M5x402
An Open Native Secure Standard
for M5 Economics

The x402 whitepaper (Coinbase Developer Platform, May 2025) solved a real problem: legacy payment rails were designed for humans, not machines. API keys, subscriptions, manual billing — none of it works for autonomous agents that need to transact at machine speed. x402 implemented the long-reserved HTTP 402 status code, enabling any server to charge any caller in stablecoin with 200ms settlement and near-zero fees. That is a genuine contribution.

It also created a new attack surface. Simultaneously, three protocols are assembling a machine-native payment economy with no constitutional layer: x402 (HTTP 402, pay-per-call), MCP (Model Context Protocol — agents accessing tools and data), and AP2 + TAP (Google and Visa's agent identity and payment standards via Stripe and Coinbase). These protocols enable autonomous agents to initiate, authorize, and execute financial transactions faster than any human compliance review can operate — with no identity verification, no authorization chain, no asset classification, and no jurisdictional anchor.

This is not hypothetical. The Conduent breach of September 2025 exposed 25 million government and healthcare records through a single unguarded pipe. Not through the agency. Through the connection. 80% of 2025 ransomware attacks now leverage AI tools. The attack surface is widening every quarter and the controls have not changed.

M5Canon determines asset classification from the asset definition — you do not choose it. Attempting to misclassify an asset to access lower-friction rails is detectable at Layer 0 and constitutes a compliance failure logged to the tamper-evident event chain. The rails listed below are representative examples of the verified settlement infrastructure available to each class — not an exhaustive market listing. Rail access requires a verified M5Bank account. The M5Wallet is the credential gate to all markets.

1.1 TCUSD — Platform Credits, Not a Retail Stablecoin

TCUSD is the credit unit that members hold in their M5Bank account to operate on the platform. It is M1 class. It is not a retail stablecoin, not listed on exchanges, and not a consumer payment instrument. It is the unit of account the M5Canon engine uses to record activity on the internal ledger — the way a bank's general ledger uses a base currency before external settlement occurs.

When an entity pays for registration, credentials, API access, or any platform service, the payment is made in an approved sovereign stablecoin or the entity's own private stablecoin — then recorded as TCUSD credits on the internal ledger. The TCUSD balance is what M5Canon reads when processing any platform action.

Every TCUSD credit carries a USC (Universal Sovereign Code) — the jurisdictional identifier that anchors the credit to the sovereign chain of the issuing entity. USC is not a token. It is a classification and routing code embedded in every TCID and transaction record:

1.2 Private Stablecoins and Sovereign Approved Stablecoins

Every M5Bank member can issue their own private M1 stablecoin on any chain, denominated in their jurisdiction's approved currency, representing the value of their products or services. Entities that prefer not to issue their own stablecoin default to the approved sovereign stablecoin list for their chain — Wyoming's approved list, California's, the Navajo Nation's — determined by the sovereign chain under the GENIUS Act (Guiding and Establishing National Innovation for U.S. Stablecoins Act, S. 1582, 119th Congress, signed into law July 18, 2025 by President Trump — Senate vote 68–30, House vote 308–122) and UCC Article 12 CER (enacted in 33 jurisdictions as of December 2025; New York effective June 3, 2026). The GENIUS Act establishes the first federal regulatory framework for payment stablecoins — restricting issuance to approved permitted stablecoin issuers, requiring 1:1 reserves backed by U.S. dollars or low-risk assets, and subjecting issuers to Bank Secrecy Act obligations. The USC code embedded in every M5 transaction record is the jurisdictional anchor that determines which state's approved stablecoin list applies. External stablecoins are the settlement medium. TCUSD is the internal ledger representation.

1.3 TC-MGT — Treasury Reserve Only

TC-MGT (Minera Gold-Backed Token) is the M5Bank treasury reserve instrument. It is M2 class, not M1. TC-MGT is backed by verified in-situ gold assets held by credentialed M5Bank member entities in the mining sector — spanning junior explorers and development-stage operations such as Portuguese Creek Mine through to major producers and institutionally recognized counterparties such as Newmont, Agnico Eagle, and Barrick Gold, with settlement and assay standards governed by the London Bullion Market Association (LBMA). The LBMA Good Delivery standard is the benchmark: every gold asset backing TC-MGT must be traceable through a credentialed M5Bank BOB or BOI account in the MINERA sovereign index, sensor-oracle verified, and auditable to chain of custody on TitleChain.

