Research: Crossmint public contract under ambiguous commit

[safal207]

What this adds

• Public Contract Study 001 for Crossmint agent-payment recovery under ambiguous create/timeout.
• A source manifest separating public documentation, bounded vendor clarification, and derived integration composition.
• A recovery-path model for authorized payment → ambiguous outcome → reconcile → retry/stop.
• Explicit separation between provider guarantees and integrator inference.

Updated finding — 2026-08-15

Crossmint support confirmed the core reading of the public surface:

• same-key replay can discover an already-created transaction after timeout;
• transaction lookup is the system-of-record state surface;
• webhooks are at-least-once notifications rather than the canonical record;
• onChain.txId is useful after broadcast for confirmation/settlement and weak for pre-broadcast discovery;
• Crossmint does not publish a complete normative precedence rule for the timeout case.

Therefore the result is now split:

NORMATIVE TIMEOUT PRECEDENCE     = NOT PUBLISHED / UNRESOLVED
OPERATIONAL RECOVERY COMPOSITION = SUPPORTED INFERENCE

The inferred composition is:

preserve logical operation identity
→ same-key replay for discovery
→ canonical lookup until terminal
→ webhook as reconciliation trigger
→ settlement evidence when available
→ separate continuation authority before another operation

The final sequence is deliberately not relabeled as a Crossmint guarantee.

ContractGraph-QA implementation

The clarified semantics are now implemented separately in ContractGraph-QA draft PR #62 as Ambiguous Financial State Protocol (AFSP) v0.1. Crossmint is the first external provider profile for the reusable continuation gate.

Boundary

No production/staging testing, no vulnerability claim, no internal-architecture inference, no private failure data, and no affiliation or endorsement implied.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 7a84f587-131a-460a-8a8f-cf7b28861ba0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}