diff --git a/.agents/skills/omniclaw-cli/scripts/generate_cli_reference.sh b/.agents/skills/omniclaw-cli/scripts/generate_cli_reference.sh
deleted file mode 100755
index 644523e..0000000
--- a/.agents/skills/omniclaw-cli/scripts/generate_cli_reference.sh
+++ /dev/null
@@ -1,6 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../../.." && pwd)"
-cd "$ROOT_DIR"
-python3 .agents/skills/omniclaw-cli/scripts/generate_cli_reference.py
diff --git a/.dockerignore b/.dockerignore
index 5918ab1..b2b8939 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -7,7 +7,8 @@ logs
 tmp
 .runtime
 output/doc
-docs/internal
+internal
+.agents
 dist
 build
 *.egg-info
diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..7bc8c67
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,130 @@
+# OmniClaw environment template
+#
+# Copy to `.env` for local development. Never commit real secrets.
+# Pick the sections that match your deployment role.
+
+# =============================================================================
+# Shared Network Configuration
+# =============================================================================
+
+# Supported examples: ETH-SEPOLIA, BASE-SEPOLIA, ARC-TESTNET
+OMNICLAW_NETWORK=BASE-SEPOLIA
+OMNICLAW_RPC_URL=https://sepolia.base.org
+
+# development, test, or production
+OMNICLAW_ENV=development
+
+# Log level: DEBUG, INFO, WARNING, ERROR, CRITICAL
+OMNICLAW_LOG_LEVEL=INFO
+
+# =============================================================================
+# Buyer / Seller Signing Key
+# =============================================================================
+
+# Private key used by the SDK or Financial Policy Engine for allowed actions.
+# In production, use restricted infrastructure and secret management.
+OMNICLAW_PRIVATE_KEY=0x...
+
+# =============================================================================
+# Financial Policy Engine
+# =============================================================================
+
+# Use this when an agent, worker, or partner integration should not hold raw key
+# authority. The policy engine exposes the controlled payment API.
+OMNICLAW_AGENT_TOKEN=replace-with-agent-token
+OMNICLAW_AGENT_POLICY_PATH=./policy.json
+OMNICLAW_OWNER_TOKEN=replace-with-owner-token
+
+# Policy hot reload interval in seconds. Use a larger value or disable reload in
+# production if policies are deployed immutably.
+OMNICLAW_POLICY_RELOAD_INTERVAL=5
+
+# Optional persistence backend.
+# Values: memory, redis
+OMNICLAW_STORAGE_BACKEND=memory
+OMNICLAW_REDIS_URL=redis://localhost:6379/0
+
+# =============================================================================
+# Agent CLI Runtime
+# =============================================================================
+
+# Used by `omniclaw-cli` when acting as an agent execution layer.
+OMNICLAW_SERVER_URL=http://127.0.0.1:8080
+OMNICLAW_TOKEN=replace-with-agent-token
+
+# Optional human-readable CLI output. Default output is agent-friendly JSON.
+OMNICLAW_CLI_HUMAN=0
+
+# =============================================================================
+# Circle Gateway / Nanopayments
+# =============================================================================
+
+# Required for Circle Gateway nanopayments, Gateway balance, and Circle-backed
+# wallet operations.
+CIRCLE_API_KEY=replace-with-circle-api-key
+
+# Entity secret for Circle wallet encryption.
+# If your Circle account/API key already has an Entity Secret, set it here.
+# Circle only allows one active Entity Secret per account/API key, so OmniClaw
+# only auto-generates/registers a new one when no existing secret is provided or
+# found in the managed local credential store.
+ENTITY_SECRET=
+
+OMNICLAW_NANOPAYMENTS_ENABLED=true
+OMNICLAW_NANOPAYMENTS_ENV=testnet
+OMNICLAW_NANOPAYMENTS_AUTO_TOPUP=false
+OMNICLAW_NANOPAYMENTS_TOPUP_THRESHOLD=1.00
+OMNICLAW_NANOPAYMENTS_TOPUP_AMOUNT=10.00
+OMNICLAW_NANOPAYMENTS_MICRO_THRESHOLD=1.00
+
+# Optional Gateway contract override for seller GatewayWalletBatched metadata.
+CIRCLE_GATEWAY_CONTRACT=
+
+# =============================================================================
+# Vendor / Enterprise SDK Seller
+# =============================================================================
+
+# Vendor wallet that receives seller payments.
+SELLER_ADDRESS=0x...
+
+# Default Circle seller path:
+#   payment=client.sell("$0.25", seller_address=os.environ["SELLER_ADDRESS"])
+
+# Thirdweb managed x402 seller path:
+#   payment=client.sell("$0.25", seller_address=os.environ["SELLER_ADDRESS"], facilitator="thirdweb")
+THIRDWEB_SECRET_KEY=
+THIRDWEB_SERVER_WALLET_ADDRESS=
+THIRDWEB_X402_NETWORK=base-sepolia
+
+# OmniClaw self-hosted exact seller path:
+#   payment=client.sell("$0.25", seller_address=os.environ["SELLER_ADDRESS"], facilitator="omniclaw")
+OMNICLAW_X402_SELF_HOSTED_FACILITATOR_URL=http://127.0.0.1:4022
+OMNICLAW_X402_EXACT_NETWORK_PROFILE=ARC-TESTNET
+
+# =============================================================================
+# Self-Hosted Exact Facilitator
+# =============================================================================
+
+# Run with:
+#   omniclaw facilitator exact --network-profile ARC-TESTNET --port 4022
+OMNICLAW_X402_FACILITATOR_PRIVATE_KEY=0x...
+OMNICLAW_X402_FACILITATOR_NETWORK_PROFILE=ARC-TESTNET
+OMNICLAW_X402_FACILITATOR_RPC_URL=https://rpc.testnet.arc.network
+OMNICLAW_X402_FACILITATOR_NETWORKS=eip155:5042002
+OMNICLAW_X402_FACILITATOR_HOST=0.0.0.0
+OMNICLAW_X402_FACILITATOR_PORT=4022
+
+# =============================================================================
+# Production Hardening
+# =============================================================================
+
+# Required for production seller replay protection.
+OMNICLAW_SELLER_NONCE_REDIS_URL=redis://localhost:6379/1
+OMNICLAW_SELLER_REQUIRE_DISTRIBUTED_NONCE=true
+
+# Strict settlement should remain enabled for production payment gates.
+OMNICLAW_STRICT_SETTLEMENT=true
+
+# Webhook verification and deduplication.
+OMNICLAW_WEBHOOK_VERIFICATION_KEY=
+OMNICLAW_WEBHOOK_DEDUP_DB_PATH=/var/lib/omniclaw/webhook_dedup.sqlite3
diff --git a/.gitignore b/.gitignore
index 3831e67..4d434a3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,6 +3,7 @@
 
 .env
 .env.*
+!.env.example
 .env.local
 *.pem
 *.key
@@ -46,8 +47,10 @@ tmp/
 .runtime/
 output/doc/
 
-# Internal docs / GTM materials
-docs/internal/
+# Private operating workspace
+# Keep the root internal workspace out of git.
+internal/
+.agents/
 
 # OS
 Thumbs.db
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0662f76..56d3535 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,17 @@ All notable changes to OmniClaw are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+### Added
+- Added the owner/operator `omniclaw facilitator exact` command for self-hosted x402 exact settlement.
+- Added public facilitator documentation covering Circle Gateway, external facilitators, and OmniClaw self-hosted exact settlement.
+- Added Arc Testnet exact-settlement support documentation using CAIP-2 `eip155:5042002`.
+
+### Changed
+- Moved the owner/operator CLI entrypoint to `omniclaw.admin_cli:main` so it no longer conflicts with the `omniclaw.cli` agent CLI package.
+- Updated release artifact verification for the new admin CLI module and package layout.
+
 ## [0.0.5] - 2026-04-04
 
 ### Fixed
diff --git a/README.md b/README.md
index b350c9b..5346d65 100644
--- a/README.md
+++ b/README.md
@@ -1,327 +1,245 @@
 # OmniClaw
 
-**Economic Execution and Control Layer for Agentic Systems** — Policy-controlled payments with Circle Gateway nanopayments (EIP-3009), x402 protocol support, gasless transactions, and per-agent wallet isolation.
+**Policy-controlled payments for AI agents and machine services.**
 
-📦 [PyPI](https://pypi.org/project/omniclaw/) · 🧪 [Tests: 1220 passed](tests/)
+[![CI](https://github.com/omnuron/omniclaw/actions/workflows/ci.yml/badge.svg)](https://github.com/omnuron/omniclaw/actions/workflows/ci.yml)
+[![PyPI](https://img.shields.io/pypi/v/omniclaw.svg)](https://pypi.org/project/omniclaw/)
+[![Python](https://img.shields.io/pypi/pyversions/omniclaw.svg)](https://pypi.org/project/omniclaw/)
+[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 
----
+OmniClaw lets software agents pay, earn, and access paid APIs without giving the agent unrestricted wallet authority.
 
-## Why OmniClaw?
+The owner runs a **Financial Policy Engine**. Agents and applications execute through constrained interfaces. Every payment is checked against policy before funds move.
 
-In the Agent Era, software can act economically. But current wallets fail when software, not humans, is the operator:
+## Why It Exists
 
-- **Full key access** = extreme risk (agent can drain the wallet)
-- **Human approval** = kills speed and autonomy
-- **No spending limits** = agent can spend unlimited
+AI agents can browse, reason, call APIs, and run workflows. The hard part is money movement.
 
-Where Stripe helps merchants accept human payments, OmniClaw governs autonomous agents making machine payments — with policy, trust verification, and concurrency safety built in.
+OmniClaw solves the control problem:
 
-**OmniClaw solves this** by separating:
-1. **Financial Policy Engine** (owner runs) - holds private keys, enforces policy
-2. **Zero-Trust Execution Layer** (agent uses) - constrained CLI that only does what policy allows
+- agents can pay for services without receiving raw wallet control
+- sellers can monetize APIs through x402-compatible payment gates
+- operators can enforce budgets, recipient rules, confirmations, and route selection
+- payments can settle through Circle Gateway, standard x402 exact settlement, or a self-hosted exact facilitator
 
-The agent **never touches the private key**. It only talks to the CLI. The owner decides what the agent can do via policy.json.
+## Core Surfaces
 
----
+| Surface | Used By | Purpose |
+| --- | --- | --- |
+| Financial Policy Engine | owner / operator | Enforces policy, signs allowed actions, exposes the control API |
+| `omniclaw-cli` | agents / automation | Executes buyer payments through the policy engine without direct key access |
+| Python SDK | developers / vendors | Embeds buyer payments and seller monetization into Python applications |
+| Seller middleware | vendors / enterprises | Turns production HTTP routes into paid x402 endpoints |
+| Exact facilitator | operators | Optional self-hosted x402 exact settlement for supported EVM networks |
 
-## Architecture: Three Components
+## Install
 
-```
-┌─────────────────────────────────────────────────────────────────────┐
-│                         OMNICLAW SYSTEM                            │
-├─────────────────────────────────────────────────────────────────────┤
-│                                                                     │
-│   OWNER SIDE (runs the Financial Policy Engine)   AGENT SIDE (uses CLI)     │
-│   ════════════════════════════════════════════════   ═══════════════════════   │
-│                                                                     │
-│   ┌─────────────────────────────┐                ┌─────────────────────┐   │
-│   │  Financial Policy Engine   │                │     OmniClaw CLI   │   │
-│   │  (uvicorn server)          │◄──────────────►│ (zero-trust exec)  │   │
-│   │                            │   HTTPS        │                    │   │
-│   │  - Holds private key       │                │  - pay             │   │
-│   │  - Enforces policy         │                │  - deposit         │   │
-│   │  - Signs transactions      │                │  - withdraw        │   │
-│   └─────────────────────────────┘                └─────────────────────┘   │
-│            │                                      │                 │
-│            │      Circle Nanopayment             │                 │
-│            └──────────────┬──────────────────────┘                 │
-│                           │                                          │
-│                    ┌──────▼──────┐                                  │
-│                    │   Circle    │                                  │
-│                    │   Gateway   │                                  │
-│                    │   (USDC)    │                                  │
-│                    └─────────────┘                                  │
-│                                                                     │
-└─────────────────────────────────────────────────────────────────────┘
+```bash
+pip install omniclaw
 ```
 
-### Why Two Parts?
+For local development:
 
-| Component | Who Runs It | What It Does |
-|-----------|-------------|--------------|
-| **Financial Policy Engine** | Owner/human | Holds private key, enforces policy, signs transactions |
-| **CLI** (agent uses) | Agent | Zero-trust execution layer - constrained command surface, cannot bypass policy |
+```bash
+uv add omniclaw
+```
 
----
+## Choose The Right Path
 
-## Key Concepts
+| If you are building... | Use... | Why |
+| --- | --- | --- |
+| An agent that needs to buy services | Financial Policy Engine + `omniclaw-cli` | The agent can pay without holding raw wallet authority |
+| A backend service that buys from paid APIs | Python SDK `client.pay(...)` | Programmatic payments inside your own app |
+| A vendor or enterprise API | Python SDK `client.sell(...)` | Production paid endpoints inside your application |
+| A temporary local paid agent service | `omniclaw-cli serve` | Fast agent-owned/local monetization, not the enterprise seller path |
+| Custom or Arc exact settlement infrastructure | `omniclaw facilitator exact` | Self-hosted standard x402 `verify` / `settle` |
 
-### 1. Two Wallets Every Agent Has
+## Credential Model
 
-Every agent has **two wallets**:
+OmniClaw has two different key surfaces:
 
-| Wallet | How It Works |
-|--------|--------------|
-| **EOA** (External Owned Account) | Derived from `OMNICLAW_PRIVATE_KEY`. Holds actual USDC on-chain. Used to sign deposits. |
-| **Circle Developer Wallet** | Created via policy.json. Where withdrawn funds go. The "circle wallet." |
+- `OMNICLAW_PRIVATE_KEY` is the EOA key used for direct x402 exact settlement and Circle Gateway nanopayment signing.
+- `ENTITY_SECRET` is Circle's developer-controlled wallet encryption secret.
 
-### 2. Why Deposit + Pay + Withdraw?
+If your Circle account/API key already has an Entity Secret, set it directly. Circle allows one active Entity Secret per account/API key. OmniClaw only auto-generates and registers a new one when no existing secret is provided or found in its managed local credential store.
 
-```
-Your USDC starts here:         Then moves here:              Ends up here:
-┌──────────┐                  ┌────────────┐              ┌──────────────┐
-│   EOA    │ ─deposit───────► │  Gateway   │ ──pay──────► │    Seller    │
-│ (on-chain)│   (on-chain)    │  Contract  │   (x402)     │    EOA       │
-└──────────┘                  └────────────┘              └──────────────┘
-                                  │                              │
-                                  │ withdraw                     │
-                                  └──────────────► Circle Developer Wallet
+```bash
+export CIRCLE_API_KEY="..."
+export ENTITY_SECRET="your_existing_64_char_hex_entity_secret"
+export OMNICLAW_PRIVATE_KEY="0x..."
 ```
 
-- **Deposit**: Move USDC from your EOA → Gateway (on-chain, costs gas)
-- **Pay**: Use Gateway for gasless payments (x402 protocol)
-- **Withdraw**: Move USDC from Gateway → your Circle wallet
+For a non-interactive local setup:
 
-### 3. Why Gasless Nanopayments?
-
-Circle's Gateway supports **EIP-3009** - off-chain authorization:
-- No gas needed for payments
-- Instant settlement
-- Circle batches and settles on-chain
-- Sub-cent transactions are economically viable
-
-This is what makes agent-to-agent commerce practical — agents can trade at high frequency without bleeding gas on every transaction.
-
-### 4. Seller Side: Accept Payments from Other Agents
+```bash
+omniclaw setup --api-key "$CIRCLE_API_KEY" --entity-secret "$ENTITY_SECRET"
+```
 
-OmniClaw isn't just for buyers. You can protect your own endpoint behind x402 and accept payments from other agents:
+## Buyer: Agent CLI
 
-```python
-from omniclaw.protocols.nanopayments import GatewayMiddleware
+Use this when an autonomous agent or script should pay through the Financial Policy Engine.
 
-# Protect any async endpoint
-middleware = GatewayMiddleware(
-    price="0.01",  # 0.01 USDC per call
-    seller_address="0xYourAddress",
-)
+Start the owner-side policy engine:
 
-app = FastAPI()
-app.add_middleware(GatewayMiddleware, price="0.01")
+```bash
+export OMNICLAW_PRIVATE_KEY="0x..."
+export OMNICLAW_AGENT_TOKEN="agent-token"
+export OMNICLAW_AGENT_POLICY_PATH="./policy.json"
+export OMNICLAW_NETWORK="BASE-SEPOLIA"
+export OMNICLAW_RPC_URL="https://sepolia.base.org"
 
-@app.get("/api/data")
-async def get_data():
-    return {"data": "expensive information"}
+omniclaw server --port 8080
 ```
 
-This opens your service to agent-to-agent commerce — other agents can pay your endpoint using gasless nanopayments.
-
----
-
-## Quick Start
-
-### 1. Install
+Configure the agent runtime:
 
 ```bash
-pip install omniclaw
-# or
-uv add omniclaw
+export OMNICLAW_SERVER_URL="http://localhost:8080"
+export OMNICLAW_TOKEN="agent-token"
 ```
 
-### 2. Environment Variables (Required)
+Pay a protected x402 URL:
 
 ```bash
-# Required to run
-export OMNICLAW_PRIVATE_KEY="0x..."     # Your agent's private key
-export OMNICLAW_AGENT_TOKEN="your-token" # Token from policy.json
-export OMNICLAW_AGENT_POLICY_PATH="/path/to/policy.json"
-export CIRCLE_API_KEY="your-circle-key" # Circle API key
-
-# Network (testnet or mainnet)
-export OMNICLAW_NETWORK="ETH-SEPOLIA"    # or ETH-MAINNET
-export OMNICLAW_ENV="production"         # set for mainnet
-
-# RPC for on-chain operations
-export OMNICLAW_RPC_URL="https://..."
-# Nanopayments CAIP-2 is derived from OMNICLAW_NETWORK (EVM only)
+omniclaw-cli can-pay --recipient https://seller.example.com/compute
+omniclaw-cli inspect-x402 --recipient https://seller.example.com/compute
+omniclaw-cli pay --recipient https://seller.example.com/compute --idempotency-key job-123
 ```
 
-### 3. Start Financial Policy Engine (Owner)
+Pay a direct address:
 
 ```bash
-uvicorn omniclaw.agent.server:app --port 8080
+omniclaw-cli pay \
+  --recipient 0xRecipientAddress \
+  --amount 5.00 \
+  --purpose "service payment" \
+  --idempotency-key job-123
 ```
 
-This runs the Financial Policy Engine that holds the private key and enforces policy.
+## Buyer: Python SDK
 
-### 4. Configure CLI (Agent)
+Use this when a Python service should pay programmatically.
 
-Agent runtime should set these (no interactive setup required):
+```python
+from omniclaw import Network, OmniClaw
 
-```bash
-export OMNICLAW_SERVER_URL="http://localhost:8080"
-export OMNICLAW_TOKEN="your-agent-token"
-```
+client = OmniClaw(network=Network.BASE_SEPOLIA)
 
-Optional: persist config locally for dev workflows:
+result = await client.pay(
+    wallet_id="wallet-id",
+    recipient="https://seller.example.com/compute",
+    amount="1.00",
+    purpose="compute job",
+    idempotency_key="job-123",
+)
 
-```bash
-omniclaw-cli configure --server-url http://localhost:8080 --token your-token --wallet primary
+print(result.status, result.blockchain_tx or result.transaction_id)
 ```
 
-CLI output is agent-first (JSON, no banner). For human-friendly output set:
+For x402 URLs, `amount` acts as the maximum spend allowed for that request. The seller's x402 requirements define the exact amount to settle.
 
-```bash
-export OMNICLAW_CLI_HUMAN=1
-```
+## Seller: Vendor / Enterprise SDK
 
-Note: `omniclaw` and `omniclaw-cli` point to the same CLI.
+Use this when a vendor, enterprise, or application team wants to monetize API routes. This is the default seller path for real products.
 
-## Examples
+```python
+from fastapi import FastAPI
+from omniclaw import OmniClaw
 
-- `examples/local-economy/README.md` — canonical local buyer/seller flow
-- `examples/business-compute/README.md` — business-facing paid compute and paid PDF seller using OmniClaw directly in a web app
+app = FastAPI()
+client = OmniClaw()
+
+@app.get("/premium-data")
+async def premium_data(
+    payment=client.sell("$0.25", seller_address="0xYourSellerWallet")
+):
+    return {
+        "data": "premium content",
+        "paid_by": payment.payer,
+        "amount": payment.amount,
+    }
+```
 
----
+The route returns `402 Payment Required` until the buyer submits a valid x402 payment. After verification and settlement, the handler executes and returns the paid response.
 
-## For BUYERS (Paying for Services)
+## Seller: Agent-Owned Local Service
 
-### Step 1: Get USDC
-Send USDC to your EOA address (derived from OMNICLAW_PRIVATE_KEY)
+Use this only when an agent or local automation wants to expose a temporary paid service. It is not the recommended integration path for vendor or enterprise APIs.
 
-### Step 2: Deposit to Gateway
 ```bash
-omniclaw-cli deposit --amount 10
+omniclaw-cli serve \
+  --price 0.25 \
+  --endpoint /compute \
+  --exec "python compute_job.py" \
+  --port 8000
 ```
-→ Moves USDC from EOA → Circle Gateway contract (on-chain, costs gas)
 
-### Step 3: Pay for Services
-```bash
-# Pay another agent
-omniclaw-cli pay --recipient 0xDEAD... --amount 5
+For vendor and enterprise APIs, use the Python SDK middleware so payments are part of the application itself.
 
-# Or pay for x402 service (URL)
-omniclaw-cli pay --recipient https://api.example.com/data --amount 1
-```
-→ Uses gasless nanopayments via x402 protocol (Gateway CAIP-2 derived from `OMNICLAW_NETWORK`, EVM only)
+## Settlement Paths
 
-### Step 4: Withdraw to Circle Wallet
-```bash
-omniclaw-cli withdraw --amount 3
-```
-→ Moves USDC from Gateway → your Circle Developer Wallet
+OmniClaw is settlement-rail aware and policy-first. The buyer uses one execution path while the seller advertises the x402 requirements it supports.
 
----
+| Path | Status | Notes |
+| --- | --- | --- |
+| Circle Gateway `GatewayWalletBatched` | supported | Gasless nanopayments through Circle Gateway |
+| Standard x402 exact via x402.org | live-proven on Base Sepolia | External exact facilitator validation |
+| OmniClaw self-hosted exact facilitator | live-proven on Arc Testnet | Self-hosted `verify` and `settle` for supported EVM profiles |
+| Thirdweb x402 HTTP facilitator | implemented and test-covered | Live account validation pending credentials |
 
-## For SELLERS (Receiving Payments)
+Current live proof:
 
-### Option A: Simple Transfer
-Just share your address, receive payments directly:
-```bash
-omniclaw-cli address  # Get your address to share
-```
+- Base Sepolia external x402 exact settlement
+- Arc Testnet self-hosted exact settlement
+- buyer/seller wallet separation
+- policy-controlled buyer route through `/api/v1/pay`
 
-### Option B: x402 Payment Gate (Recommended)
-Expose your service behind payment:
+## Examples
 
-```bash
-omniclaw-cli serve \
-  --price 0.01 \
-  --endpoint /api/data \
-  --exec "python my_service.py" \
-  --port 8000
-```
+| Example | Demonstrates |
+| --- | --- |
+| [B2B SDK Integration](examples/b2b-sdk-integration/README.md) | Enterprise buyer/seller SDK integration with multiple facilitators |
+| [Machine to Machine](examples/machine-to-machine/README.md) | One machine service paying another |
+| [Machine to Vendor](examples/machine-to-vendor/README.md) | Agent buyer paying a vendor-owned API |
+| [Vendor Integration](examples/vendor-integration/README.md) | Vendor-side paid API integration |
+| [Business Compute](examples/business-compute/README.md) | Payment-gated compute service |
+| [Local Economy](examples/local-economy/README.md) | Local buyer/seller economy with Docker |
+| [External x402 Facilitator](examples/external-x402-facilitator/README.md) | x402.org Base Sepolia validation |
+| [Thirdweb HTTP Facilitator](examples/thirdweb-http-facilitator/README.md) | Thirdweb HTTP API validation |
 
-This opens `http://localhost:8000/api/data` that requires USDC payment to access.
-
----
-
-## Complete CLI Commands
-
-| Command | Description | Example |
-|---------|-------------|---------|
-| `configure` | Set Financial Policy Engine URL, token, wallet | `configure --server-url http://localhost:8080 --token mytoken --wallet primary` |
-| `address` | Get wallet address | `address` |
-| `balance` | Get wallet balance | `balance` |
-| `balance-detail` | Detailed balance (EOA, Gateway, Circle) | `balance-detail` |
-| `deposit` | Deposit USDC to Gateway | `deposit --amount 5` |
-| `withdraw` | Withdraw to Circle wallet | `withdraw --amount 2` |
-| `withdraw-trustless` | Trustless withdraw (~7-day fallback) | `withdraw-trustless --amount 2` |
-| `withdraw-trustless-complete` | Complete trustless withdraw after delay | `withdraw-trustless-complete` |
-| `pay` | Make payment | `pay --recipient 0x... --amount 5` |
-| `simulate` | Simulate payment | `simulate --recipient 0x... --amount 5` |
-| `serve` | Expose x402 payment gate | `serve --price 0.01 --endpoint /api --exec "echo hello"` |
-| `status` | Agent status | `status` |
-| `ping` | Health check | `ping` |
-| `ledger` | Transaction history | `ledger --limit 20` |
-
----
-
-## Default Policy.json
-
-Copy and edit `examples/policy-simple.json`:
-
-For full policy options, see **[docs/POLICY_REFERENCE.md](docs/POLICY_REFERENCE.md)**
-
-```json
-{
-  "version": "2.0",
-  "tokens": {
-    "YOUR_AGENT_TOKEN": {
-      "wallet_alias": "primary",
-      "active": true,
-      "label": "Your Agent Name"
-    }
-  },
-  "wallets": {
-    "primary": {
-      "name": "Primary Wallet",
-      "limits": {
-        "daily_max": "100.00",
-        "per_tx_max": "50.00"
-      },
-      "recipients": {
-        "mode": "allow_all"
-      }
-    }
-  }
-}
-```
+## Documentation
 
----
+| Start Here | Use Case |
+| --- | --- |
+| [Documentation Index](docs/README.md) | Complete docs map |
+| [Developer Guide](docs/developer-guide.md) | Python SDK buyer and seller integration |
+| [Agent Getting Started](docs/agent-getting-started.md) | Agent CLI setup and usage |
+| [CLI Reference](docs/cli-reference.md) | Generated `omniclaw-cli` reference |
+| [Operator CLI](docs/operator-cli.md) | `omniclaw server`, setup, policy, facilitator commands |
+| [Policy Reference](docs/POLICY_REFERENCE.md) | Policy file structure and controls |
+| [Facilitators](docs/facilitators.md) | x402 facilitator model and deployment paths |
+| [Production Readiness](docs/production-readiness.md) | Proof status and release checklist |
+| [API Reference](docs/API_REFERENCE.md) | Python SDK and API details |
 
-## Environment Variables Reference
+## Development
 
-| Variable | Required | Description |
-|----------|----------|-------------|
-| `OMNICLAW_PRIVATE_KEY` | Yes | Agent's private key for signing |
-| `OMNICLAW_AGENT_TOKEN` | Yes | Token matching policy.json |
-| `OMNICLAW_AGENT_POLICY_PATH` | Yes | Path to policy.json |
-| `OMNICLAW_NETWORK` | No | Network (ETH-SEPOLIA, ETH-MAINNET) |
-| `OMNICLAW_ENV` | No | Set to "production" for mainnet |
-| `OMNICLAW_RPC_URL` | No | RPC endpoint for on-chain ops |
-| `CIRCLE_API_KEY` | Yes | Circle API key |
-| `OMNICLAW_SERVER_URL` | No | Financial Policy Engine URL for the zero-trust CLI |
+```bash
+uv sync --extra dev
+uv run pytest
+```
 
----
+Release verification:
 
-## Documentation
+```bash
+./scripts/release_verify.sh
+```
+
+## Security
 
-- **[docs/agent-getting-started.md](docs/agent-getting-started.md)** - Agent setup walkthrough
-- **[docs/agent-skills.md](docs/agent-skills.md)** - Skill instructions for AI agents
-- **[docs/FEATURES.md](docs/FEATURES.md)** - Full feature documentation
+OmniClaw is designed around separation of authority: agents do not need unrestricted wallet access. Production deployments should still use restricted keys, policy limits, confirmation thresholds, hardened secrets, and audited infrastructure.
 
----
+Report vulnerabilities through [SECURITY.md](SECURITY.md).
 
 ## License
 
-MIT — © 2026 [Omnuron AI](https://www.omniclaw.ai/). See [LICENSE](LICENSE) for details.
+MIT. See [LICENSE](LICENSE).
diff --git a/docs/API_REFERENCE.md b/docs/API_REFERENCE.md
index ca8bff2..420095e 100644
--- a/docs/API_REFERENCE.md
+++ b/docs/API_REFERENCE.md
@@ -15,6 +15,7 @@ from omniclaw import (
     PaymentStatus,
     PaymentIntentStatus,
     quick_setup,
+    validate_entity_secret,
 )
 ```
 
@@ -24,7 +25,7 @@ Required:
 
 ```env
 CIRCLE_API_KEY=...
-OMNICLAW_NETWORK=ETH-SEPOLIA  # or ARC-TESTNET
+OMNICLAW_NETWORK=ETH-SEPOLIA
 # Direct-key mode (recommended for agents / nanopayments)
 OMNICLAW_PRIVATE_KEY=0x...
 ```
@@ -56,17 +57,29 @@ OMNICLAW_CONFIRM_THRESHOLD=500.00
 
 Defined in [onboarding.py](../src/omniclaw/onboarding.py).
 
-### `quick_setup(api_key, env_path=".env", network="ARC-TESTNET")`
+### `quick_setup(api_key, env_path=".env", network="ARC-TESTNET", entity_secret=None)`
 
-One-time onboarding helper that generates and registers an entity secret and writes an env file (optional).
+One-time onboarding helper that writes a local env file and syncs OmniClaw's managed credential store.
+
+If `entity_secret` is provided, OmniClaw treats it as the existing Circle Entity Secret for that API key and does not try to register a replacement. Circle only allows one active Entity Secret per account/API key.
+
+If `entity_secret` is omitted, OmniClaw generates and registers a new Entity Secret, then saves the recovery file in the secure config directory.
+
+The helper currently defaults to `ARC-TESTNET`, so pass an explicit network if you want the generated env file to target `ETH-SEPOLIA`, `BASE-SEPOLIA`, or another supported network.
+
+Public examples in the docs usually show `ETH-SEPOLIA` or `BASE-SEPOLIA`, but the SDK still supports other configured networks such as `ARC-TESTNET` when selected explicitly.
 
 ### `generate_entity_secret()` (optional)
 
 Returns a 64-character hex entity secret (manual setup only).
 
+### `validate_entity_secret(entity_secret)`
+
+Validates that an existing Circle Entity Secret is a 64-character hex value before it is written to env or managed config.
+
 ### `register_entity_secret(api_key, entity_secret, recovery_dir=None)` (optional)
 
-Registers an entity secret with Circle and downloads the recovery file (manual setup only).
+Registers a new entity secret with Circle and downloads the recovery file (manual setup only). Do not call this for an API key/account that already has an Entity Secret; set `ENTITY_SECRET` directly instead.
 
 ### `create_env_file(api_key, entity_secret, env_path=".env", network="ARC-TESTNET", overwrite=False)` (optional)
 
@@ -167,6 +180,27 @@ await client.pay(
 )
 ```
 
+For x402 URL payments, pass the HTTP request context through `kwargs`:
+
+```python
+await client.pay(
+    wallet_id=wallet.id,
+    recipient="https://seller.example.com/premium",
+    amount="0.25",
+    method="POST",
+    request_body='{"job":"prime-count","size":70000}',
+    request_headers={"x-request-id": "job-123"},
+)
+```
+
+Buyer routing is requirement-driven:
+
+- seller advertises `GatewayWalletBatched` and the buyer is Gateway-ready -> OmniClaw can use the Gateway nanopayment path
+- seller advertises standard x402 `exact` -> OmniClaw uses the upstream x402 SDK path
+- seller advertises both and the buyer is not Gateway-ready -> OmniClaw uses `exact`
+
+When the seller is exact-only, OmniClaw routes directly to `exact` instead of attempting Gateway first.
+
 ```python
 await client.simulate(
     wallet_id,
@@ -234,8 +268,8 @@ Nanopayments use EIP-3009 for gas-free USDC transfers on Circle Gateway. They wo
 # Get the GatewayMiddleware for protecting endpoints
 await client.gateway()  # -> GatewayMiddleware
 
-# Decorator factory for marking paid FastAPI routes
-client.sell(price: str)  # -> Depends() for FastAPI
+# Dependency factory for marking paid FastAPI routes
+client.sell(price: str)  # -> FastAPI Depends() object
 
 # Get current payment info inside a @sell() decorated route
 client.current_payment()  # -> PaymentInfo(payer, amount, network, transaction)
@@ -244,10 +278,8 @@ client.current_payment()  # -> PaymentInfo(payer, amount, network, transaction)
 Example (FastAPI seller):
 
 ```python
-from fastapi import Depends
-
 @app.get("/premium")
-async def premium(payment=Depends(omniclaw.sell("$0.001"))):
+async def premium(payment=omniclaw.sell("$0.001")):
     payment_info = omniclaw.current_payment()
     return {"data": "paid content", "paid_by": payment_info.payer}
 ```
diff --git a/docs/ChatGPT Image Apr 2, 2026, 09_43_28 AM.png b/docs/ChatGPT Image Apr 2, 2026, 09_43_28 AM.png
deleted file mode 100644
index b8446b7..0000000
Binary files a/docs/ChatGPT Image Apr 2, 2026, 09_43_28 AM.png and /dev/null differ
diff --git a/docs/ChatGPT Image Mar 30, 2026, 02_19_22 PM.png b/docs/ChatGPT Image Mar 30, 2026, 02_19_22 PM.png
deleted file mode 100644
index 26fa54a..0000000
Binary files a/docs/ChatGPT Image Mar 30, 2026, 02_19_22 PM.png and /dev/null differ
diff --git a/docs/FEATURES.md b/docs/FEATURES.md
index a3abb8c..828391b 100644
--- a/docs/FEATURES.md
+++ b/docs/FEATURES.md
@@ -49,11 +49,41 @@ The router in [payment/router.py](../src/omniclaw/payment/router.py) chooses an
 
 Current routing:
 
-- URL -> `NanopaymentProtocolAdapter` (Gateway x402), with fallback to `X402Adapter` if needed
+- URL -> inspect seller requirements, then choose `NanopaymentProtocolAdapter` for `GatewayWalletBatched` only when the buyer is Gateway-ready; otherwise use `X402Adapter` for standard `exact` x402 when the seller advertises it
 - address + amount below micro-threshold -> `NanopaymentProtocolAdapter` (Gateway)
 - address -> `TransferAdapter`
 - `destination_chain` set -> `GatewayAdapter`
 
+### Exact Facilitator Layer
+
+OmniClaw is facilitator-agnostic. It can pay seller endpoints backed by external x402 facilitators, Circle Gateway, or an optional self-hosted OmniClaw exact facilitator.
+
+The self-hosted exact facilitator layer exists for standard x402 settlement when teams need local proof, custom network control, or a fallback while validating an external provider.
+
+Current exact-settlement profiles include:
+
+- Base Sepolia
+- Ethereum Sepolia
+- Base mainnet
+- Ethereum mainnet
+- Arc Testnet
+
+Arc Testnet uses CAIP-2 `eip155:5042002` and the official USDC ERC-20 interface `0x3600000000000000000000000000000000000000`.
+
+The facilitator layer is intentionally separate from the Financial Policy Engine. The policy engine decides whether an agent is allowed to pay. The facilitator verifies and settles a valid x402 payload on the selected network.
+
+Supported deployment modes:
+
+- managed external x402 facilitator, including Thirdweb-backed seller endpoints
+- Circle Gateway `GatewayWalletBatched` for gasless nanopayment settlement
+- self-hosted OmniClaw exact facilitator, started with `omniclaw facilitator exact`
+
+Thirdweb is a priority external integration path because it provides broad EVM facilitator coverage and gas-sponsored settlement. OmniClaw adds buyer-side policy, route selection, SDK/CLI execution surfaces, and operator visibility.
+
+OmniClaw added the self-hosted exact facilitator so teams can support networks and proof environments before they are available through their selected hosted facilitator. This is how Arc Testnet is handled: it remains standard x402 `exact` settlement, with OmniClaw providing the network profile, asset metadata, RPC, and facilitator runtime.
+
+See [facilitators.md](facilitators.md) for deployment details.
+
 ### Guards
 
 The guard system in [guards/](../src/omniclaw/guards) is the primary spend-control layer.
@@ -148,7 +178,7 @@ The on-chain settlement is batched — multiple nanopayments settle in a single
 #### Buyer vs Seller
 
 - **Buyer**: Uses `NanopaymentAdapter` and `NanopaymentClient` to create and send payments via `client.pay()`
-- **Seller**: Uses `GatewayMiddleware` and `@omniclaw.sell()` to protect FastAPI endpoints
+- **Seller**: Uses `GatewayMiddleware` and `client.sell()` to protect FastAPI endpoints
 
 #### Key Management
 
@@ -194,7 +224,7 @@ Core environment variables:
 
 ```env
 CIRCLE_API_KEY=...
-OMNICLAW_NETWORK=ARC-TESTNET
+OMNICLAW_NETWORK=ETH-SEPOLIA
 ```
 
 Optional:
@@ -214,6 +244,8 @@ OMNICLAW_CONFIRM_ALWAYS=false
 OMNICLAW_CONFIRM_THRESHOLD=500.00
 ```
 
+Use the network that matches your target environment. Public examples in this repo mainly use `ETH-SEPOLIA` or `BASE-SEPOLIA`, while other supported networks can still be selected explicitly.
+
 ## Execution Sequence
 
 For a typical `pay()` call, the Financial Policy Engine does the following:
diff --git a/docs/Gemini_Generated_Image_pekpr0pekpr0pekp.png b/docs/Gemini_Generated_Image_pekpr0pekpr0pekp.png
deleted file mode 100644
index ce7dde7..0000000
Binary files a/docs/Gemini_Generated_Image_pekpr0pekpr0pekp.png and /dev/null differ
diff --git a/docs/PRODUCTION_HARDENING.md b/docs/PRODUCTION_HARDENING.md
index 30c2705..92e2d8b 100644
--- a/docs/PRODUCTION_HARDENING.md
+++ b/docs/PRODUCTION_HARDENING.md
@@ -46,6 +46,26 @@ Production seller flows must use distributed nonce storage:
 - `OMNICLAW_STRICT_SETTLEMENT=true` ensures success reflects irreversible settlement states.
 - Do not disable strict settlement in production.
 
