initial pilot implementation: 6 Anchor programs

[A1igator]

Summary

Adds the full pilot implementation in one commit. Architectural symmetry with base/commerce-payments (so each piece has a one-to-one EVM counterpart) plus x402r-specific extensions on top:

Program	Role
auth-capture-escrow	Pure escrow primitive (AuthCaptureEscrow analog). 6 lifecycle ixs (authorize/charge/capture/void/refund/reclaim) + 1 admin (initialize_protocol_fee_config). CPIs into ITokenCollector for fund movement.
spl-token-collector	The pilot's only ITokenCollector impl. SPL Token transfers for collect_authorize + collect_refund. Future Token-2022 / cross-chain / streaming collectors slot in via the same interface.
payment-operator	x402r factory + slot dispatch. Allocates per-merchant OperatorState PDAs at [b"operator", authority] (PDA address IS the operator pubkey). Wraps escrow ixs with pre-action conditions + post-action hooks via invoke_signed.
static-address-condition	Generic ICondition reference impl.
receiver-condition	Stateless ICondition: outer signer == payment_info.receiver.
payer-condition	Stateless ICondition: outer signer == payment_info.payer.

reclaim lives only on the escrow and is called by the payer directly — bypasses the operator program because the deadline-based escape hatch must not be defeasible.

Licensing

• Every Rust source file carries SPDX-License-Identifier: BUSL-1.1 and // CONTRACTS UNAUDITED: USE AT YOUR OWN RISK (matches x402r-contracts).
• Every Cargo.toml declares license = "BUSL-1.1".
• Same BUSL parameters as x402r-contracts: Change Date 2029-12-09, Change License MIT, Hackathon Promotional Rights grant retained.

Layout

programs/auth-capture-escrow      Escrow primitive
programs/spl-token-collector      ITokenCollector for SPL
programs/payment-operator         Factory + slot dispatch
programs/{static-address,receiver,payer}-condition  ICondition impls
tests/                            Vitest + Codama Kit client (TODO bodies)
fuzz/                             Trident fuzz harnesses
migrations/                       Deploy + program-ID pinning
codama/                           Codama generator

Status

Pilot, unaudited. Mainnet usage is at users' own risk.

Things that need to follow before this builds end-to-end:

• anchor build to produce IDLs (toolchain not installed locally)
• pnpm codama:generate to swap stubs in the @x402r/svm SDK (companion: @x402r/svm: implement authCapture for SVM (pilot) x402r-scheme#46)
• Replace placeholder Anchor instruction discriminators with values from target/idl/*.json
• Fill out the Vitest test bodies (currently expect.fail("TODO") scaffolding covering all flows + error paths)
• Devnet + mainnet-beta deploy via migrations/deploy.ts + migrations/pin-program-ids.ts

Companion PRs (in x402r-scheme)

• Spec: spec: authCapture for SVM (pilot) x402r-scheme#45
• SDK: @x402r/svm: implement authCapture for SVM (pilot) x402r-scheme#46

🤖 Generated with Claude Code

[A1igator]

Superseded by the two-PR split for easier review: #2 (base commerce-payments port) and #3 (x402r extensions, stacked on #2). Closing this PR.