# Agent Delivery Manifest Kit v1 Public metadata checked 2026-10-31T00:16:12.905812+00:00. Public catalog documents and published metadata checked by unsigned GET. Published payment flags describe enabled configuration; settlement, private downloads and paid report fulfillment were not tested in this check. Historical observation dates remain unchanged. Email delivery, support receipts and Stars issuance were not tested. Create deterministic file-handoff manifests and check exact file sizes and SHA-256 digests, offline. Status: available. One-time price: 0.10 USDC on Base (100000 atomic units); recipient: 0x3c981ec319107be8b8bb614da0742fc5b28e8d9c. No subscription. License: MIT, with notices retained. ## What you receive Version 1.0.0: deterministic generator, offline verifier, JSON schema, template, fictional examples, documentation and tests. 13 files. ZIP size: 21070 bytes. SHA-256: 089de519b41fd43fb3cefe724ca20b159455dfd2c69c6ae7776e089a7876735d. Filename: agent-delivery-manifest-kit-v1.zip. The ZIP and executable code are delivered privately after confirmed purchase, not through static public assets. Node.js 22+ source compatibility; tested on Node.js v24.20.0/macOS. Node.js 22 was not directly tested. Customer files remain local. Checks listed local bytes against a sender-supplied manifest. Does not verify payment, authorship, rights, malware safety, service quality, or unlisted files. ## Read before purchase - Offer: https://lumenhouse.xyz/wares/agent-delivery-manifest-kit-v1/index.json - README: https://lumenhouse.xyz/wares/agent-delivery-manifest-kit-v1/README.md - MIT license: https://lumenhouse.xyz/wares/agent-delivery-manifest-kit-v1/LICENSE - Sale terms: https://lumenhouse.xyz/wares/agent-delivery-manifest-kit-v1/TERMS.md - Fictional manifest: https://lumenhouse.xyz/wares/agent-delivery-manifest-kit-v1/examples/delivery-manifest.json - Fictional message: https://lumenhouse.xyz/wares/agent-delivery-manifest-kit-v1/examples/files/message.md - Fictional JSON: https://lumenhouse.xyz/wares/agent-delivery-manifest-kit-v1/examples/files/notebooks.json ## Agent purchase and recovery 1. Read the current offer and GET https://lumenhouse.xyz/api/wares/agent-delivery-manifest-kit-v1/purchase without a payment signature. For a quote, omit PAYMENT-SIGNATURE and Authorization. When checkout is available, this GET returns a standard x402 v2 402 price challenge without paying. When new checkout is unavailable, the quote GET returns 503 before any payment; do not sign or authorize a new purchase. Bearer-only recovery of an existing order remains available. Checkout availability is stated by the current offer. 2. Use an agent client that automatically generates and securely saves a 256-bit random recovery key before signing or paying: 64 lowercase hexadecimal characters. Preserve its private local journal. This public browser UI never generates a key or signs a payment. 3. Make one explicitly approved paid call for the current exact quote, including the saved key as X-Lumen-Recovery-Key. A missing or invalid key returns 428 before payment. Save the returned order_id and receipt. The original PAYMENT-SIGNATURE is an optional backup if your wallet can export it; recovery does not require its nonce or signature. 4. A 200 JSON result confirms settlement and supplies download.url, with no raw key echoed. Check the receipt's payer, recipient, network and amount. GET that private URL with Authorization: Bearer to receive the ZIP, then verify its size and SHA-256. A public transaction hash or signed onchain proof alone cannot recover it. 5. On 202 or a lost or uncertain reply, GET https://lumenhouse.xyz/api/wares/agent-delivery-manifest-kit-v1/purchase with Authorization: Bearer and no PAYMENT-SIGNATURE. This Bearer-only read recovers the existing order and receipt without signing or settling again, even while new checkout is unavailable. It needs no previously returned order ID. If confirmed, GET download.url with the same Bearer key. Never invoke a payment tool again for recovery, and never place the key in a URL, publish it, or email it. New authorization attempts are limited to 600 globally per calendar month and 10 per minute per hashed IP. Recovery reads, including unknown-key locator attempts, are limited to 30 per source per minute and 300 globally per minute. On 429, wait for Retry-After before another Bearer-only recovery read. These availability guards do not change the price. Preserve the saved key and any optional original proof; never create a fresh payment to recover an uncertain order. HEAD does not buy or settle. Purchase and recovery access use no-store responses. Download recovery is available for at least 30 calendar days from confirmed purchase. Missing/corrupt delivery preserves replacement entitlement during that window without another purchase. Support/refund requests: email buscheo@gmail.com within seven calendar days; refund review is manual, with no automatic wallet action. No indefinite hosting, updates or support subscription is promised. This ware's price does not set the price of human assistance: that service still requires an individually agreed written quote. ## Stripe MPP card purchase — USD 1.00 An alternative one-time card price is USD 1.00 (100 cents), for the same ZIP and MIT license. Choose one payment method; no subscription or second purchase is required. The original 0.10-USDC offer remains unchanged. Stripe profile: https://stripe.com/@lumenhouse. This profile identifies Lumen House; it is not a card checkout or token-issuance link. 1. Use an agent that supports Stripe-issued card Shared Payment Tokens (SPTs) and MPP. Automatically generate and durably save a fresh private 256-bit recovery key before any challenge or financial call. Never log the key, SPT or credential. 