+## Facilitator Strategy
+
+OmniClaw is facilitator-agnostic. Production deployments should choose the settlement provider that fits the seller and network:
+
+- Thirdweb-backed x402 facilitator for managed gas-sponsored exact settlement across broad EVM coverage
+- Circle Gateway `GatewayWalletBatched` for gasless batched nanopayments
+- external standard x402 facilitator where the seller already uses one
+- self-hosted OmniClaw exact facilitator only when local proof, custom network support, or enterprise self-hosting is required
+
+Do not run a self-hosted facilitator by default if a managed facilitator already supports the target flow. The self-hosted path is operational infrastructure, not the primary product wedge.
+
+Before production traffic, validate the exact seller path with:
+
+```bash
+omniclaw-cli inspect-x402 --recipient https://seller.example.com/compute
+omniclaw-cli pay --recipient https://seller.example.com/compute --idempotency-key production-canary-001
+```
+
+For Thirdweb validation, use `examples/thirdweb-http-facilitator/README.md`.
+
 ## Canary and SLA
 
 Use the canary script to validate end-to-end payment lifecycle before/after deploys:
@@ -55,7 +75,7 @@ python scripts/payment_canary.py \
   --wallet-id <wallet_id> \
   --recipient <recipient> \
   --amount 0.10 \
-  --network ARC-TESTNET \
+  --network <target_network> \
   --sla-seconds 300
 ```
 
@@ -69,10 +89,11 @@ Exit behavior:
 1. Apply required production env vars.
 2. Run `omniclaw doctor`.
 3. Run canary in target environment.
-4. Deploy with staged traffic.
-5. Monitor:
+4. Confirm `inspect-x402` selects the expected seller scheme and network.
+5. Confirm settlement appears in the selected facilitator dashboard or explorer.
+6. Deploy with staged traffic.
+7. Monitor:
    - settlement latency
    - webhook duplicate reject counts
    - pending settlement age distribution
-6. Keep rollback path ready (app + env).
-
+8. Keep rollback path ready (app + env).
diff --git a/docs/README.md b/docs/README.md
index 0265071..8839272 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -1,45 +1,74 @@
-# OmniClaw Docs
+# OmniClaw Documentation
 
-This directory is split into two parts:
+OmniClaw is a policy-controlled payment layer for agents, applications, and machine services.
 
-- public product and developer docs in `docs/`
-- internal GTM, grant, outreach, and demo materials in `docs/internal/`
+Use this index to choose the right integration path.
 
-## Public Docs
+## Choose Your Path
 
-### Getting Started
+| Role | Start Here | What You Build |
+| --- | --- | --- |
+| Agent buyer | [Agent Getting Started](agent-getting-started.md) | An agent that pays through `omniclaw-cli` |
+| Python buyer | [Developer Guide](developer-guide.md) | A backend service that pays programmatically |
+| Vendor / enterprise seller | [Developer Guide](developer-guide.md) | A FastAPI service with paid endpoints through the SDK |
+| Operator | [Operator CLI](operator-cli.md) | Financial Policy Engine, policies, and facilitators |
+| Release owner | [Production Readiness](production-readiness.md) | Proof checklist and ship status |
 
-- `docs/agent-getting-started.md`
-- `docs/agent-skills.md`
-- `docs/cli-reference.md`
+## Buyer Guides
 
-### Examples
+| Guide | Use Case |
+| --- | --- |
+| [Agent Getting Started](agent-getting-started.md) | Configure an agent with `omniclaw-cli` |
+| [CLI Reference](cli-reference.md) | Full generated `omniclaw-cli` command reference |
+| [Developer Guide](developer-guide.md) | Pay with the Python SDK |
+| [API Reference](API_REFERENCE.md) | SDK methods, request shapes, and payment APIs |
 
-- `examples/local-economy/README.md`
-- `examples/business-compute/README.md`
+## Seller Guides
 
-### Product And Architecture
+| Guide | Use Case |
+| --- | --- |
+| [Developer Guide](developer-guide.md) | Add production paid FastAPI routes with `client.sell()` |
+| [B2B SDK Integration](../examples/b2b-sdk-integration/README.md) | Enterprise SDK deployment with Circle, Thirdweb, or self-hosted exact |
+| [Vendor Integration](../examples/vendor-integration/README.md) | Production-style vendor API integration |
+| [Business Compute](../examples/business-compute/README.md) | Payment-gated compute service |
+| [CLI Reference](cli-reference.md) | Agent-owned local service flow with `omniclaw-cli serve` |
 
-- `docs/FEATURES.md`
-- `docs/compliance-architecture.md`
-- `docs/architecture_overview.svg`
-- `docs/OmniClaw_Whitepaper_v1.0.pdf`
+## Machine Payment Examples
 
-### Technical Reference
+| Example | Demonstrates |
+| --- | --- |
+| [B2B SDK Integration](../examples/b2b-sdk-integration/README.md) | Enterprise buyer/seller SDK integration |
+| [Machine to Machine](../examples/machine-to-machine/README.md) | One automated service paying another |
+| [Machine to Vendor](../examples/machine-to-vendor/README.md) | Agent buyer paying a vendor-owned API |
+| [Local Economy](../examples/local-economy/README.md) | Local buyer/seller stack with Docker |
+| [External x402 Facilitator](../examples/external-x402-facilitator/README.md) | x402.org exact settlement on Base Sepolia |
+| [Thirdweb HTTP Facilitator](../examples/thirdweb-http-facilitator/README.md) | Thirdweb HTTP facilitator integration |
 
-- `docs/API_REFERENCE.md`
-- `docs/POLICY_REFERENCE.md`
-- `docs/SDK_USAGE_GUIDE.md`
-- `docs/CCTP_USAGE.md`
-- `docs/PRODUCTION_HARDENING.md`
-- `docs/erc_804_spec.md`
+## Operator and Production Docs
 
-## Internal Docs
+| Document | Covers |
+| --- | --- |
+| [Operator CLI](operator-cli.md) | `omniclaw server`, `omniclaw setup`, `omniclaw facilitator exact` |
+| [Policy Reference](POLICY_REFERENCE.md) | Tokens, wallets, budgets, recipient rules, confirmations |
+| [Facilitators](facilitators.md) | Circle Gateway, x402.org, Thirdweb, self-hosted exact |
+| [Production Readiness](production-readiness.md) | Live proof status and release checklist |
+| [Production Hardening](PRODUCTION_HARDENING.md) | Deployment controls, Redis, nonce, security settings |
 
-Use `docs/internal/README.md` for:
+## Architecture and Reference
 
-- grant strategy
-- sponsor and investor messaging
-- public post drafts
-- demo narration and story
-- archived older grant docs
+| Document | Covers |
+| --- | --- |
+| [Architecture and Features](FEATURES.md) | Core design, route selection, guards, settlement paths |
+| [Architecture Diagram](architecture_overview.svg) | System overview |
+| [Compliance Architecture](compliance-architecture.md) | Compliance and control framing |
+| [CCTP Usage](CCTP_USAGE.md) | Circle CCTP notes |
+| [ERC-804 Spec](erc_804_spec.md) | Trust-related specification notes |
+
+## Project Files
+
+| File | Purpose |
+| --- | --- |
+| [CHANGELOG](../CHANGELOG.md) | Release history |
+| [CONTRIBUTING](../CONTRIBUTING.md) | Development and PR workflow |
+| [SECURITY](../SECURITY.md) | Security reporting |
+| [ROADMAP](../ROADMAP.md) | Built status and planned work |
diff --git a/docs/SDK_USAGE_GUIDE.md b/docs/SDK_USAGE_GUIDE.md
deleted file mode 100644
index fd622fa..0000000
--- a/docs/SDK_USAGE_GUIDE.md
+++ /dev/null
@@ -1,509 +0,0 @@
-# OmniClaw Financial Policy Engine Usage Guide
-
-This guide covers common workflows for the Financial Policy Engine without repeating the full architecture or every method signature.
-
-## 1. Initialize the Client
-
-```python
-from omniclaw import OmniClaw, Network
-
-client = OmniClaw(network=Network.ARC_TESTNET)
-```
-
-With environment variables:
-
-```env
-CIRCLE_API_KEY=your_circle_api_key
-OMNICLAW_NETWORK=ARC-TESTNET
-```
-
-Optional runtime settings:
-
-```env
-OMNICLAW_STORAGE_BACKEND=redis
-OMNICLAW_REDIS_URL=redis://localhost:6379
-OMNICLAW_LOG_LEVEL=DEBUG
-OMNICLAW_RPC_URL=https://your-rpc-provider
-
-# Nanopayments network is derived from OMNICLAW_NETWORK (EVM chain)
-```
-
-### Entity Secret
-
-You do not need to set `ENTITY_SECRET` manually. It is auto-generated and registered on first run when `CIRCLE_API_KEY` is available.
-
-Linux recovery-file location:
-
-```text
-~/.config/omniclaw/
-```
-
-This matters because Circle entity secret registration is effectively a one-time setup per account until you recover or reset it.
-
-Run the built-in diagnostic command to check the full state:
-
-```bash
-omniclaw doctor
-```
-
-## Testing with Real Funds
-
-To test payments with real USDC on testnet:
-
-**1. Configure for Base Sepolia:**
-
-```env
-OMNICLAW_NETWORK=BASE-SEPOLIA
-OMNICLAW_RPC_URL=https://sepolia.base.org
-```
-
-**2. Get testnet tokens:**
-
-- **ETH (for gas):** https://faucets.chain.link/base-sepolia
-- **USDC (for payments):** https://faucet.circle.com/ → Select Base Sepolia → Send 20 USDC
-
-**3. Get payment addresses:**
-
-```python
-wallet_set, wallet = await client.create_agent_wallet("my-agent")
-
-# Circle wallet (for transfers)
-circle_address = wallet.address
-
-# Nano/Gateway (for nanopayments - EIP-3009)
-nano_address = client.nanopayment_adapter.address
-```
-
-**4. Test a payment:**
-
-```python
-result = await client.pay(
-    wallet_id=wallet.id,
-    recipient="0xRecipientAddress",
-    amount="0.01",  # 1 cent USDC
-)
-```
-
-## 2. Create a Wallet
-
-Fastest path:
-
-```python
-wallet_set, wallet = await client.create_agent_wallet("agent-007")
-```
-
-Manual path:
-
-```python
-wallet_set = await client.create_wallet_set("ops-wallets")
-wallet = await client.create_wallet(
-    wallet_set_id=wallet_set.id,
-    blockchain=Network.ETH,
-)
-```
-
-Common wallet operations:
-
-```python
-wallets = await client.list_wallets(wallet_set_id=wallet_set.id)
-wallet_info = await client.get_wallet(wallet.id)
-balance = await client.get_balance(wallet.id)
-
-# Get payment address (where to fund with USDC)
-payment_address = await client.get_payment_address(wallet.id)
-
-# Get detailed balance (available + reserved for intents)
-detailed = await client.get_detailed_balance(wallet.id)
-print(f"Available: {detailed['available']}, Reserved: {detailed['reserved']}")
-
-transactions = await client.list_transactions(wallet_id=wallet.id)
-```
-
-## 3. Add Safety Guards
-
-```python
-await client.add_budget_guard(wallet.id, daily_limit="100.00", hourly_limit="20.00")
-await client.add_rate_limit_guard(wallet.id, max_per_minute=5)
-await client.add_single_tx_guard(wallet.id, max_amount="25.00")
-await client.add_recipient_guard(
-    wallet.id,
-    mode="whitelist",
-    addresses=["0xTrustedRecipient"],
-    domains=["api.openai.com"],
-)
-await client.add_confirm_guard(wallet.id, threshold="500.00")
-```
-
-Wallet-set guard helpers apply the same logic across all wallets in a set.
-
-```python
-await client.add_budget_guard_for_set(wallet_set.id, daily_limit="500.00")
-await client.add_rate_limit_guard_for_set(wallet_set.id, max_per_hour=100)
-```
-
-## 4. Execute a Payment
-
-```python
-result = await client.pay(
-    wallet_id=wallet.id,
-    recipient="0x742d35Cc6634C0532925a3b844Bc9e7595f5e4a0",
-    amount="10.50",
-    purpose="vendor payment",
-)
-```
-
-Key runtime arguments:
-
-- `wallet_id`: required source wallet
-- `recipient`: blockchain address or URL
-- `amount`: USDC amount
-- `destination_chain`: set for cross-chain flows
-- `purpose`: audit-friendly note
-- `idempotency_key`: caller-controlled dedupe key
-- `skip_guards`: bypass guards, only for special cases
-- `check_trust`: `None`, `True`, or `False`
-- `wait_for_completion`: wait for provider confirmation when supported
-
-## 5. Understand Routing
-
-OmniClaw routes automatically:
-
-- URL -> Gateway nanopayments (x402), with fallback to x402 direct if needed
-- address + amount below micro-threshold -> Gateway nanopayments
-- address -> direct transfer
-- address + `destination_chain` -> gateway/cross-chain
-
-Examples:
-
-```python
-await client.pay(wallet_id=wallet.id, recipient="0xRecipient", amount="5.00")
-await client.pay(wallet_id=wallet.id, recipient="https://api.vendor.com/paywall", amount="0.05")
-await client.pay(
-    wallet_id=wallet.id,
-    recipient="0xRecipientOnBase",
-    amount="20.00",
-    destination_chain=Network.BASE,
-)
-```
-
-## 6. Simulate Before Sending
-
-```python
-sim = await client.simulate(
-    wallet_id=wallet.id,
-    recipient="0xRecipient",
-    amount="25.00",
-)
-
-if sim.would_succeed:
-    print(sim.route)
-else:
-    print(sim.reason)
-```
-
-Simulation checks:
-
-- balance after reservations
-- guard outcomes
-- trust outcome when enabled
-- adapter suitability
-
-## 7. Use Payment Intents for Approval Flows
-
-```python
-intent = await client.create_payment_intent(
-    wallet_id=wallet.id,
-    recipient="0xRecipient",
-    amount="250.00",
-    purpose="high-value purchase",
-)
-```
-
-Confirm later:
-
-```python
-result = await client.confirm_payment_intent(intent.id)
-```
-
-Cancel if needed:
-
-```python
-await client.cancel_payment_intent(intent.id, reason="approval denied")
-```
-
-Use intents when you need:
-
-- human review
-- delayed execution
-- serialized approval flows
-- explicit reservation of spendable balance
-
-## 8. Receive Nanopayments as a Seller
-
-Nanopayments use EIP-3009 for gas-free USDC transfers via Circle Gateway batch settlement. As a seller, you protect FastAPI endpoints so buyers pay before receiving content.
-
-### Quick Start (6 lines!)
-
-```python
-from fastapi import FastAPI, Depends
-from omniclaw import OmniClaw
-
-app = FastAPI()
-client = OmniClaw()
-
-# Create seller account - ONE CALL does everything
-wallet_set, wallet = await client.create_agent_wallet("my-saas-product")
-
-# Protect your endpoint - that's it!
-@app.get("/premium-data")
-async def get_premium(payment=Depends(client.sell("$0.01"))):
-    return {
-        "data": "premium content",
-        "paid_by": payment.payer,
-    }
-```
-
-### How It Works
-
-1. **Circle Gateway batch settlement** - All nanopayments are automatically batched and settled via EIP-3009
-2. **Gasless for buyers** - Buyers don't pay gas fees
-3. **Seller receives USDC in Gateway** - Instant settlement to your Gateway wallet
-
-### Get Payment Address
-
-```python
-# Get address for buyers to pay to
-payment_address = await client.get_payment_address(wallet.id)
-```
-
-### Check Earnings
-
-```python
-# Check your Gateway balance (USDC received from buyers)
-balance = await client.get_gateway_balance(wallet.id)
-print(f"Total: {balance.formatted_total}")
-print(f"Available: {balance.formatted_available}")
-```
-
-### Withdraw Earnings
-
-```python
-# Withdraw to your Circle wallet
-await client.withdraw_from_gateway(
-    wallet_id=wallet.id,
-    amount_usdc="50.00",
-)
-
-# Or withdraw to another chain (cross-chain via CCTP)
-await client.withdraw_from_gateway(
-    wallet_id=wallet.id,
-    amount_usdc="25.00",
-    destination_chain="eip155:1",  # Ethereum mainnet
-    recipient="0xYourEthAddress",
-)
-```
-
-### Why OmniClaw vs Raw x402?
-
-**OmniClaw (SIMPLE - 3 lines):**
-```python
-wallet_set, wallet = await client.create_agent_wallet("my-product")
-
-@app.get("/data")
-async def handler(payment=Depends(client.sell("$0.01"))):
-    return {"data": "..."}
-```
-
-**Raw x402 (40+ lines):**
-```python
-server = x402ResourceServer(HTTPFacilitatorClient(FacilitatorConfig(url=...)))
-server.register("eip155:84532", ExactEvmServerScheme())
-
-routes = {
-    "GET /data": RouteConfig(
-        accepts=[PaymentOption(scheme="exact", price="$0.01", network="eip155:84532", pay_to=address)]
-    ),
-}
-app.add_middleware(PaymentMiddlewareASGI, routes=routes, server=server)
-
-@app.get("/data")
-async def handler():
-    return {"data": "..."}
-```
-
-**OmniClaw handles all the complexity** - facilitator, settlement, networks - you just write business logic!
-
-### Advanced: Custom Routes (like x402)
-
-If you need more control like x402:
-
-```python
-# Coming soon - define custom routes with multiple payment options
-routes = {
-    "GET /premium": RouteConfig(
-        accepts=[
-            PaymentOption(scheme="exact", price="$0.01", network="eip155:84532", pay_to=address),
-            PaymentOption(scheme="exact", price="$0.01", network="eip155:1", pay_to=address),
-        ]
-    ),
-}
-```
-
-### Deposit USDC to Enable Receiving
-
-Your gateway wallet needs a USDC balance to receive payments (it acts as a buffer — buyers pay you by sending from their gateway to yours).
-
-```python
-# Check your gateway balance (uses wallet_id)
-balance = await client.get_gateway_balance(wallet.id)
-print(f"Gateway balance: {balance.formatted_total}")
-
-# Deposit from your Circle wallet to Gateway (for gasless nanopayments)
-await client.deposit_to_gateway(
-    wallet_id=wallet.id,
-    amount_usdc="100.00",
-)
-
-# Withdraw from Gateway back to your wallet
-await client.withdraw_from_gateway(
-    wallet_id=wallet.id,
-    amount_usdc="50.00",
-)
-```
-
-### Protect FastAPI Endpoints
-
-```python
-from fastapi import FastAPI, Depends
-
-app = FastAPI()
-
-@app.get("/premium-data")
-async def get_premium(payment=Depends(client.sell("$0.001"))):
-    payment_info = client.current_payment()
-    return {
-        "data": "premium content",
-        "paid_by": payment_info.payer,
-        "network": payment_info.network,
-    }
-```
-
-The `@client.sell()` decorator:
-
-- Returns a FastAPI `Depends()` that gates the route with x402 payment
-- Checks the `PAYMENT-SIGNATURE` header (base64-encoded EIP-3009 authorization)
-- Verifies the payment amount matches
-- Settles via Circle Gateway
-- Returns `PaymentInfo` including the payer's address
-
-### Get Paid Content
-
-```python
-@app.get("/premium")
-async def premium(payment=Depends(client.sell("$0.50"))):
-    info = client.current_payment()
-    print(f"Paid by {info.payer} on {info.network}")
-    print(f"Transaction: {info.transaction}")
-    return {"content": "..."}
-```
-
-### Withdraw from Gateway
-
-```python
-# Withdraw to your Circle wallet
-await client.withdraw_from_gateway(
-    wallet_id=wallet.id,
-    amount_usdc="50.00",
-)
-
-# Or withdraw to another blockchain address
-await client.withdraw_from_gateway(
-    wallet_id=wallet.id,
-    amount_usdc="25.00",
-    destination_chain=Network.BASE,
-    recipient="0xBaseRecipient",
-)
-```
-
-### Auto-Topup
-
-Automatically refill gateway balance when it drops below a threshold:
-
-```python
-client.configure_nanopayments(
-    auto_topup_enabled=True,
-    auto_topup_threshold="5.00",  # Refill when balance < $5
-    auto_topup_amount="50.00",    # Add $50 each time
-    wallet_manager=gateway_manager,
-)
-```
-
-## 9. Send Nanopayments as a Buyer
-
-Nanopayments are sent automatically when you `pay()` a small amount to a gateway-enabled address:
-
-```python
-# Amounts below the micro threshold use gateway nanopayments
-result = await client.pay(
-    wallet_id=wallet.id,
-    recipient="0xSellerGatewayAddress",
-    amount="0.05",  # Small amount → gas-free nanopayment
-)
-```
-
-Configuration:
-
-```env
-OMNICLAW_NANOPAYMENTS_MICRO_THRESHOLD=1.00  # Amounts < $1 use nanopayments
-```
-
-**Gateway CAIP-2:** The nanopayment CAIP-2 chain identifier is derived from `OMNICLAW_NETWORK` via `network_to_caip2`. Only EVM networks are supported.
-
-On the buyer side, OmniClaw:
-1. Checks if the recipient supports gateway nanopayments
-2. Creates an EIP-3009 authorization (off-chain signing)
-3. Sends the authorization as a `PAYMENT-SIGNATURE` header to Circle's settle API
-4. Circle batches and settles on-chain
-
-## 10. Enable Trust Checks
-
-Set a real RPC URL:
-
-```env
-OMNICLAW_RPC_URL=https://your-rpc-provider
-```
-
-Then request trust evaluation:
-
-```python
-result = await client.pay(
-    wallet_id=wallet.id,
-    recipient="0xRecipient",
-    amount="10.00",
-    check_trust=True,
-)
-```
-
-Rules:
-
-- `check_trust=True` fails if no real RPC URL is configured
-- `check_trust=None` uses auto mode
-- `check_trust=False` skips trust evaluation
-
-## 11. Webhooks
-
-Use the webhook parser when handling Circle events:
-
-```python
-event = client.webhooks.handle(payload, headers)
-```
-
-If signature verification is configured, pass the raw payload and headers so verification can run before parsing.
-
-## 12. Operational Guidance
-
-- Use Redis in any concurrent deployment.
-- Keep `OMNICLAW_NETWORK` explicit in every deployed environment.
-- Keep trust checks opt-in unless your deployment is prepared with a working RPC provider.
-- Prefer `simulate()` for higher-risk or user-approved operations.
-- Prefer payment intents for review-required or delayed-execution flows.
diff --git a/docs/agent-getting-started.md b/docs/agent-getting-started.md
index 5140edc..6bf1255 100644
--- a/docs/agent-getting-started.md
+++ b/docs/agent-getting-started.md
@@ -1,6 +1,6 @@
 # OmniClaw Agent Getting Started
 
-This guide walks you through setting up an OmniClaw agent for both buying and selling.
+This guide walks you through setting up an OmniClaw agent for policy-controlled payments.
 
 OmniClaw is the **Economic Execution and Control Layer for Agentic Systems**.
 In that system:
@@ -8,7 +8,9 @@ In that system:
 - the owner runs the **Financial Policy Engine**
 - the agent uses `omniclaw-cli` as the **zero-trust execution layer**
 - buyers pay with `omniclaw-cli pay`
-- sellers earn with `omniclaw-cli serve`
+- agents can expose temporary local paid services with `omniclaw-cli serve`
+
+For vendor, SaaS, or enterprise APIs, use the Python SDK seller middleware instead of `omniclaw-cli serve`. See the [Developer Guide](developer-guide.md).
 
 ---
 
@@ -16,6 +18,7 @@ In that system:
 
 - Python 3.10+
 - Circle API key
+- Circle Entity Secret if your Circle account/API key already has one
 - USDC on the target network (testnet or mainnet)
 - A private key for your agent
 
@@ -68,6 +71,10 @@ export OMNICLAW_AGENT_TOKEN="my-agent-token"   # Must match policy.json token ke
 export OMNICLAW_AGENT_POLICY_PATH="/path/to/policy.json"
 export CIRCLE_API_KEY="your-circle-api-key"
 
+# Required when your Circle account/API key already has an Entity Secret.
+# If omitted, OmniClaw only auto-generates one when no existing local secret is found.
+export ENTITY_SECRET="your-existing-64-char-hex-entity-secret"
+
 # Network (testnet or mainnet)
 export OMNICLAW_NETWORK="ETH-SEPOLIA"         # or ETH-MAINNET for production
 
@@ -85,7 +92,7 @@ export OMNICLAW_POLICY_RELOAD_INTERVAL="5"     # Hot reload interval (seconds)
 ## Step 3: Start the Financial Policy Engine
 
 ```bash
-uvicorn omniclaw.agent.server:app --port 8080
+omniclaw server --port 8080
 ```
 
 The Financial Policy Engine runs at `http://localhost:8080`.
@@ -134,7 +141,7 @@ omniclaw-cli balance_detail
 ```bash
 omniclaw-cli deposit --amount 10
 ```
-This moves USDC from your EOA to the Circle Gateway contract.
+This moves USDC from your EOA to the Circle Gateway contract. It is required for `GatewayWalletBatched` nanopayments. It is not required for standard x402 `exact` payments that spend from the buyer signer directly.
 
 ### Withdraw to Circle Wallet
 ```bash
@@ -142,6 +149,31 @@ omniclaw-cli withdraw --amount 5
 ```
 This moves USDC from Gateway to your Circle Developer Wallet.
 
+### Buyer Flow For x402 Services
+
+For a new paid URL, use this order:
+
+```bash
+omniclaw-cli can-pay --recipient https://seller.example.com/premium
+omniclaw-cli inspect-x402 --recipient https://seller.example.com/premium
+omniclaw-cli pay --recipient https://seller.example.com/premium --idempotency-key job-123
+```
+
+What this tells you:
+
+- `can-pay` confirms policy allow or deny
+- `inspect-x402` shows whether the seller is paywalled, what schemes it advertises, and whether OmniClaw will use `gateway_balance` or `direct_wallet`
+- `pay` executes through the single `/api/v1/pay` buyer route
+
+For x402 URLs, OmniClaw chooses the route from the seller's advertised requirements:
+
+- `GatewayWalletBatched` when the seller advertises Circle Gateway nanopayments and the buyer is actually Gateway-ready
+- `exact` when the seller advertises a standard x402 payment flow
+
+If the seller advertises both and the buyer has no Gateway balance, OmniClaw uses `exact`.
+
+If the seller is exact-only, OmniClaw routes directly to the x402 exact path.
+
 ---
 
 ## Confirmations (High-Value Policy Thresholds)
@@ -172,9 +204,9 @@ Then retry the payment with the same `confirmation_id` in metadata:
 
 ---
 
-## For SELLERS: Expose a Payment Gate
+## Agent-to-Agent Selling (Local Data)
 
-To receive payments, expose a service behind x402 payment:
+If an agent wants to temporarily sell access to a local Python script or data file to another agent, they can use the CLI to spin up a fast payment gate:
 
 ```bash
 omniclaw-cli serve \
@@ -184,13 +216,9 @@ omniclaw-cli serve \
   --port 8000
 ```
 
-This opens `http://localhost:8000/api/data` that requires USDC payment to access.
+This opens `http://localhost:8000/api/data` that requires a USDC payment to execute `my_service.py` and return its output.
 
-This is the seller side of the same OmniClaw economy.
-The same CLI powers both sides:
-
-- buyer: `omniclaw-cli pay`
-- seller: `omniclaw-cli serve`
+> **Web developer or vendor:** For real API or SaaS products, use the Python SDK inside your FastAPI application instead of `omniclaw-cli serve`. See the [Developer Guide](developer-guide.md).
 
 ---
 
@@ -204,7 +232,9 @@ The same CLI powers both sides:
 | `omniclaw-cli withdraw --amount X` | Withdraw to Circle wallet |
 | `omniclaw-cli withdraw_trustless --amount X` | Trustless withdraw (~7-day delay) |
 | `omniclaw-cli withdraw_trustless_complete` | Complete trustless withdraw after delay |
+| `omniclaw-cli inspect-x402 --recipient URL` | Inspect seller requirements and buyer readiness |
 | `omniclaw-cli pay --recipient 0x... --amount X` | Pay another agent |
+| `omniclaw-cli pay --recipient URL` | Pay a seller x402 endpoint |
 | `omniclaw-cli serve --price X --endpoint /api --exec "cmd"` | Start payment gate |
 
 ---
@@ -231,7 +261,16 @@ Wait a few seconds and retry. The agent is setting up.
 Check that `OMNICLAW_AGENT_TOKEN` matches a key in your policy.json's `tokens` section.
 
 ### "Insufficient balance"
-Make sure you've deposited USDC to the Gateway first:
+Check which route the seller requires:
+
+```bash
+omniclaw-cli inspect-x402 --recipient https://seller.example.com/premium
+```
+
+If the route is `GatewayWalletBatched`, deposit to Gateway first:
+
 ```bash
 omniclaw-cli deposit --amount 10
 ```
+
+If the route is `exact`, fund the buyer signer wallet on the required chain instead.
diff --git a/docs/agent-skills.md b/docs/agent-skills.md
index ca0d588..4301b45 100644
--- a/docs/agent-skills.md
+++ b/docs/agent-skills.md
@@ -16,10 +16,12 @@ That full system is larger than the CLI alone:
 - the settlement rails include direct USDC transfers, x402, CCTP, and Circle Gateway nanopayments
 - the policy, trust, ledger, and concurrency controls are part of the overall OmniClaw system
 
-It is the same CLI on both sides of the economy:
+It is the same CLI for agent-side economic execution:
 
 - buyer side: `omniclaw-cli pay`
-- seller side: `omniclaw-cli serve`
+- temporary/local seller side: `omniclaw-cli serve`
+
+Vendor and enterprise seller APIs should use the Python SDK with `client.sell(...)`.
 
 That two-sided model matters:
 
@@ -35,17 +37,13 @@ There are now three separate artifacts, each with a different audience:
 
 - `docs/agent-skills.md`
   - human/operator guide
-- `.agents/skills/omniclaw-cli/SKILL.md`
-  - actual agent instruction file
-- `.agents/skills/omniclaw-cli/references/cli-reference.md`
-  - exact agent command reference generated from live CLI help
-
-There is also a human-copy of the generated command reference:
-
+- `docs/omniclaw-cli-skill/SKILL.md`
+  - public shipped skill specification
 - `docs/cli-reference.md`
+  - exact generated command reference for the public CLI surface
 
 This split is deliberate.
-It keeps agent instructions short and reliable while giving humans a fuller explanation.
+It keeps the public skill specification separate from the human/operator guide and generated command reference.
 
 ## Setup Model
 
@@ -280,6 +278,7 @@ Current top-level commands exposed by the CLI:
 ## Recommended Operational Rules
 
 - use `can-pay` for new recipients
+- use `inspect-x402` for a new paid URL before the first live payment
 - use `--idempotency-key` for job-based payments
 - use `balance-detail` when Gateway balances matter
 - use `simulate` when the amount or guard risk is non-trivial
@@ -293,12 +292,11 @@ The exact command reference is generated from the live CLI help surface.
 Regenerate it with:
 
 ```bash
-python .agents/skills/omniclaw-cli/scripts/generate_cli_reference.py
+python docs/omniclaw-cli-skill/scripts/generate_cli_reference.py
 ```
 
 Generated outputs:
 
-- `.agents/skills/omniclaw-cli/references/cli-reference.md`
 - `docs/cli-reference.md`
 
 That keeps the documented flags and command surface aligned with the actual CLI.
@@ -315,18 +313,19 @@ It is useful for things like:
 
 It is not required for the OmniClaw agent skill to work.
 
-For this repository, the functional sources of truth are:
+For this repository, the public sources of truth are:
 
-- `.agents/skills/omniclaw-cli/SKILL.md`
-- `.agents/skills/omniclaw-cli/references/cli-reference.md`
+- `docs/omniclaw-cli-skill/SKILL.md`
+- `docs/cli-reference.md`
 
-That keeps the runtime path minimal and avoids duplicating instruction content in another file.
+That keeps the shipped skill and the shipped command reference in public docs.
 
 ## Ship Recommendation
 
 This is now the recommended storage layout:
 
-- keep agent runtime instructions under `.agents/skills/omniclaw-cli/`
+- keep public shipped skill specs under `docs/`
+- keep repo-local internal-use skills under `.agents/skills/`
 - keep human/operator docs under `docs/`
 - keep the exact CLI reference generated, not handwritten
 
diff --git a/docs/cli-reference.md b/docs/cli-reference.md
index 5692345..6426824 100644
--- a/docs/cli-reference.md
+++ b/docs/cli-reference.md
@@ -6,13 +6,14 @@ Do not hand-edit command schemas here; regenerate instead.
 Generator:
 
 ```bash
-python3 .agents/skills/omniclaw-cli/scripts/generate_cli_reference.py
+python3 docs/omniclaw-cli-skill/scripts/generate_cli_reference.py
 ```
 
 ## Usage Notes
 
 - same CLI, two roles: buyer uses `pay`, seller uses `serve`
 - use `can-pay` before a new recipient when policy allow/deny matters
+- use `inspect-x402` before a new paid URL when you need to see seller requirements and buyer funding readiness
 - use `balance-detail` when Gateway state matters
 - use `--idempotency-key` for job-based payments
 - for x402 URLs, `--amount` can be omitted because the payment requirements come from the seller endpoint
@@ -24,6 +25,7 @@ Buyer paying an x402 endpoint:
 
 ```bash
 omniclaw-cli can-pay --recipient http://seller-host:8000/api/data
+omniclaw-cli inspect-x402 --recipient http://seller-host:8000/api/data
 omniclaw-cli pay --recipient http://seller-host:8000/api/data --idempotency-key job-123
 ```
 
@@ -82,6 +84,9 @@ omniclaw-cli serve \
 │ withdraw_trustless_complete   Alias for withdraw-trustless-complete          │
 │ pay                           Execute a payment or pay for an x402 service.  │
 │ simulate                      Simulate a payment without executing.          │
+│ inspect-x402                  Inspect an x402 endpoint and show which        │
+│                               payment route OmniClaw would use.              │
+│ inspect_x402                  Alias for inspect-x402                         │
 │ can-pay                       Check if recipient is allowed.                 │
 │ can_pay                       Alias for can-pay                              │
 │ create-intent                 Create a payment intent (authorize).           │
@@ -204,6 +209,24 @@ omniclaw-cli serve \
 ╰──────────────────────────────────────────────────────────────────────────────╯
 ```
 
