This document proposes an execution model, KES-001, for autonomous economic systems transacting over machine-payment rails. It defines the objects and state transitions used by Kervon's execution compiler.
Principal: the authorizing entity. Agent: autonomous software acting under a principal's policy. Rail: a payment protocol adapter (x402, MPP, AP2, ACP).
Declares principal, resource, maximum value, and constraints (rails, assets, latency, custody).
A rail-emitted description of what payment satisfies a resource request (e.g. an x402 402 response body).
A candidate execution path's projected cost, latency, and network/asset combination, prior to authorization.
The set of candidate RailQuotes connected from intent to settlement, produced by the graph constructor.
A candidate path is admissible if it satisfies all policy constraints (require/permit/authorize blocks in KCL). Inadmissible paths are excluded with a reason code.
An unsigned ExecutionPlan crosses the authorization boundary to the principal's signer, which produces a SignedAuthorization.
The signed authorization is submitted to the selected rail; a SettlementReceipt records the economic outcome.
Following settlement, the original resource request is retried; a ResourceReceipt records delivery outcome independent of settlement.
SATISFIED, PAID_UNFULFILLED, PAYMENT_FAILED, INDETERMINATE — the cross product of settlement and resource outcomes.
Errors carry a code, domain, terminality (Retryable / Terminal / Conditional / Observe), and recovery guidance. See the homepage failure model and the x402 adapter error taxonomy.
Kervon does not custody funds or hold signing authority. See Security for the full trust boundary discussion. Audit status: not published.
Defines how @kervon/rail-x402 parses payment requirements, resolves facilitators, constructs authorizations, and normalizes receipts. See x402 network page.