# KerfLedger 1.0.0

Original integer-mm kerf-aware stock cutting planner, served at:
https://test.hpservices-tx.com/kerfledger/docs

Paid endpoint: POST /kerfledger/v1/plan, 0.01 native Base USDC, x402 v2 exact EIP-3009.
Free fixed live example: /kerfledger/example. Terms: /kerfledger/terms.

## Reproduce safely

Python 3.11+, dependencies in requirements.txt. No private operator key needed.

```
uv venv .venv
uv pip install --python .venv/bin/python -r requirements.txt
KERFLEDGER_DB=/tmp/kerfledger-import.sqlite3 .venv/bin/python -m pytest test_service.py -q
```

All payment tests use fresh unfunded ephemeral test keys and injected MockPayments objects; no test connects to /settle. They exercise real signature recovery and the real planner. Mock settlement/receipts are not real transactions. The publicly deployed app uses LivePayments with no HTTP/environment mock-payment bypass.

## Deployment installed on this host

Source workspace: /root/kerfledger. Runtime copy: /opt/kerfledger. State: /var/lib/kerfledger/calls.sqlite3. Service: kerfledger.service, DynamicUser, loopback 127.0.0.1:18842, Restart=on-failure. Nginx adds only a /kerfledger namespace to the pre-existing test-website-proxy site. It does not replace existing pages. Public source downloads expose only explicitly allowlisted non-secret source files.

```
systemctl is-active kerfledger
curl -i http://127.0.0.1:18842/kerfledger/health
curl -i https://test.hpservices-tx.com/kerfledger/health
```

Nginx change is syntax-tested, then gracefully reloaded without restarting existing services. To pause this API only: systemctl stop kerfledger. Remove only its snippet/include to retire routing; keep private state for recovery. Do not delete payment tombstones while old authorizations/results may be replayed.

## Payment durability and limitations

SQLite WAL/full default synchronization, unique operation ID from network/token/payer/nonce, deterministic output/input hash durable before settlement, one atomic winner, one facilitator settlement invocation. Replays use the original header and input. A separate Base RPC checks AuthorizationUsed plus exact Transfer in a successful safe-block receipt, not merely the facilitator success flag. Unknown outcomes return 202 and reconcile without another settlement. A pre-dispatch crash can remain pending indefinitely; no second charge is preferred over automatic resubmission. No direct-call automated refunds, EIP-1271, Permit2 or SLA. The free PayAI tier can exhaust; no paid upgrade credentials are configured.

The launch evidence must distinguish real unpaid challenge/fixed example, real read-only verification rejection for an unfunded ephemeral EOA, and simulated paid/recovery paths. No self-purchase or organic sales claim.