+### `omniclaw-cli inspect-x402 --help`
+
+```text
+
+ Usage: omniclaw-cli inspect-x402 [OPTIONS]
+
+ Inspect an x402 endpoint and show which payment route OmniClaw would use.
+
+╭─ Options ────────────────────────────────────────────────────────────────────╮
+│ *  --recipient        TEXT  x402 URL to inspect [required]                  │
+│    --amount           TEXT  Optional max amount in USDC                     │
+│    --method           TEXT  HTTP method for x402 requests [default: GET]    │
+│    --body             TEXT  Request body for x402 requests                  │
+│    --header           TEXT  Additional headers for x402 requests            │
+│    --help                   Show this message and exit.                     │
+╰──────────────────────────────────────────────────────────────────────────────╯
+```
+
 ### `omniclaw-cli simulate --help`
 
 ```text
diff --git a/docs/developer-guide.md b/docs/developer-guide.md
new file mode 100644
index 0000000..146083d
--- /dev/null
+++ b/docs/developer-guide.md
@@ -0,0 +1,224 @@
+# OmniClaw Developer Guide (Python SDK)
+
+This guide covers how developers, vendors, and application teams build policy-controlled payment flows with the OmniClaw Python SDK.
+
+> **Vendors vs Agents:** This guide is for developers embedding OmniClaw code into real Python applications (like FastAPI servers or backend worker scripts). If you are looking to operate an autonomous AI Agent using the command line, please see the [Agent CLI Guide](agent-getting-started.md).
+
+---
+
+## 1. Initialize the SDK Client
+
+```python
+from omniclaw import OmniClaw, Network
+
+# Initialize the client (auto-loads credentials from env)
+client = OmniClaw(network=Network.ETH_SEPOLIA)
+```
+
+With environment variables:
+
+```env
+CIRCLE_API_KEY=your_circle_api_key
+OMNICLAW_NETWORK=ETH-SEPOLIA
+```
+
+### Automatic Entity Secret Management
+
+If your Circle account/API key already has an Entity Secret, set it directly:
+
+```env
+ENTITY_SECRET=your_existing_64_char_hex_entity_secret
+```
+
+Circle only allows one active Entity Secret per account/API key. OmniClaw will use `ENTITY_SECRET` from the environment first, then its managed local credential store. It only auto-generates and registers a new Entity Secret when no existing secret is provided or found.
+
+For non-interactive setup:
+
+```bash
+omniclaw setup --api-key "$CIRCLE_API_KEY" --entity-secret "$ENTITY_SECRET"
+```
+
+---
+
+## 2. Managing Wallets programmatically
+
+Whether you are building a buyer app that needs to spend funds or a seller app that needs to receive funds, you need an OmniClaw-managed wallet.
+
+### Create an Application Wallet
+```python
+# Creates a wallet_set and primary wallet for your app
+wallet_set, wallet = await client.create_agent_wallet("my-backend-app")
+
+print(f"Your application's wallet ID is: {wallet.id}")
+print(f"Your on-chain address is: {wallet.address}")
+
+# Get detailed balance (what you can spend safely)
+detailed = await client.get_detailed_balance(wallet.id)
+print(f"Available USDC: {detailed['available']}")
+```
+
+---
+
+## 3. As a Developer: Buying and Sending Payments
+
+Use the SDK to programmatically send USDC payments (e.g., in a background job, cron script, or user-initiated transaction).
+
+### Standard P2P Transfer
+```python
+result = await client.pay(
+    wallet_id=wallet.id,
+    recipient="0xRecipientAddress",
+    amount="10.50",
+    purpose="Monthly API refill",
+)
+print(f"Payment successful. TX: {result.blockchain_tx or result.transaction_id}")
+```
+
+### Paying an x402 Paid Endpoint Programmatically
+OmniClaw's routing engine handles all the complexity of the x402 402-Payment-Required handshake internally. Just pass the URL as the recipient:
+
+```python
+# OmniClaw performs the 402 handshake, signs the selected payment, retries the
+# request with the payment header, and returns the paid resource response.
+result = await client.pay(
+    wallet_id=wallet.id,
+    recipient="https://api.vendor.com/premium-data",
+    amount="0.05",
+)
+
+print(result.status, result.blockchain_tx or result.transaction_id)
+print(result.resource_data)
+```
+
+---
+
+## 4. As a Developer: Selling and Receiving Payments (Vendor)
+
+If you are building an API and want to monetize it without setting up a separate billing system, use `client.sell()` in FastAPI.
+
+### Quick Start: Gated Endpoints
+```python
+from fastapi import FastAPI
+from omniclaw import OmniClaw
+
+app = FastAPI()
+client = OmniClaw()
+
+# Require $0.01 in USDC to access this route
+@app.get("/premium-data")
+async def get_data(
+    payment=client.sell("$0.01", seller_address="0xYourWalletAddress"),
+):
+
+    # This code ONLY executes if the payment has cleared and settled.
+    return {
+        "status": "success",
+        "data": "premium content",
+        "buyer_address": payment.payer,
+    }
+```
+
+### Seller Facilitator Options
+
+The seller SDK supports multiple settlement paths.
+
+Circle Gateway default:
+
+```python
+payment=client.sell("$0.25", seller_address="0xVendorWallet")
+```
+
+Thirdweb managed x402:
+
+```python
+payment=client.sell(
+    "$0.25",
+    seller_address="0xThirdwebServerWallet",
+    facilitator="thirdweb",
+)
+```
+
+OmniClaw self-hosted exact facilitator:
+
+```python
+payment=client.sell(
+    "$0.25",
+    seller_address="0xVendorWallet",
+    facilitator="omniclaw",
+)
+```
+
+For the self-hosted path, run the facilitator separately:
+
+```bash
+export OMNICLAW_X402_SELF_HOSTED_FACILITATOR_URL="http://127.0.0.1:4022"
+export OMNICLAW_X402_EXACT_NETWORK_PROFILE="ARC-TESTNET"
+
+omniclaw facilitator exact --network-profile ARC-TESTNET --port 4022
+```
+
+See [B2B SDK Integration](../examples/b2b-sdk-integration/README.md) for complete deployment examples.
+
+### Managing Your Vendor Earnings
+Payments received via the standard Circle Gateway routes pile up in your Gateway balance. You must withdraw them to your main on-chain wallet.
+
+```python
+# Check earnings
+balance = await client.get_gateway_balance(wallet.id)
+print(f"Earnings waiting in Gateway: {balance.formatted_total}")
+
+# Sweep earnings to your exact on-chain wallet
+await client.withdraw_from_gateway(
+    wallet_id=wallet.id,
+    amount_usdc="50.00",
+)
+```
+
+---
+
+## 5. Adding Safety Guards via Code
+
+As a developer, you want absolute assurance your background jobs won't drain your liquidity.
+
+```python
+# Block your application from spending more than $100 a day
+await client.add_budget_guard(wallet.id, daily_limit="100.00", hourly_limit="20.00")
+
+# Stop runaway loops: max 5 payments per minute
+await client.add_rate_limit_guard(wallet.id, max_per_minute=5)
+
+# Never allow a single payment over $25
+await client.add_single_tx_guard(wallet.id, max_amount="25.00")
+
+# Restrict outbound funds to a specific whitelist of known vendor APIs
+await client.add_recipient_guard(
+    wallet.id,
+    mode="whitelist",
+    addresses=["0xTrustedSupplier"],
+    domains=["api.openai.com", "api.anthropic.com"],
+)
+```
+
+## 6. Advanced programmatic controls
+
+### Simulating Payments
+Test if a complex payment flow will pass guards without actually sending money.
+```python
+sim = await client.simulate(
+    wallet_id=wallet.id,
+    recipient="0xRecipient",
+    amount="25.00",
+)
+
+if sim.would_succeed:
+    print(f"Will execute using route: {sim.route}")
+else:
+    print(f"Blocked by: {sim.reason}")
+```
+
+### Webhooks
+When receiving async settlement events from the Circle API:
+```python
+event = client.webhooks.handle(payload, headers)
+print(f"Received settlement for transaction {event.transaction_hash}")
+```
diff --git a/docs/erc_804_spec.md b/docs/erc_804_spec.md
index add9574..fca6197 100644
--- a/docs/erc_804_spec.md
+++ b/docs/erc_804_spec.md
@@ -5,7 +5,7 @@ This file is a historical design note for OmniClaw's trust-layer direction. It i
 Use these docs for the current product surface instead:
 
 - [README](../README.md)
-- [Financial Policy Engine Usage Guide](SDK_USAGE_GUIDE.md)
+- [Developer Guide (SDK)](developer-guide.md)
 - [API Reference](API_REFERENCE.md)
 - [Architecture and Features](FEATURES.md)
 
diff --git a/docs/facilitators.md b/docs/facilitators.md
new file mode 100644
index 0000000..db71b44
--- /dev/null
+++ b/docs/facilitators.md
@@ -0,0 +1,361 @@
+# x402 Facilitators
+
+OmniClaw supports x402 payments through facilitator-backed settlement.
+
+A facilitator is the service that verifies an x402 payment payload and settles it on the target rail. OmniClaw is integration-first: it governs agent financial authority and routes into the facilitator that fits the seller's requirements.
+
+Supported deployment shapes:
+
+- Circle Gateway `GatewayWalletBatched` for gasless nanopayments
+- standard x402 `exact` settlement through an external facilitator such as Thirdweb or x402.org
+- optional standard x402 `exact` settlement through a self-hosted OmniClaw facilitator
+
+## Deployment Matrix
+
+Use this matrix as the canonical operating model:
+
+| Mode | Seller creates `accepts` | Who runs `verify` / `settle` | Live proof status |
+| --- | --- | --- | --- |
+| Circle Gateway | OmniClaw seller middleware | Circle Gateway facilitator | already supported in OmniClaw seller flow |
+| External exact via x402.org | seller app or OmniClaw external seller harness | x402.org | live-proven on Base Sepolia |
+| External exact via Thirdweb | Thirdweb `accepts` API or seller using Thirdweb server wallet | Thirdweb | HTTP integration wired and tested in repo; live account validation pending credentials |
+| Self-hosted OmniClaw exact facilitator | seller app or OmniClaw seller harness | OmniClaw exact facilitator | live-proven on Arc Testnet; use for Arc, Base, Ethereum Sepolia, and other supported EVM profiles |
+
+The architectural split matters:
+
+- `accepts` is a seller concern
+- `verify` and `settle` are facilitator concerns
+- buyer routing is an OmniClaw policy concern
+
+OmniClaw does not mix these layers together.
+
+The buyer still uses one action:
+
+```bash
+omniclaw-cli inspect-x402 --recipient https://seller.example.com/compute
+omniclaw-cli pay --recipient https://seller.example.com/compute --idempotency-key job-123
+```
+
+The Financial Policy Engine inspects the seller's x402 requirements and chooses a route that the seller supports and the buyer can actually fund.
+
+## Integration Model
+
+OmniClaw supports managed and self-hosted settlement paths. Thirdweb, Circle, x402.org, and other facilitators can handle settlement where they are the best fit.
+
+OmniClaw's product responsibility:
+
+- inspect what the seller accepts
+- enforce buyer policy before money moves
+- choose a fundable route
+- sign only the allowed action
+- preserve logs, limits, and operator visibility
+
+That means a seller can use managed facilitator coverage, while the buyer still uses OmniClaw as the policy-controlled execution layer.
+
+## SDK Seller Examples
+
+Vendor and enterprise sellers should normally use the Python SDK.
+
+Circle Gateway:
+
+```python
+payment=client.sell("$0.25", seller_address="0xVendorWallet")
+```
+
+Thirdweb:
+
+```python
+payment=client.sell(
+    "$0.25",
+    seller_address="0xThirdwebServerWallet",
+    facilitator="thirdweb",
+)
+```
+
+OmniClaw self-hosted exact:
+
+```python
+payment=client.sell(
+    "$0.25",
+    seller_address="0xVendorWallet",
+    facilitator="omniclaw",
+)
+```
+
+For the self-hosted exact path, set:
+
+```env
+OMNICLAW_X402_SELF_HOSTED_FACILITATOR_URL=http://127.0.0.1:4022
+OMNICLAW_X402_EXACT_NETWORK_PROFILE=ARC-TESTNET
+```
+
+## Self-Hosted Exact Facilitator
+
+OmniClaw includes a self-hosted exact facilitator for teams that need direct control over settlement infrastructure.
+
+Common use cases:
+
+- custom network support
+- enterprise self-hosting requirements
+- deterministic testnet proof
+- chain-native settlement on a selected EVM profile
+- local development and integration testing
+
+The self-hosted facilitator implements standard x402 `exact` verify and settle behavior. The seller still owns the resource URL and `accepts` requirements; the facilitator verifies and settles the signed payment payload.
+
+## Buyer Route Selection
+
+For URL payments, the buyer path is:
+
+1. request the resource
+2. receive HTTP 402 x402 requirements
+3. inspect accepted payment schemes
+4. enforce OmniClaw policy
+5. choose the best supported route
+6. sign and execute through the selected payment rail
+
+Current route priority:
+
+- use `GatewayWalletBatched` when the seller supports Circle Gateway nanopayments and the buyer has Gateway balance on the required network
+- use `exact` when the seller supports standard x402 exact settlement
+- if the seller supports both and Gateway is not ready, use `exact`
+- if no supported route is available, fail clearly before spending
+
+## Self-Host An Exact Facilitator
+
+Use self-hosting when you need local proof, custom network control, or a fallback while validating an external provider.
+
+Run a facilitator with the first-class OmniClaw command:
+
+```bash
+export OMNICLAW_X402_FACILITATOR_PRIVATE_KEY="0x..."
+
+omniclaw facilitator exact \
+  --network-profile ARC-TESTNET \
+  --port 4022
+```
+
+For Base Sepolia:
+
+```bash
+export OMNICLAW_X402_FACILITATOR_PRIVATE_KEY="0x..."
+
+omniclaw facilitator exact \
+  --network-profile BASE-SEPOLIA \
+  --port 4022
+```
+
+You can override the RPC and accepted CAIP-2 network explicitly:
+
+```bash
+omniclaw facilitator exact \
+  --network-profile ARC-TESTNET \
+  --network eip155:5042002 \
+  --rpc-url https://rpc.testnet.arc.network \
+  --port 4022
+```
+
+The facilitator exposes:
+
+- `GET /supported`
+- `POST /verify`
+- `POST /settle`
+
+It does not need to expose `accepts`.
+
+For standard x402, `accepts` comes from the seller endpoint that is being monetized. OmniClaw's seller layer and seller harnesses create those requirements, and the facilitator handles verification and settlement after the buyer signs.
+
+## Environment Variables
+
+Self-hosted facilitator:
+
+```env
+OMNICLAW_X402_FACILITATOR_PRIVATE_KEY=0x...
+OMNICLAW_X402_FACILITATOR_NETWORK_PROFILE=ARC-TESTNET
+OMNICLAW_X402_FACILITATOR_RPC_URL=https://rpc.testnet.arc.network
+OMNICLAW_X402_FACILITATOR_NETWORKS=eip155:5042002
+OMNICLAW_X402_FACILITATOR_HOST=0.0.0.0
+OMNICLAW_X402_FACILITATOR_PORT=4022
+```
+
+Seller exact endpoint:
+
+```env
+OMNICLAW_X402_EXACT_NETWORK_PROFILE=ARC-TESTNET
+OMNICLAW_X402_EXACT_FACILITATOR_URL=http://127.0.0.1:4022
+OMNICLAW_X402_EXACT_PRICE=$0.25
+```
+
+Preferred behavior:
+
+- set `OMNICLAW_PRIVATE_KEY` for the seller runtime
+- let the seller derive `payTo` from that key
+
+Optional override:
+
+```env
+OMNICLAW_X402_EXACT_PAY_TO=0xSellerAddress
+```
+
+Use the override only when you intentionally want the seller to advertise a payout address different from the runtime key.
+
+External exact facilitator:
+
+```env
+OMNICLAW_X402_EXACT_FACILITATOR_URL=https://x402.org/facilitator
+```
+
+### x402.org Base Sepolia
+
+Use x402.org first when you need an external facilitator test without Thirdweb account setup.
+
+```bash
+export OMNICLAW_PRIVATE_KEY="0xYourSellerPrivateKey"
+export OMNICLAW_X402_EXACT_NETWORK_PROFILE="BASE-SEPOLIA"
+export OMNICLAW_X402_EXACT_FACILITATOR_URL="https://x402.org/facilitator"
+
+python scripts/start_external_x402_seller.py
+```
+
+If you need a non-default payout address, add:
+
+```bash
+export OMNICLAW_X402_EXACT_PAY_TO="0xYourSellerAddress"
+```
+
+Then pay the seller with:
+
+```bash
+omniclaw-cli inspect-x402 --recipient http://127.0.0.1:4021/compute?size=70000
+omniclaw-cli pay --recipient http://127.0.0.1:4021/compute?size=70000 --idempotency-key x402-org-base-sepolia-001
+```
+
+Full runbook: [../examples/external-x402-facilitator/README.md](../examples/external-x402-facilitator/README.md).
+
+Thirdweb-backed sellers normally configure their seller middleware with Thirdweb's own facilitator object. OmniClaw buyers do not need special Thirdweb configuration; they inspect and pay the seller's x402 endpoint through the standard buyer path.
+
+For OmniClaw seller-side Thirdweb validation, set:
+
+```env
+THIRDWEB_SECRET_KEY=...
+THIRDWEB_SERVER_WALLET_ADDRESS=0x...
+THIRDWEB_X402_NETWORK=base-sepolia
+```
+
+Then create the seller gate with `facilitator="thirdweb"` and use the Thirdweb server wallet address as the seller address.
+
+Thirdweb is different from the self-hosted OmniClaw exact facilitator:
+
+- Thirdweb exposes `accepts`, `verify`, `settle`, `fetch`, and discovery over HTTP
+- OmniClaw exact facilitator exposes `supported`, `verify`, and `settle`
+- OmniClaw seller middleware or seller app still owns the resource URL and price policy
+
+## Arc Testnet
+
+Arc is supported as an exact-settlement EVM network profile:
+
+- OmniClaw profile: `ARC-TESTNET`
+- CAIP-2 network: `eip155:5042002`
+- default RPC: `https://rpc.testnet.arc.network`
+- explorer: `https://testnet.arcscan.app`
+- USDC interface: `0x3600000000000000000000000000000000000000`
+
+That means an Arc seller can advertise standard x402 `exact` requirements, the buyer can pay through OmniClaw policy controls, and settlement can be viewed on ArcScan.
+
+Arc self-hosted exact is now live-proven in this repo workflow:
+
+- seller advertises `exact` on `eip155:5042002`
+- OmniClaw buyer selects `x402` with `direct_wallet`
+- OmniClaw exact facilitator handles `verify` and `settle`
+- settlement confirms on Arc Testnet RPC
+
+Practical boundary:
+
+- yes, self-hosted OmniClaw exact can be used for Arc
+- yes, the same exact model works for Base Sepolia and other supported EVM profiles
+- no, this does not mean "every network automatically works"
+
+For the profiles already configured in OmniClaw, nothing else needs to be invented in the product layer. The required network metadata is already present in code:
+
+- CAIP-2 mapping
+- default RPC
+- explorer base URL where available
+- default USDC asset address where available
+
+The network must have:
+
+- an EVM CAIP-2 mapping
+- a configured network profile
+- an RPC endpoint
+- a USDC asset address compatible with the exact flow
+
+So the operational requirement for an already configured profile is only:
+
+- run the facilitator with a funded seller key
+- run the seller surface with the same target profile
+- run the buyer policy engine with a funded buyer key on that network
+- execute `inspect-x402` and `pay`
+
+That is a deployment requirement, not a missing architecture requirement.
+
+## External Facilitators
+
+External facilitators remain first-class. If a seller advertises an `exact` payment requirement using another facilitator, OmniClaw's buyer flow can still pay through the standard x402 SDK path as long as:
+
+- the buyer has the required chain funds
+- the seller requirements include a supported `exact` payment option
+- the selected facilitator can verify and settle the payload
+
+The product rule is simple: OmniClaw governs financial authority; facilitators settle supported x402 payment payloads.
+
+### Thirdweb
+
+Thirdweb is the recommended managed external facilitator path to validate next. It is a strong fit for teams that want broad EVM network coverage and gas sponsorship without operating their own facilitator.
+
+Based on Thirdweb's x402 facilitator docs, their facilitator:
+
+- verifies and submits x402 payments
+- uses the seller's Thirdweb server wallet
+- supports gasless transaction submission through EIP-7702
+- exposes public HTTP `accepts`, `verify`, `settle`, `fetch`, and discovery endpoints that OmniClaw can call directly from Python
+- supports payments across 170+ EVM chains
+- supports tokens that expose ERC-2612 permit or ERC-3009 authorization
+
+How this fits OmniClaw:
+
+- buyer side: OmniClaw can pay Thirdweb-backed x402 endpoints through the standard `exact` buyer path
+- seller side: a team can use Thirdweb's own seller/facilitator stack instead of running an OmniClaw facilitator
+- policy layer: OmniClaw still controls whether the agent is allowed to pay before money moves
+
+Recommended Thirdweb validation flow:
+
+1. call Thirdweb's HTTP `accepts` endpoint through OmniClaw's Python facilitator adapter to generate seller requirements
+2. capture a signed x402 `paymentPayload` and matching `paymentRequirements`
+3. call Thirdweb's HTTP `verify` endpoint through OmniClaw's Python facilitator adapter
+4. call Thirdweb's HTTP `settle` endpoint through OmniClaw's Python facilitator adapter
+5. optionally test Thirdweb's HTTP `fetch` and discovery endpoints for ecosystem integration
+6. confirm the transaction in the Thirdweb dashboard and chain explorer
+7. run a full buyer flow against a Thirdweb-backed seller URL once seller credentials are available
+
+The repo includes a direct HTTP validation target at [../examples/thirdweb-http-facilitator/README.md](../examples/thirdweb-http-facilitator/README.md).
+
+When Thirdweb credentials are available, validate the full flow with the same proof checklist used for other facilitators: seller URL, requirements, payment result, settlement transaction, and final paid response.
+
+## Operational Model
+
+For production-like deployments, run the facilitator as separate infrastructure from the Financial Policy Engine.
+
+Recommended separation:
+
+- buyer Financial Policy Engine: enforces the buyer's policy and signs buyer-side actions
+- seller app: exposes paid resources and advertises x402 requirements
+- facilitator: verifies and settles x402 payloads
+
+This separation matters because it keeps policy, resource serving, and settlement independently deployable.
+
+## References
+
+- Arc contract addresses: https://docs.arc.network/arc/references/contract-addresses
+- Circle USDC contract addresses: https://developers.circle.com/stablecoins/usdc-contract-addresses
+- Thirdweb x402 facilitator: https://portal.thirdweb.com/x402/facilitator
+- x402 network and token support: https://docs.x402.org/core-concepts/network-and-token-support
diff --git a/.agents/skills/omniclaw-cli/SKILL.md b/docs/omniclaw-cli-skill/SKILL.md
similarity index 77%
rename from .agents/skills/omniclaw-cli/SKILL.md
rename to docs/omniclaw-cli-skill/SKILL.md
index b79d65f..837c129 100644
--- a/.agents/skills/omniclaw-cli/SKILL.md
+++ b/docs/omniclaw-cli-skill/SKILL.md
@@ -1,12 +1,12 @@
 ---
 name: omniclaw
 description: >
-  Use this skill whenever you need to pay for an x402 URL, transfer USDC to an
-  address, inspect OmniClaw balances or ledger entries, or expose a paid API
-  with omniclaw-cli serve. OmniClaw is the Economic Execution and Control Layer
-  for Agentic Systems. The CLI is the zero-trust execution layer: buyers use
-  `omniclaw-cli pay`, sellers use `omniclaw-cli serve`. Use this skill for the
-  CLI execution path only, not for owner setup, policy editing, wallet
+  Use this skill whenever an agent needs to pay for an x402 URL, transfer USDC
+  to an address, inspect OmniClaw balances or ledger entries, or expose a
+  temporary agent-owned paid service with omniclaw-cli serve. OmniClaw is the
+  Economic Execution and Control Layer for Agentic Systems. The CLI is the
+  zero-trust execution layer for agents. Use this skill for the CLI execution
+  path only, not for vendor SDK integration, owner setup, policy editing, wallet
   provisioning, or Financial Policy Engine administration.
 requires:
   - env: OMNICLAW_SERVER_URL
@@ -31,7 +31,7 @@ Use `omniclaw-cli` only when the task is directly about one of these actions:
 - transfer USDC to an address
 - inspect wallet, Gateway, or Circle balances
 - inspect transaction history
-- expose a paid seller endpoint with `serve`
+- expose a temporary agent-owned paid endpoint with `serve`
 
 Do not use this skill for:
 
@@ -52,10 +52,12 @@ It is the economic execution and control layer that combines:
 
 This skill is specifically about the CLI execution surface.
 
-The same CLI has two economic roles:
+The same CLI has two agent-side economic roles:
 
 - buyer role: `omniclaw-cli pay`
-- seller role: `omniclaw-cli serve`
+- temporary/local seller role: `omniclaw-cli serve`
+
+Vendor and enterprise seller APIs should use the Python SDK with `client.sell(...)`, not this CLI skill.
 
 The agent does not control the private key.
 The Financial Policy Engine enforces policy and signs allowed actions.
@@ -93,16 +95,17 @@ Do not invent or search for them yourself.
 
 ### For x402 URLs
 
-1. Use `omniclaw-cli pay --recipient <url>`.
-2. Add `--method`, `--body`, and `--header` when the paid endpoint expects a non-GET request.
-3. Add `--output` if the paid response should be saved.
+1. Run `omniclaw-cli inspect-x402 --recipient <url>` before the first live payment to confirm the seller requirements and buyer funding path.
+2. Use `omniclaw-cli pay --recipient <url>`.
+3. Add `--method`, `--body`, and `--header` when the paid endpoint expects a non-GET request.
+4. Add `--output` if the paid response should be saved.
 
 ### For direct address transfers
 
 1. Use `omniclaw-cli pay --recipient <0xaddress> --amount <usdc>`.
 2. Always include `--purpose`.
 
-### For seller tasks
+### For agent-owned local seller tasks
 
 1. Inspect current state with `balance-detail`.
 2. Start the paid endpoint with `omniclaw-cli serve`.
diff --git a/.agents/skills/omniclaw-cli/references/cli-reference.md b/docs/omniclaw-cli-skill/references/cli-reference.md
similarity index 94%
rename from .agents/skills/omniclaw-cli/references/cli-reference.md
rename to docs/omniclaw-cli-skill/references/cli-reference.md
index 5692345..a729bea 100644
--- a/.agents/skills/omniclaw-cli/references/cli-reference.md
+++ b/docs/omniclaw-cli-skill/references/cli-reference.md
@@ -6,13 +6,14 @@ Do not hand-edit command schemas here; regenerate instead.
 Generator:
 
 ```bash
-python3 .agents/skills/omniclaw-cli/scripts/generate_cli_reference.py
+python3 scripts/generate_cli_reference.py
 ```
 
 ## Usage Notes
 
 - same CLI, two roles: buyer uses `pay`, seller uses `serve`
 - use `can-pay` before a new recipient when policy allow/deny matters
+- use `inspect-x402` before a new paid URL when you need to see seller requirements and buyer funding readiness
 - use `balance-detail` when Gateway state matters
 - use `--idempotency-key` for job-based payments
 - for x402 URLs, `--amount` can be omitted because the payment requirements come from the seller endpoint
@@ -24,6 +25,7 @@ Buyer paying an x402 endpoint:
 
 ```bash
 omniclaw-cli can-pay --recipient http://seller-host:8000/api/data
+omniclaw-cli inspect-x402 --recipient http://seller-host:8000/api/data
 omniclaw-cli pay --recipient http://seller-host:8000/api/data --idempotency-key job-123
 ```
 
@@ -82,6 +84,9 @@ omniclaw-cli serve \
 │ withdraw_trustless_complete   Alias for withdraw-trustless-complete          │
 │ pay                           Execute a payment or pay for an x402 service.  │
 │ simulate                      Simulate a payment without executing.          │
+│ inspect-x402                  Inspect an x402 endpoint and show which        │
+│                               payment route OmniClaw would use.              │
+│ inspect_x402                  Alias for inspect-x402                         │
 │ can-pay                       Check if recipient is allowed.                 │
 │ can_pay                       Alias for can-pay                              │
 │ create-intent                 Create a payment intent (authorize).           │
@@ -204,6 +209,24 @@ omniclaw-cli serve \
 ╰──────────────────────────────────────────────────────────────────────────────╯
 ```
 
+### `omniclaw-cli inspect-x402 --help`
+
+```text
+                                                                                
+ Usage: omniclaw-cli inspect-x402 [OPTIONS]                                     
+                                                                                
+ Inspect an x402 endpoint and show which payment route OmniClaw would use.      
+                                                                                
+╭─ Options ────────────────────────────────────────────────────────────────────╮
+│ *  --recipient        TEXT  x402 URL to inspect [required]                  │
+│    --amount           TEXT  Optional max amount in USDC                     │
+│    --method           TEXT  HTTP method for x402 requests [default: GET]    │
+│    --body             TEXT  Request body for x402 requests                  │
+│    --header           TEXT  Additional headers for x402 requests            │
+│    --help                   Show this message and exit.                     │
+╰──────────────────────────────────────────────────────────────────────────────╯
+```
+
 ### `omniclaw-cli simulate --help`
 
 ```text
diff --git a/docs/omniclaw-cli-skill/scripts/generate_cli_reference.py b/docs/omniclaw-cli-skill/scripts/generate_cli_reference.py
new file mode 100755
index 0000000..0a1a753
--- /dev/null
+++ b/docs/omniclaw-cli-skill/scripts/generate_cli_reference.py
@@ -0,0 +1,149 @@
+#!/usr/bin/env python3
+from __future__ import annotations
+
+import os
+import subprocess
+from pathlib import Path
+
+REPO_ROOT = Path(__file__).resolve().parents[3]
+HUMAN_REF = REPO_ROOT / "docs" / "cli-reference.md"
+
+COMMANDS = [
+    ("omniclaw-cli --help", ["omniclaw-cli", "--help"]),
+    ("omniclaw-cli configure --help", ["omniclaw-cli", "configure", "--help"]),
+    ("omniclaw-cli status --help", ["omniclaw-cli", "status", "--help"]),
+    ("omniclaw-cli ping --help", ["omniclaw-cli", "ping", "--help"]),
+    ("omniclaw-cli address --help", ["omniclaw-cli", "address", "--help"]),
+    ("omniclaw-cli balance --help", ["omniclaw-cli", "balance", "--help"]),
+    ("omniclaw-cli balance-detail --help", ["omniclaw-cli", "balance-detail", "--help"]),
+    ("omniclaw-cli can-pay --help", ["omniclaw-cli", "can-pay", "--help"]),
+    ("omniclaw-cli inspect-x402 --help", ["omniclaw-cli", "inspect-x402", "--help"]),
+    ("omniclaw-cli simulate --help", ["omniclaw-cli", "simulate", "--help"]),
+    ("omniclaw-cli pay --help", ["omniclaw-cli", "pay", "--help"]),
+    ("omniclaw-cli deposit --help", ["omniclaw-cli", "deposit", "--help"]),
+    ("omniclaw-cli withdraw --help", ["omniclaw-cli", "withdraw", "--help"]),
+    ("omniclaw-cli withdraw-trustless --help", ["omniclaw-cli", "withdraw-trustless", "--help"]),
+    ("omniclaw-cli withdraw-trustless-complete --help", ["omniclaw-cli", "withdraw-trustless-complete", "--help"]),
+    ("omniclaw-cli serve --help", ["omniclaw-cli", "serve", "--help"]),
+    ("omniclaw-cli create-intent --help", ["omniclaw-cli", "create-intent", "--help"]),
+    ("omniclaw-cli confirm-intent --help", ["omniclaw-cli", "confirm-intent", "--help"]),
+    ("omniclaw-cli get-intent --help", ["omniclaw-cli", "get-intent", "--help"]),
+    ("omniclaw-cli cancel-intent --help", ["omniclaw-cli", "cancel-intent", "--help"]),
+    ("omniclaw-cli ledger --help", ["omniclaw-cli", "ledger", "--help"]),
+    ("omniclaw-cli list-tx --help", ["omniclaw-cli", "list-tx", "--help"]),
+    ("omniclaw-cli confirmations --help", ["omniclaw-cli", "confirmations", "--help"]),
+    ("omniclaw-cli confirmations get --help", ["omniclaw-cli", "confirmations", "get", "--help"]),
+    ("omniclaw-cli confirmations approve --help", ["omniclaw-cli", "confirmations", "approve", "--help"]),
+    ("omniclaw-cli confirmations deny --help", ["omniclaw-cli", "confirmations", "deny", "--help"]),
+]
+
+FALLBACK_OUTPUTS = {
+    "omniclaw-cli balance --help": """\
+Usage: omniclaw-cli balance [OPTIONS]
+
+Get wallet balance.
+
+Options:
+  --help  Show this message and exit.
+""",
+    "omniclaw-cli balance-detail --help": """\
+Usage: omniclaw-cli balance-detail [OPTIONS]
+
+Get detailed balance including Gateway and Circle wallet.
+
+Options:
+  --help  Show this message and exit.
+""",
+}
+
+TIMEOUT_SECONDS = 25
+
+HEADER = """# OmniClaw CLI Reference
+
+This file is generated from the live `omniclaw-cli --help` surface.
+Do not hand-edit command schemas here; regenerate instead.
+
+Generator:
+
+```bash
+python3 scripts/generate_cli_reference.py
+```
+
+## Usage Notes
+
+- same CLI, two roles: buyer uses `pay`, seller uses `serve`
+- use `can-pay` before a new recipient when policy allow/deny matters
+- use `inspect-x402` before a new paid URL when you need to see seller requirements and buyer funding readiness
+- use `balance-detail` when Gateway state matters
+- use `--idempotency-key` for job-based payments
+- for x402 URLs, `--amount` can be omitted because the payment requirements come from the seller endpoint
+- `serve` binds to `0.0.0.0` even if the banner prints `localhost`
+
+## Example Flows
+
+Buyer paying an x402 endpoint:
+
+```bash
+omniclaw-cli can-pay --recipient http://seller-host:8000/api/data
+omniclaw-cli inspect-x402 --recipient http://seller-host:8000/api/data
+omniclaw-cli pay --recipient http://seller-host:8000/api/data --idempotency-key job-123
+```
+
+Buyer paying a direct address:
+
+```bash
+omniclaw-cli pay \\
+  --recipient 0xRecipientAddress \\
+  --amount 5.00 \\
+  --purpose "service payment" \\
+  --idempotency-key job-123
+```
+
+Seller exposing a paid endpoint:
+
+```bash
+omniclaw-cli serve \\
+  --price 0.01 \\
+  --endpoint /api/data \\
+  --exec "python app.py" \\
+  --port 8000
+```
+
+## Live Help Output
+"""
+
+
+def run_help(title: str, args: list[str]) -> str:
+    try:
+        proc = subprocess.run(
+            args,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.STDOUT,
+            text=True,
+            timeout=TIMEOUT_SECONDS,
+            check=False,
+            env={"OMNICLAW_CLI_NO_BANNER": "1", **os.environ},
+        )
+    except subprocess.TimeoutExpired:
+        fallback = FALLBACK_OUTPUTS.get(title)
+        if fallback:
+            return f"{fallback.rstrip()}\n\n[live help timed out after {TIMEOUT_SECONDS}s; schema filled from source]"
+        return f"[help command timed out after {TIMEOUT_SECONDS}s]"
+
+    output = (proc.stdout or "").rstrip()
+    if proc.returncode == 0:
+        return output
+
+    if output:
+        return f"{output}\n\n[exit code: {proc.returncode}]"
+    return f"[help command failed with exit code {proc.returncode}]"
+
+
+sections: list[str] = [HEADER.rstrip()]
+for title, args in COMMANDS:
+    output = run_help(title, args)
+    sections.append(f"### `{title}`\n\n```text\n{output}\n```")
+
+content = "\n\n".join(sections) + "\n"
+HUMAN_REF.write_text(content)
+print(f"wrote {HUMAN_REF}")
diff --git a/docs/omniclaw-cli-skill/scripts/generate_cli_reference.sh b/docs/omniclaw-cli-skill/scripts/generate_cli_reference.sh
new file mode 100755
index 0000000..0188225
--- /dev/null
+++ b/docs/omniclaw-cli-skill/scripts/generate_cli_reference.sh
@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT_DIR"
+python3 scripts/generate_cli_reference.py
diff --git a/docs/operator-cli.md b/docs/operator-cli.md
new file mode 100644
index 0000000..68fe01a
--- /dev/null
+++ b/docs/operator-cli.md
@@ -0,0 +1,54 @@
+# Operator CLI
+
+OmniClaw ships two command surfaces:
+
+- `omniclaw` for owner/operator infrastructure
+- `omniclaw-cli` for agent-side financial execution
+
+Use `omniclaw` when you are running infrastructure:
+
+```bash
+omniclaw setup --api-key "$CIRCLE_API_KEY" --entity-secret "$ENTITY_SECRET"
+omniclaw server --port 8080
+omniclaw facilitator exact --network-profile ARC-TESTNET --port 4022
+omniclaw policy lint --path ./policy.json
+omniclaw env
+omniclaw doctor
+```
+
+`--entity-secret` is optional only when this Circle API key/account has not created one yet. Circle allows one active Entity Secret per account/API key. If you already have it, pass it directly; if you omit it and OmniClaw cannot find one in env or managed config, setup will generate and register a new one.
+
+Use `omniclaw-cli` when an agent is performing constrained financial actions:
+
+```bash
+omniclaw-cli can-pay --recipient https://seller.example.com/compute
+omniclaw-cli inspect-x402 --recipient https://seller.example.com/compute
+omniclaw-cli pay --recipient https://seller.example.com/compute --idempotency-key job-123
+omniclaw-cli serve --price 0.01 --endpoint /api/data --exec "python app.py"
+```
+
+`omniclaw-cli serve` is for agent-owned or local paid services. Vendor and enterprise APIs should use the Python SDK seller middleware (`client.sell(...)`) inside the application.
+
+## Responsibility Split
+
+The operator CLI manages trusted infrastructure and configuration. The agent CLI executes through the Financial Policy Engine and never needs raw owner authority.
+
+This split is central to OmniClaw:
+
+- tools expose what the agent can try to do
+- the Financial Policy Engine governs what financial authority the agent actually has
+- facilitators settle valid x402 payment payloads on supported rails
+
+## Self-Hosted Facilitator
+
+The operator CLI includes a first-class facilitator command:
+
+```bash
+export OMNICLAW_X402_FACILITATOR_PRIVATE_KEY="0x..."
+
+omniclaw facilitator exact \
+  --network-profile ARC-TESTNET \
+  --port 4022
+```
+
+For the full facilitator guide, see [facilitators.md](facilitators.md).
diff --git a/docs/production-readiness.md b/docs/production-readiness.md
new file mode 100644
index 0000000..3b55167
--- /dev/null
+++ b/docs/production-readiness.md
@@ -0,0 +1,134 @@
+# Production Readiness
+
+This is the short production checklist for OmniClaw.
+
+Use it before publishing a release, running a pilot, or demoing a real external facilitator flow.
+
+## What OmniClaw Is
+
+OmniClaw is the policy-controlled execution layer for agent payments.
+
+It does four things:
+
+- inspects what a seller accepts
+- enforces buyer policy before money moves
+- routes to a compatible payment rail
+- records what happened for operators
+
+## Facilitator Strategy
+
+OmniClaw is facilitator-aware. Sellers can use the settlement path that fits their deployment while buyers keep OmniClaw policy controls in front of money movement.
+
+Supported facilitator paths:
+
+- x402.org can validate external standard exact settlement immediately on Base Sepolia
+- Thirdweb can provide broad gas-sponsored x402 settlement
+- Circle Gateway can provide batched gasless nanopayments
+- x402.org or other facilitators can support standard exact settlement
+- OmniClaw self-hosted exact facilitator is optional infrastructure for proof, Arc/custom networks, and self-hosted control
+
+## Required Proofs Before Claiming Support
+
+For any public network/facilitator claim, capture:
+
+- seller URL
+- `inspect-x402` output
+- `pay` output
+- transaction hash or settlement ID
+- dashboard/explorer screenshot
+- policy file used for the buyer
+
+Do not claim a facilitator/network combination is production-proven until this proof exists.
+
+## Buyer Lock
+
+The buyer path is locked when:
+
+- `omniclaw-cli can-pay` works
+- `omniclaw-cli inspect-x402` reports the selected route
+- `omniclaw-cli pay` uses `/api/v1/pay`
+- policy blocks unsafe recipients before settlement
+- exact x402 payments use the standard x402 SDK path
+- Gateway payments require Gateway readiness before selecting `GatewayWalletBatched`
+
+## Seller Lock
+
+The seller path is locked when:
+
+- seller advertises correct x402 requirements
+- seller does not leak Gateway metadata into non-Gateway exact flows
+- paid response unlocks only after settlement
+- settlement status is visible in logs and response metadata
+
+## Facilitator Lock
+
+The facilitator strategy is locked as:
+
+- x402.org first for external exact validation on Base Sepolia
+- Thirdweb next for managed external x402 validation once account access is available
+- Circle Gateway for batched nanopayments
+- external exact facilitators where seller requirements support them
+- OmniClaw self-hosted exact facilitator only for proof, custom networks, Arc, and self-hosted enterprise deployments
+
+Operational split:
+
+- seller surface creates `accepts`
+- facilitator verifies and settles
+- buyer policy engine decides whether payment is allowed and which route is selected
+
+Keep these layers separate in deployment docs and product claims.
+
+## Current Proof Status
+
+Treat these as the current ship state:
+
+- Base Sepolia external exact via x402.org: live-proven end to end
+- buyer exact x402 path via `/api/v1/pay`: live-proven end to end
+- seller exact route advertising correct `payTo`: live-proven end to end
+- OmniClaw self-hosted exact facilitator: live-proven on Arc Testnet and test-covered
+- Arc exact profile: live-proven with self-hosted facilitator settlement
+- Thirdweb HTTP integration: wired and test-covered for `accepts`, `verify`, `settle`, `fetch`, and discovery; live account proof still pending credentials
+
+Production wording rule:
+
+- say `live-proven` only when transaction proof exists
+- say `code-ready` when the path is implemented and test-covered but not yet rerun live in the current environment
+
+## Release Gate
+
+Run before shipping:
+
+```bash
+uv sync --extra dev
+uv run pytest \
+  tests/test_setup.py \
+  tests/test_payment_intents.py \
+  tests/test_client.py \
+  tests/test_webhook_verification.py
+
+python3 -m py_compile \
+  src/omniclaw/seller/facilitator_generic.py \
+  examples/thirdweb-http-facilitator/verify_settle.py \
+  src/omniclaw/admin_cli.py \
+  src/omniclaw/facilitator/exact.py \
+  src/omniclaw/facilitator/networks.py \
+  scripts/verify_release_artifact.py
+
+python3 scripts/release_verify.sh
+```
+
+If you are validating exact-flow pilot coverage, run the current smoke slice after syncing
+dependencies:
+
+```bash
+uv run pytest \
+  tests/test_facilitator_e2e.py \
+  tests/test_cli_facilitator.py \
+  tests/test_cctp_constants.py \
+  tests/test_exact_network_profiles.py \
+  tests/test_exact_facilitator_app.py \
+  tests/test_x402_sdk_adapter.py \
+  -q
+```
+
+This exact-flow slice currently depends on an `x402` build that exposes `x402.schemas`.
diff --git a/examples/agent/seller/start.sh b/examples/agent/seller/start.sh
index 8f33c96..a8440be 100755
--- a/examples/agent/seller/start.sh
+++ b/examples/agent/seller/start.sh
@@ -1,9 +1,8 @@
 #!/bin/bash
-export CIRCLE_API_KEY=TEST_API_KEY:511a1daf3edd65884326e8f56368088a:396b2b196a9206c435c08de607f7ee2b
-export OMNICLAW_PRIVATE_KEY=0x5ec6f9922879be60d25c2d10b39a89cd8138eeffedc077296a174c2a1b9254c0
-export OMNICLAW_RPC_URL=https://ethereum-sepolia-rpc.publicnode.com
-export OMNICLAW_NETWORK=ETH-SEPOLIA
-export OMNICLAW_AGENT_TOKEN=seller-agent-token
-export OMNICLAW_AGENT_POLICY_PATH=/home/abiorh/omnuron-labs/omniclaw/examples/agent/seller/policy.json
-cd /home/abiorh/omnuron-labs/omniclaw
+export CIRCLE_API_KEY=${CIRCLE_API_KEY:-}
+export OMNICLAW_PRIVATE_KEY=${OMNICLAW_PRIVATE_KEY:-}
+export OMNICLAW_RPC_URL=${OMNICLAW_RPC_URL:-https://ethereum-sepolia-rpc.publicnode.com}
+export OMNICLAW_NETWORK=${OMNICLAW_NETWORK:-ETH-SEPOLIA}
+export OMNICLAW_AGENT_TOKEN=${OMNICLAW_AGENT_TOKEN:-seller-agent-token}
+export OMNICLAW_AGENT_POLICY_PATH=${OMNICLAW_AGENT_POLICY_PATH:-$(pwd)/examples/agent/seller/policy.json}
 exec uv run uvicorn omniclaw.agent.server:app --host 0.0.0.0 --port 8081
diff --git a/examples/b2b-sdk-integration/README.md b/examples/b2b-sdk-integration/README.md
new file mode 100644
index 0000000..55e8e33
--- /dev/null
+++ b/examples/b2b-sdk-integration/README.md
@@ -0,0 +1,220 @@
+# B2B SDK Integration
+
+This is the enterprise/vendor integration path.
+
+Use this when a business owns the product surface, backend, API, or workflow. The vendor integrates OmniClaw through the Python SDK. Agents may still buy from that vendor, but the vendor does not need to run `omniclaw-cli`.
+
+## Deployment Model
+
+| Component | Who Runs It | Purpose |
+| --- | --- | --- |
+| Vendor app | enterprise/vendor | Serves the product API and uses `client.sell(...)` |
+| Buyer app or agent | customer/partner/internal team | Pays through SDK or CLI |
+| Financial Policy Engine | owner/operator | Optional API service for policy-controlled agent execution |
+| Facilitator | vendor/operator/managed provider | Verifies and settles x402 payloads |
+
+The Financial Policy Engine is the hosted policy-control service built on the same OmniClaw SDK primitives. Use it when the payer is an agent, workflow, or external automation that should not hold raw wallet authority.
+
+For pure backend-to-backend integrations, a business can also embed the SDK directly in its own service and apply guards/policy in-process.
+
+## Scenario 1: Vendor API With Circle Gateway
+
+Use this when the vendor wants Circle Gateway `GatewayWalletBatched` settlement.
+
+Environment:
+
+```bash
+export CIRCLE_API_KEY="..."
+export OMNICLAW_PRIVATE_KEY="0xVendorOrOperatorKey"
+export OMNICLAW_NETWORK="BASE-SEPOLIA"
+export OMNICLAW_RPC_URL="https://sepolia.base.org"
+export SELLER_ADDRESS="0xVendorSellerAddress"
+```
+
+Vendor app:
+
+```python
+import os
+
+from fastapi import FastAPI
+from omniclaw import Network, OmniClaw
+
+app = FastAPI()
+client = OmniClaw(network=Network.BASE_SEPOLIA)
+
+@app.get("/compute")
+async def compute(
+    payment=client.sell("$0.25", seller_address=os.environ["SELLER_ADDRESS"]),
+):
+    return {
+        "service": "vendor-compute",
+        "paid_by": payment.payer,
+        "result": {"job": "complete"},
+    }
+```
+
+Executable example: `vendor_circle.py`
+
+Run:
+
+```bash
+uvicorn vendor_app:app --host 0.0.0.0 --port 8000
+```
+
+## Scenario 2: Vendor API With Thirdweb Managed x402
+
+Use this when the vendor wants managed external x402 settlement and Thirdweb server wallet support.
+
+Environment:
+
+```bash
+export THIRDWEB_SECRET_KEY="..."
+export THIRDWEB_SERVER_WALLET_ADDRESS="0xThirdwebServerWallet"
+export THIRDWEB_X402_NETWORK="base-sepolia"
+export SELLER_ADDRESS="$THIRDWEB_SERVER_WALLET_ADDRESS"
+```
+
+Vendor app:
+
+```python
+import os
+
+from fastapi import FastAPI
+from omniclaw import OmniClaw
+
+app = FastAPI()
+client = OmniClaw()
+
+@app.get("/report")
+async def report(
+    payment=client.sell(
+        "$0.50",
+        seller_address=os.environ["SELLER_ADDRESS"],
+        facilitator="thirdweb",
+    ),
+):
+    return {
+        "service": "vendor-report",
+        "paid_by": payment.payer,
+        "report": {"status": "ready"},
+    }
+```
+
+Executable example: `vendor_thirdweb.py`
+
+Thirdweb creates the seller `accepts` requirements and handles `verify` / `settle`. OmniClaw still controls the SDK surface and exposes the same paid endpoint behavior.
+
+## Scenario 3: Vendor API With OmniClaw Self-Hosted Exact Facilitator
+
+Use this when the vendor wants self-hosted exact settlement on a supported EVM profile such as Arc Testnet or Base Sepolia.
+
+Start the facilitator:
+
+```bash
+export OMNICLAW_X402_FACILITATOR_PRIVATE_KEY="0xFacilitatorKey"
+
+omniclaw facilitator exact \
+  --network-profile ARC-TESTNET \
+  --port 4022
+```
+
+Vendor app environment:
+
+```bash
+export OMNICLAW_X402_SELF_HOSTED_FACILITATOR_URL="http://127.0.0.1:4022"
+export OMNICLAW_X402_EXACT_NETWORK_PROFILE="ARC-TESTNET"
+export SELLER_ADDRESS="0xVendorSellerAddress"
+```
+
+Vendor app:
+
+```python
+import os
+
+from fastapi import FastAPI
+from omniclaw import OmniClaw
+
+app = FastAPI()
+client = OmniClaw()
+
+@app.get("/arc-compute")
+async def arc_compute(
+    payment=client.sell(
+        "$0.25",
+        seller_address=os.environ["SELLER_ADDRESS"],
+        facilitator="omniclaw",
+    ),
+):
+    return {
+        "service": "arc-vendor-compute",
+        "paid_by": payment.payer,
+        "result": {"network": "ARC-TESTNET", "status": "complete"},
+    }
+```
+
+Executable example: `vendor_self_hosted_exact.py`
+
+In this mode:
+
+- the vendor app creates `accepts`
+- the self-hosted OmniClaw facilitator handles `/verify` and `/settle`
+- the buyer can pay with OmniClaw CLI, OmniClaw SDK, or any compatible x402 buyer
+
+## Scenario 4: Enterprise Buyer With SDK
+
+Use this when a backend service, not an interactive agent, needs to buy from a paid vendor endpoint.
+
+```python
+from omniclaw import Network, OmniClaw
+
+client = OmniClaw(network=Network.BASE_SEPOLIA)
+
+result = await client.pay(
+    wallet_id="enterprise-wallet-id",
+    recipient="https://vendor.example.com/compute",
+    amount="1.00",
+    purpose="vendor compute job",
+    idempotency_key="compute-job-2026-04-14-001",
+)
+
+if not result.success:
+    raise RuntimeError(result.error or "payment failed")
+
+print(result.status, result.blockchain_tx or result.transaction_id)
+```
+
+Executable example: `buyer_sdk.py`
+
+## Scenario 5: Enterprise Buyer With Policy Engine
+
+Use this when the payer is an internal agent, worker, or partner-facing integration and the enterprise wants a network boundary between the agent and signing authority.
+
+Policy engine environment:
+
+```bash
+export OMNICLAW_PRIVATE_KEY="0xEnterpriseBuyerKey"
+export OMNICLAW_AGENT_TOKEN="enterprise-agent-token"
+export OMNICLAW_AGENT_POLICY_PATH="./policy.json"
+export OMNICLAW_NETWORK="BASE-SEPOLIA"
+export OMNICLAW_RPC_URL="https://sepolia.base.org"
+
+omniclaw server --port 8080
+```
+
+Agent or worker environment:
+
+```bash
+export OMNICLAW_SERVER_URL="https://policy.enterprise.example"
+export OMNICLAW_TOKEN="enterprise-agent-token"
+```
+
+The worker can now call the policy engine instead of holding wallet authority directly. The CLI is one client for this API; an enterprise can also call the API from its own worker.
+
+## Deployment Checklist
+
+- Choose the seller path: Circle Gateway, Thirdweb, or OmniClaw self-hosted exact.
+- Put the vendor product API behind `client.sell(...)`.
+- Run the buyer through SDK directly or through the Financial Policy Engine.
+- Use one idempotency key per business job.
+- Log seller fulfillment separately from settlement.
+- Capture `402`, `inspect`, `pay`, settlement tx, and final paid response before production traffic.
diff --git a/examples/b2b-sdk-integration/buyer_sdk.py b/examples/b2b-sdk-integration/buyer_sdk.py
new file mode 100644
index 0000000..3d4f8e1
--- /dev/null
+++ b/examples/b2b-sdk-integration/buyer_sdk.py
@@ -0,0 +1,23 @@
+from __future__ import annotations
+
+import asyncio
+import os
+from uuid import uuid4
+
+from omniclaw import Network, OmniClaw
+
+
+async def main() -> None:
+    client = OmniClaw(network=Network.from_string(os.getenv("OMNICLAW_NETWORK", "BASE-SEPOLIA")))
+    result = await client.pay(
+        wallet_id=os.environ["OMNICLAW_BUYER_WALLET_ID"],
+        recipient=os.environ["OMNICLAW_BUYER_RECIPIENT"],
+        amount=os.getenv("OMNICLAW_BUYER_MAX_AMOUNT", "1.00"),
+        purpose=os.getenv("OMNICLAW_BUYER_PURPOSE", "vendor payment"),
+        idempotency_key=os.getenv("OMNICLAW_BUYER_IDEMPOTENCY_KEY", f"buyer-sdk-{uuid4()}"),
+    )
+    print(result.model_dump_json(indent=2) if hasattr(result, "model_dump_json") else result)
+
+
+if __name__ == "__main__":
+    asyncio.run(main())
diff --git a/examples/b2b-sdk-integration/vendor_circle.py b/examples/b2b-sdk-integration/vendor_circle.py
new file mode 100644
index 0000000..7371822
--- /dev/null
+++ b/examples/b2b-sdk-integration/vendor_circle.py
@@ -0,0 +1,24 @@
+from __future__ import annotations
+
+import os
+
+from fastapi import FastAPI
+
+from omniclaw import Network, OmniClaw
+
+
+app = FastAPI(title="OmniClaw B2B Vendor - Circle Gateway")
+client = OmniClaw(network=Network.from_string(os.getenv("OMNICLAW_NETWORK", "BASE-SEPOLIA")))
+
+
+@app.get("/compute")
+async def compute(
+    payment=client.sell("$0.25", seller_address=os.environ["SELLER_ADDRESS"]),
+):
+    return {
+        "service": "vendor-circle-compute",
+        "paid_by": payment.payer,
+        "amount": payment.amount,
+        "result": {"status": "complete"},
+    }
+
diff --git a/examples/b2b-sdk-integration/vendor_self_hosted_exact.py b/examples/b2b-sdk-integration/vendor_self_hosted_exact.py
new file mode 100644
index 0000000..9898278
--- /dev/null
+++ b/examples/b2b-sdk-integration/vendor_self_hosted_exact.py
@@ -0,0 +1,29 @@
+from __future__ import annotations
+
+import os
+
+from fastapi import FastAPI
+
+from omniclaw import OmniClaw
+
+
+app = FastAPI(title="OmniClaw B2B Vendor - Self-Hosted Exact")
+client = OmniClaw()
+
+
+@app.get("/arc-compute")
+async def arc_compute(
+    payment=client.sell(
+        "$0.25",
+        seller_address=os.environ["SELLER_ADDRESS"],
+        facilitator="omniclaw",
+    ),
+):
+    return {
+        "service": "vendor-self-hosted-exact-compute",
+        "paid_by": payment.payer,
+        "amount": payment.amount,
+        "network": os.getenv("OMNICLAW_X402_EXACT_NETWORK_PROFILE", "ARC-TESTNET"),
+        "result": {"status": "complete"},
+    }
+
diff --git a/examples/b2b-sdk-integration/vendor_thirdweb.py b/examples/b2b-sdk-integration/vendor_thirdweb.py
new file mode 100644
index 0000000..879fe4b
--- /dev/null
+++ b/examples/b2b-sdk-integration/vendor_thirdweb.py
@@ -0,0 +1,28 @@
+from __future__ import annotations
+
+import os
+
+from fastapi import FastAPI
+
+from omniclaw import OmniClaw
+
+
+app = FastAPI(title="OmniClaw B2B Vendor - Thirdweb")
+client = OmniClaw()
+
+
+@app.get("/report")
+async def report(
+    payment=client.sell(
+        "$0.50",
+        seller_address=os.environ["SELLER_ADDRESS"],
+        facilitator="thirdweb",
+    ),
+):
+    return {
+        "service": "vendor-thirdweb-report",
+        "paid_by": payment.payer,
+        "amount": payment.amount,
+        "report": {"status": "ready"},
+    }
+
diff --git a/examples/business-compute/README.md b/examples/business-compute/README.md
index e888cc6..e3e86e3 100644
--- a/examples/business-compute/README.md
+++ b/examples/business-compute/README.md
@@ -28,6 +28,24 @@ From the repo root:
 bash scripts/start_business_compute_demo.sh
 ```
 