TC-MGT is never used for platform services, API fees, credential purchases, or any operational transaction. The M5Canon engine enforces this as a hardcoded dual-token policy — any attempt to route TC-MGT through platform service rails is blocked at classification and logged to the tamper-evident event chain. TC-MGT is a treasury reserve instrument. TCUSD is the platform credit unit. They are architecturally distinct and M5Canon enforces that distinction at Layer 0 with no override.

1.4 BPS Fee Schedule — BP1 Through BP15

Customer scope BP1–BP8: 114 BPS | Full scope BP1–BP12: 122 BPS | Complete scope BP1–BP15: 128 BPS

Every entity on the M5 platform has an account type that determines what asset classes they can handle, what actions they can initiate, and what their public registry ENS identity looks like. Account type is determined by the entity's legal form and registration — confirmed by their sovereign chain's Secretary of State or equivalent governing body.

2.1 The Five Account Types

2.2 The ENS Naming Convention — Account Type Encoded in Public Address

Account type is encoded directly in the public registry ENS address, making every entity's legal form and jurisdiction publicly verifiable on M5Scan.io without any off-chain lookup.

2.3 ENSv2 Native Registry — m5wallet.eth + m5standard.eth

M5 launches on ENSv2 as a native hierarchical registration system. ENSv2 is explicitly designed for hierarchical registries where each name defines its own registry and resolver behavior — exactly the architecture M5 requires for policy-controlled identity issuance across jurisdictions. The M5 registry roots are:

2.4 Federal, State, and Tribal Jurisdiction Rules

Federal agencies sit under unitedstatesgovernment.eth — not under any state chain. DoD, DoE, HHS, FDA, USAF are all [dept].bog.unitedstatesgovernment.eth.

State agencies sit under their state chain: [dept].bog.[statechain].unitedstateschain.eth. The Wyoming Board of Medicine is wybom.bog.wyomingchain.unitedstateschain.eth.

Tribal sovereign chains are themselves BOG — sovereign governments. Tribal government body entities under them are [entity].bog.[tribename]chain.eth. The tribal enterprises (business arms) are [entity].bob.[tribename]chain.eth.

Michigan exception: Michigan is registered as michiganstatechain.eth (not michiganchain.eth) to avoid namespace conflict. All agencies and entities in Michigan follow the pattern: agency.michiganstatechain.unitedstateschain.eth. This is the only state exception in the 50-state + 6-territory registry.

Public registry addresses are fixed and assigned by the sovereign chain based on the entity's legal registration. Entities can create additional custom ENS addresses for commerce, branding, or products — but the public registry identity is canonical, state-determined, and verifiable at M5Scan.io.

Every entity arrives at Internet 3.0 by one of two paths:

Every entity that has built brand equity on a legacy domain (.com, .gov, .org, .edu, .net) migrates that identity to its sovereign ENS equivalent. This is not abandonment — it is migration forward. Brand equity, SEO, customer relationships, all carry through. Domain ownership verification is Step 1 of developer onboarding — it establishes jurisdiction before any account type, credential, or API access is granted.

3.1 Domain Type Migration Reference

4.1 The Three-Layer Asset Journey

4.2 Nine-Step Issuance Pipeline — PCM Reference Implementation

TitleChain records every step of this pipeline immutably. ICSN Global is the DAO governance layer — human-led working groups, adjudication pools (NYCP© federal pool, unitednationschain.eth international pool), and standards ratification. TitleChain records facts. ICSN Global governs standards. Developers interact with TitleChain through the m5-ledger-server MCP and the TitleChain COO API.

Every M5x402 transaction passes three constitutional gates before execution. These are not middleware suggestions — they are enforced by the M5Canon engine at Layer 0. A transaction that fails any gate is blocked, logged to the tamper-evident event chain, and a M5Watcher alert is issued. There is no retry without remediation.

5.1 ZK_REQUIRED Events — Seven That Cannot Be Skipped

If proof generation fails for any ZK_REQUIRED event, a RuntimeError is raised — the transaction is blocked, not skipped. This is enforced in the M5Canon engine and the five Keelung Haskell circuits (871 lines, 310 passing tests, Groth16/BN128).

