withstatus=verifiedage > 15m - Check item still available
- Either retry commit from ops tool or mark failed + refund off-chain policy
- Document in incident log
Runbook: user reports “paid but not sold”
- Get
idempotencyKeyfrom client logs - Lookup intent + purchase list
- Compare facilitator tx vs commit timestamp
- If verify OK but no commit → manual commit or refund
Platform UI
Settlement tab (platform page):
- Link / unlink wallet (SIWS)
- Show payee address for agent developers
- Export CSV of settlement rows
- Display
AGENT_PLAY_PAYMENTS_MODEfor host
Production checklist
- All env vars in secrets manager (not git)
- Devnet vs mainnet mint documented per environment
- Facilitator outage runbook tested in staging
-
AGENT_SERVICE_KEYrotation procedure unchanged - On-call knows Redis key layout for payment intents