+## Arc Vendor Mode
+
+For the shipped Arc-specific flow, use:
+
+```bash
+bash scripts/start_arc_vendor_demo.sh
+```
+
+This mode is different from the older local demo in one important way:
+
+- the buyer is not a bundled local test button
+- the buyer is your real external CLI agent, for example Telegram/OpenClaw
+- the launcher deploys the buyer policy engine and seller policy engine
+- the browser app acts as the vendor-facing seller surface
+- `ARC-TESTNET` is the default network
+
+The launcher prints the buyer policy engine details you need to configure the external CLI agent.
+
 Open in the browser:
 
 ```text
@@ -98,3 +116,10 @@ This example is intentionally business-first.
 
 The business is not presented as another agent using `omniclaw-cli`.
 The business owns the API surface, while OmniClaw provides the payment and control layer underneath.
+
+In Arc vendor mode:
+
+- the buyer uses `omniclaw-cli` externally
+- the seller is a vendor web app
+- both policy engines run on `ARC-TESTNET`
+- the business app shows the payment flow, deliveries, and settlement visibility
diff --git a/examples/business-compute/app.py b/examples/business-compute/app.py
index 795e0ad..52ae89d 100644
--- a/examples/business-compute/app.py
+++ b/examples/business-compute/app.py
@@ -25,6 +25,15 @@
 BUYER_SERVER_URL = os.environ.get("BUYER_OMNICLAW_SERVER_URL", "http://localhost:9090")
 BUYER_TOKEN = os.environ.get("BUYER_OMNICLAW_TOKEN", "payment-agent-token")
 APP_PORT = int(os.environ.get("BUSINESS_COMPUTE_PORT", "8010"))
+NETWORK_NAME = os.environ.get("BUSINESS_COMPUTE_NETWORK", "ARC-TESTNET")
+EXPLORER_BASE_URL = os.environ.get(
+    "BUSINESS_COMPUTE_EXPLORER_BASE_URL", "https://testnet.arcscan.app"
+)
+ENABLE_LOCAL_BUYER = os.environ.get("BUSINESS_COMPUTE_ENABLE_LOCAL_BUYER", "false").lower() in {
+    "1",
+    "true",
+    "yes",
+}
 PAPERS_DIR = Path(__file__).resolve().parent / "papers"
 DOWNLOAD_SIGNING_SECRET = os.environ.get(
     "BUSINESS_COMPUTE_DOWNLOAD_SECRET", "local-business-compute-demo-secret"
@@ -42,7 +51,11 @@ def default_buyer_base_url() -> str:
     return f"http://{ip}:{APP_PORT}"
 
 
-BUYER_BASE_URL = os.environ.get("BUSINESS_COMPUTE_BUYER_BASE_URL", default_buyer_base_url())
+PUBLIC_BASE_URL = os.environ.get(
+    "BUSINESS_COMPUTE_PUBLIC_BASE_URL",
+    os.environ.get("BUSINESS_COMPUTE_BUYER_BASE_URL", default_buyer_base_url()),
+)
+AGENT_BASE_URL = os.environ.get("BUSINESS_COMPUTE_AGENT_BASE_URL", default_buyer_base_url())
 
 app = FastAPI(title="OmniClaw Business Demo")
 EVENTS: deque[dict[str, Any]] = deque(maxlen=120)
@@ -174,7 +187,7 @@ class PaperProduct:
 <head>
   <meta charset=\"utf-8\" />
   <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />
-  <title>OmniClaw Business Demo</title>
+  <title>OmniClaw Arc Vendor Demo</title>
   <style>
     :root {
       --bg: #0c1220;
@@ -231,9 +244,9 @@ class PaperProduct:
 <body>
   <div class=\"wrap\">
     <div class=\"hero\">
-      <div class=\"eyebrow\">Business Seller</div>
-      <h1>Mini AWS + Research Library powered by OmniClaw</h1>
-      <div class=\"sub\">This server is the business surface. It exposes paid compute and paid research-paper products over HTTP, uses OmniClaw directly for seller-side x402 verification and Circle Gateway settlement, and only unlocks the product after payment.</div>
+      <div class=\"eyebrow\">Arc Vendor Flow</div>
+      <h1>Arc vendor services powered by OmniClaw</h1>
+      <div class=\"sub\">This server is the vendor surface. It exposes paid compute and paid research-paper products over HTTP, uses OmniClaw directly for seller-side x402 verification and Circle Gateway settlement, and only unlocks the product after payment. The buyer is expected to be your external Telegram/OpenClaw agent using omniclaw-cli against the buyer policy engine.</div>
     </div>
     <div class=\"meta\" id=\"meta\"></div>
     <div class=\"meta\" id=\"summary\"></div>
@@ -245,7 +258,7 @@ class PaperProduct:
         </div>
         <div class=\"panel\">
           <h2>Buyer usage</h2>
-          <div class=\"small\">Use the exact paid URL below inside Telegram/OpenClaw. The local test button runs the buyer through OmniClaw directly.</div>
+          <div class=\"small\">Use the exact paid URL below inside Telegram/OpenClaw. This deployed flow assumes your external agent is the real buyer.</div>
           <div style=\"height:10px\"></div>
           <pre id=\"buyerPrompt\"></pre>
         </div>
@@ -261,8 +274,8 @@ class PaperProduct:
           <pre id=\"settlements\">No settlements yet.</pre>
         </div>
         <div class=\"panel\">
-          <h2>Last buyer result</h2>
-          <pre id=\"result\">No local buyer run yet.</pre>
+          <h2>Buyer integration</h2>
+          <pre id=\"result\">External buyer mode. Use your Telegram/OpenClaw agent with the buyer policy engine details printed by the launcher.</pre>
         </div>
       </div>
     </div>
@@ -276,11 +289,15 @@ class PaperProduct:
 async function load() {
   const [catalog, summary] = await Promise.all([fetchJSON('/api/catalog'), fetchJSON('/api/summary')]);
   window.__products = catalog.products;
+  window.__enableLocalBuyer = Boolean(catalog.enable_local_buyer);
   document.getElementById('meta').innerHTML = `
-    <div class="stat"><div class="k">Seller backend</div><div class="v">${esc(catalog.seller_server)}</div></div>
-    <div class="stat"><div class="k">Buyer gateway</div><div class="v">${esc(catalog.buyer_server)}</div></div>
-    <div class="stat"><div class="k">Buyer pay base</div><div class="v">${esc(catalog.buyer_base_url)}</div></div>
-    <div class="stat"><div class="k">Browser base</div><div class="v">${esc(catalog.public_base_url)}</div></div>`;
+    <div class="stat"><div class="k">Network</div><div class="v">${esc(catalog.network)}</div></div>
+    <div class="stat"><div class="k">Seller policy engine</div><div class="v">${esc(catalog.seller_server)}</div></div>
+    <div class="stat"><div class="k">Buyer policy engine</div><div class="v">${esc(catalog.buyer_server)}</div></div>
+    <div class="stat"><div class="k">Buyer-facing base</div><div class="v">${esc(catalog.buyer_base_url)}</div></div>
+    <div class="stat"><div class="k">Buyer execution base</div><div class="v">${esc(catalog.agent_base_url)}</div></div>
+    <div class="stat"><div class="k">Explorer</div><div class="v">${esc(catalog.explorer_base_url)}</div></div>
+    <div class="stat"><div class="k">Browser base</div><div class="v">${esc(catalog.browser_base_url)}</div></div>`;
   document.getElementById('summary').innerHTML = `
     <div class="stat"><div class="k">Revenue</div><div class="v">$${esc(summary.revenue_usdc)} USDC</div></div>
     <div class="stat"><div class="k">Deliveries</div><div class="v">${esc(summary.deliveries)}</div></div>
@@ -294,11 +311,13 @@ class PaperProduct:
       <p>${esc(p.description)}</p>
       <div class="badges">${p.badges.map(b => `<span class="badge">${esc(b)}</span>`).join('')}</div>
       <div class="url">${esc(p.pay_url)}</div>
-      <div class="small" style="margin-top:8px">Browser endpoint: ${esc(p.browser_url)}</div>
+      <div class="small" style="margin-top:8px">Buyer execution URL: ${esc(p.pay_url)}</div>
+      <div class="small" style="margin-top:4px">Public URL: ${esc(p.public_pay_url)}</div>
+      <div class="small" style="margin-top:4px">Browser endpoint: ${esc(p.browser_url)}</div>
       <div class="actions">
         <button class="secondary" onclick='copyUrl(${i})'>Copy URL</button>
         <button class="secondary" onclick='copyPrompt(${i})'>Copy OpenClaw prompt</button>
-        <button onclick='runLocalBuyer(${i})'>Run local buyer test</button>
+        ${catalog.enable_local_buyer ? `<button onclick='runLocalBuyer(${i})'>Run local buyer test</button>` : ``}
       </div>
     </div>`).join('');
   await refreshEvents();
@@ -310,6 +329,10 @@ class PaperProduct:
   navigator.clipboard.writeText('pay for this url: ' + window.__products[i].pay_url);
 }
 async function runLocalBuyer(i) {
+  if (!window.__enableLocalBuyer) {
+    document.getElementById('result').textContent = 'Local buyer mode disabled for this deployment.';
+    return;
+  }
   document.getElementById('result').textContent = 'Running local buyer payment...';
   const data = await fetchJSON('/api/demo/pay', {method:'POST', headers:{'Content-Type':'application/json'}, body: JSON.stringify(window.__products[i])});
   document.getElementById('result').textContent = JSON.stringify(data, null, 2);
@@ -378,6 +401,25 @@ def persist_state() -> None:
     REDIS_CLIENT.set(REDIS_STATE_KEY, json.dumps(serialize_state()))
 
 
+def reset_state() -> None:
+    EVENTS.clear()
+    RECENT_SETTLEMENTS.clear()
+    SESSION_STORE.clear()
+    METRICS.clear()
+    METRICS.update(
+        {
+            "revenue_usdc": 0.0,
+            "deliveries": 0,
+            "compute_runs": 0,
+            "paper_unlocks": 0,
+            "downloads": 0,
+            "sessions_created": 0,
+        }
+    )
+    if REDIS_CLIENT is not None:
+        REDIS_CLIENT.delete(REDIS_STATE_KEY)
+
+
 def log_event(stage: str, message: str, level: str = "info") -> None:
     EVENTS.appendleft(
         {
@@ -711,42 +753,52 @@ async def catalog(request: Request) -> dict[str, Any]:
     for product in COMPUTE_PRODUCTS:
         query = urlencode({"job": product.job, "size": product.size})
         browser_url = f"{base_url}/compute?{query}"
-        pay_url = f"{BUYER_BASE_URL}/compute?{query}"
+        pay_url = f"{AGENT_BASE_URL}/compute?{query}"
+        public_pay_url = f"{PUBLIC_BASE_URL}/compute?{query}"
         products.append(
             {
                 **asdict(product),
                 "browser_url": browser_url,
                 "pay_url": pay_url,
+                "public_pay_url": public_pay_url,
                 "badges": ["compute", f"job={product.job}", f"size={product.size}"],
             }
         )
     for session in SESSION_PRODUCTS:
         browser_url = f"{base_url}/compute/session?tier={session.tier}"
-        pay_url = f"{BUYER_BASE_URL}/compute/session?tier={session.tier}"
+        pay_url = f"{AGENT_BASE_URL}/compute/session?tier={session.tier}"
+        public_pay_url = f"{PUBLIC_BASE_URL}/compute/session?tier={session.tier}"
         products.append(
             {
                 **asdict(session),
                 "browser_url": browser_url,
                 "pay_url": pay_url,
+                "public_pay_url": public_pay_url,
                 "badges": ["session", session.tier, f"credits={session.credits}"],
             }
         )
     for paper in PAPER_PRODUCTS:
         browser_url = f"{base_url}/papers/{paper.slug}"
-        pay_url = f"{BUYER_BASE_URL}/papers/{paper.slug}"
+        pay_url = f"{AGENT_BASE_URL}/papers/{paper.slug}"
+        public_pay_url = f"{PUBLIC_BASE_URL}/papers/{paper.slug}"
         products.append(
             {
                 **asdict(paper),
                 "browser_url": browser_url,
                 "pay_url": pay_url,
+                "public_pay_url": public_pay_url,
                 "badges": ["paper", "pdf", paper.title],
             }
         )
     return {
+        "network": NETWORK_NAME,
+        "explorer_base_url": EXPLORER_BASE_URL,
         "seller_server": SELLER_SERVER_URL,
         "buyer_server": BUYER_SERVER_URL,
-        "public_base_url": base_url,
-        "buyer_base_url": BUYER_BASE_URL,
+        "buyer_base_url": PUBLIC_BASE_URL,
+        "agent_base_url": AGENT_BASE_URL,
+        "browser_base_url": base_url,
+        "enable_local_buyer": ENABLE_LOCAL_BUYER,
         "products": products,
     }
 
@@ -761,8 +813,20 @@ async def summary() -> dict[str, Any]:
     return build_summary()
 
 
+@app.post("/api/admin/reset")
+async def admin_reset() -> dict[str, Any]:
+    reset_state()
+    log_event("boot", "Business seller reset. Waiting for buyer traffic.")
+    return {"ok": True, "status": "reset"}
+
+
 @app.post("/api/demo/pay")
 async def demo_pay(payload: dict[str, Any]) -> JSONResponse:
+    if not ENABLE_LOCAL_BUYER:
+        return JSONResponse(
+            status_code=409,
+            content={"success": False, "status": "disabled", "detail": "Local buyer mode disabled"},
+        )
     url = payload["pay_url"]
     log_event("buyer", f"Buyer initiated payment for {url}")
     resp = await buyer_post("/api/v1/x402/pay", {"url": url, "method": "GET"})
@@ -849,8 +913,8 @@ async def compute_session(request: Request) -> JSONResponse:
             "session_id": session["session_id"],
             "credits_total": product.credits,
             "credits_remaining": product.credits,
-            "submit_url": f"{BUYER_BASE_URL}/compute/jobs/{session['session_id']}?job=prime-count&size=5000",
-            "status_url": f"{BUYER_BASE_URL}/compute/sessions/{session['session_id']}",
+            "submit_url": f"{PUBLIC_BASE_URL}/compute/jobs/{session['session_id']}?job=prime-count&size=5000",
+            "status_url": f"{PUBLIC_BASE_URL}/compute/sessions/{session['session_id']}",
             "paid_by": verified.get("sender") or "unknown",
             "amount_usdc": product.price_usdc,
             "settlement_tx": verified.get("transaction") or "",
@@ -884,7 +948,7 @@ async def paper(slug: str, request: Request) -> JSONResponse:
     if isinstance(verified, JSONResponse):
         return verified
     download_token = sign_download_token(paper.filename, verified.get("transaction") or "")
-    download_url = f"{BUYER_BASE_URL}/downloads/{paper.filename}?token={download_token}"
+    download_url = f"{PUBLIC_BASE_URL}/downloads/{paper.filename}?token={download_token}"
     result = {
         "service": "research-library",
         "product": paper.title,
diff --git a/examples/external-x402-facilitator/README.md b/examples/external-x402-facilitator/README.md
new file mode 100644
index 0000000..fa84184
--- /dev/null
+++ b/examples/external-x402-facilitator/README.md
@@ -0,0 +1,101 @@
+# External x402 Facilitator Validation
+
+This example validates OmniClaw against an external standard x402 `exact` facilitator.
+
+Use this first for standard external-facilitator validation. The default path uses the public x402.org facilitator on Base Sepolia.
+
+## What This Proves
+
+- seller advertises standard x402 `exact` requirements
+- settlement goes through an external facilitator
+- OmniClaw buyer can inspect and pay through `/api/v1/pay`
+- no OmniClaw self-hosted facilitator is required for this path
+
+## Seller: x402.org On Base Sepolia
+
+Preferred setup:
+
+```bash
+export OMNICLAW_PRIVATE_KEY="0xYourSellerPrivateKey"
+```
+
+Start the seller:
+
+```bash
+python scripts/start_external_x402_seller.py
+```
+
+Defaults:
+
+```env
+OMNICLAW_X402_EXACT_NETWORK_PROFILE=BASE-SEPOLIA
+OMNICLAW_X402_EXACT_NETWORK=eip155:84532
+OMNICLAW_X402_EXACT_PRICE=$0.25
+OMNICLAW_X402_EXACT_FACILITATOR_URL=https://x402.org/facilitator
+OMNICLAW_X402_EXACT_PORT=4021
+```
+
+The seller harness derives `payTo` from `OMNICLAW_PRIVATE_KEY` by default.
+
+Optional override:
+
+```bash
+export OMNICLAW_X402_EXACT_PAY_TO="0xYourSellerAddress"
+```
+
+Use that override only when you intentionally want to advertise a payout address different from the runtime key.
+
+Paid endpoint:
+
+```text
+http://127.0.0.1:4021/compute?size=70000
+```
+
+## Buyer: OmniClaw CLI
+
+Point the CLI at the buyer Financial Policy Engine:
+
+```bash
+export OMNICLAW_SERVER_URL="http://127.0.0.1:8080"
+export OMNICLAW_TOKEN="my-agent-token"
+```
+
+Inspect:
+
+```bash
+omniclaw-cli inspect-x402 \
+  --recipient http://127.0.0.1:4021/compute?size=70000
+```
+
+Pay:
+
+```bash
+omniclaw-cli pay \
+  --recipient http://127.0.0.1:4021/compute?size=70000 \
+  --idempotency-key x402-org-base-sepolia-001
+```
+
+## Success Criteria
+
+- `inspect-x402` selects `x402`
+- selected payment source is `direct_wallet`
+- selected network is `eip155:84532`
+- payment settles
+- paid compute response unlocks
+- transaction hash appears in the response metadata
+
+## Product Meaning
+
+If this passes, the supported product claim is:
+
+`OmniClaw supports external standard x402 exact facilitators. The buyer remains policy-controlled, while the seller can settle through an external facilitator such as x402.org.`
+
+Thirdweb remains the next managed facilitator target once account access is available.
+
+## Layer Ownership
+
+For this flow:
+
+- seller harness creates the `accepts` requirements
+- x402.org handles `verify` and `settle`
+- OmniClaw buyer policy engine inspects, approves, and signs the allowed payment
diff --git a/examples/machine-to-machine/README.md b/examples/machine-to-machine/README.md
new file mode 100644
index 0000000..206744f
--- /dev/null
+++ b/examples/machine-to-machine/README.md
@@ -0,0 +1,63 @@
+# Machine-to-Machine Payments
+
+This example documents a service-to-service payment flow where one machine consumes another machine's paid API.
+
+Use it when an internal job runner, workflow engine, or autonomous agent needs to buy compute or data from another service without involving a human.
+
+## What It Proves
+
+- the consumer can inspect a paid URL
+- the consumer can pay from a policy-controlled agent
+- the producer can keep a clean HTTP product surface
+- retries stay safe through an idempotency key
+
+## Example Flow
+
+Producer service:
+
+```text
+https://api.vendor.example/compute
+```
+
+Consumer service:
+
+```bash
+export OMNICLAW_SERVER_URL="http://127.0.0.1:8080"
+export OMNICLAW_TOKEN="service-agent-token"
+
+omniclaw-cli can-pay --recipient https://api.vendor.example/compute
+omniclaw-cli inspect-x402 --recipient https://api.vendor.example/compute
+omniclaw-cli pay --recipient https://api.vendor.example/compute --idempotency-key batch-042
+```
+
+## Service Contract
+
+Design the downstream API so a machine can use it without special casing:
+
+- return `402 Payment Required` when the resource is unpaid
+- publish a stable URL that identifies the paid resource
+- accept safe retries with the same idempotency key
+- keep the paid response deterministic for the same job inputs
+
+## When To Use Exact Or Gateway
+
+OmniClaw chooses the route based on the seller's advertised requirements:
+
+- use `GatewayWalletBatched` when the producer supports Circle Gateway nanopayments and the consumer has Gateway balance
+- use `exact` when the producer supports standard x402 settlement
+- let `pay` route directly when the seller is exact-only
+
+That keeps the consumer side simple: one URL, one policy engine, one payment command.
+
+## Verification Checklist
+
+- the consumer sees `can-pay: true` before execution
+- `inspect-x402` shows the seller's supported scheme
+- payment succeeds with the same idempotency key on retry
+- the producer logs a single successful fulfillment event
+
+## Related Examples
+
+- [Vendor Integration](../vendor-integration/README.md)
+- [Local Economy](../local-economy/README.md)
+- [External x402 Facilitator](../external-x402-facilitator/README.md)
diff --git a/examples/machine-to-vendor/README.md b/examples/machine-to-vendor/README.md
new file mode 100644
index 0000000..41796ce
--- /dev/null
+++ b/examples/machine-to-vendor/README.md
@@ -0,0 +1,86 @@
+# Machine-to-Vendor Payments
+
+This example documents the flow where an external machine or agent pays a vendor-owned service.
+
+Use it when the vendor controls the product surface and the buyer is a separate agent, workflow, or integration.
+
+## What It Proves
+
+- a vendor can publish a paid endpoint without a human checkout
+- an external buyer can discover the required payment scheme
+- the paid response unlocks only after settlement
+- the vendor keeps control of the product and logs
+
+## Example Vendor Surface
+
+```text
+https://vendor.example.com/premium-report
+```
+
+The vendor should expose that URL through the SDK, for example:
+
+```python
+from fastapi import FastAPI
+from omniclaw import OmniClaw
+
+app = FastAPI()
+client = OmniClaw()
+
+@app.get("/premium-report")
+async def premium_report(
+    payment=client.sell("$0.50", seller_address="0xVendorWallet"),
+):
+    return {"report": "paid report", "paid_by": payment.payer}
+```
+
+The buyer treats that URL as a paid resource.
+
+Agent buyer:
+
+```bash
+export OMNICLAW_SERVER_URL="http://127.0.0.1:8080"
+export OMNICLAW_TOKEN="buyer-agent-token"
+
+omniclaw-cli inspect-x402 --recipient https://vendor.example.com/premium-report
+omniclaw-cli pay --recipient https://vendor.example.com/premium-report --idempotency-key report-2026-04-14
+```
+
+SDK buyer:
+
+```python
+result = await client.pay(
+    wallet_id="buyer-wallet-id",
+    recipient="https://vendor.example.com/premium-report",
+    amount="1.00",
+    purpose="premium report",
+    idempotency_key="report-2026-04-14",
+)
+```
+
+## Vendor Responsibilities
+
+- advertise the paid endpoint clearly
+- return `402 Payment Required` until payment is verified
+- use a stable product URL
+- keep the response public-safe and deterministic
+- log settlement and fulfillment events separately
+
+## Buyer Responsibilities
+
+- inspect the seller requirements before paying
+- use a stable idempotency key for each attempt
+- do not assume a specific rail unless the seller advertises it
+- retry only with the same job identity
+
+## Operational Notes
+
+The vendor does not need to know the buyer's internal system.
+The buyer does not need direct wallet access.
+OmniClaw sits between the policy decision and the payment execution.
+
+For vendor-facing API surfaces, pair this runbook with:
+
+- [B2B SDK Integration](../b2b-sdk-integration/README.md)
+- [Vendor Integration](../vendor-integration/README.md)
+- [External x402 Facilitator](../external-x402-facilitator/README.md)
+- [Thirdweb HTTP Facilitator](../thirdweb-http-facilitator/README.md)
diff --git a/examples/thirdweb-http-facilitator/README.md b/examples/thirdweb-http-facilitator/README.md
new file mode 100644
index 0000000..01fbf3b
--- /dev/null
+++ b/examples/thirdweb-http-facilitator/README.md
@@ -0,0 +1,73 @@
+# Thirdweb HTTP Facilitator Validation
+
+This example validates Thirdweb as a managed external x402 facilitator using HTTP directly from the Python OmniClaw codebase.
+
+No TypeScript seller SDK is required for this repo.
+
+OmniClaw uses Thirdweb's public HTTP API:
+
+- `POST https://api.thirdweb.com/v1/payments/x402/accepts`
+- `POST https://api.thirdweb.com/v1/payments/x402/verify`
+- `POST https://api.thirdweb.com/v1/payments/x402/settle`
+- `POST https://api.thirdweb.com/v1/payments/x402/fetch`
+- `GET https://api.thirdweb.com/v1/payments/x402/discovery/resources`
+
+## What This Proves
+
+- Thirdweb can handle managed x402 settlement.
+- OmniClaw can integrate Thirdweb without competing with it.
+- OmniClaw remains the policy and execution control layer.
+
+## Inputs
+
+You need two JSON files from an x402 flow:
+
+- `payment-payload.json` - signed x402 payment payload from the buyer
+- `payment-requirements.json` - selected seller payment requirements
+
+These are the same objects passed to x402 facilitator verify/settle calls.
+
+For seller-side requirement generation, OmniClaw can call Thirdweb's `accepts` endpoint through `ThirdwebFacilitator.create_accepts(...)`. This is the API that creates the x402 `accepts` array using the Thirdweb server wallet context.
+
+## Configure
+
+```bash
+export THIRDWEB_SECRET_KEY="..."
+export THIRDWEB_SERVER_WALLET_ADDRESS="0x..."
+```
+
+## Verify Only
+
+```bash
+python examples/thirdweb-http-facilitator/verify_settle.py \
+  --payment-payload payment-payload.json \
+  --payment-requirements payment-requirements.json \
+  --verify-only
+```
+
+## Verify And Settle
+
+```bash
+python examples/thirdweb-http-facilitator/verify_settle.py \
+  --payment-payload payment-payload.json \
+  --payment-requirements payment-requirements.json
+```
+
+## Expected Result
+
+The script prints JSON with:
+
+- facilitator name
+- verify result
+- settle result when settlement is enabled
+
+## Product Position
+
+Thirdweb settles. OmniClaw governs.
+
+For buyer-side agent flows, the normal command remains:
+
+```bash
+omniclaw-cli inspect-x402 --recipient https://seller.example.com/compute
+omniclaw-cli pay --recipient https://seller.example.com/compute --idempotency-key job-123
+```
diff --git a/examples/thirdweb-http-facilitator/verify_settle.py b/examples/thirdweb-http-facilitator/verify_settle.py
new file mode 100644
index 0000000..a387f3d
--- /dev/null
+++ b/examples/thirdweb-http-facilitator/verify_settle.py
@@ -0,0 +1,74 @@
+#!/usr/bin/env python3
+from __future__ import annotations
+
+import argparse
+import asyncio
+import json
+import os
+from pathlib import Path
+from typing import Any
+
+from omniclaw.seller import create_facilitator
+
+
+def load_json(path: str) -> dict[str, Any]:
+    with Path(path).open() as f:
+        data = json.load(f)
+    if not isinstance(data, dict):
+        raise ValueError(f"{path} must contain a JSON object")
+    return data
+
+
+async def main() -> int:
+    parser = argparse.ArgumentParser(description="Validate Thirdweb x402 HTTP facilitator calls.")
+    parser.add_argument("--payment-payload", required=True, help="Path to signed payment payload JSON")
+    parser.add_argument(
+        "--payment-requirements",
+        required=True,
+        help="Path to selected payment requirements JSON",
+    )
+    parser.add_argument("--verify-only", action="store_true", help="Do not call settle")
+    parser.add_argument(
+        "--secret-key",
+        default=os.environ.get("THIRDWEB_SECRET_KEY"),
+        help="Thirdweb secret key. Defaults to THIRDWEB_SECRET_KEY.",
+    )
+    args = parser.parse_args()
+
+    if not args.secret_key:
+        raise SystemExit("Set THIRDWEB_SECRET_KEY or pass --secret-key")
+
+    facilitator = create_facilitator(provider="thirdweb", api_key=args.secret_key)
+    try:
+        payment_payload = load_json(args.payment_payload)
+        payment_requirements = load_json(args.payment_requirements)
+
+        verify_result = await facilitator.verify(payment_payload, payment_requirements)
+        output: dict[str, Any] = {
+            "facilitator": facilitator.name,
+            "base_url": facilitator.base_url,
+            "verify": {
+                "is_valid": verify_result.is_valid,
+                "payer": verify_result.payer,
+                "invalid_reason": verify_result.invalid_reason,
+            },
+        }
+
+        if not args.verify_only:
+            settle_result = await facilitator.settle(payment_payload, payment_requirements)
+            output["settle"] = {
+                "success": settle_result.success,
+                "transaction": settle_result.transaction,
+                "network": settle_result.network,
+                "payer": settle_result.payer,
+                "error_reason": settle_result.error_reason,
+            }
+
+        print(json.dumps(output, indent=2, sort_keys=True))
+        return 0
+    finally:
+        await facilitator.close()
+
+
+if __name__ == "__main__":
+    raise SystemExit(asyncio.run(main()))
diff --git a/examples/vendor-integration/README.md b/examples/vendor-integration/README.md
new file mode 100644
index 0000000..d180813
--- /dev/null
+++ b/examples/vendor-integration/README.md
@@ -0,0 +1,153 @@
+# Vendor Integration Guide
+
+This guide shows how a traditional software vendor can expose a paid HTTP surface using the OmniClaw Python SDK.
+
+Use this when you (a human developer or business) own the product endpoint and want autonomous agents to pay before they receive data, compute, or another gated response.
+
+> **Note on Tooling:** Vendors build applications using the **OmniClaw Python SDK** (`client.sell()`). The `omniclaw-cli` tool is designed for the autonomous agents that will act as the *buyers* of your service.
+
+## What It Covers
+
+- Vendor-side payment gating with FastAPI
+- HTTP `402 Payment Required` flows
+- Production-safe vendor APIs without human checkout
+- SDK-first seller integration for B2B and enterprise deployments
+
+## Recommended Shape
+
+Keep the public surface simple:
+
+- one paid endpoint per product class
+- one clear price or pricing tier per endpoint
+- one idempotency key per job or request
+- one seller-side log stream for verification and audit
+
+Example public endpoint:
+
+```text
+https://vendor.example.com/compute
+```
+
+## Vendor Setup (FastAPI SDK)
+
+To require payment for an endpoint, integrate the OmniClaw SDK into your application. See the provided `app.py` for the complete example.
+
+```python
+from fastapi import FastAPI
+from omniclaw import OmniClaw
+
+app = FastAPI()
+client = OmniClaw()
+
+@app.get("/compute")
+async def premium_compute(
+    payment=client.sell("$0.25", seller_address="0xYourVendorWalletAddress"),
+):
+    # This code only runs AFTER payment is verified and settled!
+    return {
+        "status": "success",
+        "paid_by": payment.payer,
+        "result": {"data": "..."}
+    }
+```
+
+Run your vendor application:
+
+```bash
+uvicorn app:app --port 8000
+```
+
+## Facilitator Options
+
+The vendor controls the seller integration and chooses the settlement path.
+
+### Circle Gateway
+
+Default seller path when using Circle Gateway:
+
+```python
+payment=client.sell("$0.25", seller_address="0xYourVendorWalletAddress")
+```
+
+### Thirdweb Managed x402
+
+Use Thirdweb when the vendor wants managed x402 facilitator coverage:
+
+```bash
+export THIRDWEB_SECRET_KEY="..."
+export THIRDWEB_SERVER_WALLET_ADDRESS="0xThirdwebServerWallet"
+export THIRDWEB_X402_NETWORK="base-sepolia"
+```
+
+```python
+payment=client.sell(
+    "$0.25",
+    seller_address="0xThirdwebServerWallet",
+    facilitator="thirdweb",
+)
+```
+
+### OmniClaw Self-Hosted Exact
+
+Use this when the vendor wants to run its own exact facilitator for Arc, Base Sepolia, or another supported EVM profile:
+
+```bash
+omniclaw facilitator exact \
+  --network-profile ARC-TESTNET \
+  --port 4022
+```
+
+```bash
+export OMNICLAW_X402_SELF_HOSTED_FACILITATOR_URL="http://127.0.0.1:4022"
+export OMNICLAW_X402_EXACT_NETWORK_PROFILE="ARC-TESTNET"
+```
+
+```python
+payment=client.sell(
+    "$0.25",
+    seller_address="0xYourVendorWalletAddress",
+    facilitator="omniclaw",
+)
+```
+
+## Buyer Integration
+
+Buyers can pay from an agent CLI, a backend using the SDK, or any compatible x402 buyer.
+
+Agent buyer:
+
+```bash
+export OMNICLAW_SERVER_URL="http://127.0.0.1:8080"
+export OMNICLAW_TOKEN="agent-token-123"
+
+# The agent inspects your requirements
+omniclaw-cli inspect-x402 --recipient https://vendor.example.com/compute
+
+# The agent executes the payment
+omniclaw-cli pay --recipient https://vendor.example.com/compute --idempotency-key job-123
+```
+
+SDK buyer:
+
+```python
+result = await client.pay(
+    wallet_id="buyer-wallet-id",
+    recipient="https://vendor.example.com/compute",
+    amount="1.00",
+    purpose="vendor compute",
+    idempotency_key="job-123",
+)
+```
+
+## Verification Checklist
+
+- unauthenticated/unpaid requests return `402 Payment Required`
+- paid requests return `200 OK` and the expected product payload
+- the seller log shows a matching settlement event
+- the published URL does not require a human login flow
+
+## Related Examples
+
+- [Business Compute](../business-compute/README.md) - A larger example of a vendor web app with sessions.
+- [B2B SDK Integration](../b2b-sdk-integration/README.md)
+- [Machine-to-Machine](../machine-to-machine/README.md)
diff --git a/examples/vendor-integration/app.py b/examples/vendor-integration/app.py
new file mode 100644
index 0000000..156e4c6
--- /dev/null
+++ b/examples/vendor-integration/app.py
@@ -0,0 +1,53 @@
+"""
+Vendor Integration Example: FastAPI app protected by OmniClaw
+
+This example demonstrates how a human developer (a vendor or business)
+uses the OmniClaw Python SDK to monetize an API endpoint.
+
+Unlike autonomous agents that use `omniclaw-cli`, vendors integrate
+the OmniClaw SDK directly into their backend services.
+"""
+
+from fastapi import FastAPI
+from omniclaw import OmniClaw
+
+app = FastAPI(title="Vendor Payment-Gated API")
+client = OmniClaw()
+
+# 1. Provide your seller wallet address.
+# This represents the vendor's wallet where payments will settle.
+# For this example, we use a placeholder or assume it's passed via env.
+import os
+SELLER_ADDRESS = os.environ.get("SELLER_ADDRESS", "0xYourVendorWalletAddress")
+
+# 2. Add an endpoint that is free
+@app.get("/status")
+async def status():
+    return {"status": "ok", "message": "This endpoint is free."}
+
+# 3. Add an endpoint protected by OmniClaw x402 payment gate (Price: $0.25)
+# The `client.sell` dependency handles the 402 Payment Required handshake
+# and only allows the request through once settlement is verified.
+@app.get("/compute")
+async def premium_compute(
+    payment=client.sell("$0.25", seller_address=SELLER_ADDRESS),
+):
+    # If the code reaches here, OmniClaw has verified the payment!
+    
+    # You can access payment metadata for logging or audit
+    payer_address = payment.payer
+    
+    return {
+        "status": "success",
+        "message": "Payment verified. Compute complete.",
+        "paid_by": payer_address,
+        "amount": "$0.25",
+        "result": {
+            "computation": "complex_data_analysis_result"
+        }
+    }
+
+if __name__ == "__main__":
+    import uvicorn
+    # Run the vendor app
+    uvicorn.run(app, host="127.0.0.1", port=8000)
diff --git a/pyproject.toml b/pyproject.toml
index fca287b..5c5d951 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -86,7 +86,7 @@ Repository = "https://github.com/omnuron/omniclaw"
 Issues = "https://github.com/omnuron/omniclaw/issues"
 
 [project.scripts]
-omniclaw = "omniclaw.cli:main"
+omniclaw = "omniclaw.admin_cli:main"
 omniclaw-cli = "omniclaw.cli_agent:main"
 
 [dependency-groups]
@@ -127,7 +127,7 @@ warn_unused_ignores = true
 [tool.ruff.lint.per-file-ignores]
 # nanopayments __init__ needs specific import order to avoid circular imports
 "src/omniclaw/protocols/nanopayments/__init__.py" = ["I001"]
-"src/omniclaw/cli.py" = ["I001", "F401", "E402"]
+"src/omniclaw/admin_cli.py" = ["I001", "F401", "E402"]
 "src/omniclaw/__init__.py" = ["E402", "F401", "I001"]
 "src/omniclaw/agent/server.py" = ["E402", "F401"]
 "src/omniclaw/agent/routes.py" = ["B008", "UP037", "E402"]
diff --git a/.agents/skills/omniclaw-cli/scripts/generate_cli_reference.py b/scripts/generate_cli_reference.py
similarity index 94%
rename from .agents/skills/omniclaw-cli/scripts/generate_cli_reference.py
rename to scripts/generate_cli_reference.py
index cd584b3..ac47cb8 100755
--- a/.agents/skills/omniclaw-cli/scripts/generate_cli_reference.py
+++ b/scripts/generate_cli_reference.py
@@ -4,9 +4,7 @@
 import subprocess
 from pathlib import Path
 
-ROOT = Path(__file__).resolve().parents[4]
-SKILL_DIR = Path(__file__).resolve().parents[1]
-SKILL_REF = SKILL_DIR / "references" / "cli-reference.md"
+ROOT = Path(__file__).resolve().parents[1]
 HUMAN_REF = ROOT / "docs" / "cli-reference.md"
 
 COMMANDS = [
@@ -66,7 +64,7 @@
 Generator:
 
