Add x402 product API

[atimics]

What changed

This adds a narrow product-facing leCore surface and a hardened x402 API publisher:

• LocalAgentCore remains the embedded/in-process SDK; the hosted product is consistently presented as the leCore Agent Memory & Routing API.
• The landing page now leads with an above-the-fold first request, a four-step x402 quickstart, exact per-call pricing, preview boundaries, and direct links to Swagger UI, ReDoc, pricing, health, and the raw OpenAPI schema.
• OpenAPI documents the canonical server, stable operation IDs, typed success bodies and examples, real validation/tenant/facilitator failures, and the complete x402 v2 header flow: Payment-Required, Payment-Signature, and Payment-Response.
• Public OpenAPI contains only the five customer-facing operations. Authenticated /admin/* routes remain mounted but are not advertised.
• Private tenant authorization, isolated durable state, replay-safe writes, transaction recovery, and the optional pinned NoSQLite semantic-memory backend are preserved.
• Canonical x402 resource URLs no longer trust request Host or forwarded-protocol headers.
• Responses now carry path-appropriate cache and browser security policies. The SDK browser wallet page has a narrow Base Sepolia/coinbase connectivity policy instead of a blanket exception.
• Landing accessibility now includes visible high-contrast focus, reduced-motion behavior, a reliable skip target, and 44 px navigation/footer targets.
• Reference generation now tie-breaks duplicate basenames by full path, preventing cross-filesystem docs-bot reorder churn.

The developer preview remains on Base Sepolia at $0.0011 per request. The superseded leOS discounted routes and offer metadata are intentionally removed.

Validation

• x402 API suite with the compiled NoSQLite binary: 46 passed.
• Generated-reference determinism suite: 7 passed.
• Generated-doc checks, import/wiring/catalog/skill/tag/structure/service-doc gates, compile checks, and git diff --check passed.
• The unrestricted repository run completed with 5,922 passed and 421 skipped. Its 14 failures are unrelated numerical, timing, and C-emitter checks; no x402 test failed.
• Desktop rendering at 1280x720 keeps the primary action above the fold with no horizontal overflow. Swagger renders all five public operations with no browser-console errors; mobile breakpoint, focus, reduced-motion, and touch-target regressions are pinned in tests.
• The production image scan exactly matches the previous image baseline: 4 critical, 8 high, 5 medium, with no newly introduced finding.

Deployment

Production is steady on ECS task definition lecore-x402-api:15, pinned to image digest sha256:e5de7f1a46ece274bafb4b4dfc7a4a57653251d13f36da06341dc5bd5d8b041a.

Live verification passed for the revised landing page, Swagger, ReDoc, typed OpenAPI, health, pricing, the canonical JSON /v1/dashboard challenge, and the SDK browser wallet page. ECS reports one running task, no pending tasks, one healthy ALB target, the exact pinned digest, and zero ERROR, Traceback, or Exception log matches during the rollout. Revision 14 and its prior digest remain available for rollback.

The deployed application commit is bfe83d9; the later branch commits change generated reference documentation and its deterministic ordering only.

[atimics]

Deployed commit 9858386 to AWS ECS task definition lecore-x402-api:8. Live verification on https://lecore.rati.foundation: /health 200 with private tenants enabled; /pricing lists regular $0.0011 and leOS $0.0010 routes; /v1/dashboard returns x402 402 amount 1100; /leos/v1/dashboard returns x402 402 amount 1000; admin tenant-token and admin tenant memory smoke tests returned 200 using AWS Secrets Manager-backed secrets.

[atimics]

Follow-up deploy: wired durable tenant state to EFS. ECS is now on lecore-x402-api:9 with EFS fs-0692f704e0d5a6eef mounted at /data/tenants through access point fsap-0ba4691cb609a92a3, and LECORE_X402_TENANT_STATE_DIR=/data/tenants. Verified persistence by writing tenant efs-smoke-20260712-1118 before forced task replacement (memory id m1), forcing ECS replacement, then writing the same tenant again and receiving memory id m2. /health and /pricing remain healthy; rollout completed.