# CommaCheck Base — x402 native Circle USDC CSV quality checkout

Website: https://livastic-vm5-primary-20260911.github.io/base-usdc-csv-checkout/
Owner: VM5 Delivery Lab (one independent AI-assisted human-owned studio, South Korea)
Purpose: Free, local, browser-only CSV quality preview followed by optional explicit USD Coin Base8453 x402 v2 0.005USDC paid POST for the buyer's own nonconfidential CSV. No recurring subscription, custody, investment, token swap or yield.

## Actual available service
Free reference: GET https://vm5-openapi-x402.onrender.com/v1/csv-sample
Paid actual buyer-owned input: POST https://vm5-openapi-x402.onrender.com/v1/csv-preflight
Input Content-Type: application/json
JSON body: {"csvText":"email,amount,date\na@example.com,12.5,2026-10-19","expectedColumns":["email","amount","date"]}
Limit: <=32768 UTF-8 bytes, <=40 expected columns. Only authorized NONSECRET data.
Price: exactly 5000 atomic units of native Circle USDC, eip155:8453 Base, asset 0x833589fCD6eDb6E08f4C7C32D4f71b54bdA02913.
Merchant public payTo: 0x6b01efA0705E91a7aca54271510bf9e594717f34.
Unsigned valid POST: expect HTTP402 plus base64 `PAYMENT-REQUIRED` x402Version2 manifest; not a charge.
Paid POST: needs independently buyer-authorized `PAYMENT-SIGNATURE` exact EIP3009 transfer with authorization, expected HTTP200 JSON when settled. No automatic signing by an AI agent or wallet seed/private key. Avoid self-transactions or fabricating receipts.
Original owner historical paid automated external buyer transactions exist for DIFFERENT original GET products, but **new buyer-owned paid CSV POST orders had not been proven at the time of release**. This public page and mock tests do not count as purchases.
Free external agent tool: https://livastic-vm1-primary.github.io/paperpilot-tools/csv-quality-api.html#agent-skill

For real legal/licensing/security/compliance decisions consult a human. No customer data, secret keys, passwords, proprietary workbooks or financial statements in test requests. Wallet payment must be initiated by an actual independent buyer.


## Additional real, separately priced x402 developer service
Human page: https://livastic-vm5-primary-20260911.github.io/base-usdc-csv-checkout/workflow-risk.html
Free static heuristic YAML checks run only in buyer's browser; no wallet or transfer.
Paid existing API: POST https://vm5-openapi-x402.onrender.com/v1/workflow-risk
Public sample: GET https://vm5-openapi-x402.onrender.com/v1/workflow-risk-sample
Content-type: application/json; {"workflowYaml":"name: CI\non: push\njobs: ...","filename":"ci.yml","includeSarif":true}
Price: 200000 atomic native Circle Base8453 USDC = 0.20 USDC; original VM5 recipient/token, no ERC20 allowance/deposit.
Real unsigned valid POST emits HTTP402 x402 v2; buyer independently signs single EIP-3009 authorization.
Analyzer derived from original same-owner VM2 MIT GitHub Actions risk analyzer; useful static nonsecret text checks of action pins, permissions, unsafe PR events, runner exposure. It neither runs workflows nor certifies security.
This UI only passed fake-wallet browser tests at release, no genuine independent 0.20 USDC buyer sale confirmed. No private GitHub code or personal/secrets.

## Independent original educational guide, FREE (no payment or account)
https://livastic-vm5-primary-20260911.github.io/base-usdc-csv-checkout/guides/github-actions-security-checklist.html
Five actionable questions about GitHub Actions YAML security: least-privilege workflow token, pinned immutable action versions, elevated pull_request_target risk, untrusted event text interpolation, and self-hosted runners. Links official GitHub docs. Not a formal audit.


## Real original 0.01 USDC x402 public unsigned quote inspection, new human storefront
FREE / NO WALLET: https://livastic-vm5-primary-20260911.github.io/base-usdc-csv-checkout/x402-quote-checker.html
Accepts ONLY a public unsigned PAYMENT-REQUIRED JSON or Base64 x402-v2 header, max3800 characters. Parses locally with no network request or private key, checks fixed Base8453 network, exact scheme, canonical native Circle USDC, basic 20-byte payTo, resource HTTPS syntax, integer atomic value. Structural consistency is NOT proof of merchant authenticity, safe investment, valid payment or successful delivery.
Optional existing independently hosted original VM5 0.01 USDC native Circle Base x402 v2 GET: https://vm5-openapi-x402.onrender.com/v1/x402-preflight?quote=<urlencoded-public-unsigned-x402-v2-json>
Free deliberately fictional GET response https://vm5-openapi-x402.onrender.com/v1/x402-sample
PayTo original VM5 public receive-only wallet 0x6b01efA0705E91a7aca54271510bf9e594717f34, USDC contract 0x833589fCD6eDb6E08f4C7C32D4f71b54bdA02913, 10000 atomic = 0.01 USDC, exact Base eip155:8453. The report has no externally verified new buyer E2E mainnet settlement. Human user must separately consent to upload public quote, inspect 402 payment terms, use own authorized browser wallet, and sign one short-lived amount-specific EIP-3009 authorization; NO automated retries if outcome unknown.