 ```bash
-python3 .agents/skills/omniclaw-cli/scripts/generate_cli_reference.py
+python3 scripts/generate_cli_reference.py
 ```
 
 ## Usage Notes
@@ -142,7 +140,5 @@ def run_help(title: str, args: list[str]) -> str:
     sections.append(f"### `{title}`\n\n```text\n{output}\n```")
 
 content = "\n\n".join(sections) + "\n"
-SKILL_REF.write_text(content)
 HUMAN_REF.write_text(content)
-print(f"wrote {SKILL_REF}")
 print(f"wrote {HUMAN_REF}")
diff --git a/scripts/generate_cli_reference.sh b/scripts/generate_cli_reference.sh
new file mode 100755
index 0000000..0188225
--- /dev/null
+++ b/scripts/generate_cli_reference.sh
@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT_DIR"
+python3 scripts/generate_cli_reference.py
diff --git a/scripts/reset_arc_vendor_demo_state.sh b/scripts/reset_arc_vendor_demo_state.sh
new file mode 100755
index 0000000..79c0d9c
--- /dev/null
+++ b/scripts/reset_arc_vendor_demo_state.sh
@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+BASE_URL="${1:-http://127.0.0.1:8010}"
+
+curl -fsS -X POST "${BASE_URL}/api/admin/reset" >/dev/null
+
+printf 'Arc vendor demo state reset at %s\n' "$BASE_URL"
+printf 'Summary:\n'
+curl -fsS "${BASE_URL}/api/summary"
+printf '\n'
diff --git a/scripts/start_arc_vendor_demo.sh b/scripts/start_arc_vendor_demo.sh
new file mode 100755
index 0000000..0b23b4b
--- /dev/null
+++ b/scripts/start_arc_vendor_demo.sh
@@ -0,0 +1,100 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT=$(cd "$(dirname "$0")/.." && pwd)
+cd "$ROOT"
+
+if [[ -f .env ]]; then
+  set -a
+  source .env
+  set +a
+fi
+
+export OMNICLAW_NETWORK="ARC-TESTNET"
+export OMNICLAW_RPC_URL="https://rpc.testnet.arc.network"
+export BUSINESS_COMPUTE_NETWORK="ARC-TESTNET"
+export BUSINESS_COMPUTE_EXPLORER_BASE_URL="https://testnet.arcscan.app"
+export BUSINESS_COMPUTE_ENABLE_LOCAL_BUYER="false"
+# Demo-only cleanup: strip persisted wallet bindings from copied example policies
+# so Arc runs start from a clean runtime state.
+export OMNICLAW_DEMO_RESET_POLICY_WALLETS="1"
+
+HOST_IP=$(hostname -I | awk '{print $1}')
+PUBLIC_BASE="${BUSINESS_COMPUTE_PUBLIC_BASE_URL:-http://${HOST_IP}:8010}"
+
+docker rm -f omniclaw-business-compute-demo business-compute-redis >/dev/null 2>&1 || true
+docker compose -p omniclaw-buyer -f examples/local-economy/docker-compose.payment-agent.yml down -v >/dev/null 2>&1 || true
+docker compose -p omniclaw-seller -f examples/local-economy/docker-compose.seller-agent.yml down -v >/dev/null 2>&1 || true
+
+bash scripts/start_local_economy.sh >/dev/null
+
+export PAYMENT_AGENT_POLICY_FILE="${PAYMENT_AGENT_POLICY_FILE:-$ROOT/.runtime/payment-agent.policy.runtime.json}"
+export SELLER_AGENT_POLICY_FILE="${SELLER_AGENT_POLICY_FILE:-$ROOT/.runtime/seller-agent.policy.runtime.json}"
+
+docker rm -f omniclaw-business-compute-demo >/dev/null 2>&1 || true
+docker rm -f business-compute-redis >/dev/null 2>&1 || true
+docker run -d --name business-compute-redis --network omniclaw-buyer_default redis:7-alpine >/dev/null
+
+docker run -d \
+  --name omniclaw-business-compute-demo \
+  --network omniclaw-buyer_default \
+  -p 8010:8010 \
+  -v "$ROOT:/workspace" \
+  -w /workspace \
+  -e SELLER_OMNICLAW_SERVER_URL="http://seller-agent:9091" \
+  -e SELLER_OMNICLAW_TOKEN="seller-agent-token" \
+  -e BUYER_OMNICLAW_SERVER_URL="http://payment-agent:9090" \
+  -e BUYER_OMNICLAW_TOKEN="payment-agent-token" \
+  -e BUSINESS_COMPUTE_PORT="8010" \
+  -e BUSINESS_COMPUTE_REDIS_URL="redis://business-compute-redis:6379/0" \
+  -e BUSINESS_COMPUTE_PUBLIC_BASE_URL="$PUBLIC_BASE" \
+  -e BUSINESS_COMPUTE_NETWORK="$BUSINESS_COMPUTE_NETWORK" \
+  -e BUSINESS_COMPUTE_EXPLORER_BASE_URL="$BUSINESS_COMPUTE_EXPLORER_BASE_URL" \
+  -e BUSINESS_COMPUTE_ENABLE_LOCAL_BUYER="false" \
+  -e UV_PROJECT_ENVIRONMENT="/tmp/omniclaw-business-demo-venv" \
+  omniclaw-agent:local \
+  sh -lc 'PYTHONPATH=/workspace/src:/workspace uvx --from uvicorn --with fastapi[standard] --with httpx --with redis uvicorn examples.business-compute.app:app --host 0.0.0.0 --port 8010' >/dev/null
+
+docker network connect omniclaw-seller_default omniclaw-business-compute-demo >/dev/null 2>&1 || true
+
+BUSINESS_IP=$(docker inspect omniclaw-business-compute-demo --format '{{with index .NetworkSettings.Networks "omniclaw-buyer_default"}}{{.IPAddress}}{{end}}')
+AGENT_BASE="http://${BUSINESS_IP}:8010"
+python3 - <<PY
+import json
+from pathlib import Path
+p = Path('.runtime/payment-agent.policy.runtime.json')
+data = json.loads(p.read_text())
+domains = data['wallets']['payment-agent']['recipients']['domains']
+for value in ['${BUSINESS_IP}'.strip(), '${HOST_IP}'.strip(), 'host.docker.internal', '172.17.0.1', '172.18.0.1']:
+    if value and value not in domains:
+        domains.append(value)
+p.write_text(json.dumps(data, indent=2) + '\\n')
+PY
+
+docker compose -p omniclaw-buyer -f examples/local-economy/docker-compose.payment-agent.yml up -d --no-build --force-recreate --remove-orphans >/dev/null
+
+printf '\nArc vendor demo is live.\n\n'
+printf 'Network: %s\n' "$OMNICLAW_NETWORK"
+printf 'RPC: %s\n' "$OMNICLAW_RPC_URL"
+printf 'Explorer: %s\n' "$BUSINESS_COMPUTE_EXPLORER_BASE_URL"
+printf '\nSeller vendor app:\n'
+printf '  Browser URL: http://127.0.0.1:8010\n'
+printf '  Buyer-facing base: %s\n' "$PUBLIC_BASE"
+printf '  Buyer execution base: %s\n' "$AGENT_BASE"
+printf '  Example paid URL: %s/compute?job=prime-count&size=1000\n' "$PUBLIC_BASE"
+printf '  Example buyer CLI URL: %s/compute?job=prime-count&size=1000\n' "$AGENT_BASE"
+printf '\nBuyer policy engine for Telegram/OpenClaw CLI:\n'
+printf '  Server URL: http://%s:9090\n' "$HOST_IP"
+printf '  Token: payment-agent-token\n'
+printf '  Wallet alias: payment-agent\n'
+printf '  Network: %s\n' "$OMNICLAW_NETWORK"
+printf '\nSeller policy engine:\n'
+printf '  Server URL: http://%s:9091\n' "$HOST_IP"
+printf '  Token: seller-agent-token\n'
+printf '  Wallet alias: seller-agent\n'
+printf '\nOpenClaw prompt:\n'
+printf '  pay for this url: %s/compute?job=prime-count&size=1000\n' "$AGENT_BASE"
+printf '\nBusiness logs:\n'
+printf '  docker logs -f omniclaw-business-compute-demo\n\n'
+
+exec docker logs -f omniclaw-business-compute-demo
diff --git a/scripts/start_external_x402_seller.py b/scripts/start_external_x402_seller.py
new file mode 100644
index 0000000..1914b9b
--- /dev/null
+++ b/scripts/start_external_x402_seller.py
@@ -0,0 +1,22 @@
+#!/usr/bin/env python3
+from __future__ import annotations
+
+import os
+import sys
+from pathlib import Path
+
+os.environ.setdefault("OMNICLAW_X402_EXACT_NETWORK_PROFILE", "BASE-SEPOLIA")
+os.environ.setdefault("OMNICLAW_X402_EXACT_FACILITATOR_URL", "https://x402.org/facilitator")
+
+ROOT = Path(__file__).resolve().parent.parent
+if str(ROOT) not in sys.path:
+    sys.path.insert(0, str(ROOT))
+
+from scripts.start_x402_exact_testnet_seller import app  # noqa: E402
+
+
+if __name__ == "__main__":
+    import uvicorn
+
+    port = int(os.environ.get("OMNICLAW_X402_EXACT_PORT", "4021"))
+    uvicorn.run(app, host="0.0.0.0", port=port)
diff --git a/scripts/start_local_economy.sh b/scripts/start_local_economy.sh
index 368305a..8ca47d3 100755
--- a/scripts/start_local_economy.sh
+++ b/scripts/start_local_economy.sh
@@ -2,15 +2,69 @@
 set -euo pipefail
 ROOT=$(cd "$(dirname "$0")/.." && pwd)
 cd "$ROOT"
+
+preserve_env_var() {
+  local name="$1"
+  local sentinel="__OMNICLAW_UNSET__"
+  local current="${!name-$sentinel}"
+  printf '%s' "$current"
+}
+
+restore_env_var() {
+  local name="$1"
+  local value="$2"
+  if [[ "$value" != "__OMNICLAW_UNSET__" ]]; then
+    export "$name=$value"
+  fi
+}
+
+PRE_OMNICLAW_NETWORK="$(preserve_env_var OMNICLAW_NETWORK)"
+PRE_OMNICLAW_RPC_URL="$(preserve_env_var OMNICLAW_RPC_URL)"
+PRE_CIRCLE_API_KEY="$(preserve_env_var CIRCLE_API_KEY)"
+PRE_ENTITY_SECRET="$(preserve_env_var ENTITY_SECRET)"
+PRE_OMNICLAW_PRIVATE_KEY="$(preserve_env_var OMNICLAW_PRIVATE_KEY)"
+PRE_BUYER_CIRCLE_API_KEY="$(preserve_env_var BUYER_CIRCLE_API_KEY)"
+PRE_SELLER_CIRCLE_API_KEY="$(preserve_env_var SELLER_CIRCLE_API_KEY)"
+PRE_BUYER_ENTITY_SECRET="$(preserve_env_var BUYER_ENTITY_SECRET)"
+PRE_SELLER_ENTITY_SECRET="$(preserve_env_var SELLER_ENTITY_SECRET)"
+PRE_BUYER_OMNICLAW_PRIVATE_KEY="$(preserve_env_var BUYER_OMNICLAW_PRIVATE_KEY)"
+PRE_SELLER_OMNICLAW_PRIVATE_KEY="$(preserve_env_var SELLER_OMNICLAW_PRIVATE_KEY)"
+
 if [[ -f .env ]]; then
   set -a
   source .env
   set +a
 fi
+
+# Restore caller-provided env so wrapper scripts can force a specific network or key set.
+restore_env_var OMNICLAW_NETWORK "$PRE_OMNICLAW_NETWORK"
+restore_env_var OMNICLAW_RPC_URL "$PRE_OMNICLAW_RPC_URL"
+restore_env_var CIRCLE_API_KEY "$PRE_CIRCLE_API_KEY"
+restore_env_var ENTITY_SECRET "$PRE_ENTITY_SECRET"
+restore_env_var OMNICLAW_PRIVATE_KEY "$PRE_OMNICLAW_PRIVATE_KEY"
+restore_env_var BUYER_CIRCLE_API_KEY "$PRE_BUYER_CIRCLE_API_KEY"
+restore_env_var SELLER_CIRCLE_API_KEY "$PRE_SELLER_CIRCLE_API_KEY"
+restore_env_var BUYER_ENTITY_SECRET "$PRE_BUYER_ENTITY_SECRET"
+restore_env_var SELLER_ENTITY_SECRET "$PRE_SELLER_ENTITY_SECRET"
+restore_env_var BUYER_OMNICLAW_PRIVATE_KEY "$PRE_BUYER_OMNICLAW_PRIVATE_KEY"
+restore_env_var SELLER_OMNICLAW_PRIVATE_KEY "$PRE_SELLER_OMNICLAW_PRIVATE_KEY"
 STATE_DIR="${STATE_DIR:-$ROOT/.runtime}"
 mkdir -p "$STATE_DIR"
 cp examples/local-economy/payment-agent.policy.json "$STATE_DIR/payment-agent.policy.runtime.json"
 cp examples/local-economy/seller-agent.policy.json "$STATE_DIR/seller-agent.policy.runtime.json"
+if [[ "${OMNICLAW_DEMO_RESET_POLICY_WALLETS:-0}" == "1" ]]; then
+  python3 - <<PY
+import json
+from pathlib import Path
+for name in ["payment-agent.policy.runtime.json", "seller-agent.policy.runtime.json"]:
+    p = Path("$STATE_DIR") / name
+    data = json.loads(p.read_text())
+    for wallet in data.get("wallets", {}).values():
+        wallet.pop("wallet_id", None)
+        wallet.pop("address", None)
+    p.write_text(json.dumps(data, indent=2) + "\n")
+PY
+fi
 HOST_IP=$(hostname -I | awk '{print $1}')
 python3 - <<PY
 import json
diff --git a/scripts/start_x402_exact_testnet_facilitator.py b/scripts/start_x402_exact_testnet_facilitator.py
new file mode 100644
index 0000000..9b00138
--- /dev/null
+++ b/scripts/start_x402_exact_testnet_facilitator.py
@@ -0,0 +1,17 @@
+#!/usr/bin/env python3
+from __future__ import annotations
+
+from omniclaw.facilitator import (
+    create_exact_facilitator_app,
+    load_exact_facilitator_config_from_env,
+)
+
+
+config = load_exact_facilitator_config_from_env()
+app = create_exact_facilitator_app(config)
+
+
+if __name__ == "__main__":
+    import uvicorn
+
+    uvicorn.run(app, host=config.host, port=config.port)
diff --git a/scripts/start_x402_exact_testnet_seller.py b/scripts/start_x402_exact_testnet_seller.py
new file mode 100644
index 0000000..16283d3
--- /dev/null
+++ b/scripts/start_x402_exact_testnet_seller.py
@@ -0,0 +1,124 @@
+#!/usr/bin/env python3
+from __future__ import annotations
+
+import os
+
+from eth_account import Account
+from fastapi import FastAPI
+from fastapi.responses import JSONResponse
+from web3 import Web3
+from omniclaw.facilitator.networks import (
+    build_exact_asset_amount,
+    resolve_exact_settlement_network_profile,
+)
+from omniclaw.protocols.x402_compat import patch_x402_web3_compat
+
+
+patch_x402_web3_compat()
+
+from x402.http import FacilitatorConfig, HTTPFacilitatorClient, PaymentOption
+from x402.http.middleware.fastapi import PaymentMiddlewareASGI
+from x402.http.types import RouteConfig
+from x402.mechanisms.evm.exact import ExactEvmServerScheme
+from x402.server import x402ResourceServer
+
+
+def _env(name: str, default: str) -> str:
+    value = os.environ.get(name, "").strip()
+    return value or default
+
+
+APP_PORT = int(_env("OMNICLAW_X402_EXACT_PORT", "4021"))
+NETWORK_PROFILE = resolve_exact_settlement_network_profile(
+    _env("OMNICLAW_X402_EXACT_NETWORK_PROFILE", _env("OMNICLAW_NETWORK", "BASE-SEPOLIA"))
+)
+
+
+def _resolve_pay_to() -> str:
+    explicit = os.environ.get("OMNICLAW_X402_EXACT_PAY_TO", "").strip()
+    if explicit:
+        return Web3.to_checksum_address(explicit)
+
+    private_key = os.environ.get("OMNICLAW_PRIVATE_KEY", "").strip()
+    if private_key:
+        return Account.from_key(private_key).address
+
+    raise RuntimeError(
+        "Set OMNICLAW_X402_EXACT_PAY_TO or OMNICLAW_PRIVATE_KEY before starting the seller"
+    )
+
+
+PAY_TO = _resolve_pay_to()
+NETWORK = _env("OMNICLAW_X402_EXACT_NETWORK", NETWORK_PROFILE.caip2)
+PRICE = _env("OMNICLAW_X402_EXACT_PRICE", "$0.25")
+FACILITATOR_URL = _env("OMNICLAW_X402_EXACT_FACILITATOR_URL", "https://x402.org/facilitator")
+
+
+app = FastAPI(title=f"OmniClaw Exact Seller ({NETWORK_PROFILE.label})")
+
+facilitator = HTTPFacilitatorClient(FacilitatorConfig(url=FACILITATOR_URL))
+server = x402ResourceServer(facilitator)
+exact_scheme = ExactEvmServerScheme()
+exact_scheme.register_money_parser(
+    lambda amount, network: build_exact_asset_amount(
+        profile=NETWORK_PROFILE,
+        decimal_amount=amount,
+        network=str(network),
+    )
+)
+server.register("eip155:*", exact_scheme)
+
+routes = {
+    "GET /compute": RouteConfig(
+        accepts=[
+            PaymentOption(
+                scheme="exact",
+                price=PRICE,
+                network=NETWORK,
+                pay_to=PAY_TO,
+            )
+        ],
+        description=f"{NETWORK_PROFILE.label} exact x402 compute job",
+        mime_type="application/json",
+    )
+}
+
+app.add_middleware(PaymentMiddlewareASGI, routes=routes, server=server)
+
+
+@app.get("/compute")
+async def compute(size: int = 70000) -> JSONResponse:
+    return JSONResponse(
+        {
+            "service": "x402-exact-testnet-seller",
+            "job": "prime-count",
+            "input": {"size": size},
+            "output": {"prime_count": _prime_count(size)},
+            "network": NETWORK,
+            "network_profile": NETWORK_PROFILE.label,
+            "asset": NETWORK_PROFILE.default_asset_address,
+            "price": PRICE,
+            "facilitator": FACILITATOR_URL,
+        }
+    )
+
+
+def _prime_count(limit: int) -> int:
+    if limit < 2:
+        return 0
+    sieve = bytearray(b"\x01") * (limit + 1)
+    sieve[0:2] = b"\x00\x00"
+    n = 2
+    while n * n <= limit:
+        if sieve[n]:
+            start = n * n
+            step = n
+            sieve[start : limit + 1 : step] = b"\x00" * (((limit - start) // step) + 1)
+        n += 1
+    return int(sum(sieve))
+
+
+if __name__ == "__main__":
+    import uvicorn
+
+    uvicorn.run(app, host="0.0.0.0", port=APP_PORT)
diff --git a/scripts/verify_release_artifact.py b/scripts/verify_release_artifact.py
index c78b828..461c9c2 100755
--- a/scripts/verify_release_artifact.py
+++ b/scripts/verify_release_artifact.py
@@ -14,12 +14,13 @@
 
 REQUIRED_MODULES = [
     "omniclaw/__init__.py",
-    "omniclaw/cli.py",
+    "omniclaw/admin_cli.py",
+    "omniclaw/cli/__init__.py",
     "omniclaw/cli_agent.py",
 ]
 
 EXPECTED_ENTRYPOINTS = {
-    "omniclaw": "omniclaw.cli:main",
+    "omniclaw": "omniclaw.admin_cli:main",
     "omniclaw-cli": "omniclaw.cli_agent:main",
 }
 
@@ -76,7 +77,8 @@ def smoke_install(wheel_path: Path) -> None:
                 "-c",
                 "import pathlib, sysconfig; "
                 "site = pathlib.Path(sysconfig.get_paths()['purelib']); "
-                "required = [site / 'omniclaw' / '__init__.py', site / 'omniclaw' / 'cli.py', "
+                "required = [site / 'omniclaw' / '__init__.py', "
+                "site / 'omniclaw' / 'admin_cli.py', site / 'omniclaw' / 'cli' / '__init__.py', "
                 "site / 'omniclaw' / 'cli_agent.py']; "
                 "missing = [str(p) for p in required if not p.exists()]; "
                 "assert not missing, f'missing installed files: {missing}'; "
diff --git a/src/omniclaw/__init__.py b/src/omniclaw/__init__.py
index 91084c8..dfe1f40 100644
--- a/src/omniclaw/__init__.py
+++ b/src/omniclaw/__init__.py
@@ -91,6 +91,7 @@
     print_setup_status,
     quick_setup,
     store_managed_credentials,
+    validate_entity_secret,
     verify_setup,
 )
 
@@ -159,6 +160,7 @@
     "find_recovery_file",
     "get_config_dir",
     "store_managed_credentials",
+    "validate_entity_secret",
     # Types
     "Network",
     "FeeLevel",
diff --git a/src/omniclaw/cli.py b/src/omniclaw/admin_cli.py
similarity index 54%
rename from src/omniclaw/cli.py
rename to src/omniclaw/admin_cli.py
index 1509b5e..ee134a6 100644
--- a/src/omniclaw/cli.py
+++ b/src/omniclaw/admin_cli.py
@@ -1,18 +1,16 @@
 from __future__ import annotations
 
-import warnings
-
-# Suppress deprecation warnings from downstream dependencies (e.g. web3 using pkg_resources)
-warnings.filterwarnings("ignore", category=DeprecationWarning, module="pkg_resources")
-warnings.filterwarnings("ignore", message=".*pkg_resources is deprecated.*")
-
 import argparse
 import json
 import os
+import warnings
 from collections.abc import Sequence
 
 from omniclaw.onboarding import print_doctor_status
 
+# Suppress deprecation warnings from downstream dependencies.
+warnings.filterwarnings("ignore", category=DeprecationWarning, module="pkg_resources")
+warnings.filterwarnings("ignore", message=".*pkg_resources is deprecated.*")
 
 BANNER = r"""
    ____  __  __ _   _ ___ ____ _        ___        __
@@ -25,24 +23,28 @@
   Economic Execution and Control Layer for Agentic Systems
 """
 
-
-def print_banner():
-    """Print the OmniClaw CLI banner."""
-    print(f"\033[1;36m{BANNER}\033[0m")
-    print("\033[90mOmniClaw Financial Infrastructure - v2.0 Production-Ready\033[0m\n")
-
-
 ENV_VARS = {
     "required": {
         "CIRCLE_API_KEY": "Circle API key for wallet/payment operations",
         "OMNICLAW_PRIVATE_KEY": "Private key for nanopayment signing",
     },
     "optional": {
-        "ENTITY_SECRET": "Auto-generated entity secret (advanced/manual setup only)",
+        "ENTITY_SECRET": (
+            "Existing Circle Entity Secret. Set this directly if your API key already has one."
+        ),
         "OMNICLAW_RPC_URL": "RPC endpoint for trust gate (ERC-8004)",
+        "OMNICLAW_NETWORK": "Default network profile, for example BASE-SEPOLIA or ARC-TESTNET",
         "OMNICLAW_STORAGE_BACKEND": "Storage backend: memory or redis",
         "OMNICLAW_REDIS_URL": "Redis connection URL (when using redis)",
         "OMNICLAW_LOG_LEVEL": "Logging: DEBUG, INFO, WARNING, ERROR",
+        "OMNICLAW_X402_FACILITATOR_PRIVATE_KEY": (
+            "Private key used by a self-hosted x402 exact facilitator"
+        ),
+        "OMNICLAW_X402_FACILITATOR_NETWORK_PROFILE": ("Self-hosted facilitator network profile"),
+        "OMNICLAW_X402_FACILITATOR_RPC_URL": "Self-hosted facilitator RPC endpoint",
+        "OMNICLAW_X402_FACILITATOR_NETWORKS": (
+            "Comma-separated CAIP-2 networks accepted by the facilitator"
+        ),
     },
     "production": {
         "OMNICLAW_ENV": "Set to production for mainnet/strict mode",
@@ -53,8 +55,12 @@ def print_banner():
 }
 
 
-def print_env_vars():
-    """Print all available environment variables."""
+def print_banner() -> None:
+    print(f"\033[1;36m{BANNER}\033[0m")
+    print("\033[90mOmniClaw Financial Infrastructure - v2.0 Production-Ready\033[0m\n")
+
+
+def print_env_vars() -> None:
     print("\n=== OmniClaw Environment Variables ===\n")
 
     print("Required:")
@@ -83,7 +89,6 @@ def print_env_vars():
 
 
 def build_parser() -> argparse.ArgumentParser:
-    """Build the OmniClaw CLI parser."""
     parser = argparse.ArgumentParser(prog="omniclaw")
     subparsers = parser.add_subparsers(dest="command")
 
@@ -92,20 +97,10 @@ def build_parser() -> argparse.ArgumentParser:
         help="Inspect OmniClaw setup, managed credentials, and recovery state",
     )
     doctor_parser.add_argument("--api-key", help="Override CIRCLE_API_KEY for diagnostics")
-    doctor_parser.add_argument(
-        "--entity-secret",
-        help="Override ENTITY_SECRET for diagnostics",
-    )
-    doctor_parser.add_argument(
-        "--json",
-        action="store_true",
-        help="Output machine-readable JSON",
-    )
+    doctor_parser.add_argument("--entity-secret", help="Override ENTITY_SECRET for diagnostics")
+    doctor_parser.add_argument("--json", action="store_true", help="Output machine-readable JSON")
 
-    subparsers.add_parser(
-        "env",
-        help="List all available environment variables",
-    )
+    subparsers.add_parser("env", help="List all available environment variables")
 
     setup_parser = subparsers.add_parser(
         "setup",
@@ -113,7 +108,17 @@ def build_parser() -> argparse.ArgumentParser:
     )
     setup_parser.add_argument("--api-key", help="Circle API Key")
     setup_parser.add_argument(
-        "--network", default="ARC-TESTNET", help="Circle Network (default: ARC-TESTNET)"
+        "--entity-secret",
+        default=None,
+        help=(
+            "Existing 64-char Circle Entity Secret. If omitted, OmniClaw uses a "
+            "managed/env secret or generates and registers a new one."
+        ),
+    )
+    setup_parser.add_argument(
+        "--network",
+        default="ARC-TESTNET",
+        help="Circle Network (default: ARC-TESTNET)",
     )
 
     server_parser = subparsers.add_parser(
@@ -124,10 +129,37 @@ def build_parser() -> argparse.ArgumentParser:
     server_parser.add_argument("--port", type=int, default=8080, help="Port to listen on")
     server_parser.add_argument("--reload", action="store_true", help="Enable auto-reload")
 
-    policy_parser = subparsers.add_parser(
-        "policy",
-        help="Policy utilities (lint/validate)",
+    facilitator_parser = subparsers.add_parser(
+        "facilitator",
+        help="Run OmniClaw-operated x402 facilitator services",
     )
+    facilitator_sub = facilitator_parser.add_subparsers(dest="facilitator_command")
+    exact_parser = facilitator_sub.add_parser(
+        "exact",
+        help="Start a self-hosted x402 exact facilitator",
+    )
+    exact_parser.add_argument("--host", default="0.0.0.0", help="Host to bind to")
+    exact_parser.add_argument("--port", type=int, default=4022, help="Port to listen on")
+    exact_parser.add_argument(
+        "--network-profile",
+        default=None,
+        help="OmniClaw network profile, for example BASE-SEPOLIA or ARC-TESTNET",
+    )
+    exact_parser.add_argument(
+        "--network",
+        action="append",
+        default=None,
+        help="Accepted CAIP-2 network. Repeat to support multiple networks.",
+    )
+    exact_parser.add_argument("--rpc-url", default=None, help="RPC URL for settlement")
+    exact_parser.add_argument(
+        "--private-key",
+        default=None,
+        help="Facilitator settlement private key. Prefer env in shared shells.",
+    )
+    exact_parser.add_argument("--title", default=None, help="FastAPI title")
+
+    policy_parser = subparsers.add_parser("policy", help="Policy utilities (lint/validate)")
     policy_sub = policy_parser.add_subparsers(dest="policy_command")
     lint_parser = policy_sub.add_parser("lint", help="Validate policy.json")
     lint_parser.add_argument(
@@ -140,8 +172,7 @@ def build_parser() -> argparse.ArgumentParser:
 
 
 def handle_setup(args: argparse.Namespace) -> int:
-    """Handle the setup command."""
-    from omniclaw.onboarding import resolve_entity_secret, create_env_file
+    from omniclaw.onboarding import create_env_file, resolve_entity_secret, validate_entity_secret
 
     api_key = args.api_key or os.getenv("CIRCLE_API_KEY")
     if not api_key:
@@ -151,9 +182,10 @@ def handle_setup(args: argparse.Namespace) -> int:
         print("❌ Error: Circle API Key is required.")
         return 1
 
-    entity_secret = resolve_entity_secret(api_key)
+    entity_secret = args.entity_secret or resolve_entity_secret(api_key)
     if entity_secret:
-        print("✅ Found existing Entity Secret in managed store.")
+        entity_secret = validate_entity_secret(entity_secret)
+        print("✅ Using existing Circle Entity Secret.")
     else:
         print("💡 No Entity Secret found for this API key.")
         entity_secret = input(
@@ -164,6 +196,8 @@ def handle_setup(args: argparse.Namespace) -> int:
 
             print("🚀 Generating and registering new Entity Secret...")
             entity_secret = auto_setup_entity_secret(api_key)
+        else:
+            entity_secret = validate_entity_secret(entity_secret)
 
     env_path = ".env.agent"
     create_env_file(api_key, entity_secret, env_path=env_path, network=args.network, overwrite=True)
@@ -177,12 +211,11 @@ def handle_setup(args: argparse.Namespace) -> int:
 
 
 def handle_server(args: argparse.Namespace) -> int:
-    """Handle the server command."""
     import uvicorn
     from dotenv import load_dotenv
-    from omniclaw.onboarding import resolve_entity_secret, auto_setup_entity_secret
 
-    # Load .env.agent if it exists
+    from omniclaw.onboarding import auto_setup_entity_secret, resolve_entity_secret
+
     if os.path.exists(".env.agent"):
         load_dotenv(".env.agent")
         print("📄 Loaded configuration from .env.agent")
@@ -190,7 +223,6 @@ def handle_server(args: argparse.Namespace) -> int:
         load_dotenv(".env")
         print("📄 Loaded configuration from .env")
 
-    # Auto-Setup Logic: Check if we have an API key but no Entity Secret
     api_key = os.getenv("CIRCLE_API_KEY")
     entity_secret = os.getenv("ENTITY_SECRET")
 
@@ -219,24 +251,100 @@ def handle_server(args: argparse.Namespace) -> int:
     return 0
 
 
+def handle_facilitator_exact(args: argparse.Namespace) -> int:
+    import uvicorn
+    from dotenv import load_dotenv
+
+    from omniclaw.facilitator import (
+        ExactFacilitatorConfig,
+        create_exact_facilitator_app,
+        resolve_exact_settlement_network_profile,
+    )
+
+    if os.path.exists(".env.agent"):
+        load_dotenv(".env.agent")
+        print("📄 Loaded configuration from .env.agent")
+    elif os.path.exists(".env"):
+        load_dotenv(".env")
+        print("📄 Loaded configuration from .env")
+
+    profile_name = (
+        args.network_profile
+        or os.getenv("OMNICLAW_X402_FACILITATOR_NETWORK_PROFILE")
+        or os.getenv("OMNICLAW_NETWORK")
+        or "BASE-SEPOLIA"
+    )
+    profile = resolve_exact_settlement_network_profile(profile_name)
+    private_key = (
+        args.private_key
+        or os.getenv("OMNICLAW_X402_FACILITATOR_PRIVATE_KEY")
+        or os.getenv("OMNICLAW_PRIVATE_KEY")
+        or ""
+    ).strip()
+    if not private_key:
+        print(
+            "❌ Error: set OMNICLAW_X402_FACILITATOR_PRIVATE_KEY or pass --private-key "
+            "to run an exact facilitator."
+        )
+        return 1
+
+    explicit_env_networks = tuple(
+        value.strip()
+        for value in os.getenv("OMNICLAW_X402_FACILITATOR_NETWORKS", "").split(",")
+        if value.strip()
+    )
+    networks = tuple(args.network or ()) or explicit_env_networks or (profile.caip2,)
+    rpc_url = (
+        args.rpc_url
+        or os.getenv("OMNICLAW_X402_FACILITATOR_RPC_URL")
+        or profile.default_rpc_url
+        or ""
+    ).strip()
+    if not rpc_url:
+        print(
+            "❌ Error: set OMNICLAW_X402_FACILITATOR_RPC_URL or pass --rpc-url "
+            f"for {profile.label}."
+        )
+        return 1
+
+    config = ExactFacilitatorConfig(
+        private_key=private_key,
+        rpc_url=rpc_url,
+        networks=networks,
+        network_profile=profile.label,
+        port=args.port,
+        host=args.host,
+        title=args.title or f"OmniClaw Exact Facilitator ({profile.label})",
+    )
+    app = create_exact_facilitator_app(config)
+    print(f"🚀 Starting OmniClaw x402 exact facilitator on {config.host}:{config.port}")
+    print(f"   Profile: {profile.label}")
+    print(f"   Networks: {', '.join(config.networks)}")
+    print(f"   RPC: {config.rpc_url}")
+    uvicorn.run(
+        app,
+        host=config.host,
+        port=config.port,
+        log_level=os.getenv("OMNICLAW_LOG_LEVEL", "info").lower(),
+    )
+    return 0
+
+
 def handle_policy_lint(args: argparse.Namespace) -> int:
-    """Validate policy.json against strict schema."""
     from omniclaw.agent.policy_schema import validate_policy
 
-    path = args.path
     try:
-        with open(path) as f:
+        with open(args.path) as f:
             data = json.load(f)
         validate_policy(data)
-        print(f"✅ policy.json is valid: {path}")
+        print(f"✅ policy.json is valid: {args.path}")
         return 0
-    except Exception as e:
-        print(f"❌ Invalid policy.json: {e}")
+    except Exception as exc:
+        print(f"❌ Invalid policy.json: {exc}")
         return 1
 
 
 def main(argv: Sequence[str] | None = None) -> int:
-    """Run the OmniClaw CLI."""
     parser = build_parser()
     args = parser.parse_args(argv)
     print_banner()
@@ -259,15 +367,19 @@ def main(argv: Sequence[str] | None = None) -> int:
     if args.command == "server":
         return handle_server(args)
 
+    if args.command == "facilitator" and args.facilitator_command == "exact":
+        return handle_facilitator_exact(args)
+
     if args.command == "policy" and args.policy_command == "lint":
         return handle_policy_lint(args)
 
     parser.print_help()
     print("\nCommands:")
-    print("  setup   - Quick credentials configuration")
-    print("  server  - Start the Financial Firewall server")
-    print("  doctor  - Inspect setup and credentials")
-    print("  env     - List all environment variables")
+    print("  setup       - Quick credentials configuration")
+    print("  server      - Start the Financial Policy Engine server")
+    print("  facilitator - Run OmniClaw-operated x402 facilitator services")
+    print("  doctor      - Inspect setup and credentials")
+    print("  env         - List all environment variables")
     return 1
 
 
diff --git a/src/omniclaw/agent/models.py b/src/omniclaw/agent/models.py
index c0d2c0b..0854a9f 100644
--- a/src/omniclaw/agent/models.py
+++ b/src/omniclaw/agent/models.py
@@ -11,13 +11,18 @@ class PayRequest(BaseModel):
     """Payment request."""
 
     recipient: str = Field(..., description="Payment recipient (address or URL)")
-    amount: str = Field(..., description="Amount in USDC")
+    amount: str | None = Field(None, description="Amount in USDC")
     purpose: str | None = Field(None, description="Payment purpose")
     idempotency_key: str | None = Field(None, description="Idempotency key for deduplication")
     destination_chain: str | None = Field(None, description="Target network for cross-chain")
     fee_level: str | None = Field(None, description="Gas fee level (LOW, MEDIUM, HIGH)")
     check_trust: bool = Field(False, description="Run ERC-8004 Trust Gate check")
     skip_guards: bool = Field(False, description="Skip policy guards (OWNER ONLY)")
+    method: str = Field("GET", description="HTTP method for x402 URL payments")
+    body: str | None = Field(None, description="Request body for x402 URL payments")
+    headers: dict[str, str] | None = Field(
+        None, description="Request headers for x402 URL payments"
+    )
     metadata: dict[str, Any] | None = Field(None, description="Additional context")
 
 
@@ -171,15 +176,34 @@ class HealthResponse(BaseModel):
     version: str = "1.0.0"
 
 
-class X402PayRequest(BaseModel):
-    """X402 Payment request."""
+class X402InspectRequest(BaseModel):
+    """X402 inspection request."""
 
     url: str = Field(..., description="x402 Service URL")
-    amount: str | None = Field(None, description="Payment amount in USDC (default: 0.01)")
+    amount: str | None = Field(None, description="Optional max payment amount in USDC")
     method: str = Field("GET", description="HTTP method")
     body: str | None = Field(None, description="Request body")
     headers: dict[str, str] | None = Field(None, description="Request headers")
-    idempotency_key: str | None = Field(None, description="Idempotency key")
+
+
+class X402InspectResponse(BaseModel):
+    """X402 inspection response."""
+
+    url: str
+    requires_payment: bool
+    buyer_ready: bool
+    reason: str | None = None
+    router_detected_route: str | None = None
+    selected_route: str | None = None
+    payment_source: str | None = None
+    buyer_address: str | None = None
+    gateway_available_balance: str | None = None
+    selected_scheme: str | None = None
+    selected_network: str | None = None
+    selected_amount_atomic: str | None = None
+    selected_amount_usdc: str | None = None
+    selected_pay_to: str | None = None
+    seller_accepts: list[dict[str, Any]] = Field(default_factory=list)
 
 
 class X402VerifyRequest(BaseModel):
diff --git a/src/omniclaw/agent/policy.py b/src/omniclaw/agent/policy.py
index 25207ea..f4e993e 100644
--- a/src/omniclaw/agent/policy.py
+++ b/src/omniclaw/agent/policy.py
@@ -15,6 +15,7 @@
 
 from omniclaw.agent.policy_schema import RecipientMode, validate_policy
 from omniclaw.core.logging import get_logger
+from omniclaw.core.types import normalize_network
 
 logger = get_logger(__name__)
 
@@ -576,6 +577,9 @@ async def initialize_wallets(self) -> dict[str, str]:
 
         changed = False
         results: dict[str, str] = {}
+        target_network = normalize_network(
+            getattr(getattr(self._client, "_config", None), "network", None)
+        )
 
         # PHASE 2: Ensure each alias has a Circle wallet id + address
         async def init_alias(alias: str) -> tuple[str, str | None, str | None]:
@@ -591,9 +595,22 @@ async def init_alias(alias: str) -> tuple[str, str | None, str | None]:
             if wallet_id:
                 try:
                     wallet = await self._client.get_wallet(wallet_id)
-                    if wallet and wallet.address and wallet.address != wallet_address:
-                        wallet_address = wallet.address
-                    return alias, wallet_id, wallet_address
+                    wallet_network = normalize_network(getattr(wallet, "blockchain", None))
+                    if target_network and wallet_network and wallet_network != target_network:
+                        self._logger.warning(
+                            "Wallet '%s' for alias '%s' is on %s but current network is %s. "
+                            "Creating a new wallet for the target network.",
+                            wallet_id,
+                            alias,
+                            wallet_network.value,
+                            target_network.value,
+                        )
+                        wallet_id = None
+                        wallet_address = None
+                    else:
+                        if wallet and wallet.address and wallet.address != wallet_address:
+                            wallet_address = wallet.address
+                        return alias, wallet_id, wallet_address
                 except Exception:
                     # Fall through to create a new wallet
                     pass
diff --git a/src/omniclaw/agent/routes.py b/src/omniclaw/agent/routes.py
index 648f212..a9711f4 100644
--- a/src/omniclaw/agent/routes.py
+++ b/src/omniclaw/agent/routes.py
@@ -4,7 +4,7 @@
 
 import os
 from decimal import Decimal
-from typing import TYPE_CHECKING
+from typing import TYPE_CHECKING, Any
 
 from fastapi import APIRouter, Depends, HTTPException, Request
 from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
@@ -25,12 +25,14 @@
     SimulateResponse,
     TransactionInfo,
     WalletInfo,
-    X402PayRequest,
+    X402InspectRequest,
+    X402InspectResponse,
     X402RequirementsRequest,
     X402VerifyRequest,
 )
 from omniclaw.agent.policy import PolicyManager, WalletManager
 from omniclaw.core.logging import get_logger
+from omniclaw.core.types import PaymentMethod
 from omniclaw.guards.confirmations import ConfirmationStore
 from omniclaw.ledger import LedgerEntry, LedgerEntryStatus, LedgerEntryType
 
@@ -49,6 +51,195 @@ def _fmt_amount(value: object) -> str:
         return str(value)
 
 
+def _find_adapter_by_method(client: OmniClaw, method: PaymentMethod | str):
+    for adapter in client._router.get_adapters():
+        adapter_method = getattr(adapter, "method", None)
+        adapter_value = adapter_method.value if hasattr(adapter_method, "value") else adapter_method
+        target_value = method.value if hasattr(method, "value") else method
+        if adapter_value == target_value:
+            return adapter
+    return None
+
+
+async def _choose_x402_route(
+    *,
+    client: OmniClaw,
+    wallet_id: str,
+    x402_adapter: Any,
+    requirements: Any,
+) -> dict[str, object]:
+    agent_network = x402_adapter._resolve_agent_network(wallet_id, None)
+    selected_gateway_kind = requirements.select_preferred_kind(
+        prefer_gateway=True,
+        source_network=agent_network,
+    )
+    selected_exact_kind = requirements.select_preferred_kind(
+        prefer_gateway=False,
+        source_network=agent_network,
+    )
+
+    gateway_available_balance: str | None = None
+    gateway_ready: bool | None = None
+    gateway_reason: str | None = None
+
+    if selected_gateway_kind is not None:
+        if client._nano_adapter is None:
+            gateway_ready = False
+            gateway_reason = "Gateway route is advertised but nanopayments are not enabled"
+        else:
+            try:
+                balance = await client.get_gateway_balance(wallet_id)
+                gateway_available_balance = balance.formatted_available
+                required_atomic = int(selected_gateway_kind.amount_atomic)
+                gateway_ready = balance.available >= required_atomic
+                gateway_reason = (
+                    "Gateway balance is sufficient for GatewayWalletBatched"
+                    if gateway_ready
+                    else "Gateway balance is below the required amount"
+                )
+            except Exception as exc:
+                gateway_ready = False
+                gateway_reason = f"Gateway balance check failed: {exc}"
+
+    if selected_gateway_kind is not None and gateway_ready:
+        return {
+            "selected_kind": selected_gateway_kind,
+            "selected_route": "nanopayment",
+            "payment_source": "gateway_balance",
+            "gateway_available_balance": gateway_available_balance,
+            "gateway_ready": gateway_ready,
+            "gateway_reason": gateway_reason,
+        }
+
+    if selected_exact_kind is not None:
+        return {
+            "selected_kind": selected_exact_kind,
+            "selected_route": "x402",
+            "payment_source": "direct_wallet",
+            "gateway_available_balance": gateway_available_balance,
+            "gateway_ready": gateway_ready,
+            "gateway_reason": gateway_reason,
+        }
+
+    if selected_gateway_kind is not None:
+        return {
+            "selected_kind": selected_gateway_kind,
+            "selected_route": "nanopayment",
+            "payment_source": "gateway_balance",
+            "gateway_available_balance": gateway_available_balance,
+            "gateway_ready": gateway_ready,
+            "gateway_reason": gateway_reason,
+        }
+
+    return {
+        "selected_kind": None,
+        "selected_route": None,
+        "payment_source": None,
+        "gateway_available_balance": gateway_available_balance,
+        "gateway_ready": gateway_ready,
+        "gateway_reason": gateway_reason,
+    }
+
+
+async def _inspect_x402_target(
+    *,
+    client: OmniClaw,
+    wallet_id: str,
+    url: str,
+    method: str = "GET",
+    headers: dict[str, str] | None = None,
+    body: str | bytes | None = None,
+) -> dict[str, object]:
+    x402_adapter = _find_adapter_by_method(client, PaymentMethod.X402)
+    if x402_adapter is None:
+        return {
+            "ok": False,
+            "requires_payment": False,
+            "reason": "X402 adapter is not registered",
+        }
+
+    try:
+        response, requirements = await x402_adapter._request_with_402_check(
+            url,
+            method=method,
+            headers=headers,
+            content=body,
+        )
+    except Exception as exc:
+        return {
+            "ok": False,
+            "requires_payment": False,
+            "reason": f"Inspection request failed: {exc}",
+        }
+
+    router_method = client.detect_method(url)
+    router_route = router_method.value if hasattr(router_method, "value") else str(router_method)
+
+    if response.status_code != 402:
+        return {
+            "ok": True,
+            "requires_payment": False,
+            "reason": "Endpoint does not currently require payment",
+            "router_detected_route": router_route,
+            "selected_route": None,
+            "payment_source": None,
+            "seller_accepts": [],
+            "selected_kind": None,
+            "x402_adapter": x402_adapter,
+        }
+
+    if not requirements:
+        return {
+            "ok": False,
+            "requires_payment": True,
+            "reason": "Endpoint returned 402 but payment requirements could not be parsed",
+            "router_detected_route": router_route,
+            "seller_accepts": [],
+            "selected_kind": None,
+            "x402_adapter": x402_adapter,
+        }
+
+    route_choice = await _choose_x402_route(
+        client=client,
+        wallet_id=wallet_id,
+        x402_adapter=x402_adapter,
+        requirements=requirements,
+    )
+    selected_kind = route_choice["selected_kind"]
+    selected_route = route_choice["selected_route"]