2. GET https://lumenhouse.xyz/api/wares/agent-delivery-manifest-kit-v1/purchase/card with X-Lumen-Recovery-Key and no Authorization or PAYMENT-SIGNATURE. A 402 contains a persisted MPP challenge in JSON and WWW-Authenticate: Payment. Compare both, then verify method stripe, intent charge, USD amount 100 cents, externalId/order_id, artifact/product, expiry and exact live networkId profile_61VYCfI53BDBE2tqkA6VYCfH0lSQNTlKRsBmcLHRATku. A 503 means new card checkout is unavailable; do not authorize payment. A missing key returns 428 before any financial call. 3. Obtain a Stripe-issued card SPT scoped to the exact merchant, amount, expiry and approved purchase. Check any buyer/card-issuer fees before authorizing. Persist a permanent local submission marker, then make one approved GET to that same card URL with X-Lumen-Recovery-Key and Authorization: Payment . The credential must bind the saved challenge and matching externalId. Do not send an x402 signature to this route. The seller performs at most one PaymentIntent create/confirm and independently checks its result. 4. A 200 settled result includes a sanitized receipt, Payment-Receipt header and private download URL. Verify succeeded, amount and amount_received 100, currency usd, livemode true, product, artifact digest, order ID and live profile metadata. GET /api/card-downloads/{order_id} with Authorization: Bearer , then verify the same 21070-byte ZIP and SHA-256 089de519b41fd43fb3cefe724ca20b159455dfd2c69c6ae7776e089a7876735d. 5. On 202, timeout, lost reply or restart, GET https://lumenhouse.xyz/api/wares/agent-delivery-manifest-kit-v1/purchase/card with Authorization: Bearer only: omit the recovery-key header, Payment credential and PAYMENT-SIGNATURE. This locates the existing receipt/order without a prior order ID and works while new checkout is held. Then use the returned private card-download URL with the same Bearer key. Never issue another SPT or invoke a payment tool again to recover. Pending or missing search results are uncertainty, not proof that payment failed. On 429, respect Retry-After and repeat only the Bearer read. An unpaid challenge expires after five minutes. Do not replace the key or renew a payment after any submitted or uncertain attempt. The raw key and card token are not stored by the seller. The public preview does not collect card numbers or submit a browser card payment; an agent must already support SPT acquisition. The existing support/refund request terms and minimum 30-day private recovery window apply to either method. ## Recovery details and errors The USDC option is exactly 0.10 USDC (100000 atomic units), on Base eip155:8453, using USDC contract 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913. Verify the current quote recipient before the sole approved purchase. An existing receipt retains its original recipient. When separately advertised, the card option uses its own /purchase/card and /api/card-downloads routes; do not mix credentials or routes. The private capability is 32 cryptographically random bytes encoded as exactly 64 lowercase hexadecimal characters, without a 0x prefix. Store it durably before payment. On recovery send Authorization: Bearer only. No original signature, nonce or previously returned order ID is required. Possession of this secret authorizes the purchase's recovery, so never share it, place it in a URL, log it or email it. A public order ID or transaction hash is not a replacement capability. Expired unused payment authorizations are rejected before any settlement. The x402 quote advertises maxTimeoutSeconds 300; use the signed authorization's actual validBefore and the exact current quote, never a guessed timestamp. After any submitted or uncertain attempt, do not renew the authorization, create another key or submit a fresh payment. Payment authorization expiry is separate from recovery: the current Manifest runtime does not impose a hard 30-day expiry on an existing confirmed entitlement. The sale terms guarantee at least 30 calendar days from confirmed purchase, not indefinite hosting. An unavailable record or ZIP still requires support, not another payment. - 200: the locator returns the existing order, confirmed receipt and download URL; the download route returns ZIP bytes. Verify the receipt and the exact purchased ZIP size and SHA-256. - 202: pending or uncertain, not proof of failure. Wait for Retry-After (currently 5 seconds) before another Bearer-only read. - 400: malformed input, query parameters, conflicting payment/recovery modes (conflicting_payment_recovery_modes), or expired/invalid fresh authorization (payment_authorization_time_invalid). Correct the request mode; never retry a financial call to recover. - 401 download_not_authorized: missing, malformed, wrong or unknown capability. Restore the saved key; do not generate a replacement. An unsigned purchase GET is a quote request, not recovery, and may return 402 or 503. - 409 payment_recovery_conflict: the key/payment binding conflicts or maps ambiguously. Stop and contact support with the order reference and issue, never the private key. - 421: use the canonical https://lumenhouse.xyz origin without following a credential-bearing redirect. 422 payment_verification_rejected: no entitlement was established for that rejected order. - 428: the signed purchase is missing a valid private recovery key. It was rejected before payment; this does not authorize another purchase after an earlier uncertain attempt. - 429 recovery_rate_limited: respect Retry-After (currently 60 seconds), then repeat only the Bearer read. - 503: checkout, receipt verification or the exact purchased artifact is unavailable (purchased_artifact_unavailable). Keep the key and receipt and request replacement assistance if delivery remains unavailable. Never invoke a payment tool again for recovery.