Roadmap
What ships in v0.1, and what is out of scope.
Tollstile is in early access. The core payment lifecycle is implemented, but some rails and runtime integrations still need production verification. The v0.1 release includes the implemented areas below.
v0.1
| Area | Contents | Status |
|---|---|---|
| Core | Quotes, authorizations, charges on two axes, authorization and upfront flows, variable prices, dynamic prices, request commitment, execution plans and rail exclusion, payer-scoped idempotency and result references, structured denial codes/actions, redaction, reconciliation, events | Implemented |
| Conformance | railConformance(), RailHarness, ConformanceCase from tollstile/testing; shared ledger tests | Implemented; fake-provider coverage, with unsupported harness cases reported as skipped |
| Policies and requirements | subscriber, credits with reservations, payPerCall, limit, payers, when | Implemented |
| Test rail and memory ledger | Failure simulation, tollstile/testing contexts and fake clock | Implemented |
| Adapters | Hono, MCP, Express, create-tollstile | Implemented; tested with the real frameworks. MCP tools can ask a person to approve a charge — rendered as an Accept / Decline dialog by Claude Code 2.1.186, measured — and send them somewhere to pay, which OpenAI's codex client opens |
| Adapters | Next.js, fetch (Workers, Deno, Bun) | Implemented; fetch runs the live demo on Cloudflare Workers. Not yet run inside Next.js, or on Deno or Bun |
| Rails | x402 (exact, upto), MPP (Stripe charge, Tempo charge), L402, KYAPay | Implemented and tested against fakes, published vectors, and reference libraries. x402 exact also verified on Base Sepolia with a real USDC transfer, and MPP Stripe in Stripe test mode, each including retries, refunds, and reconciliation |
| Rails | MPP Tempo session | Experimental |
| Requirements | verifiedAgent() (Web Bot Auth) | Implemented; tested against RFC vectors, not verified against a live agent |
| Requirements | userMandate() (AP2) | Experimental |
| CLI | npx tollstile reconcile: resolve charges a crash left behind, from a config file or a cron | Implemented |
| Ledgers | Postgres, SQLite (including D1) | Implemented; tested on PGlite and node:sqlite, on a real PostgreSQL 16 server in CI under 100-way concurrency and crash recovery, and on D1 in the live demo |
Still to verify
- The remaining rails against their live providers: Tempo Moderato for MPP, LND on regtest for L402, the Skyfire sandbox for KYAPay.
- x402's
uptoscheme, and any facilitator other than x402.org on a testnet. - Run the Next.js and fetch adapters inside Next.js and on Workers, Deno, and Bun, and the D1 and Neon ledger adapters against those services.
After v0.1
escrowflow (settle a deposit, then the final amount)- OpenTelemetry package built on
onEvent
Experiments
Things being tried in the open. Not API, not a standard, and not covered by any compatibility promise — they live in examples until something outside this project uses them.
A published price list
An agent that must contract with a provider before it can call anything is not buying software at the moment it needs it. Paying needs a rail; knowing the price needs nothing at all, and there was no machine-readable way to ask.
The demo serves one at /.well-known/tollstile:
{
"call": "POST /v1/summarize",
"price": "up to $0.50, then $0.001 per word",
"plan": {
"pricing": "up_to",
"commitment": "request",
"access": ["credits", "payPerCall"],
"rails": [{ "rail": "test", "flow": "authorization", "settles": "after_handler", "onHandlerFailure": "release" }]
}
}plan is not a description someone maintains beside the code: it is the route's ExecutionPlan, the same object the gate enforces, so a published price cannot drift from the charged one. The example agent reads it before spending anything.
What would move this out of Experiments: something other than this demo reading one. If that happens, most of it is already in core — ExecutionPlan carries all of plan — and the rest is a route that serves it.
Out of scope
| Not planned | Why |
|---|---|
| Commerce checkout protocols (ACP, UCP) | Catalogs, carts, and orders are a different problem from per-call payment |
| Handling raw card data | Cards go through a provider |
| Custody, swaps, or a token | Tollstile never takes custody of funds |
| Issuing agent identities | Tollstile verifies evidence; it does not issue it |