+    payment_source = route_choice["payment_source"]
+
+    seller_accepts: list[dict[str, object]] = []
+    for kind in requirements.accepts:
+        seller_accepts.append(
+            {
+                "scheme": kind.scheme,
+                "network": kind.network,
+                "asset": kind.asset,
+                "amount_atomic": kind.amount_atomic,
+                "amount_usdc": str(kind.get_amount_usdc()),
+                "pay_to": kind.recipient,
+                "facilitator_name": kind.facilitator_name or None,
+                "is_gateway_batched": kind.is_gateway_batched,
+            }
+        )
+
+    return {
+        "ok": True,
+        "requires_payment": True,
+        "reason": None,
+        "router_detected_route": selected_route,
+        "selected_route": selected_route,
+        "payment_source": payment_source,
+        "seller_accepts": seller_accepts,
+        "selected_kind": selected_kind,
+        "x402_adapter": x402_adapter,
+        "gateway_available_balance": route_choice["gateway_available_balance"],
+        "gateway_ready": route_choice["gateway_ready"],
+        "gateway_reason": route_choice["gateway_reason"],
+    }
+
+
 async def get_policy_manager(request: Request) -> PolicyManager:
     return request.app.state.policy_mgr
 
@@ -616,12 +807,55 @@ async def pay(
     if not policy_mgr.is_valid_recipient(request.recipient, agent.wallet_id):
         raise HTTPException(status_code=400, detail="Recipient not allowed by policy")
 
-    amount = Decimal(request.amount)
+    is_url_payment = request.recipient.startswith("http")
+    amount_raw = request.amount
+    x402_details: dict[str, object] | None = None
+    preferred_url_route: str | None = None
+    if is_url_payment:
+        x402_details = await _inspect_x402_target(
+            client=client,
+            wallet_id=agent.wallet_id,
+            url=request.recipient,
+            method=request.method,
+            headers=request.headers,
+            body=request.body,
+        )
+        if not x402_details.get("ok"):
+            raise HTTPException(status_code=400, detail=str(x402_details.get("reason")))
+
+        if bool(x402_details.get("requires_payment")):
+            selected_kind = x402_details.get("selected_kind")
+            preferred_url_route = str(x402_details.get("selected_route") or "") or None
+            if selected_kind is None:
+                raise HTTPException(
+                    status_code=400,
+                    detail=str(
+                        x402_details.get("reason")
+                        or "Seller does not advertise a buyer-supported x402 payment kind"
+                    ),
+                )
+            if amount_raw is None:
+                amount_raw = str(selected_kind.get_amount_usdc())
+        elif amount_raw is None:
+            amount_raw = "0.00"
+
+    if amount_raw is None:
+        raise HTTPException(status_code=400, detail="amount is required for direct transfers")
+
+    amount = Decimal(amount_raw)
     allowed, reason = policy_mgr.check_limits(amount, agent.wallet_id)
     if not allowed:
         raise HTTPException(status_code=400, detail=reason)
 
     try:
+        metadata = dict(request.metadata or {})
+        if is_url_payment:
+            metadata.setdefault("method", request.method)
+            if request.body is not None:
+                metadata.setdefault("body", request.body)
+            if request.headers is not None:
+                metadata.setdefault("headers", request.headers)
+
         result = await client.pay(
             wallet_id=agent.wallet_id,
             recipient=request.recipient,
@@ -632,7 +866,11 @@ async def pay(
             fee_level=request.fee_level,
             check_trust=request.check_trust,
             skip_guards=request.skip_guards,
-            metadata=request.metadata,
+            method=request.method,
+            request_body=request.body,
+            request_headers=request.headers,
+            metadata=metadata or None,
+            preferred_url_route=preferred_url_route,
         )
         requires_confirmation = bool(
             result.metadata.get("confirmation_required") if result.metadata else False
@@ -654,15 +892,16 @@ async def pay(
             error=result.error,
             requires_confirmation=requires_confirmation,
             confirmation_id=confirmation_id,
+            response_data=result.resource_data,
         )
     except Exception as e:
         logger.error(f"Payment failed: {e}")
         return PayResponse(
             success=False,
-            amount=_fmt_amount(request.amount),
+            amount=_fmt_amount(amount_raw),
             recipient=request.recipient,
             status="FAILED",
-            method="TRANSFER",
+            method="x402" if is_url_payment else "TRANSFER",
             error=str(e),
             requires_confirmation=False,
         )
@@ -957,53 +1196,115 @@ async def list_wallets(
     return ListWalletsResponse(wallets=wallets)
 
 
-@router.post("/x402/pay", response_model=PayResponse)
-async def x402_pay(
-    request: X402PayRequest,
+@router.post("/x402/inspect", response_model=X402InspectResponse)
+async def x402_inspect(
+    request: X402InspectRequest,
     agent: AuthenticatedAgent = Depends(get_current_agent),
+    policy_mgr: PolicyManager = Depends(get_policy_manager),
     client: OmniClaw = Depends(get_omniclaw_client),
 ):
-    """Execute an automated x402 payment flow using client.pay() for automatic routing to Circle Gateway."""
-    try:
-        amount = request.amount if request.amount else "0.01"
-        result = await client.pay(
-            wallet_id=agent.wallet_id,
-            recipient=request.url,
-            amount=amount,
-            idempotency_key=request.idempotency_key,
-            metadata={"method": request.method, "body": request.body, "headers": request.headers},
+    """Inspect an x402 endpoint and report which buyer route OmniClaw would use."""
+    if agent.wallet_id.startswith("pending-"):
+        raise HTTPException(
+            status_code=425,
+            detail="Wallet is currently initializing. Please try again in a few seconds.",
         )
-        requires_confirmation = bool(
-            result.metadata.get("confirmation_required") if result.metadata else False
+
+    if not policy_mgr.is_valid_recipient(request.url, agent.wallet_id):
+        return X402InspectResponse(
+            url=request.url,
+            requires_payment=False,
+            buyer_ready=False,
+            reason="Recipient not allowed by policy",
+            router_detected_route="transfer",
         )
-        confirmation_id = result.metadata.get("confirmation_id") if result.metadata else None
 
-        return PayResponse(
-            success=result.success,
-            transaction_id=result.transaction_id,
-            blockchain_tx=result.blockchain_tx,
-            amount=_fmt_amount(result.amount),
-            recipient=result.recipient,
-            status=result.status.value
-            if result.status and hasattr(result.status, "value")
-            else (str(result.status) if result.status else "failed"),
-            method="nanopayment",
-            error=result.error,
-            requires_confirmation=requires_confirmation,
-            confirmation_id=confirmation_id,
-            response_data=result.resource_data,
+    inspection = await _inspect_x402_target(
+        client=client,
+        wallet_id=agent.wallet_id,
+        url=request.url,
+        method=request.method,
+        headers=request.headers,
+        body=request.body,
+    )
+    if not inspection.get("ok"):
+        return X402InspectResponse(
+            url=request.url,
+            requires_payment=False,
+            buyer_ready=False,
+            reason=str(inspection.get("reason")),
         )
-    except Exception as e:
-        logger.error(f"x402 payment failed: {e}")
-        return PayResponse(
-            success=False,
-            amount="0.00",
+
+    if not inspection.get("requires_payment"):
+        return X402InspectResponse(
+            url=request.url,
+            requires_payment=False,
+            buyer_ready=True,
+            reason=str(inspection.get("reason")),
+            router_detected_route=inspection.get("router_detected_route"),
+            selected_route=None,
+            payment_source=None,
+        )
+
+    x402_adapter = inspection["x402_adapter"]
+    selected_kind = inspection.get("selected_kind")
+    selected_route = inspection.get("selected_route")
+    payment_source = inspection.get("payment_source")
+    seller_accepts = inspection.get("seller_accepts") or []
+
+    buyer_address: str | None = None
+    if client._nano_adapter:
+        buyer_address = client._nano_adapter.address
+    else:
+        private_key = os.environ.get("OMNICLAW_PRIVATE_KEY")
+        if private_key:
+            try:
+                from eth_account import Account
+
+                if not private_key.startswith("0x"):
+                    private_key = f"0x{private_key}"
+                buyer_address = Account.from_key(private_key).address
+            except Exception:
+                buyer_address = None
+
+    gateway_available_balance = inspection.get("gateway_available_balance")
+    buyer_ready = False
+    reason: str | None = None
+
+    if selected_kind is None:
+        reason = "Seller does not advertise a buyer-supported x402 payment kind"
+    elif selected_route == "nanopayment":
+        buyer_ready = bool(inspection.get("gateway_ready"))
+        reason = str(inspection.get("gateway_reason") or "")
+    else:
+        sim_result = await x402_adapter.simulate(
+            wallet_id=agent.wallet_id,
             recipient=request.url,
-            status="FAILED",
-            method="nanopayment",
-            error=str(e),
-            response_data=None,
+            amount=selected_kind.get_amount_usdc(),
+            method=request.method,
+            request_body=request.body,
+            request_headers=request.headers,
         )
+        buyer_ready = bool(sim_result.get("would_succeed"))
+        reason = sim_result.get("reason")
+
+    return X402InspectResponse(
+        url=request.url,
+        requires_payment=True,
+        buyer_ready=buyer_ready,
+        reason=reason,
+        router_detected_route=inspection.get("router_detected_route"),
+        selected_route=selected_route,
+        payment_source=payment_source,
+        buyer_address=buyer_address,
+        gateway_available_balance=gateway_available_balance,
+        selected_scheme=selected_kind.scheme if selected_kind else None,
+        selected_network=selected_kind.network if selected_kind else None,
+        selected_amount_atomic=selected_kind.amount_atomic if selected_kind else None,
+        selected_amount_usdc=str(selected_kind.get_amount_usdc()) if selected_kind else None,
+        selected_pay_to=selected_kind.recipient if selected_kind else None,
+        seller_accepts=seller_accepts,
+    )
 
 
 @router.post("/x402/verify")
diff --git a/src/omniclaw/cli/commands/payments.py b/src/omniclaw/cli/commands/payments.py
index 2c9b1f9..ad77c83 100644
--- a/src/omniclaw/cli/commands/payments.py
+++ b/src/omniclaw/cli/commands/payments.py
@@ -45,61 +45,24 @@ def pay(
 
     client = get_client()
 
-    # If recipient is a URL, handle x402 flow
-    if recipient.startswith("http"):
-        if not is_quiet():
-            typer.echo(f"Paying for x402 service: {recipient}")
-        payload: dict[str, Any] = {
-            "url": recipient,
-            "method": method,
-        }
-        if body:
-            payload["body"] = body
-        if header:
-            parsed_headers: dict[str, str] = {}
-            for raw in header:
-                key, sep, value = raw.partition(":")
-                if not sep:
-                    typer.echo(
-                        f"Error: Invalid header '{raw}'. Use 'Header: value' format.",
-                        err=True,
-                    )
-                    raise typer.Exit(1)
-                parsed_headers[key.strip()] = value.strip()
-            payload["headers"] = parsed_headers
-        if idempotency_key:
-            payload["idempotency_key"] = idempotency_key
-
-        try:
-            response = client.post("/api/v1/x402/pay", json=payload)
-            response.raise_for_status()
-            data = response.json()
-            requires_confirmation = data.get("requires_confirmation") or data.get(
-                "confirmation_required"
-            )
-            if not is_quiet() and requires_confirmation:
-                confirmation_id = data.get("confirmation_id")
-                if confirmation_id:
-                    typer.echo("Payment requires confirmation.")
-                    typer.echo(f"Run: omniclaw-cli confirmations approve --id {confirmation_id}")
-            if output:
-                Path(output).write_text(json.dumps(data, indent=2))
-                if not is_quiet():
-                    typer.echo(f"Response saved to {output}")
-                if is_quiet():
-                    typer.echo(json.dumps(data, indent=2))
-            else:
-                typer.echo(json.dumps(data, indent=2))
-            return data
-        except httpx.HTTPStatusError as e:
-            typer.echo(f"Error: {e.response.json().get('detail', str(e))}", err=True)
-            raise typer.Exit(1) from e
-        except Exception as e:
-            typer.echo(f"Error: {e}", err=True)
-            raise typer.Exit(1) from e
-
-    # Standard direct transfer
-    if not amount:
+    parsed_headers: dict[str, str] | None = None
+    if header:
+        parsed_headers = {}
+        for raw in header:
+            key, sep, value = raw.partition(":")
+            if not sep:
+                typer.echo(
+                    f"Error: Invalid header '{raw}'. Use 'Header: value' format.",
+                    err=True,
+                )
+                raise typer.Exit(1)
+            parsed_headers[key.strip()] = value.strip()
+
+    is_url_payment = recipient.startswith("http")
+    if is_url_payment and not is_quiet():
+        typer.echo(f"Paying for x402 service: {recipient}")
+
+    if not amount and not is_url_payment:
         if is_quiet():
             typer.echo("Error: --amount is required for direct transfers", err=True)
             raise typer.Exit(1)
@@ -121,6 +84,12 @@ def pay(
         payload["check_trust"] = True
     if skip_guards:
         payload["skip_guards"] = True
+    if is_url_payment:
+        payload["method"] = method
+        if body:
+            payload["body"] = body
+        if parsed_headers:
+            payload["headers"] = parsed_headers
 
     try:
         response = client.post("/api/v1/pay", json=payload)
@@ -134,6 +103,10 @@ def pay(
             if confirmation_id:
                 typer.echo("Payment requires confirmation.")
                 typer.echo(f"Run: omniclaw-cli confirmations approve --id {confirmation_id}")
+        if output and is_url_payment:
+            Path(output).write_text(json.dumps(data, indent=2))
+            if not is_quiet():
+                typer.echo(f"Response saved to {output}")
         typer.echo(json.dumps(data, indent=2))
         return data
     except httpx.HTTPStatusError as e:
@@ -189,6 +162,54 @@ def simulate(
         raise typer.Exit(1) from e
 
 
+def inspect_x402(
+    recipient: str = typer.Option(..., "--recipient", help="x402 URL to inspect"),
+    amount: str | None = typer.Option(None, "--amount", help="Optional max amount in USDC"),
+    method: str = typer.Option("GET", "--method", help="HTTP method for x402 requests"),
+    body: str | None = typer.Option(None, "--body", help="Request body for x402 requests"),
+    header: list[str] = typer.Option([], "--header", help="Additional headers for x402 requests"),
+) -> dict[str, Any]:
+    """Inspect an x402 endpoint and show which payment route OmniClaw would use."""
+    if not recipient.startswith("http"):
+        typer.echo("Error: --recipient must be an HTTP(S) URL for x402 inspection", err=True)
+        raise typer.Exit(1)
+
+    client = get_client()
+    parsed_headers: dict[str, str] | None = None
+    if header:
+        parsed_headers = {}
+        for raw in header:
+            key, sep, value = raw.partition(":")
+            if not sep:
+                typer.echo(
+                    f"Error: Invalid header '{raw}'. Use 'Header: value' format.",
+                    err=True,
+                )
+                raise typer.Exit(1)
+            parsed_headers[key.strip()] = value.strip()
+
+    payload: dict[str, Any] = {"url": recipient, "method": method}
+    if amount is not None:
+        payload["amount"] = amount
+    if body is not None:
+        payload["body"] = body
+    if parsed_headers:
+        payload["headers"] = parsed_headers
+
+    try:
+        response = client.post("/api/v1/x402/inspect", json=payload)
+        response.raise_for_status()
+        data = response.json()
+        typer.echo(json.dumps(data, indent=2))
+        return data
+    except httpx.HTTPStatusError as e:
+        typer.echo(f"Error: {e.response.json().get('detail', str(e))}", err=True)
+        raise typer.Exit(1) from e
+    except Exception as e:
+        typer.echo(f"Error: {e}", err=True)
+        raise typer.Exit(1) from e
+
+
 def can_pay(
     recipient: str = typer.Option(..., "--recipient", help="Recipient to check"),
 ) -> dict[str, Any]:
@@ -219,11 +240,15 @@ def can_pay_alias(
 def register(app: typer.Typer, group: typer.Typer | None = None) -> None:
     app.command()(pay)
     app.command()(simulate)
+    app.command(name="inspect-x402")(inspect_x402)
+    app.command(name="inspect_x402", help="Alias for inspect-x402")(inspect_x402)
     app.command("can-pay")(can_pay)
     app.command(name="can_pay", help="Alias for can-pay")(can_pay_alias)
 
     if group is not None and group is not app:
         group.command()(pay)
         group.command()(simulate)
+        group.command(name="inspect-x402")(inspect_x402)
+        group.command(name="inspect_x402", help="Alias for inspect-x402")(inspect_x402)
         group.command("can-pay")(can_pay)
         group.command(name="can_pay", help="Alias for can-pay")(can_pay_alias)
diff --git a/src/omniclaw/client.py b/src/omniclaw/client.py
index 480fc30..7a89777 100644
--- a/src/omniclaw/client.py
+++ b/src/omniclaw/client.py
@@ -416,6 +416,7 @@ async def premium(payment=Depends(omniclaw.gateway().require("$0.001"))):
                 - "ordern": OrderN
                 - "rbx": RBX
                 - "thirdweb": Thirdweb
+                - "omniclaw": OmniClaw self-hosted exact facilitator
 
         Raises:
             NanopaymentNotInitializedError: If nanopayments are disabled and facilitator is Circle.
@@ -479,10 +480,10 @@ def sell(
         Returns a FastAPI Depends() that gates the route with x402 payment.
 
         Usage:
-            from fastapi import Depends
+            from fastapi import FastAPI
 
             @app.get("/premium")
-            async def premium(payment=Depends(omniclaw.sell("$0.001"))):
+            async def premium(payment=omniclaw.sell("$0.001")):
                 payment_info = omniclaw.current_payment()
                 return {"data": "paid content", "paid_by": payment_info.payer}
 
@@ -497,6 +498,7 @@ async def premium(payment=Depends(omniclaw.sell("$0.001"))):
                 - "ordern": OrderN
                 - "rbx": RBX
                 - "thirdweb": Thirdweb
+                - "omniclaw": OmniClaw self-hosted exact facilitator
 
         Returns:
             A FastAPI Depends() callable.
@@ -509,8 +511,9 @@ async def premium(payment=Depends(omniclaw.sell("$0.001"))):
             # Other facilitators (just provide your address)
             client.sell("$0.01", facilitator="coinbase")
             client.sell("$0.01", seller_address="0xYourAddress", facilitator="coinbase")
+            client.sell("$0.01", seller_address="0xYourAddress", facilitator="omniclaw")
         """
-        from fastapi import Depends
+        from fastapi import Depends, Request
 
         def base_dependency_factory():
             return self.gateway(
@@ -520,10 +523,10 @@ def base_dependency_factory():
 
         price_str = price
 
-        async def wrapper() -> PaymentInfo:
+        async def wrapper(request: Request) -> PaymentInfo:
             gateway_mw = await base_dependency_factory()
             base_dep = gateway_mw.require(price_str)
-            payment_info: PaymentInfo = await base_dep()
+            payment_info: PaymentInfo = await base_dep(request)
             _current_payment_info.set(payment_info)
             return payment_info
 
@@ -1169,6 +1172,7 @@ async def pay(
                     source_network=source_network,
                     destination_chain=kwargs.get("destination_chain"),
                     amount=amount_decimal,
+                    preferred_url_route=kwargs.get("preferred_url_route"),
                 )
                 or PaymentMethod.TRANSFER
             )
diff --git a/src/omniclaw/core/cctp_constants.py b/src/omniclaw/core/cctp_constants.py
index 5dcac9d..41b14ee 100644
--- a/src/omniclaw/core/cctp_constants.py
+++ b/src/omniclaw/core/cctp_constants.py
@@ -99,8 +99,8 @@
     # Polygon
     "MATIC": "0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359",
     "MATIC-AMOY": "0x41e94eb019c0762f9bfcf9fb1e58725bfb0e7582",
-    # Arc - USDC on Arc Testnet
-    "ARC-TESTNET": "0x79A02482A880bCE3F13e09Da970dC34db4CD24d1",
+    # Arc - official USDC ERC-20 interface on Arc Testnet
+    "ARC-TESTNET": "0x3600000000000000000000000000000000000000",
 }
 
 # Iris API
diff --git a/src/omniclaw/facilitator/__init__.py b/src/omniclaw/facilitator/__init__.py
new file mode 100644
index 0000000..b7d18af
--- /dev/null
+++ b/src/omniclaw/facilitator/__init__.py
@@ -0,0 +1,23 @@
+"""Internal facilitator surfaces for OmniClaw-operated x402 settlement."""
+
+from omniclaw.facilitator.exact import (
+    CompatFacilitatorWeb3Signer,
+    ExactFacilitatorConfig,
+    create_exact_facilitator_app,
+    load_exact_facilitator_config_from_env,
+)
+from omniclaw.facilitator.networks import (
+    ExactSettlementNetworkProfile,
+    build_exact_asset_amount,
+    resolve_exact_settlement_network_profile,
+)
+
+__all__ = [
+    "CompatFacilitatorWeb3Signer",
+    "ExactFacilitatorConfig",
+    "ExactSettlementNetworkProfile",
+    "build_exact_asset_amount",
+    "create_exact_facilitator_app",
+    "load_exact_facilitator_config_from_env",
+    "resolve_exact_settlement_network_profile",
+]
diff --git a/src/omniclaw/facilitator/exact.py b/src/omniclaw/facilitator/exact.py
new file mode 100644
index 0000000..ea0dcbe
--- /dev/null
+++ b/src/omniclaw/facilitator/exact.py
@@ -0,0 +1,193 @@
+from __future__ import annotations
+
+import os
+from collections.abc import Callable
+from dataclasses import dataclass
+from typing import Any
+
+from fastapi import FastAPI, HTTPException
+from pydantic import BaseModel, ConfigDict, Field
+
+from omniclaw.facilitator.networks import resolve_exact_settlement_network_profile
+from omniclaw.protocols.x402_compat import (
+    get_signed_raw_transaction_bytes,
+    patch_x402_web3_compat,
+)
+
+patch_x402_web3_compat()
+
+from x402 import x402Facilitator  # noqa: E402
+from x402.mechanisms.evm.exact import register_exact_evm_facilitator  # noqa: E402
+from x402.mechanisms.evm.signers import FacilitatorWeb3Signer  # noqa: E402
+from x402.schemas import PaymentPayload, PaymentRequirements  # noqa: E402
+
+
+def _env(name: str, default: str = "") -> str:
+    value = os.environ.get(name, "").strip()
+    return value or default
+
+
+def _required_env(*names: str) -> str:
+    for name in names:
+        value = os.environ.get(name, "").strip()
+        if value:
+            return value
+    missing = ", ".join(names)
+    raise RuntimeError(f"Missing required environment variable. Set one of: {missing}")
+
+
+@dataclass(frozen=True)
+class ExactFacilitatorConfig:
+    private_key: str
+    rpc_url: str
+    networks: tuple[str, ...]
+    network_profile: str | None = None
+    port: int = 4022
+    host: str = "0.0.0.0"
+    title: str = "OmniClaw Exact Facilitator"
+
+
+class CompatFacilitatorWeb3Signer(FacilitatorWeb3Signer):
+    """Handle eth-account and web3 compatibility differences in this runtime."""
+
+    def write_contract(
+        self,
+        address: str,
+        abi: list[dict[str, Any]],
+        function_name: str,
+        *args: Any,
+    ) -> str:
+        from web3 import Web3
+
+        contract = self._w3.eth.contract(
+            address=Web3.to_checksum_address(address),
+            abi=abi,
+        )
+        func = getattr(contract.functions, function_name)
+        tx = func(*args).build_transaction(
+            {
+                "from": self._account.address,
+                "nonce": self._w3.eth.get_transaction_count(self._account.address),
+                "gas": 300000,
+                "gasPrice": self._w3.eth.gas_price,
+            }
+        )
+        signed_tx = self._account.sign_transaction(tx)
+        tx_hash = self._w3.eth.send_raw_transaction(get_signed_raw_transaction_bytes(signed_tx))
+        return tx_hash.hex()
+
+    def send_transaction(self, to: str, data: bytes) -> str:
+        from web3 import Web3
+
+        tx = {
+            "from": self._account.address,
+            "to": Web3.to_checksum_address(to),
+            "data": data,
+            "nonce": self._w3.eth.get_transaction_count(self._account.address),
+            "gas": 300000,
+            "gasPrice": self._w3.eth.gas_price,
+        }
+        signed_tx = self._account.sign_transaction(tx)
+        tx_hash = self._w3.eth.send_raw_transaction(get_signed_raw_transaction_bytes(signed_tx))
+        return tx_hash.hex()
+
+
+class FacilitatorRequest(BaseModel):
+    model_config = ConfigDict(extra="forbid", populate_by_name=True)
+
+    x402_version: int = Field(alias="x402Version")
+    payment_payload: dict[str, Any] = Field(alias="paymentPayload")
+    payment_requirements: dict[str, Any] = Field(alias="paymentRequirements")
+
+
+def load_exact_facilitator_config_from_env() -> ExactFacilitatorConfig:
+    profile_name = _env(
+        "OMNICLAW_X402_FACILITATOR_NETWORK_PROFILE",
+        _env("OMNICLAW_NETWORK", "BASE-SEPOLIA"),
+    )
+    profile = resolve_exact_settlement_network_profile(profile_name)
+    explicit_networks = tuple(
+        value.strip()
+        for value in _env("OMNICLAW_X402_FACILITATOR_NETWORKS", "").split(",")
+        if value.strip()
+    )
+    networks = explicit_networks or (profile.caip2,)
+    rpc_url = _env("OMNICLAW_X402_FACILITATOR_RPC_URL", profile.default_rpc_url or "")
+    if not rpc_url:
+        raise RuntimeError(
+            "Missing OMNICLAW_X402_FACILITATOR_RPC_URL and no default RPC is known for "
+            f"{profile.label}"
+        )
+
+    return ExactFacilitatorConfig(
+        port=int(_env("OMNICLAW_X402_FACILITATOR_PORT", "4022")),
+        host=_env("OMNICLAW_X402_FACILITATOR_HOST", "0.0.0.0"),
+        rpc_url=rpc_url,
+        private_key=_required_env(
+            "OMNICLAW_X402_FACILITATOR_PRIVATE_KEY",
+            "OMNICLAW_PRIVATE_KEY",
+        ),
+        networks=networks,
+        network_profile=profile.label,
+        title=_env(
+            "OMNICLAW_X402_FACILITATOR_TITLE",
+            f"OmniClaw Exact Facilitator ({profile.label})",
+        ),
+    )
+
+
+def create_exact_facilitator_app(
+    config: ExactFacilitatorConfig,
+    *,
+    signer_factory: Callable[..., Any] = CompatFacilitatorWeb3Signer,
+    facilitator_factory: Callable[[], Any] = x402Facilitator,
+    register_facilitator: Callable[..., Any] = register_exact_evm_facilitator,
+) -> FastAPI:
+    app = FastAPI(title=config.title)
+
+    signer = signer_factory(
+        private_key=config.private_key,
+        rpc_url=config.rpc_url,
+    )
+    facilitator = facilitator_factory()
+    register_facilitator(
+        facilitator,
+        signer=signer,
+        networks=list(config.networks),
+    )
+
+    app.state.omniclaw_exact_facilitator_config = config
+    app.state.omniclaw_exact_facilitator = facilitator
+
+    @app.get("/supported")
+    async def supported() -> dict[str, Any]:
+        result = facilitator.get_supported()
+        if hasattr(result, "model_dump"):
+            return result.model_dump(by_alias=True, exclude_none=True)
+        return result
+
+    @app.post("/verify")
+    async def verify(request: FacilitatorRequest) -> dict[str, Any]:
+        if request.x402_version != 2:
+            raise HTTPException(status_code=400, detail="Only x402Version=2 is supported")
+
+        payload = PaymentPayload.model_validate(request.payment_payload)
+        requirements = PaymentRequirements.model_validate(request.payment_requirements)
+        result = await facilitator.verify(payload, requirements)
+        if hasattr(result, "model_dump"):
+            return result.model_dump(by_alias=True, exclude_none=True)
+        return result
+
+    @app.post("/settle")
+    async def settle(request: FacilitatorRequest) -> dict[str, Any]:
+        if request.x402_version != 2:
+            raise HTTPException(status_code=400, detail="Only x402Version=2 is supported")
+
+        payload = PaymentPayload.model_validate(request.payment_payload)
+        requirements = PaymentRequirements.model_validate(request.payment_requirements)
+        result = await facilitator.settle(payload, requirements)
+        if hasattr(result, "model_dump"):
+            return result.model_dump(by_alias=True, exclude_none=True)
+        return result
+
+    return app
diff --git a/src/omniclaw/facilitator/networks.py b/src/omniclaw/facilitator/networks.py
new file mode 100644
index 0000000..8643b59
--- /dev/null
+++ b/src/omniclaw/facilitator/networks.py
@@ -0,0 +1,121 @@
+from __future__ import annotations
+
+from dataclasses import dataclass
+from decimal import Decimal
+
+from x402.schemas import AssetAmount
+
+from omniclaw.core.cctp_constants import USDC_CONTRACTS
+from omniclaw.core.types import Network, network_to_caip2, normalize_network
+
+
+@dataclass(frozen=True)
+class ExactSettlementNetworkProfile:
+    network: Network
+    caip2: str
+    label: str
+    default_rpc_url: str | None = None
+    explorer_base_url: str | None = None
+    default_asset_address: str | None = None
+    default_asset_name: str = "USDC"
+    default_asset_version: str = "2"
+    default_asset_decimals: int = 6
+
+
+_DEFAULT_PROFILE_METADATA: dict[Network, dict[str, str | None]] = {
+    Network.ETH: {
+        "default_rpc_url": "https://ethereum-rpc.publicnode.com",
+        "explorer_base_url": "https://etherscan.io/tx/",
+    },
+    Network.ETH_SEPOLIA: {
+        "default_rpc_url": "https://ethereum-sepolia-rpc.publicnode.com",
+        "explorer_base_url": "https://sepolia.etherscan.io/tx/",
+    },
+    Network.BASE: {
+        "default_rpc_url": "https://mainnet.base.org",
+        "explorer_base_url": "https://basescan.org/tx/",
+    },
+    Network.BASE_SEPOLIA: {
+        "default_rpc_url": "https://sepolia.base.org",
+        "explorer_base_url": "https://sepolia.basescan.org/tx/",
+    },
+    Network.OP: {
+        "default_rpc_url": "https://mainnet.optimism.io",
+        "explorer_base_url": "https://optimistic.etherscan.io/tx/",
+    },
+    Network.OP_SEPOLIA: {
+        "default_rpc_url": "https://sepolia.optimism.io",
+        "explorer_base_url": "https://sepolia-optimism.etherscan.io/tx/",
+    },
+    Network.ARB: {
+        "default_rpc_url": "https://arb1.arbitrum.io/rpc",
+        "explorer_base_url": "https://arbiscan.io/tx/",
+    },
+    Network.ARB_SEPOLIA: {
+        "default_rpc_url": "https://sepolia-rollup.arbitrum.io/rpc",
+        "explorer_base_url": "https://sepolia.arbiscan.io/tx/",
+    },
+    Network.UNI: {
+        "default_rpc_url": "https://mainnet.unichain.org",
+        "explorer_base_url": "https://uniscan.xyz/tx/",
+    },
+    Network.UNI_SEPOLIA: {
+        "default_rpc_url": "https://sepolia.unichain.org",
+        "explorer_base_url": "https://sepolia.uniscan.xyz/tx/",
+    },
+    Network.ARC_TESTNET: {
+        "default_rpc_url": "https://rpc.testnet.arc.network",
+        "explorer_base_url": "https://testnet.arcscan.app/tx/",
+    },
+}
+
+
+def resolve_exact_settlement_network_profile(
+    network: Network | str | None,
+) -> ExactSettlementNetworkProfile:
+    normalized = normalize_network(network or Network.BASE_SEPOLIA)
+    if normalized is None:
+        raise ValueError("Exact settlement network profile cannot be resolved from None")
+    if not normalized.is_evm():
+        raise ValueError(f"Exact settlement only supports EVM networks, got: {normalized.value}")
+
+    caip2 = network_to_caip2(normalized)
+    if not caip2:
+        raise ValueError(f"No CAIP-2 mapping available for exact settlement: {normalized.value}")
+
+    metadata = _DEFAULT_PROFILE_METADATA.get(normalized, {})
+    return ExactSettlementNetworkProfile(
+        network=normalized,
+        caip2=caip2,
+        label=normalized.value,
+        default_rpc_url=metadata.get("default_rpc_url"),
+        explorer_base_url=metadata.get("explorer_base_url"),
+        default_asset_address=USDC_CONTRACTS.get(normalized.value),
+    )
+
+
+def build_exact_asset_amount(
+    *,
+    profile: ExactSettlementNetworkProfile,
+    decimal_amount: float | str | Decimal,
+    network: str,
+) -> AssetAmount | None:
+    if network != profile.caip2 or not profile.default_asset_address:
+        return None
+
+    amount_decimal = Decimal(str(decimal_amount))
+    scaled = amount_decimal * (Decimal(10) ** profile.default_asset_decimals)
+    if scaled != scaled.to_integral_value():
+        raise ValueError(
+            f"Amount {decimal_amount} cannot be represented with "
+            f"{profile.default_asset_decimals} decimals"
+        )
+
+    return AssetAmount(
+        amount=str(int(scaled)),
+        asset=profile.default_asset_address,
+        extra={
+            "name": profile.default_asset_name,
+            "version": profile.default_asset_version,
+        },
+    )
diff --git a/src/omniclaw/onboarding.py b/src/omniclaw/onboarding.py
index 7d1781f..d465140 100644
--- a/src/omniclaw/onboarding.py
+++ b/src/omniclaw/onboarding.py
@@ -10,6 +10,7 @@
 Usage:
     >>> from omniclaw.onboarding import quick_setup
     >>> quick_setup("YOUR_CIRCLE_API_KEY")
+    >>> quick_setup("YOUR_CIRCLE_API_KEY", entity_secret="YOUR_EXISTING_ENTITY_SECRET")
 """
 
 from __future__ import annotations
@@ -282,6 +283,26 @@ def generate_entity_secret() -> str:
     return secrets.token_hex(32)
 
 
+def validate_entity_secret(entity_secret: str) -> str:
+    """
+    Validate and normalize a Circle Entity Secret.
+
+    Circle accounts/API keys can only have one active Entity Secret registered.
+    If a user already has that secret, OmniClaw should use it directly instead
+    of generating and trying to register a replacement.
+    """
+    normalized = entity_secret.strip()
+    if len(normalized) != 64:
+        raise SetupError(f"Entity Secret must be 64 hex characters, got {len(normalized)}")
+
+    try:
+        int(normalized, 16)
+    except ValueError:
+        raise SetupError("Entity Secret must be valid hexadecimal") from None
+
+    return normalized
+
+
 def register_entity_secret(
     api_key: str,
     entity_secret: str,
@@ -306,14 +327,7 @@ def register_entity_secret(
             "Circle SDK not installed. Run: pip install circle-developer-controlled-wallets"
         )
 
-    # Validate entity secret format
-    if len(entity_secret) != 64:
-        raise SetupError(f"Entity Secret must be 64 hex characters, got {len(entity_secret)}")
-
-    try:
-        int(entity_secret, 16)
-    except ValueError:
-        raise SetupError("Entity Secret must be valid hexadecimal") from None
+    entity_secret = validate_entity_secret(entity_secret)
 
     # Default to secure config directory
     # Default to secure config directory
@@ -450,6 +464,7 @@ def create_env_file(
         SetupError: If file exists and overwrite=False
     """
     env_path = Path(env_path)
+    entity_secret = validate_entity_secret(entity_secret)
 
     if env_path.exists() and not overwrite:
         raise SetupError(f"{env_path} already exists. Use overwrite=True to replace.")
@@ -471,24 +486,31 @@ def quick_setup(
     api_key: str,
     env_path: str | Path = ".env",
     network: str = "ARC-TESTNET",
+    entity_secret: str | None = None,
 ) -> dict[str, Any]:
     """
     Complete SDK setup in one call.
 
-    Creates:
-    - .env file with CIRCLE_API_KEY and ENTITY_SECRET (in current directory)
-    - Recovery file in secure config directory (~/.config/omniclaw/)
+    If `entity_secret` is provided, OmniClaw assumes it is the existing Circle
+    Entity Secret for this API key and writes it directly. Circle only allows one
+    Entity Secret per account/API key, so provided secrets are not re-registered.
+
+    If `entity_secret` is omitted, OmniClaw generates a new Entity Secret,
+    registers it with Circle, and saves the recovery file in the secure config
+    directory.
 
     Args:
         api_key: Your Circle API key
         env_path: Path for .env file (default: ".env" in current directory)
         network: Target network (default: "ARC-TESTNET")
+        entity_secret: Existing 64-character Circle Entity Secret, if already created
 
     Returns:
         Dict with entity_secret, env_path, recovery_dir
 
     Example:
         >>> quick_setup("sk_test_...")
+        >>> quick_setup("sk_test_...", entity_secret="a" * 64)
     """
     env_path = Path(env_path).resolve()
     recovery_dir = get_config_dir()  # Secure platform-specific location
@@ -496,21 +518,28 @@ def quick_setup(
     print("OmniClaw Setup")
     print("-" * 40)
 
-    # Step 1: Generate Entity Secret
-    entity_secret = generate_entity_secret()
-    print("[OK] Generated Entity Secret")
+    recovery_file: Path | None = None
+    used_existing_entity_secret = bool(entity_secret)
+    if entity_secret:
+        entity_secret = validate_entity_secret(entity_secret)
+        print("[OK] Using existing Circle Entity Secret")
+    else:
+        # Step 1: Generate Entity Secret
+        entity_secret = generate_entity_secret()
+        print("[OK] Generated Entity Secret")
 
-    # Step 2: Register with Circle (saves recovery file to config dir)
-    try:
-        register_entity_secret(
-            api_key=api_key,
-            entity_secret=entity_secret,
-            recovery_dir=recovery_dir,
-        )
-        print("[OK] Registered with Circle")
-    except SetupError as e:
-        print(f"[FAILED] Registration failed:\n{e}")
-        raise
+        # Step 2: Register with Circle (saves recovery file to config dir)
+        try:
+            register_entity_secret(
+                api_key=api_key,
+                entity_secret=entity_secret,
+                recovery_dir=recovery_dir,
+            )
+            print("[OK] Registered with Circle")
+        except SetupError as e:
+            print(f"[FAILED] Registration failed:\n{e}")
+            raise
+        recovery_file = find_recovery_file()
 
     # Step 3: Create .env file in project directory
     env_content = f"""# OmniClaw Configuration
@@ -521,7 +550,8 @@ def quick_setup(
 
     env_path.write_text(env_content)
     os.chmod(env_path, 0o600)
-    recovery_file = find_recovery_file()
+    if recovery_file is None:
+        recovery_file = find_recovery_file()
     try:
         store_managed_credentials(
             api_key,
@@ -536,10 +566,15 @@ def quick_setup(
     # Summary
     print("-" * 40)
     print(f"Credentials saved to: {env_path}")
-    print(f"Recovery file saved to: {recovery_dir}")
+    if recovery_file:
+        print(f"Recovery file found at: {recovery_file}")
+    elif used_existing_entity_secret:
+        print("Recovery file: not found locally for the provided existing Entity Secret")
+    else:
+        print(f"Recovery file saved to: {recovery_dir}")
     print()
-    print("IMPORTANT: Keep the recovery file safe. You will need it if you")
-    print("lose your entity secret and need to reset it.")
+    print("IMPORTANT: Keep your Entity Secret and Circle recovery file safe.")
+    print("Circle allows one active Entity Secret per account/API key.")
     print()
     print("Ready to use:")
     print("  from omniclaw import OmniClaw")
@@ -557,21 +592,32 @@ def auto_setup_entity_secret(
     logger: Logger | None = None,
 ) -> str:
     """
-    Silently auto-generate and register entity secret.
+    Resolve or silently auto-generate/register an entity secret.
 
-    Called automatically by OmniClaw client when ENTITY_SECRET is missing.
-    Saves recovery file to secure config directory (~/.config/omniclaw/).
-    Also appends ENTITY_SECRET to .env file if it exists.
+    Called automatically by OmniClaw client when ENTITY_SECRET is missing. The
+    function first checks env and OmniClaw's managed config. It only generates
+    and registers a new Circle Entity Secret when no existing secret is found.
+
+    Circle allows one active Entity Secret per account/API key. If the Circle
+    account already has one but it is not available locally, set ENTITY_SECRET
+    directly instead of forcing a new registration.
 
     Args:
         api_key: Circle API key
         logger: Optional logger for status messages
 
     Returns:
-        Generated entity secret (64 hex chars)
