🪙 "If your agent is going to pay, you set the rules." Sester plugs x402-style metering, quotas, fail-closed spend policy and a tamper-evident hash-chain receipt ledger into your API — as one ASGI middleware, with zero required dependencies.

What it does, in one paragraph: every paid request passes through a 402 → payment → receipt handshake; spend is metered in integer minor units against per-agent daily quotas; a fail-closed policy engine (host allow-lists, time windows, escalation to human approval) decides before your handler runs; and every decision and charge lands in a hash-chained ledger that third parties can verify with nothing but sha256. Four agent-commerce protocols — x402, AP2, ACP, UCP — compile onto one wire-format core (ChargeIntent/ChargeReceipt), so adding a fifth protocol is one adapter, not a rewrite.

Why fail-closed matters

Sester is built on one doctrine: every failure path denies spend. A corrupt policy file → DENY_ALL. An unknown payment scheme → 402. A tampered evidence bundle → loud RED, never a receipt. A facilitator outage → 402, not a free call. Silent fallbacks (except: pass) are treated as security bugs — the test suite pins them. If you are metering money, "fail open" is not a mode, it is a leak.

3-minute demo

# 1) Start the demo API (port 8402)
uvicorn sester.demo_api:app --port 8402

# 2) Prepare a payment envelope (HMAC issuer)
python -m sester.demo_api --mac f1-telemetry:n1:0.05 /weather

# 3) Send the paid request (paste the envelope from step 2)
curl -H "X-Sester-Agent: f1-telemetry" \
     -H "X-Payment: pugio0 f1-telemetry:n1:0.05:<mac>" \
     "http://127.0.0.1:8402/weather?city=istanbul"

# 4) Open the panel: http://127.0.0.1:8402/panel

The flow: curl without payment → 402 + X-Payment-Required challenge; with payment → 200 + X-Sester-Receipt evidence header; the 5th call → 402 quota exceeded; /panel shows who called, how much, and a live chain-integrity badge.

Feature map (by version)

Protocol adapters

All four compile to the same ChargeIntent/ChargeReceipt core — one shared wallet means one shared quota. Register your own via register_scheme / ProtocolAdapter.

Test suites & acceptance runs

.venv/bin/python -m pytest tests/ -q    # full suite: policy, ledger, middleware, EVM schemes,
                                        # evidence, facilitator, protocol adapters, escalation,
                                        # JWS, signed policy, UCP, settlement, minor units,
                                        # payee registry, S6 joint acceptance — 200+ test legs
python scripts/s1_dogfood.py            # S1 acceptance scenario → KABUL (accepted)
python scripts/dogrula.py adoption/s1-kanit-bundle.json   # receiver side — no Sester needed

Cross-repo bridge tests (tests/test_bridges_crossrepo.py) run external evidence receivers end-to-end via subprocess (clean → ACCEPT, tampered → RED). They skip automatically when the counterpart repos are absent — the embedded pure-stdlib mirrors in bridge_receivers/ pin the same wire contract in every run.

Documentation

Deliberate v0 limits

Non-goals by decision, not by omission (see the repository's decision records): transaction signing stays out of the library (non-custodial — the signing party is yours), live PSP certification is pending real-world traffic, and the CLI surface is minimal by design. Everything else on the roadmap through v0.5.0 is implemented and gated by the test suite above.

License

Apache-2.0 — see LICENSE. The frozen wire fields (pugio0, pugio_bundle_version, source: "sikke") are kept for receiver compatibility and are documented in the repository's identity-migration record; visual and wire identity are separate layers.