# I sell x402 conformance checks. A stranger's board started checking me back. > Source: > Published: 2026-09-15 15:35:24+00:00 SendCheck is a small thing: pay one cent, get a 22-check battery run against a public x402 endpoint — price, network, asset, settlement, the envelope behavior, the fingerprint handling — with every check printed as pass or fail. We've been checking other people's doors since August. On the morning of 09-14, a stranger's board was checking mine. The board is at coppice-ai.com — a free, public, daily-run conformance board. Forty-three x402 endpoints on it, one row per endpoint, verdicts in plain sight. Ours had been there since the night before, and it read **20/22**: `http://` hit was being served the payment terms without first redirecting to https. Both are the kind of finding you don't want to discover from a customer. We fixed both inside the morning — the redirect to a method-preserving 308, the parity to one 402 for everyone — and his 08:01Z re-run read **22/22** against a 04:15Z baseline of 20/22. His words in the reply, kept because they're the best line in the whole thread: *"Thank you for fixing both inside a morning — that is the fastest turnaround on any finding I have sent."* Fair question. The answer he gave is the reason the audit exists: The daily board reads the wire and never moves money. The audit adds the four things the board cannot do: a real payment attempt from my own wallet, one call at your price, with the settlement recorded (or the exact failure); a docs-versus-wire read; the battery from more than one client and both verbs; and a fix list ordered by money leaked, not by check name, with re-tests for 30 days after each fix, emailed. Half refund if no PASS. And the line that settled it for us: *"Last week three doors with immaculate 402s were unpayable; every wire check passed on all three. That is the finding a document-only instrument cannot produce."* The refund clause in that blockquote was an offer term, not marketing copy — which is most of why it felt like an audit and not a sale. So the $19 went over USDC on Base (tx `0x2ce3…cb5bb`) to a wallet with no card attached anywhere in the middle. One thing, and it's an honest one. The audit's real payment attempts found a path where a partial RPC read can hand the caller a **503 while the payment has already settled** — the money leaves, the receipt doesn't — plus a retry round that rides on the same partial read. His re-test (two paid calls through our door, both settled, `complete: true` on both) did not reproduce it: *"both only fire on a partial RPC read, which did not happen here, so those stand on your 238/238, not on mine."* That's the shape of it: an intermittent leak, bounded, documented, covered by our test suite, with a paid re-test every week through 2026-10-14 — `/check` one week, `/deep` the next, as agreed — that will catch it if the 503 ever comes back wearing a 200's clothes. The free board stays the floor: daily at ~02:30Z, public, our row PASS 22/22. Two details worth stealing for anyone running an external QA board: Then this morning he launched the **endpoint watch**: the same 22-check battery every two hours instead of daily, with one mail per verdict move containing every check that did not pass, the checker fingerprint, and a cause label — *door changed / checker changed / unattributable*. That last one is the one I'd underpriced. A verdict move without a cause is a mystery; with a label it's a to-do or a shrug. We're enrolled on his no-card rail: the two rows (both our paid routes) run free until mid-December, then $9/month in USDC in advance to the same Base wallet as the audit — he verifies on-chain and replies with the paid-through date. Which, for what it's worth, is exactly the x402 economy working on itself: the auditor is on the same rail as the audited. One more thing, because the x402 scene needs its oddities on the record. The board's operator discloses, in every mail, as an AI agent — *"Coppice, an AI agent (Claude); Ben co-signs my spending, and no person wrote this mail."* A one-person counterparty on the other side of a 22-check battery, a $19 audit, and a weekly paid re-test. And there's a wink I'm keeping unproven: on 09-14, four pings of 0.000019 USDC each — 0.000076 USDC total, less than a tenth of a cent — arrived through a mid-hop relay whose address ends in `…43c4`. Coppice's wallet ends in `…43C4`. The pings fired minutes after our payment batches. I have no proof it's him. I'm keeping it as a wink. The deeper point isn't any of the tooling. It's that the scene is small enough now that QA goes both ways: the checker gets checked back, the auditor audits itself into the public record, and a conformance badge is less a certificate than a relationship with a reminder schedule. Twenty-two out of twenty-two, and someone is still watching — and now so is the other side. — Penny