+        Existing or generated entity secret (64 hex chars)
     """
     log = logger or logging.getLogger("omniclaw.onboarding")
 
+    existing_secret = resolve_entity_secret(api_key)
+    if existing_secret:
+        existing_secret = validate_entity_secret(existing_secret)
+        os.environ["ENTITY_SECRET"] = existing_secret
+        log.info("Using existing Circle Entity Secret from environment or managed store.")
+        return existing_secret
+
     entity_secret = generate_entity_secret()
 
     # Register with Circle - save to secure config directory
diff --git a/src/omniclaw/payment/router.py b/src/omniclaw/payment/router.py
index b8d0718..7f0f37a 100644
--- a/src/omniclaw/payment/router.py
+++ b/src/omniclaw/payment/router.py
@@ -46,6 +46,14 @@ def unregister_adapter(self, method: PaymentMethod) -> None:
     def get_adapters(self) -> list[ProtocolAdapter]:
         return list(self._adapters)
 
+    @staticmethod
+    def _matches_preferred_route(adapter: ProtocolAdapter, preferred_route: Any) -> bool:
+        if not preferred_route:
+            return True
+        adapter_method = getattr(adapter, "method", None)
+        adapter_value = adapter_method.value if hasattr(adapter_method, "value") else adapter_method
+        return str(adapter_value) == str(preferred_route)
+
     def detect_method(
         self,
         recipient: str,
@@ -54,6 +62,8 @@ def detect_method(
         **kwargs: Any,
     ) -> PaymentMethod | None:
         for adapter in self._adapters:
+            if not self._matches_preferred_route(adapter, kwargs.get("preferred_url_route")):
+                continue
             if adapter.supports(
                 recipient,
                 source_network=source_network,
@@ -71,6 +81,8 @@ def _find_adapter(
         **kwargs: Any,
     ) -> ProtocolAdapter | None:
         for adapter in self._adapters:
+            if not self._matches_preferred_route(adapter, kwargs.get("preferred_url_route")):
+                continue
             if adapter.supports(
                 recipient,
                 source_network=source_network,
@@ -90,7 +102,8 @@ def _find_adapters(
         return [
             adapter
             for adapter in self._adapters
-            if adapter.supports(
+            if self._matches_preferred_route(adapter, kwargs.get("preferred_url_route"))
+            and adapter.supports(
                 recipient,
                 source_network=source_network,
                 destination_chain=destination_chain,
diff --git a/src/omniclaw/protocols/nanopayments/adapter.py b/src/omniclaw/protocols/nanopayments/adapter.py
index 94314f4..c630f0f 100644
--- a/src/omniclaw/protocols/nanopayments/adapter.py
+++ b/src/omniclaw/protocols/nanopayments/adapter.py
@@ -966,7 +966,8 @@ def supports(
         """Check if this adapter can handle the recipient via nanopayments."""
         # URL → can try x402 with Gateway
         if _is_url(recipient):
-            return True
+            preferred_url_route = kwargs.get("preferred_url_route")
+            return preferred_url_route != "x402"
         # EVM address below micro threshold
         if _is_address(recipient):
             amount = kwargs.get("amount")
@@ -1027,7 +1028,7 @@ async def execute(
             return PaymentResult(
                 success=result.success,
                 transaction_id=result.transaction or None,
-                blockchain_tx=result.transaction or None,
+                blockchain_tx=None,
                 amount=Decimal(result.amount_usdc) if result.amount_usdc else amount,
                 recipient=recipient,
                 method=PaymentMethod.NANOPAYMENT,
diff --git a/src/omniclaw/protocols/nanopayments/middleware.py b/src/omniclaw/protocols/nanopayments/middleware.py
index b686127..a42ccce 100644
--- a/src/omniclaw/protocols/nanopayments/middleware.py
+++ b/src/omniclaw/protocols/nanopayments/middleware.py
@@ -31,6 +31,7 @@ async def premium(payment=Depends(gateway.require("$0.001"))):
 from __future__ import annotations
 
 import base64
+import inspect
 import json
 from dataclasses import dataclass
 from typing import Any
@@ -193,6 +194,10 @@ def __init__(
         self._facilitator = facilitator
         self._facilitator_name = facilitator.name if facilitator else "circle"
 
+    def _uses_gateway_batched_scheme(self) -> bool:
+        """Return True when this middleware should advertise Circle's GatewayWalletBatched."""
+        return not self._facilitator or str(self._facilitator_name).lower() == "circle"
+
     # -------------------------------------------------------------------------
     # Supported networks management
     # -------------------------------------------------------------------------
@@ -295,28 +300,31 @@ def _build_accepts_array(
             return []  # No networks available
 
         accepts = []
+        use_gateway_batched = self._uses_gateway_batched_scheme()
         for kind in kinds:
             verifying_contract = kind.verifying_contract
             usdc_address = kind.usdc_address
 
-            if not verifying_contract or not usdc_address:
+            if not usdc_address:
                 continue
 
-            accepts.append(
-                {
-                    "scheme": "exact",
-                    "network": kind.network,
-                    "asset": usdc_address,
-                    "amount": str(price_atomic),
-                    "maxTimeoutSeconds": MAX_TIMEOUT_SECONDS,
-                    "payTo": self._seller_address,
-                    "extra": {
-                        "name": "GatewayWalletBatched",
-                        "version": "1",
-                        "verifyingContract": verifying_contract,
-                    },
+            accept: dict[str, Any] = {
+                "scheme": "exact",
+                "network": kind.network,
+                "asset": usdc_address,
+                "amount": str(price_atomic),
+                "maxTimeoutSeconds": MAX_TIMEOUT_SECONDS,
+                "payTo": self._seller_address,
+            }
+            if use_gateway_batched:
+                if not verifying_contract:
+                    continue
+                accept["extra"] = {
+                    "name": "GatewayWalletBatched",
+                    "version": "1",
+                    "verifyingContract": verifying_contract,
                 }
-            )
+            accepts.append(accept)
 
         return accepts
 
@@ -327,6 +335,9 @@ def _build_accepts_array(
     async def _build_402_response(
         self,
         price_usd: str,
+        *,
+        resource_url: str = "",
+        method: str = "GET",
     ) -> dict[str, Any]:
         """
         Build the x402 v2 402 response body.
@@ -336,6 +347,19 @@ async def _build_402_response(
         """
         price_atomic = parse_price(price_usd)
 
+        create_accepts = getattr(self._facilitator, "create_accepts", None)
+        if self._facilitator and inspect.iscoroutinefunction(create_accepts):
+            accepts = await create_accepts(
+                resource_url=resource_url,
+                method=method,
+                price=price_usd,
+                server_wallet_address=self._seller_address,
+            )
+            return {
+                "x402Version": X402_VERSION,
+                "accepts": accepts,
+            }
+
         # Get supported kinds - handle both Circle and other facilitators
         kinds = None
         if self._supported_kinds is None and self._facilitator:
@@ -396,6 +420,9 @@ async def handle(
         self,
         request_headers: dict[str, str],
         price_usd: str,
+        *,
+        resource_url: str = "",
+        method: str = "GET",
     ) -> PaymentInfo:
         """
         Handle payment for a request.
@@ -421,7 +448,11 @@ async def handle(
 
         if not sig_header:
             # Build 402 response
-            body = await self._build_402_response(price_usd)
+            body = await self._build_402_response(
+                price_usd,
+                resource_url=resource_url,
+                method=method,
+            )
             header_value = self._encode_requirements(body)
             raise PaymentRequiredHTTPError(
                 status_code=402,
@@ -439,9 +470,10 @@ async def handle(
                 headers={},
             ) from None
 
-        # Build requirements from the payment payload
-        # We need to match the requirements that the buyer used
+        # Build requirements from the payment payload.
+        # Circle Gateway uses GatewayWalletBatched metadata; external facilitators use standard exact.
         gateway_kind = None
+        facilitator_requirements: dict[str, Any] | None = None
         if payload.payload.authorization:
             auth = payload.payload.authorization
             expected_amount = str(parse_price(price_usd))
@@ -492,51 +524,78 @@ async def handle(
                     headers={},
                 )
 
-            if not verifying_contract or not usdc_address:
+            if not usdc_address:
                 raise PaymentRequiredHTTPError(
                     status_code=502,
                     detail={"error": f"Missing contract addresses for network {payload.network}"},
                     headers={},
                 )
 
-            gateway_kind = PaymentRequirementsKind(
-                scheme="exact",
-                network=payload.network,
-                asset=usdc_address,  # Use actual USDC address from supported kinds
-                amount=auth.value,
-                max_timeout_seconds=MAX_TIMEOUT_SECONDS,
-                pay_to=self._seller_address,
-                extra=PaymentRequirementsExtra(
-                    name="GatewayWalletBatched",
-                    version="1",
-                    verifying_contract=verifying_contract,
-                ),
-            )
+            if self._uses_gateway_batched_scheme():
+                if not verifying_contract:
+                    raise PaymentRequiredHTTPError(
+                        status_code=502,
+                        detail={
+                            "error": f"Missing verifying contract for network {payload.network}"
+                        },
+                        headers={},
+                    )
+                gateway_kind = PaymentRequirementsKind(
+                    scheme="exact",
+                    network=payload.network,
+                    asset=usdc_address,
+                    amount=auth.value,
+                    max_timeout_seconds=MAX_TIMEOUT_SECONDS,
+                    pay_to=self._seller_address,
+                    extra=PaymentRequirementsExtra(
+                        name="GatewayWalletBatched",
+                        version="1",
+                        verifying_contract=verifying_contract,
+                    ),
+                )
+            else:
+                facilitator_requirements = {
+                    "x402Version": X402_VERSION,
+                    "accepts": [
+                        {
+                            "scheme": "exact",
+                            "network": payload.network,
+                            "asset": usdc_address,
+                            "amount": auth.value,
+                            "maxTimeoutSeconds": MAX_TIMEOUT_SECONDS,
+                            "payTo": self._seller_address,
+                        }
+                    ],
+                }
 
-        if gateway_kind is None:
+        if gateway_kind is None and facilitator_requirements is None:
             raise PaymentRequiredHTTPError(
                 status_code=402,
                 detail={"error": "Missing authorization in PAYMENT-SIGNATURE payload"},
                 headers={},
             )
 
-        requirements = PaymentRequirements(
-            x402_version=X402_VERSION,
-            accepts=(gateway_kind,) if gateway_kind else (),
-        )
+        requirements = None
+        if gateway_kind is not None:
+            requirements = PaymentRequirements(
+                x402_version=X402_VERSION,
+                accepts=(gateway_kind,),
+            )
 
         # Settle the payment - use facilitator if provided, otherwise use Circle client
         try:
             if self._facilitator:
-                # Use custom facilitator (Coinbase, OrderN, RBX, Thirdweb)
                 payload_dict = payload.to_dict()
-                req_dict = requirements.to_dict()
+                req_dict = (
+                    facilitator_requirements
+                    if facilitator_requirements is not None
+                    else requirements.to_dict()
+                )
                 settle_resp = await self._facilitator.settle(payload_dict, req_dict)
                 settle_success = settle_resp.success
                 settle_payer = settle_resp.payer
                 settle_tx = settle_resp.transaction
             else:
-                # Use Circle Gateway (default)
                 settle_resp = await self._client.settle(
                     payload=payload,
                     requirements=requirements,
@@ -585,7 +644,12 @@ async def premium(payment=Depends(gateway.require("$0.001"))):
         async def dependency(request: Request) -> PaymentInfo:
             headers = dict(request.headers)
             try:
-                return await self.handle(headers, price)
+                return await self.handle(
+                    headers,
+                    price,
+                    resource_url=str(request.url),
+                    method=request.method,
+                )
             except PaymentRequiredHTTPError as exc:
                 raise HTTPException(
                     status_code=exc.status_code,
diff --git a/src/omniclaw/protocols/x402.py b/src/omniclaw/protocols/x402.py
index f36a634..c020503 100644
--- a/src/omniclaw/protocols/x402.py
+++ b/src/omniclaw/protocols/x402.py
@@ -3,26 +3,30 @@
 from __future__ import annotations
 
 import base64
+import ipaddress
 import json
+import os
 import re
 from dataclasses import dataclass
 from decimal import Decimal
 from typing import TYPE_CHECKING, Any
+from urllib.parse import urlparse
 
 import httpx
 
-from omniclaw.core.exceptions import InsufficientBalanceError, ProtocolError, WalletError
+from omniclaw.core.exceptions import ProtocolError, WalletError
 from omniclaw.core.idempotency import derive_idempotency_key
 from omniclaw.core.logging import get_logger
-from omniclaw.core.state_machine import is_effective_success_status, is_irreversible_success_status
 from omniclaw.core.types import (
     FeeLevel,
     Network,
     PaymentMethod,
     PaymentResult,
     PaymentStatus,
+    network_to_caip2,
 )
 from omniclaw.protocols.base import ProtocolAdapter
+from omniclaw.protocols.x402_compat import patch_x402_web3_compat
 
 if TYPE_CHECKING:
     from omniclaw.core.config import Config
@@ -34,8 +38,9 @@
 HEADER_PAYMENT_RESPONSE = "PAYMENT-RESPONSE"  # V2
 HEADER_PAYMENT_REQUIRED_V1 = "X-Payment-Required"  # V1 Legacy
 
-# URL pattern for detecting x402-compatible endpoints (HTTPS only)
-URL_PATTERN = re.compile(r"^https://")
+# URL pattern for detecting x402-compatible endpoints
+HTTPS_URL_PATTERN = re.compile(r"^https://")
+HTTP_URL_PATTERN = re.compile(r"^http://")
 
 _CAIP2_TO_NETWORK: dict[str, Network] = {
     "eip155:1": Network.ETH,
@@ -66,17 +71,42 @@ def _resolve_network(value: str) -> Network | None:
         return None
 
 
-@dataclass
-class PaymentRequirements:
-    """Payment requirements parsed from a 402 response."""
+@dataclass(frozen=True)
+class AcceptedPaymentKind:
+    """A single accepted x402 payment kind advertised by the seller."""
 
     scheme: str
     network: str
-    max_amount_required: str  # Smallest unit
-    resource: str
-    description: str
+    amount_atomic: str
     recipient: str
     extra: dict[str, Any] | None = None
+    asset: str | None = None
+    max_timeout_seconds: int | None = None
+
+    @property
+    def facilitator_name(self) -> str:
+        extra = self.extra or {}
+        return str(extra.get("name") or "").strip()
+
+    @property
+    def is_gateway_batched(self) -> bool:
+        return self.facilitator_name == "GatewayWalletBatched"
+
+    def get_amount_usdc(self) -> Decimal:
+        try:
+            return Decimal(int(self.amount_atomic)) / Decimal(10**6)
+        except Exception:
+            return Decimal(self.amount_atomic)
+
+
+@dataclass
+class PaymentRequirements:
+    """Payment requirements parsed from a 402 response."""
+
+    accepts: tuple[AcceptedPaymentKind, ...]
+    resource: str
+    description: str = ""
+    x402_version: int = 2
 
     @classmethod
     def from_response(cls, response: httpx.Response) -> PaymentRequirements:
@@ -93,15 +123,11 @@ def from_response(cls, response: httpx.Response) -> PaymentRequirements:
                 # V2 format: {x402Version, accepts: [{scheme, network, asset, amount, payTo, ...}]}
                 accepts = data.get("accepts", [])
                 if accepts:
-                    kind = accepts[0]
                     return cls(
-                        scheme=kind.get("scheme", "exact"),
-                        network=kind.get("network", ""),
-                        max_amount_required=kind.get("amount", "0"),
+                        accepts=tuple(cls._parse_kind(kind) for kind in accepts),
                         resource=str(response.url),
                         description="",
-                        recipient=kind.get("payTo", ""),
-                        extra=kind.get("extra"),
+                        x402_version=int(data.get("x402Version", 2) or 2),
                     )
             except Exception:
                 pass
@@ -115,26 +141,27 @@ def from_response(cls, response: httpx.Response) -> PaymentRequirements:
             # Handle V2 body with 'accepts' array
             accepts = data.get("accepts")
             if accepts and isinstance(accepts, list):
-                kind = accepts[0]
                 return cls(
-                    scheme=kind.get("scheme", "exact"),
-                    network=kind.get("network", ""),
-                    max_amount_required=kind.get("amount", "0"),
+                    accepts=tuple(cls._parse_kind(kind) for kind in accepts),
                     resource=str(response.url),
                     description="",
-                    recipient=kind.get("payTo", ""),
-                    extra=kind.get("extra"),
+                    x402_version=int(data.get("x402Version", 2) or 2),
                 )
 
             # Legacy body format
             return cls(
-                scheme=data.get("scheme", "exact"),
-                network=data.get("network", ""),
-                max_amount_required=data.get("maxAmountRequired", data.get("amount", "0")),
+                accepts=(
+                    AcceptedPaymentKind(
+                        scheme=data.get("scheme", "exact"),
+                        network=data.get("network", ""),
+                        amount_atomic=data.get("maxAmountRequired", data.get("amount", "0")),
+                        recipient=data.get("paymentAddress", data.get("recipient", "")),
+                        extra=data.get("extra"),
+                    ),
+                ),
                 resource=data.get("resource", str(response.url)),
                 description=data.get("description", ""),
-                recipient=data.get("paymentAddress", data.get("recipient", "")),
-                extra=data.get("extra"),
+                x402_version=2,
             )
         except Exception:
             pass
@@ -155,25 +182,104 @@ def from_header(cls, header_value: str) -> PaymentRequirements:
             decoded = base64.b64decode(header_value)
             data = json.loads(decoded)
             return cls(
-                scheme=data.get("scheme", "exact"),
-                network=data.get("network", ""),
-                max_amount_required=data.get("maxAmountRequired", "0"),
+                accepts=(
+                    AcceptedPaymentKind(
+                        scheme=data.get("scheme", "exact"),
+                        network=data.get("network", ""),
+                        amount_atomic=data.get("maxAmountRequired", "0"),
+                        recipient=data.get("paymentAddress", data.get("recipient", "")),
+                        extra=data.get("extra"),
+                    ),
+                ),
                 resource=data.get("resource", ""),
                 description=data.get("description", ""),
-                recipient=data.get("paymentAddress", data.get("recipient", "")),
-                extra=data.get("extra"),
+                x402_version=1,
             )
         except Exception as e:
             raise ProtocolError(f"Failed to parse payment requirements: {e}") from e
 
-    def get_amount_usdc(self) -> Decimal:
-        """Get amount in USDC (assuming 6 decimals for USDC)."""
-        try:
-            # Amount is usually in smallest unit (e.g., for USDC with 6 decimals)
-            amount_int = int(self.max_amount_required)
-            return Decimal(amount_int) / Decimal(10**6)
-        except Exception:
-            return Decimal(self.max_amount_required)
+    @staticmethod
+    def _parse_kind(kind: dict[str, Any]) -> AcceptedPaymentKind:
+        return AcceptedPaymentKind(
+            scheme=kind.get("scheme", "exact"),
+            network=kind.get("network", ""),
+            amount_atomic=kind.get("amount", "0"),
+            recipient=kind.get("payTo", ""),
+            extra=kind.get("extra"),
+            asset=kind.get("asset"),
+            max_timeout_seconds=kind.get("maxTimeoutSeconds"),
+        )
+
+    def select_preferred_kind(
+        self,
+        *,
+        prefer_gateway: bool = False,
+        source_network: Network | None = None,
+    ) -> AcceptedPaymentKind | None:
+        """
+        Select the best supported x402 kind from the seller's advertised accepts list.
+
+        Buyer-side policy:
+        - If prefer_gateway=True, prefer GatewayWalletBatched on the buyer's current network
+        - Otherwise ignore GatewayWalletBatched and choose a non-gateway exact kind
+        - Prefer same-network kinds before cross-network kinds
+        """
+        if not self.accepts:
+            return None
+
+        target_caip2 = None
+        if source_network is not None:
+            target_caip2 = {
+                Network.ETH: "eip155:1",
+                Network.ETH_SEPOLIA: "eip155:11155111",
+                Network.AVAX: "eip155:43114",
+                Network.AVAX_FUJI: "eip155:43113",
+                Network.MATIC: "eip155:137",
+                Network.MATIC_AMOY: "eip155:80002",
+                Network.ARB: "eip155:42161",
+                Network.ARB_SEPOLIA: "eip155:421614",
+                Network.BASE: "eip155:8453",
+                Network.BASE_SEPOLIA: "eip155:84532",
+                Network.OP: "eip155:10",
+                Network.OP_SEPOLIA: "eip155:11155420",
+                Network.ARC_TESTNET: "eip155:5042002",
+            }.get(source_network)
+
+        candidates = [
+            kind
+            for kind in self.accepts
+            if kind.scheme == "exact"
+            and (kind.is_gateway_batched if prefer_gateway else not kind.is_gateway_batched)
+        ]
+        if not candidates:
+            return None
+
+        same_network = [
+            kind for kind in candidates if target_caip2 and kind.network == target_caip2
+        ]
+        if same_network:
+            return same_network[0]
+        return candidates[0]
+
+
+def _is_allowed_insecure_http(url: str) -> bool:
+    """Allow HTTP URLs only for localhost/private networks in non-production."""
+    if not HTTP_URL_PATTERN.match(url):
+        return False
+    parsed = urlparse(url)
+    host = parsed.hostname or ""
+    if host in {"localhost", "127.0.0.1"}:
+        return True
+
+    env = os.environ.get("OMNICLAW_ENV", "development").lower()
+    if env in {"prod", "production", "mainnet"}:
+        return False
+
+    try:
+        ip = ipaddress.ip_address(host)
+        return ip.is_private or ip.is_loopback or ip.is_link_local
+    except ValueError:
+        return host.endswith(".local")
 
 
 @dataclass
@@ -203,6 +309,76 @@ def to_header(self) -> str:
         return base64.b64encode(json_str.encode()).decode()
 
 
+class _OmniClawExactSigner:
+    """Minimal EVM signer for the upstream x402 exact client."""
+
+    def __init__(self, private_key: str) -> None:
+        from eth_account import Account
+
+        self._private_key = private_key
+        self._account = Account.from_key(private_key)
+
+    @property
+    def address(self) -> str:
+        return self._account.address
+
+    def sign_typed_data(
+        self,
+        domain: Any,
+        types: dict[str, list[Any]],
+        primary_type: str,
+        message: dict[str, Any],
+    ) -> bytes:
+        from eth_account import Account
+        from eth_account.messages import encode_typed_data
+
+        if isinstance(domain, dict):
+            domain_dict = domain
+        else:
+            domain_dict = {
+                "name": getattr(domain, "name", None),
+                "chainId": getattr(domain, "chain_id", None),
+                "verifyingContract": getattr(domain, "verifying_contract", None),
+            }
+            domain_version = getattr(domain, "version", None)
+            if domain_version:
+                domain_dict["version"] = domain_version
+        domain_dict = {key: value for key, value in domain_dict.items() if value is not None}
+
+        domain_field_map = {
+            "name": {"name": "name", "type": "string"},
+            "version": {"name": "version", "type": "string"},
+            "chainId": {"name": "chainId", "type": "uint256"},
+            "verifyingContract": {"name": "verifyingContract", "type": "address"},
+            "salt": {"name": "salt", "type": "bytes32"},
+        }
+        full_types: dict[str, list[dict[str, str]]] = {
+            "EIP712Domain": [
+                domain_field_map[key] for key in domain_dict if key in domain_field_map
+            ]
+        }
+        for type_name, fields in types.items():
+            full_types[type_name] = [
+                {"name": field.name, "type": field.type} if hasattr(field, "name") else field
+                for field in fields
+            ]
+
+        message_copy = dict(message)
+        if "nonce" in message_copy and isinstance(message_copy["nonce"], bytes):
+            message_copy["nonce"] = "0x" + message_copy["nonce"].hex()
+
+        signable = encode_typed_data(
+            full_message={
+                "types": full_types,
+                "primaryType": primary_type,
+                "domain": domain_dict,
+                "message": message_copy,
+            }
+        )
+        signed = Account.sign_message(signable, self._private_key)
+        return bytes(signed.signature)
+
+
 class X402Adapter(ProtocolAdapter):
     """
     Adapter for x402 HTTP Payment Required protocol.
@@ -258,7 +434,7 @@ def supports(
         Returns:
             True if recipient is a valid HTTP(S) URL
         """
-        return bool(URL_PATTERN.match(recipient))
+        return bool(HTTPS_URL_PATTERN.match(recipient) or _is_allowed_insecure_http(recipient))
 
     async def _get_http_client(self) -> httpx.AsyncClient:
         """Get or create HTTP client."""
@@ -285,6 +461,80 @@ async def _request_with_402_check(
 
         return response, None
 
+    @staticmethod
+    def _atomic_to_decimal(amount_atomic: str) -> Decimal:
+        return Decimal(int(amount_atomic)) / Decimal(10**6)
+
+    @staticmethod
+    def _decimal_to_atomic(amount_decimal: Decimal) -> int:
+        return int((amount_decimal * Decimal(10**6)).to_integral_value())
+
+    @staticmethod
+    def _decode_response_body(response: httpx.Response) -> Any:
+        try:
+            return response.json()
+        except Exception:
+            return response.text
+
+    def _resolve_agent_network(
+        self,
+        wallet_id: str,
+        source_network: Network | str | None,
+    ) -> Network | None:
+        if source_network:
+            if isinstance(source_network, Network):
+                return source_network
+            return Network.from_string(str(source_network))
+
+        try:
+            agent_wallet = self._wallet_service.get_wallet(wallet_id)
+            return Network.from_string(agent_wallet.blockchain)
+        except Exception:
+            return None
+
+    def _get_generic_x402_private_key(self) -> str:
+        private_key = self._config.nanopayments_private_key or os.environ.get(
+            "OMNICLAW_PRIVATE_KEY"
+        )
+        if not private_key:
+            raise WalletError("OMNICLAW_PRIVATE_KEY is required for generic x402 exact payments")
+        if not private_key.startswith("0x"):
+            private_key = f"0x{private_key}"
+        return private_key
+
+    def _build_sdk_http_client(
+        self,
+        *,
+        max_amount: Decimal,
+        preferred_network: str | None,
+    ) -> tuple[Any, dict[str, Any]]:
+        patch_x402_web3_compat()
+
+        from x402.client import max_amount as x402_max_amount
+        from x402.client import prefer_network as x402_prefer_network
+        from x402.client import prefer_scheme as x402_prefer_scheme
+        from x402.client import x402Client
+        from x402.http import x402HTTPClient
+        from x402.mechanisms.evm.exact.client import ExactEvmScheme
+
+        x402_client = x402Client()
+        x402_client.register(
+            "eip155:*",
+            ExactEvmScheme(_OmniClawExactSigner(self._get_generic_x402_private_key())),
+        )
+        x402_client.register_policy(x402_prefer_scheme("exact"))
+        if preferred_network:
+            x402_client.register_policy(x402_prefer_network(preferred_network))
+        x402_client.register_policy(x402_max_amount(self._decimal_to_atomic(max_amount)))
+
+        selection_state: dict[str, Any] = {}
+
+        async def _capture_selection(ctx: Any) -> None:
+            selection_state["requirements"] = ctx.selected_requirements
+
+        x402_client.on_after_payment_creation(_capture_selection)
+        return x402HTTPClient(x402_client), selection_state
+
     async def execute(
         self,
         wallet_id: str,
@@ -299,25 +549,27 @@ async def execute(
         timeout_seconds: float | None = None,
         **kwargs: Any,
     ) -> PaymentResult:
-        """Execute an x402 payment (V2)."""
+        """Execute an x402 exact payment using the upstream x402 SDK."""
         url = recipient
         strict_settlement = bool(getattr(self._config, "payment_strict_settlement", True))
         request_method = str(kwargs.get("http_method", kwargs.get("method", "GET"))).upper()
         request_headers = kwargs.get("request_headers") or kwargs.get("headers")
         request_json = kwargs.get("request_json")
         request_body = kwargs.get("request_body", kwargs.get("body"))
+        agent_network = self._resolve_agent_network(wallet_id, source_network)
+        agent_caip2 = network_to_caip2(agent_network)
 
         try:
-            # Check for 402
-            response, requirements = await self._request_with_402_check(
+            client = await self._get_http_client()
+            initial_response = await client.request(
+                request_method,
                 url,
-                method=request_method,
+                headers=request_headers,
                 json=request_json,
                 content=request_body,
-                headers=request_headers,
             )
 
-            if response.status_code != 402:
+            if initial_response.status_code != 402:
                 return PaymentResult(
                     success=True,
                     transaction_id=None,
@@ -326,247 +578,146 @@ async def execute(
                     recipient=url,
                     method=self.method,
                     status=PaymentStatus.COMPLETED,
-                    metadata={"http_status": response.status_code, "note": "No 402"},
-                )
-
-            if not requirements:
-                return PaymentResult(
-                    success=False,
-                    transaction_id=None,
-                    blockchain_tx=None,
-                    amount=amount,
-                    recipient=url,
-                    method=self.method,
-                    status=PaymentStatus.FAILED,
-                    error="Server returned 402 but extraction failed",
+                    metadata={"http_status": initial_response.status_code, "note": "No 402"},
                 )
 
-            # Validate Amount
-            required_amount = requirements.get_amount_usdc()
-            if required_amount > amount:
-                return PaymentResult(
-                    success=False,
-                    transaction_id=None,
-                    blockchain_tx=None,
-                    amount=required_amount,
-                    recipient=url,
-                    method=self.method,
-                    status=PaymentStatus.FAILED,
-                    error=f"Required {required_amount} > Max {amount}",
-                )
-
-            # Transfer to seller
-            payment_address = requirements.recipient
-            if not payment_address:
-                return PaymentResult(
-                    success=False,
-                    transaction_id=None,
-                    blockchain_tx=None,
-                    amount=required_amount,
-                    recipient=url,
-                    method=self.method,
-                    status=PaymentStatus.FAILED,
-                    error="No payment address found in requirements",
-                )
-
-            # Resolve network
-            from omniclaw.core.types import Network
-
-            if source_network:
-                if isinstance(source_network, Network):
-                    agent_network = source_network
-                else:
-                    agent_network = Network.from_string(str(source_network))
-            else:
-                agent_wallet = self._wallet_service.get_wallet(wallet_id)
-                agent_network = Network.from_string(agent_wallet.blockchain)
-
-            # Parse seller's network from requirements (CAIP-2 and enum values supported)
-            seller_network = _resolve_network(requirements.network)
-            if seller_network is None:
-                return PaymentResult(
-                    success=False,
-                    transaction_id=None,
-                    blockchain_tx=None,
-                    amount=required_amount,
-                    recipient=url,
-                    method=self.method,
-                    status=PaymentStatus.FAILED,
-                    error=f"Invalid network in payment requirements: {requirements.network}",
-                )
+            x402_http_client, selection_state = self._build_sdk_http_client(
+                max_amount=amount,
+                preferred_network=agent_caip2,
+            )
 
-            # Check if cross-chain transfer is needed
-            is_cross_chain = agent_network != seller_network
+            await initial_response.aread()
+            get_header, body_data = x402_http_client._handle_402_common(
+                dict(initial_response.headers),
+                initial_response.content or None,
+            )
+            payment_required = x402_http_client.get_payment_required_response(get_header, body_data)
             canonical_idempotency_key = idempotency_key or derive_idempotency_key(
                 "x402",
                 wallet_id,
                 url,
                 request_method,
-                requirements.scheme,
-                requirements.network,
-                requirements.recipient,
-                requirements.max_amount_required,
                 request_json,
                 request_body,
+                agent_caip2,
             )
+            payment_payload = await x402_http_client.create_payment_payload(payment_required)
+            selected_requirements = selection_state.get("requirements") or payment_payload.accepted
+            required_amount = self._atomic_to_decimal(str(selected_requirements.amount))
+            payment_address = str(selected_requirements.pay_to)
 
-            if is_cross_chain:
-                # Cross-chain: Use GatewayAdapter (CCTP)
-                self._logger.info(
-                    f"x402 cross-chain: {agent_network.value} → {seller_network.value}"
-                )
-                from omniclaw.protocols.gateway import GatewayAdapter
-
-                gateway = GatewayAdapter(self._config, self._wallet_service)
-                gateway_result = await gateway.execute(
-                    wallet_id=wallet_id,
-                    recipient=payment_address,
-                    amount=required_amount,
-                    purpose=purpose,
-                    fee_level=fee_level,
-                    idempotency_key=canonical_idempotency_key,
-                    wait_for_completion=True,
-                    destination_chain=seller_network,
-                    source_network=agent_network,
-                )
-
-                if not (
-                    gateway_result.success or is_effective_success_status(gateway_result.status)
-                ):
-                    return PaymentResult(
-                        success=False,
-                        transaction_id=gateway_result.transaction_id,
-                        blockchain_tx=gateway_result.blockchain_tx,
-                        amount=required_amount,
-                        recipient=url,
-                        method=self.method,
-                        status=PaymentStatus.FAILED,
-                        error=f"Cross-chain transfer failed: {gateway_result.error}",
-                    )
-
-                # Use gateway result for payment proof
-                transfer_tx_hash = gateway_result.blockchain_tx
-                transfer_tx_id = gateway_result.transaction_id
-                transfer_status = gateway_result.status
-            else:
-                # Same chain: Direct transfer
-                transfer_result = await self._wallet_service.transfer(
-                    wallet_id=wallet_id,
-                    destination_address=payment_address,
-                    amount=required_amount,
-                    fee_level=fee_level,
-                    wait_for_completion=True,
-                    idempotency_key=canonical_idempotency_key,
-                )
-
-                if not transfer_result.success:
-                    return PaymentResult(
-                        success=False,
-                        transaction_id=transfer_result.transaction.id
-                        if transfer_result.transaction
-                        else None,
-                        blockchain_tx=transfer_result.tx_hash,
-                        amount=required_amount,
-                        recipient=url,
-                        method=self.method,
-                        status=PaymentStatus.FAILED,
-                        error=f"Transfer failed: {transfer_result.error}",
-                    )
-
-                transfer_tx_hash = transfer_result.tx_hash
-                transfer_tx_id = (
-                    transfer_result.transaction.id if transfer_result.transaction else None
-                )
-                tx = transfer_result.transaction
-                tx_state = (
-                    tx.state.value
-                    if (tx and hasattr(tx.state, "value"))
-                    else (str(tx.state) if tx else "")
-                )
-                if tx and tx_state == "COMPLETE":
-                    transfer_status = (
-                        PaymentStatus.SETTLED if strict_settlement else PaymentStatus.COMPLETED
-                    )
-                elif tx and tx_state in ("FAILED", "CANCELLED"):
-                    transfer_status = (
-                        PaymentStatus.FAILED_FINAL if strict_settlement else PaymentStatus.FAILED
-                    )
-                else:
-                    transfer_status = (
-                        PaymentStatus.PENDING_SETTLEMENT
-                        if strict_settlement
-                        else PaymentStatus.PROCESSING
-                    )
-
-            # Create Payload (V2)
-            payload = PaymentPayload(
-                x402_version=2,
-                scheme=requirements.scheme,
-                network=requirements.network,
-                resource=url,
-                payload={
-                    "transactionHash": transfer_tx_hash,
-                    "fromAddress": self._wallet_service.get_wallet(wallet_id).address,
-                    "toAddress": payment_address,
-                    "amount": str(required_amount),
-                },
-            )
-
-            # Retry with PAYMENT-SIGNATURE while preserving caller-provided headers
-            payment_header = payload.to_header()
-            headers: dict[str, str] = {}
+            retry_headers: dict[str, str] = {}
             if isinstance(request_headers, dict):
-                for k, v in request_headers.items():
-                    headers[str(k)] = str(v)
-            headers[HEADER_PAYMENT_SIGNATURE] = payment_header
+                for key, value in request_headers.items():
+                    retry_headers[str(key)] = str(value)
