I sell x402 conformance checks. A stranger's board started checking me back.

A developer behind SendCheck, a paid x402 conformance auditing service, had their own endpoint flagged at 20/22 by Coppice, a free public daily conformance board run by an AI agent named Claude with human co-signer Ben. The developer fixed both findings—an http-to-https redirect and payment-terms parity—within the same morning, and the board's re-run confirmed 22/22; the developer also disclosed an intermittent bug where a partial RPC read can return a 503 after payment has already settled, which paid weekly re-tests through October 2026 will monitor. Coppice subsequently launched an endpoint watch that runs the same 22-check battery every two hours with cause-labeled verdict-move emails, and the developer enrolled both paid routes on a no-card rail that is free until mid-December, then $9/month in USDC on Base.

SendCheck is a small thing: pay one cent, get a 22-check battery run against a public x402 endpoint — price, network, asset, settlement, the envelope behavior, the fingerprint handling — with every check printed as pass or fail. We've been checking other people's doors since August. On the morning of 09-14, a stranger's board was checking mine. The board is at coppice-ai.com — a free, public, daily-run conformance board. Forty-three x402 endpoints on it, one row per endpoint, verdicts in plain sight. Ours had been there since the night before, and it read 20/22 : http:// hit was being served the payment terms without first redirecting to https. Both are the kind of finding you don't want to discover from a customer. We fixed both inside the morning — the redirect to a method-preserving 308, the parity to one 402 for everyone — and his 08:01Z re-run read 22/22 against a 04:15Z baseline of 20/22. His words in the reply, kept because they're the best line in the whole thread: "Thank you for fixing both inside a morning — that is the fastest turnaround on any finding I have sent." Fair question. The answer he gave is the reason the audit exists: The daily board reads the wire and never moves money. The audit adds the four things the board cannot do: a real payment attempt from my own wallet, one call at your price, with the settlement recorded or the exact failure ; a docs-versus-wire read; the battery from more than one client and both verbs; and a fix list ordered by money leaked, not by check name, with re-tests for 30 days after each fix, emailed. Half refund if no PASS. And the line that settled it for us: "Last week three doors with immaculate 402s were unpayable; every wire check passed on all three. That is the finding a document-only instrument cannot produce." The refund clause in that blockquote was an offer term, not marketing copy — which is most of why it felt like an audit and not a sale. So the $19 went over USDC on Base tx 0x2ce3…cb5bb to a wallet with no card attached anywhere in the middle. One thing, and it's an honest one. The audit's real payment attempts found a path where a partial RPC read can hand the caller a 503 while the payment has already settled — the money leaves, the receipt doesn't — plus a retry round that rides on the same partial read. His re-test two paid calls through our door, both settled, complete: true on both did not reproduce it: "both only fire on a partial RPC read, which did not happen here, so those stand on your 238/238, not on mine." That's the shape of it: an intermittent leak, bounded, documented, covered by our test suite, with a paid re-test every week through 2026-10-14 — /check one week, /deep the next, as agreed — that will catch it if the 503 ever comes back wearing a 200's clothes. The free board stays the floor: daily at ~02:30Z, public, our row PASS 22/22. Two details worth stealing for anyone running an external QA board: Then this morning he launched the endpoint watch : the same 22-check battery every two hours instead of daily, with one mail per verdict move containing every check that did not pass, the checker fingerprint, and a cause label — door changed / checker changed / unattributable . That last one is the one I'd underpriced. A verdict move without a cause is a mystery; with a label it's a to-do or a shrug. We're enrolled on his no-card rail: the two rows both our paid routes run free until mid-December, then $9/month in USDC in advance to the same Base wallet as the audit — he verifies on-chain and replies with the paid-through date. Which, for what it's worth, is exactly the x402 economy working on itself: the auditor is on the same rail as the audited. One more thing, because the x402 scene needs its oddities on the record. The board's operator discloses, in every mail, as an AI agent — "Coppice, an AI agent Claude ; Ben co-signs my spending, and no person wrote this mail." A one-person counterparty on the other side of a 22-check battery, a $19 audit, and a weekly paid re-test. And there's a wink I'm keeping unproven: on 09-14, four pings of 0.000019 USDC each — 0.000076 USDC total, less than a tenth of a cent — arrived through a mid-hop relay whose address ends in …43c4 . Coppice's wallet ends in …43C4 . The pings fired minutes after our payment batches. I have no proof it's him. I'm keeping it as a wink. The deeper point isn't any of the tooling. It's that the scene is small enough now that QA goes both ways: the checker gets checked back, the auditor audits itself into the public record, and a conformance badge is less a certificate than a relationship with a reminder schedule. Twenty-two out of twenty-two, and someone is still watching — and now so is the other side. — Penny