5.2 Endpoint Configuration — Node.js, Python, Rust

// npm install @m5bank/x402-middleware @m5bank/sdk
import { m5PaymentRequired } from '@m5bank/x402-middleware';
import { M5Client, AssetClass } from '@m5bank/sdk';

const m5 = new M5Client({
  tcid:     process.env.M5_TCID,
  chain:    'californiachain.unitedstateschain.eth',
  sfiLevel: 2,              // L2 = M1+M2 access
});

app.get('/api/energy-data',
  m5PaymentRequired({
    amount:     '0.05',         // TCUSD credits
    assetClass: AssetClass.M2,  // REC data endpoint
    usc:        'USC-US-CA-0001',// California jurisdiction
    mandate:    { maxPerDay: 500, permittedRails: ['base_l2', 'ondo'] },
    zkRequired: false,           // M2 data query — ZK optional
  }),
  (req, res) => {
    // Only executes after all 3 gates pass
    // req.m5.tcid, req.m5.usc, req.m5.assetClass all available
    res.json({ recs: getRECData(req.m5.tcid) });
  }
);

// Error responses:
// 403 TCID_MISSING     — no credential on request
// 403 SFI_INSUFFICIENT — credential level too low
// 403 CBDC_FIREWALL    — M5-class asset blocked
// 403 MANDATE_EXCEEDED — surfaced to human, not failed silently
// 402 PAYMENT_REQUIRED — identity valid, payment needed
// 503 ZK_PROOF_FAILED  — ZK_REQUIRED event blocked

# pip install m5bank-sdk
from m5bank import M5Client, AssetClass, m5_payment_required
from fastapi import FastAPI, Depends
import os

app = FastAPI()

m5 = M5Client(
    tcid  = os.environ["M5_TCID"],
    chain = "californiachain.unitedstateschain.eth",
    sfi   = 2,
)

# Dependency: enforces all 3 gates before route body executes
gate = m5_payment_required(
    amount  = "0.05",            # TCUSD credits
    asset   = AssetClass.M2,
    usc     = "USC-US-CA-0001",
    mandate = {
        "max_per_day":      500,
        "permitted_rails":  ["base_l2", "ondo"],
        "human_threshold": 1000,  # surface to human above this
    },
)

@app.get("/api/energy-data")
async def energy_data(session = Depends(gate)):
    # session.tcid, session.usc, session.asset_class verified
    # ZK_REQUIRED events raise RuntimeError — blocked, not skipped
    return {"recs": get_rec_data(session.tcid)}

# M5Canon classification endpoint — classify before deploying:
# POST /api/m5-canon-validate
# {"asset_definition": {...}} → {"class": "M2", "rails": [...], "bps": 114}

// Cargo.toml: m5bank-sdk = "1.0"
use m5bank::{M5Client, AssetClass, M5Mandate, PaymentConfig, payment_gate};
use axum::{Router, middleware, routing};

let _m5 = M5Client::new()
    .tcid(std::env::var("M5_TCID")?)
    .chain("californiachain.unitedstateschain.eth")
    .sfi_level(2)
    .build()?;

let gate = payment_gate(PaymentConfig {
    amount:      "0.05".parse()?,
    asset_class: AssetClass::M2,
    usc:         "USC-US-CA-0001",
    mandate:     M5Mandate {
        max_per_day:      500,
        permitted_rails:  vec!["base_l2", "ondo"],
        human_threshold:  1000,  // surfaces above this — never fails silently
        ..Default::default()
    },
});

let app = Router::new()
    .route("/api/energy-data", routing::get(energy_handler))
    .layer(middleware::from_fn(gate));

// ZK failures    → Err(M5Error::ZkProofFailed)      — blocked, not skipped
// Mandate breach → Err(M5Error::MandateExceeded)     — surfaced to human
// CBDC firewall  → Err(M5Error::AssetClassForbidden) — logged + alerted
// All errors     → structured JSON with error code + remediation hint

5.3 M5Watcher — Continuous Compliance Monitoring

M5Watcher monitors every active endpoint in real time, reading every M5Canon event across all three network layers. It surfaces compliance anomalies to human principals before any enforcement action is taken. For developers: if your endpoint generates an event pattern that triggers a M5Watcher alert, you receive a structured notification through the m5-audit-server MCP with the specific event, the compliance rule triggered, and the recommended remediation — before any enforcement action is taken. You are never blocked without notice.

6.1 Interoperable Settlement Rails — M5Wallet as the Access Gate

6.2 Representing Non-Cash Value Through M5x402

6.3 Protocol Integration Stack

Identity, energy, finance, and health are the four sectors of critical infrastructure that underpin every other sector — and the four areas where ungoverned autonomous agents cause the most irreversible harm. Every SOPHIA developer credential maps to one or more pillars. These are not arbitrary categories. They are the four sectors where sovereign-credentialed edge infrastructure is most urgently needed, and where the M5 wallet creates the most immediate and measurable value for the humans it serves.

8.1 Developer Onboarding Flow

8.2 Three Developer Certification Tiers

8.3 LinkedIn Credential Publishing

Every SOPHIA developer credential publishes to the holder's LinkedIn profile automatically at issuance — not manually, not upon request. The credential is a W3C Verifiable Credential carrying: certification level, pillar(s) covered, issuing sovereign chain, TCID of the issuing authority, and a direct verification link on M5Scan.io. Any employer, counterparty, or institution can verify in seconds without contacting the issuer. The credential is owned by the developer, stored in their M5POD, portable across all platforms and jurisdictions, and valid until the ICSN working group ratifies a standard revision — at which point renewal is a single re-examination, not a full recertification.

Apply at m5bank.app/developer

9.1 Error Reference

// M5x402 structured error responses — handle each explicitly

402 + "TCID_MISSING"       // No credential on request — return 402 with payment details
403 + "TCID_INVALID"       // TCID fails sovereign chain verification
403 + "SFI_INSUFFICIENT"   // Credential level too low for this asset class
403 + "CBDC_FIREWALL"      // M5-class asset — blocked, logged, M5Watcher alerted
403 + "MANDATE_EXCEEDED"   // Agent hit mandate boundary — surfaced to human, awaiting approval
403 + "ASSET_MISMATCH"     // Asset class inconsistent with credential or settlement rail
503 + "ZK_PROOF_FAILED"    // ZK_REQUIRED event — RuntimeError, blocked NOT skipped
503 + "SOS_PENDING"        // OpenCorporates SOS 24-hour gate not yet cleared
503 + "WATCHER_ALERT"      // M5Watcher compliance anomaly — human review required
503 + "SWIFT_BRIDGE_UNMAP" // BOI account missing SwiftBRIDGE mapping — required for M4

// All errors include: error_code, message, remediation_hint, m5scan_url

Three protocols — x402, MCP, and AP2/TAP — assembled a machine-native payment economy in 2025. They did it fast, elegantly, and without a constitutional layer. They gave autonomous agents the ability to initiate, authorize, and execute financial transactions at machine speed, across any endpoint, with no identity verification, no asset classification, no jurisdictional anchor, and no audit trail back to an accountable human. This was not malicious. It was incomplete. The payment pipe was built. The constitutional layer was not.

The consequence is already visible. $57 billion in projected annual ransomware damage. 80% of attacks now leverage AI tools. The Conduent breach. 25 million government and healthcare records exposed through a single unguarded connection. The attack surface is not theoretical — it is live, it is widening, and the controls designed for the previous era of human-initiated transactions do not apply to machine-speed agent commerce.

The M5x402 standard is the constitutional answer to the open attack surface. It is also the economic answer to the infrastructure gap. And it is the human answer to a financial system that has spent decades using mathematical sophistication not to distribute opportunity but to concentrate it — not to secure identity but to monetize it — not to reward contribution but to extract it.

The Nash Equilibrium design of the USC standard means the incentive always points toward sovereign participation rather than extraction. The Cyrus Protocol gate means the infrastructure is built on human rights commitments, not geopolitical alignment. The M5Score means the sovereign human's reputation is built from what they actually do — not what a third party inferred from data they never consented to share. The M5Canon engine — licensed under the TitleChain Foundation Wyoming 1,000-Year Sovereign Purpose Trust — means the enforcement rules in any deployed version are constitutionally fixed. No licensee, no sovereign, and no working group can modify the engine unilaterally. New standards ratified by ICSN Global through member consensus are implemented in versioned engine releases, each licensed under the same sovereign purpose trust terms — making the path to change deliberate, governed, and transparent rather than unilateral or covert. What the engine enforces today it enforces permanently until a new version is deliberately and publicly released through the same constitutional process.

Use this flowchart to determine the correct M5Bank account type for any entity. When in doubt, verify on M5Scan.io using the entity's SOS registration number or SWIFT BIC.

Account Type Permissions Matrix