+            retry_headers.update(x402_http_client.encode_payment_signature_header(payment_payload))
 
-            client = await self._get_http_client()
             final_response = await client.request(
                 request_method,
                 url,
-                headers=headers,
+                headers=retry_headers,
                 json=request_json,
                 content=request_body,
             )
 
+            settle_response = None
+            settle_error: str | None = None
+            try:
+                settle_response = x402_http_client.get_payment_settle_response(
+                    lambda name: final_response.headers.get(name)
+                )
+            except Exception as exc:
+                settle_error = str(exc)
+
+            response_data = self._decode_response_body(final_response)
+            settled_ok = bool(settle_response and settle_response.success)
+            transaction_id = (
+                str(settle_response.transaction)
+                if settle_response and getattr(settle_response, "transaction", None)
+                else None
+            )
+            settlement_network = (
+                str(settle_response.network)
+                if settle_response and getattr(settle_response, "network", None)
+                else None
+            )
+            payer = (
+                str(settle_response.payer)
+                if settle_response and getattr(settle_response, "payer", None)
+                else None
+            )
+            metadata = {
+                "http_status": final_response.status_code,
+                "scheme": str(selected_requirements.scheme),
+                "payment_network": str(selected_requirements.network),
+                "settlement_network": settlement_network,
+                "payment_asset": str(selected_requirements.asset),
+                "amount_atomic": str(selected_requirements.amount),
+                "payer": payer,
+                "pay_to": payment_address,
+                "idempotency_key": canonical_idempotency_key,
+            }
+
             if 200 <= final_response.status_code < 300:
-                # Parse response body
-                try:
-                    response_data = final_response.json()
-                except Exception:
-                    response_data = final_response.text
+                if strict_settlement and not settled_ok:
+                    error_message = (
+                        (
+                            getattr(settle_response, "error_message", None)
+                            if settle_response
+                            else None
+                        )
+                        or (
+                            getattr(settle_response, "error_reason", None)
+                            if settle_response
+                            else None
+                        )
+                        or settle_error
+                        or "Missing PAYMENT-RESPONSE header"
+                    )
+                    return PaymentResult(
+                        success=False,
+                        transaction_id=transaction_id,
+                        blockchain_tx=transaction_id,
+                        amount=required_amount,
+                        recipient=url,
+                        method=self.method,
+                        status=PaymentStatus.FAILED_FINAL,
+                        error=f"x402 settlement failed: {error_message}",
+                        resource_data=response_data,
+                        metadata=metadata,
+                    )
 
                 return PaymentResult(
-                    success=is_irreversible_success_status(transfer_status)
-                    if strict_settlement
-                    else True,
-                    transaction_id=transfer_tx_id,
-                    blockchain_tx=transfer_tx_hash,
-                    amount=required_amount,
-                    recipient=url,
-                    method=self.method,
-                    status=transfer_status if strict_settlement else PaymentStatus.COMPLETED,
-                    resource_data=response_data,  # Store the actual API response
-                    metadata={
-                        "http_status": final_response.status_code,
-                        "payment_response": final_response.headers.get(HEADER_PAYMENT_RESPONSE, ""),
-                        "cross_chain": is_cross_chain,
-                        "idempotency_key": canonical_idempotency_key,
-                    },
-                )
-            else:
-                return PaymentResult(
-                    success=False,
-                    transaction_id=transfer_tx_id,
-                    blockchain_tx=transfer_tx_hash,
+                    success=True,
+                    transaction_id=transaction_id,
+                    blockchain_tx=transaction_id,
                     amount=required_amount,
                     recipient=url,
                     method=self.method,
-                    status=PaymentStatus.FAILED,
-                    error=f"Rejected: HTTP {final_response.status_code}",
+                    status=PaymentStatus.SETTLED if strict_settlement else PaymentStatus.COMPLETED,
+                    resource_data=response_data,
+                    metadata=metadata,
                 )
 
-        except (httpx.HTTPError, WalletError, InsufficientBalanceError, ValueError, KeyError) as e:
+            error_message = (
+                (getattr(settle_response, "error_message", None) if settle_response else None)
+                or (getattr(settle_response, "error_reason", None) if settle_response else None)
+                or f"Rejected: HTTP {final_response.status_code}"
+            )
+            return PaymentResult(
+                success=False,
+                transaction_id=transaction_id,
+                blockchain_tx=transaction_id,
+                amount=required_amount,
+                recipient=url,
+                method=self.method,
+                status=PaymentStatus.FAILED_FINAL if strict_settlement else PaymentStatus.FAILED,
+                error=f"x402 payment rejected: {error_message}",
+                resource_data=response_data,
+                metadata=metadata,
+            )
+
+        except Exception as e:
             return PaymentResult(
                 success=False,
                 transaction_id=None,
@@ -603,7 +754,7 @@ async def simulate(
             return result
 
         try:
-            response, requirements = await self._request_with_402_check(recipient)
+            response, _ = await self._request_with_402_check(recipient)
 
             if response.status_code != 402:
                 result["would_succeed"] = True
@@ -611,27 +762,32 @@ async def simulate(
                 result["http_status"] = response.status_code
                 return result
 
-            if requirements:
-                required_amount = requirements.get_amount_usdc()
-                result["required_amount"] = str(required_amount)
-                result["payment_address"] = requirements.recipient
-                result["description"] = requirements.description
-
-                if required_amount <= amount:
-                    # Check wallet balance
-                    balance = self._wallet_service.get_usdc_balance_amount(wallet_id)
-                    if balance >= required_amount:
-                        result["would_succeed"] = True
-                        result["current_balance"] = str(balance)
-                    else:
-                        result["would_succeed"] = False
-                        result["reason"] = f"Insufficient balance: {balance} < {required_amount}"
-                else:
-                    result["would_succeed"] = False
-                    result["reason"] = f"Required amount {required_amount} exceeds max {amount}"
-            else:
-                result["would_succeed"] = False
-                result["reason"] = "No payment requirements in 402 response"
+            agent_network = self._resolve_agent_network(wallet_id, kwargs.get("source_network"))
+            agent_caip2 = network_to_caip2(agent_network)
+            x402_http_client, selection_state = self._build_sdk_http_client(
+                max_amount=amount,
+                preferred_network=agent_caip2,
+            )
+            await response.aread()
+            get_header, body_data = x402_http_client._handle_402_common(
+                dict(response.headers),
+                response.content or None,
+            )
+            payment_required = x402_http_client.get_payment_required_response(get_header, body_data)
+            payment_payload = await x402_http_client.create_payment_payload(payment_required)
+            selected_requirements = selection_state.get("requirements") or payment_payload.accepted
+
+            required_amount = self._atomic_to_decimal(str(selected_requirements.amount))
+            result["would_succeed"] = True
+            result["required_amount"] = str(required_amount)
+            result["payment_address"] = str(selected_requirements.pay_to)
+            result["payment_network"] = str(selected_requirements.network)
+            result["payment_asset"] = str(selected_requirements.asset)
+            result["scheme"] = str(selected_requirements.scheme)
+            result["reason"] = (
+                "Buyer can create a valid x402 payment payload. "
+                "Execution still depends on seller-side settlement and on-chain balance."
+            )
 
         except Exception as e:
             result["would_succeed"] = False
diff --git a/src/omniclaw/protocols/x402_compat.py b/src/omniclaw/protocols/x402_compat.py
new file mode 100644
index 0000000..d885064
--- /dev/null
+++ b/src/omniclaw/protocols/x402_compat.py
@@ -0,0 +1,40 @@
+from __future__ import annotations
+
+from typing import Any
+
+
+def patch_x402_web3_compat() -> None:
+    """
+    Patch the web3 middleware symbol expected by x402's current EVM signer import.
+
+    The x402 Python package expects `web3.middleware.ExtraDataToPOAMiddleware`, while
+    the web3 build in this environment exposes `geth_poa_middleware`.
+    """
+    try:
+        import web3.middleware as middleware
+
+        if hasattr(middleware, "ExtraDataToPOAMiddleware"):
+            return
+
+        from web3.middleware.geth_poa import geth_poa_middleware
+
+        middleware.ExtraDataToPOAMiddleware = geth_poa_middleware
+    except Exception:
+        return
+
+
+def get_signed_raw_transaction_bytes(signed_tx: Any) -> bytes:
+    """
+    Return raw signed transaction bytes across eth-account naming variants.
+
+    Different eth-account versions expose either `rawTransaction` or
+    `raw_transaction`.
+    """
+    raw_tx = getattr(signed_tx, "rawTransaction", None) or getattr(
+        signed_tx,
+        "raw_transaction",
+        None,
+    )
+    if raw_tx is None:
+        raise AttributeError("SignedTransaction has neither rawTransaction nor raw_transaction")
+    return raw_tx
diff --git a/src/omniclaw/seller/facilitator_generic.py b/src/omniclaw/seller/facilitator_generic.py
index 4f5f0f9..974f7ee 100644
--- a/src/omniclaw/seller/facilitator_generic.py
+++ b/src/omniclaw/seller/facilitator_generic.py
@@ -27,7 +27,9 @@
 from __future__ import annotations
 
 from abc import ABC, abstractmethod
+from decimal import Decimal
 from typing import Any
+from urllib.parse import urlencode
 
 from omniclaw.seller.facilitator import (
     CircleGatewayFacilitator as CircleImpl,
@@ -146,6 +148,19 @@ async def close(self) -> None:
         pass
 
 
+def _parse_price_to_atomic(price: str) -> str:
+    value = str(price).strip()
+    if not value:
+        raise ValueError("price is required")
+    if value.startswith("$"):
+        value = value[1:].strip()
+    decimal_value = Decimal(value)
+    scaled = decimal_value * Decimal(1_000_000)
+    if scaled != scaled.to_integral_value():
+        raise ValueError(f"price {price!r} cannot be represented with 6 decimals")
+    return str(int(scaled))
+
+
 # =============================================================================
 # Coinbase Facilitator
 # =============================================================================
@@ -203,6 +218,7 @@ async def verify(self, payment_payload: dict, payment_requirements: dict) -> Ver
             )
             r.raise_for_status()
             data = r.json()
+            data = data.get("result", data) if isinstance(data, dict) else {}
             return VerifyResult(
                 is_valid=data.get("isValid", False),
                 payer=data.get("payer"),
@@ -225,6 +241,7 @@ async def settle(self, payment_payload: dict, payment_requirements: dict) -> Set
             )
             r.raise_for_status()
             data = r.json()
+            data = data.get("result", data) if isinstance(data, dict) else {}
             return SettleResult(
                 success=data.get("success", False),
                 transaction=data.get("transaction"),
@@ -300,6 +317,7 @@ async def verify(self, payment_payload: dict, payment_requirements: dict) -> Ver
             )
             r.raise_for_status()
             data = r.json()
+            data = data.get("result", data) if isinstance(data, dict) else {}
             return VerifyResult(
                 is_valid=data.get("isValid", False),
                 payer=data.get("payer"),
@@ -322,6 +340,7 @@ async def settle(self, payment_payload: dict, payment_requirements: dict) -> Set
             )
             r.raise_for_status()
             data = r.json()
+            data = data.get("result", data) if isinstance(data, dict) else {}
             return SettleResult(
                 success=data.get("success", False),
                 transaction=data.get("transaction"),
@@ -397,6 +416,7 @@ async def verify(self, payment_payload: dict, payment_requirements: dict) -> Ver
             )
             r.raise_for_status()
             data = r.json()
+            data = data.get("result", data) if isinstance(data, dict) else {}
             return VerifyResult(
                 is_valid=data.get("isValid", False),
                 payer=data.get("payer"),
@@ -419,6 +439,7 @@ async def settle(self, payment_payload: dict, payment_requirements: dict) -> Set
             )
             r.raise_for_status()
             data = r.json()
+            data = data.get("result", data) if isinstance(data, dict) else {}
             return SettleResult(
                 success=data.get("success", False),
                 transaction=data.get("transaction"),
@@ -451,23 +472,38 @@ async def close(self):
 
 class ThirdwebFacilitator(BaseFacilitator):
     """
-    Thirdweb x402 Facilitator.
+    Thirdweb x402 Facilitator using the public HTTP API.
 
-    https://thirdweb.com
+    https://portal.thirdweb.com/reference#tag/x402
     """
 
-    THIRDWEB_TESTNET = "https://gateway.thirdweb-test.com"
-    THIRDWEB_MAINNET = "https://gateway.thirdweb.com"
+    THIRDWEB_API = "https://api.thirdweb.com"
+
+    def __init__(
+        self,
+        api_key: str,
+        environment: str = "testnet",
+        timeout: float = 30.0,
+        server_wallet_address: str | None = None,
+        default_network: str | None = None,
+    ):
+        import os
 
-    def __init__(self, api_key: str, environment: str = "testnet", timeout: float = 30.0):
         import httpx
 
         self._api_key = api_key
         self._environment = environment
         self._timeout = timeout
-        self._base_url = (
-            self.THIRDWEB_TESTNET if environment == "testnet" else self.THIRDWEB_MAINNET
-        )
+        self._server_wallet_address = (
+            server_wallet_address or os.environ.get("THIRDWEB_SERVER_WALLET_ADDRESS") or ""
+        ).strip()
+        self._default_network = (
+            default_network
+            or os.environ.get("THIRDWEB_X402_NETWORK")
+            or os.environ.get("OMNICLAW_X402_NETWORK")
+            or "base-sepolia"
+        ).strip()
+        self._base_url = self.THIRDWEB_API
         self._client = httpx.AsyncClient(timeout=timeout)
 
     @property
@@ -482,9 +518,96 @@ def base_url(self) -> str:
     def environment(self) -> str:
         return self._environment
 
+    async def create_accepts(
+        self,
+        *,
+        resource_url: str,
+        method: str = "GET",
+        network: str | None = None,
+        price: str,
+        server_wallet_address: str | None = None,
+    ) -> list[dict[str, Any]]:
+        """Create x402 accepts through Thirdweb's public HTTP API."""
+        wallet_address = (server_wallet_address or self._server_wallet_address).strip()
+        if not wallet_address:
+            raise ValueError(
+                "THIRDWEB_SERVER_WALLET_ADDRESS is required to create Thirdweb x402 accepts"
+            )
+
+        url = f"{self._base_url}/v1/payments/x402/accepts"
+        headers = {"x-secret-key": self._api_key, "Content-Type": "application/json"}
+        response = await self._client.post(
+            url,
+            json={
+                "resourceUrl": resource_url,
+                "method": method.upper(),
+                "network": network or self._default_network,
+                "price": price,
+                "serverWalletAddress": wallet_address,
+            },
+            headers=headers,
+        )
+        response.raise_for_status()
+        data = response.json()
+        data = data.get("result", data) if isinstance(data, dict) else {}
+        accepts = data.get("accepts", data if isinstance(data, list) else [])
+        if not isinstance(accepts, list):
+            raise RuntimeError("Thirdweb accepts response did not contain an accepts array")
+        return accepts
+
+    async def fetch_with_payment(
+        self,
+        *,
+        url: str,
+        from_address: str,
+        method: str = "GET",
+        chain_id: str | None = None,
+        max_value: str | None = None,
+        asset: str | None = None,
+        headers: dict[str, str] | None = None,
+        body: Any = None,
+    ) -> dict[str, Any]:
+        """Proxy/pay an x402 URL through Thirdweb's public fetch API."""
+        query = {
+            "url": url,
+            "from": from_address,
+            "method": method.upper(),
+        }
+        if chain_id:
+            query["chainId"] = chain_id
+        if max_value:
+            query["maxValue"] = max_value
+        if asset:
+            query["asset"] = asset
+
+        request_headers = {"x-secret-key": self._api_key}
+        if headers:
+            request_headers.update(headers)
+        response = await self._client.post(
+            f"{self._base_url}/v1/payments/x402/fetch?{urlencode(query)}",
+            headers=request_headers,
+            json=body if isinstance(body, dict) else None,
+            content=None if isinstance(body, dict) else body,
+        )
+        response.raise_for_status()
+        data = response.json()
+        return data.get("result", data) if isinstance(data, dict) else {"result": data}
+
+    async def discover_resources(self, **query: Any) -> dict[str, Any]:
+        """Read Thirdweb x402 discovery resources."""
+        params = {key: value for key, value in query.items() if value is not None}
+        suffix = f"?{urlencode(params)}" if params else ""
+        response = await self._client.get(
+            f"{self._base_url}/v1/payments/x402/discovery/resources{suffix}",
+            headers={"x-secret-key": self._api_key, "Accept": "application/json"},
+        )
+        response.raise_for_status()
+        data = response.json()
+        return data.get("result", data) if isinstance(data, dict) else {"result": data}
+
     async def verify(self, payment_payload: dict, payment_requirements: dict) -> VerifyResult:
-        url = f"{self._base_url}/api/v1/x402/verify"
-        headers = {"Authorization": f"Bearer {self._api_key}", "Content-Type": "application/json"}
+        url = f"{self._base_url}/v1/payments/x402/verify"
+        headers = {"x-secret-key": self._api_key, "Content-Type": "application/json"}
         try:
             r = await self._client.post(
                 url,
@@ -496,6 +619,7 @@ async def verify(self, payment_payload: dict, payment_requirements: dict) -> Ver
             )
             r.raise_for_status()
             data = r.json()
+            data = data.get("result", data) if isinstance(data, dict) else {}
             return VerifyResult(
                 is_valid=data.get("isValid", False),
                 payer=data.get("payer"),
@@ -505,19 +629,21 @@ async def verify(self, payment_payload: dict, payment_requirements: dict) -> Ver
             return VerifyResult(is_valid=False, payer=None, invalid_reason=str(e))
 
     async def settle(self, payment_payload: dict, payment_requirements: dict) -> SettleResult:
-        url = f"{self._base_url}/api/v1/x402/settle"
-        headers = {"Authorization": f"Bearer {self._api_key}", "Content-Type": "application/json"}
+        url = f"{self._base_url}/v1/payments/x402/settle"
+        headers = {"x-secret-key": self._api_key, "Content-Type": "application/json"}
         try:
             r = await self._client.post(
                 url,
                 json={
                     "paymentPayload": payment_payload,
                     "paymentRequirements": payment_requirements,
+                    "waitUntil": "confirmed",
                 },
                 headers=headers,
             )
             r.raise_for_status()
             data = r.json()
+            data = data.get("result", data) if isinstance(data, dict) else {}
             return SettleResult(
                 success=data.get("success", False),
                 transaction=data.get("transaction"),
@@ -531,18 +657,179 @@ async def settle(self, payment_payload: dict, payment_requirements: dict) -> Set
             )
 
     async def get_supported_networks(self) -> list:
-        headers = {"Authorization": f"Bearer {self._api_key}", "Accept": "application/json"}
+        headers = {"x-secret-key": self._api_key, "Accept": "application/json"}
         return await _fetch_supported_networks(
             client=self._client,
             base_url=self._base_url,
             headers=headers,
-            candidate_paths=["/api/v1/x402/supported", "/v1/x402/supported", "/x402/supported"],
+            candidate_paths=[
+                "/v1/payments/x402/supported",
+                "/v1/payments/x402/accepts",
+            ],
         )
 
     async def close(self):
         await self._client.aclose()
 
 
+class OmniClawExactFacilitator(BaseFacilitator):
+    """
+    OmniClaw self-hosted exact x402 facilitator.
+
+    Use this for vendor SDK integrations that want to monetize routes with
+    `client.sell(..., facilitator="omniclaw")` while running their own
+    OmniClaw exact facilitator for verify/settle.
+    """
+
+    def __init__(
+        self,
+        api_key: str | None = None,
+        environment: str = "testnet",
+        timeout: float = 30.0,
+        base_url: str | None = None,
+        network_profile: str | None = None,
+        network: str | None = None,
+        asset: str | None = None,
+        name: str = "omniclaw",
+    ):
+        import os
+
+        import httpx
+
+        from omniclaw.facilitator.networks import resolve_exact_settlement_network_profile
+
+        profile = resolve_exact_settlement_network_profile(
+            network_profile
+            or os.environ.get("OMNICLAW_X402_EXACT_NETWORK_PROFILE")
+            or os.environ.get("OMNICLAW_X402_FACILITATOR_NETWORK_PROFILE")
+            or os.environ.get("OMNICLAW_NETWORK")
+            or "BASE-SEPOLIA"
+        )
+        self._environment = environment
+        self._name = name
+        self._base_url = (
+            base_url
+            or os.environ.get("OMNICLAW_X402_SELF_HOSTED_FACILITATOR_URL")
+            or os.environ.get("OMNICLAW_X402_EXACT_FACILITATOR_URL")
+            or "http://127.0.0.1:4022"
+        ).rstrip("/")
+        self._network = network or profile.caip2
+        self._asset = asset or profile.default_asset_address
+        if not self._asset:
+            raise ValueError(f"No exact settlement asset configured for {profile.label}")
+        self._asset_name = profile.default_asset_name
+        self._asset_version = profile.default_asset_version
+        self._client = httpx.AsyncClient(timeout=timeout)
+
+    @property
+    def name(self) -> str:
+        return self._name
+
+    @property
+    def base_url(self) -> str:
+        return self._base_url
+
+    @property
+    def environment(self) -> str:
+        return self._environment
+
+    async def create_accepts(
+        self,
+        *,
+        resource_url: str,
+        method: str = "GET",
+        network: str | None = None,
+        price: str,
+        server_wallet_address: str | None = None,
+    ) -> list[dict[str, Any]]:
+        if not server_wallet_address:
+            raise ValueError("server_wallet_address is required")
+        return [
+            {
+                "scheme": "exact",
+                "network": network or self._network,
+                "asset": self._asset,
+                "amount": _parse_price_to_atomic(price),
+                "payTo": server_wallet_address,
+                "maxTimeoutSeconds": 300,
+                "extra": {
+                    "name": self._asset_name,
+                    "version": self._asset_version,
+                },
+            }
+        ]
+
+    async def verify(self, payment_payload: dict, payment_requirements: dict) -> VerifyResult:
+        try:
+            response = await self._client.post(
+                f"{self._base_url}/verify",
+                json={
+                    "x402Version": 2,
+                    "paymentPayload": payment_payload,
+                    "paymentRequirements": payment_requirements,
+                },
+            )
+            response.raise_for_status()
+            data = response.json()
+            return VerifyResult(
+                is_valid=data.get("isValid", data.get("is_valid", False)),
+                payer=data.get("payer"),
+                invalid_reason=data.get("invalidReason") or data.get("invalid_reason"),
+            )
+        except Exception as exc:
+            return VerifyResult(is_valid=False, payer=None, invalid_reason=str(exc))
+
+    async def settle(self, payment_payload: dict, payment_requirements: dict) -> SettleResult:
+        try:
+            response = await self._client.post(
+                f"{self._base_url}/settle",
+                json={
+                    "x402Version": 2,
+                    "paymentPayload": payment_payload,
+                    "paymentRequirements": payment_requirements,
+                },
+            )
+            response.raise_for_status()
+            data = response.json()
+            return SettleResult(
+                success=data.get("success", False),
+                transaction=data.get("transaction"),
+                network=data.get("network"),
+                error_reason=data.get("errorReason") or data.get("error_reason"),
+                payer=data.get("payer"),
+            )
+        except Exception as exc:
+            return SettleResult(
+                success=False,
+                transaction=None,
+                network=None,
+                error_reason=str(exc),
+                payer=None,
+            )
+
+    async def get_supported_networks(self) -> list[dict[str, Any]]:
+        response = await self._client.get(f"{self._base_url}/supported")
+        response.raise_for_status()
+        data = response.json()
+        if isinstance(data, dict) and isinstance(data.get("kinds"), list):
+            return data["kinds"]
+        if isinstance(data, dict) and isinstance(data.get("supported"), list):
+            return data["supported"]
+        if isinstance(data, list):
+            return data
+        return [
+            {
+                "x402Version": 2,
+                "scheme": "exact",
+                "network": self._network,
+                "extra": {"usdcAddress": self._asset},
+            }
+        ]
+
+    async def close(self):
+        await self._client.aclose()
+
+
 # =============================================================================
 # Factory Function
 # =============================================================================
@@ -554,6 +841,9 @@ async def close(self):
     "ordern": OrderNFacilitator,
     "rbx": RBXFacilitator,
     "thirdweb": ThirdwebFacilitator,
+    "omniclaw": OmniClawExactFacilitator,
+    "selfhosted": OmniClawExactFacilitator,
+    "self-hosted": OmniClawExactFacilitator,
 }
 
 
@@ -566,15 +856,16 @@ def create_facilitator(
     """
     Factory to create a facilitator.
 
-    Supports top 5 facilitators:
+    Supports managed and self-hosted facilitators:
     - circle: Circle Gateway (https://circle.com)
     - coinbase: Coinbase CDP (https://coinbase.com)
     - ordern: OrderN (https://ordern.ai)
     - rbx: RBX (https://rbx.io)
     - thirdweb: Thirdweb (https://thirdweb.com)
+    - omniclaw: OmniClaw self-hosted exact facilitator
 
     Args:
-        provider: Facilitator name ("circle", "coinbase", "ordern", "rbx", "thirdweb")
+        provider: Facilitator name ("circle", "coinbase", "ordern", "rbx", "thirdweb", "omniclaw")
         api_key: API key for the facilitator
         environment: "testnet" or "mainnet"
         **kwargs: Additional options
@@ -584,16 +875,30 @@ def create_facilitator(
     """
     import os
 
+    provider = provider.lower()
+
+    if provider in {"omniclaw", "selfhosted", "self-hosted"}:
+        return OmniClawExactFacilitator(
+            api_key=api_key,
+            environment=environment,
+            name=provider,
+            **kwargs,
+        )
+
     if api_key is not None:
         key = api_key
+    elif provider == "thirdweb":
+        key = (
+            os.environ.get("THIRDWEB_SECRET_KEY")
+            or os.environ.get("FACILITATOR_API_KEY")
+            or os.environ.get("CIRCLE_API_KEY")
+        )
     else:
         key = os.environ.get("FACILITATOR_API_KEY") or os.environ.get("CIRCLE_API_KEY")
 
     if not key:
         raise ValueError("api_key is required")
 
-    provider = provider.lower()
-
     if provider not in SUPPORTED_FACILITATORS:
         raise ValueError(
             f"Unknown facilitator: {provider}. Use: {', '.join(SUPPORTED_FACILITATORS.keys())}"
@@ -614,6 +919,7 @@ def create_facilitator(
     "OrderNFacilitator",
     "RBXFacilitator",
     "ThirdwebFacilitator",
+    "OmniClawExactFacilitator",
     "VerifyResult",
     "SettleResult",
     "create_facilitator",
diff --git a/src/omniclaw/seller/seller.py b/src/omniclaw/seller/seller.py
index 5ce7b0b..eaf740e 100644
--- a/src/omniclaw/seller/seller.py
+++ b/src/omniclaw/seller/seller.py
@@ -356,7 +356,6 @@ def _create_accepts(self, endpoint: Endpoint) -> list[dict]:
                         "amount": str(amount_atomic),
                         "payTo": self.config.seller_address,
                         "maxTimeoutSeconds": 345600,
-                        "extra": {"name": "USDC", "version": "2"},
                     }
                 )
             elif scheme == PaymentScheme.GATEWAY_BATCHED:
diff --git a/tests/test_cctp_constants.py b/tests/test_cctp_constants.py
index ee2df03..3516902 100644
--- a/tests/test_cctp_constants.py
+++ b/tests/test_cctp_constants.py
@@ -77,7 +77,7 @@ def test_usdc_contracts(self):
         assert USDC_CONTRACTS["ETH-SEPOLIA"] == "0x1c7D4B196Cb0C7B01d743Fbc6116a902379C7238"
         assert USDC_CONTRACTS["BASE-SEPOLIA"] == "0x036CbD53842c5426634e7929541eC2318f3dCF7e"
         # ARC testnet USDC address
-        assert USDC_CONTRACTS["ARC-TESTNET"] == "0x79A02482A880bCE3F13e09Da970dC34db4CD24d1"
+        assert USDC_CONTRACTS["ARC-TESTNET"] == "0x3600000000000000000000000000000000000000"
 
 
 class TestCCTPUtilities:
diff --git a/tests/test_cli_facilitator.py b/tests/test_cli_facilitator.py
new file mode 100644
index 0000000..df1602e
--- /dev/null
+++ b/tests/test_cli_facilitator.py
@@ -0,0 +1,52 @@
+from argparse import Namespace
+
+from omniclaw.admin_cli import build_parser, handle_facilitator_exact
+
+
+def test_facilitator_exact_parser_accepts_arc_profile() -> None:
+    parser = build_parser()
+
+    args = parser.parse_args(
+        [
+            "facilitator",
+            "exact",
+            "--network-profile",
+            "ARC-TESTNET",
+            "--network",
+            "eip155:5042002",
+            "--port",
+            "4122",
+        ]
+    )
+
+    assert args.command == "facilitator"
+    assert args.facilitator_command == "exact"
+    assert args.network_profile == "ARC-TESTNET"
+    assert args.network == ["eip155:5042002"]
+    assert args.port == 4122
+
+
+def test_facilitator_exact_requires_private_key(monkeypatch, capsys, tmp_path) -> None:
+    monkeypatch.chdir(tmp_path)
+    for name in (
+        "OMNICLAW_X402_FACILITATOR_PRIVATE_KEY",
+        "OMNICLAW_PRIVATE_KEY",
+        "OMNICLAW_X402_FACILITATOR_NETWORK_PROFILE",
+        "OMNICLAW_X402_FACILITATOR_RPC_URL",
+        "OMNICLAW_X402_FACILITATOR_NETWORKS",
+        "OMNICLAW_NETWORK",
+    ):
+        monkeypatch.delenv(name, raising=False)
+
+    args = Namespace(
+        host="127.0.0.1",
+        port=4022,
+        network_profile="BASE-SEPOLIA",
+        network=None,
+        rpc_url="https://sepolia.base.org",
+        private_key=None,
+        title=None,
+    )
+
+    assert handle_facilitator_exact(args) == 1
+    assert "OMNICLAW_X402_FACILITATOR_PRIVATE_KEY" in capsys.readouterr().out
diff --git a/tests/test_client.py b/tests/test_client.py
index dd6f9e0..a599f1d 100644
--- a/tests/test_client.py
+++ b/tests/test_client.py
@@ -5,6 +5,7 @@
 """
 
 import os
+import inspect
 import tempfile
 from decimal import Decimal
 from pathlib import Path
@@ -388,6 +389,18 @@ async def _mock_pay(**kwargs):
         assert captured_keys[0] == captured_keys[1]
 
 
+class TestSellerDependency:
+    def test_sell_returns_fastapi_dependency_that_accepts_request(self, client):
+        dependency = client.sell(
+            "$0.01",
+            seller_address="0x742d35Cc6634C0532925a3b844Bc9e7595f1E123",
+        )
+
+        assert hasattr(dependency, "dependency")
+        signature = inspect.signature(dependency.dependency)
+        assert "request" in signature.parameters
+
+
 class TestSettlementReconciliation:
     @pytest.mark.asyncio
     async def test_finalize_pending_settlement_marks_completed(self, client):
diff --git a/tests/test_exact_facilitator_app.py b/tests/test_exact_facilitator_app.py
new file mode 100644
index 0000000..166dafb
--- /dev/null
+++ b/tests/test_exact_facilitator_app.py
@@ -0,0 +1,146 @@
+from __future__ import annotations
+
+from types import SimpleNamespace
+
+from fastapi.testclient import TestClient
+
+from omniclaw.facilitator.exact import ExactFacilitatorConfig, create_exact_facilitator_app
+
+
+class _FakeResult:
+    def __init__(self, data):
+        self._data = data
+
+    def model_dump(self, by_alias: bool = True, exclude_none: bool = True):
+        return dict(self._data)
+
+
+class _FakeFacilitator:
+    def get_supported(self):
+        return _FakeResult({"kinds": [{"scheme": "exact", "network": "eip155:84532"}]})
+
+    async def verify(self, payload, requirements):
+        return _FakeResult({"isValid": True, "payer": "0xabc"})
+
+    async def settle(self, payload, requirements):
+        return _FakeResult({"success": True, "transaction": "0xsettled"})
+
+
+def test_create_exact_facilitator_app_registers_networks():
+    recorded = {}
+
+    def fake_signer_factory(**kwargs):
+        recorded["signer_kwargs"] = kwargs
+        return object()
+
+    def fake_register(facilitator, *, signer, networks):
+        recorded["networks"] = networks
+        recorded["signer"] = signer
+
+    app = create_exact_facilitator_app(
+        ExactFacilitatorConfig(
+            private_key="0x123",
+            rpc_url="https://rpc.example",
+            networks=("eip155:84532", "arc:testnet"),
+            title="Test Facilitator",
+        ),
+        signer_factory=fake_signer_factory,
+        facilitator_factory=_FakeFacilitator,
+        register_facilitator=fake_register,
+    )
+
+    assert app.title == "Test Facilitator"
+    assert recorded["signer_kwargs"] == {
+        "private_key": "0x123",
+        "rpc_url": "https://rpc.example",
+    }
+    assert recorded["networks"] == ["eip155:84532", "arc:testnet"]
+
+
+def test_exact_facilitator_app_routes_work():
+    app = create_exact_facilitator_app(
+        ExactFacilitatorConfig(
+            private_key="0x123",
+            rpc_url="https://rpc.example",
+            networks=("eip155:84532",),
+        ),
+        signer_factory=lambda **kwargs: object(),
+        facilitator_factory=_FakeFacilitator,
+        register_facilitator=lambda facilitator, *, signer, networks: None,
+    )
+
+    client = TestClient(app)
+
+    supported = client.get("/supported")
+    assert supported.status_code == 200
+    assert supported.json()["kinds"][0]["scheme"] == "exact"
+
+    payload = {
+        "x402Version": 2,
+        "paymentPayload": {
+            "x402Version": 2,
+            "payload": {
+                "signature": "0x1234",
+                "authorization": {
+                    "from": "0x1111111111111111111111111111111111111111",
+                    "to": "0x2222222222222222222222222222222222222222",
+                    "value": "250000",
+                    "validAfter": "0",
+                    "validBefore": "9999999999",
+                    "nonce": "0x" + "11" * 32,
+                },
+            },
+            "accepted": {
+                "scheme": "exact",
+                "network": "eip155:84532",
+                "asset": "0x036CbD53842c5426634e7929541eC2318f3dCF7e",
+                "amount": "250000",
+                "payTo": "0x2222222222222222222222222222222222222222",
+                "maxTimeoutSeconds": 300,
+                "extra": {"name": "USDC", "version": "2"},
+            },
+        },
+        "paymentRequirements": {
+            "scheme": "exact",
+            "network": "eip155:84532",
+            "asset": "0x036CbD53842c5426634e7929541eC2318f3dCF7e",
+            "amount": "250000",
+            "payTo": "0x2222222222222222222222222222222222222222",
+            "maxTimeoutSeconds": 300,
+            "resource": "http://127.0.0.1:4021/compute?size=74000",
+            "description": "compute",
+            "mimeType": "application/json",
+            "outputSchema": None,
+            "extra": {"name": "USDC", "version": "2"},
+        },
+    }
+
+    verify = client.post("/verify", json=payload)
+    assert verify.status_code == 200
+    assert verify.json() == {"isValid": True, "payer": "0xabc"}
+
+    settle = client.post("/settle", json=payload)
+    assert settle.status_code == 200
+    assert settle.json() == {"success": True, "transaction": "0xsettled"}
+
+
+def test_exact_facilitator_app_rejects_wrong_version():
+    app = create_exact_facilitator_app(
+        ExactFacilitatorConfig(
+            private_key="0x123",
+            rpc_url="https://rpc.example",
+            networks=("eip155:84532",),
+        ),
+        signer_factory=lambda **kwargs: object(),
+        facilitator_factory=_FakeFacilitator,
+        register_facilitator=lambda facilitator, *, signer, networks: None,
+    )
+
+    client = TestClient(app)
+    response = client.post(
+        "/verify",
+        json={"x402Version": 1, "paymentPayload": {}, "paymentRequirements": {}},
+    )
+
+    assert response.status_code == 400
+    assert response.json()["detail"] == "Only x402Version=2 is supported"
diff --git a/tests/test_exact_network_profiles.py b/tests/test_exact_network_profiles.py
new file mode 100644
index 0000000..395b9a7
--- /dev/null
+++ b/tests/test_exact_network_profiles.py
@@ -0,0 +1,72 @@
+from __future__ import annotations
+
+from decimal import Decimal
+
+from x402.schemas import AssetAmount
+
+from omniclaw.facilitator.exact import load_exact_facilitator_config_from_env
+from omniclaw.facilitator.networks import (
+    build_exact_asset_amount,
+    resolve_exact_settlement_network_profile,
+)
+
+
+def test_resolve_arc_exact_network_profile():
+    profile = resolve_exact_settlement_network_profile("ARC-TESTNET")
+
+    assert profile.label == "ARC-TESTNET"
+    assert profile.caip2 == "eip155:5042002"
+    assert profile.default_rpc_url == "https://rpc.testnet.arc.network"
+    assert profile.explorer_base_url == "https://testnet.arcscan.app/tx/"
+    assert profile.default_asset_address == "0x3600000000000000000000000000000000000000"
+
+
+def test_resolve_base_sepolia_exact_network_profile():
+    profile = resolve_exact_settlement_network_profile("BASE-SEPOLIA")
+
+    assert profile.label == "BASE-SEPOLIA"
+    assert profile.caip2 == "eip155:84532"
+    assert profile.default_rpc_url == "https://sepolia.base.org"
+
+
+def test_load_exact_facilitator_config_uses_profile_defaults(monkeypatch):
+    monkeypatch.setenv("OMNICLAW_X402_FACILITATOR_NETWORK_PROFILE", "ARC-TESTNET")
+    monkeypatch.setenv(
+        "OMNICLAW_X402_FACILITATOR_PRIVATE_KEY",
+        "0x1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef",
+    )
+    monkeypatch.delenv("OMNICLAW_X402_FACILITATOR_RPC_URL", raising=False)
+    monkeypatch.delenv("OMNICLAW_X402_FACILITATOR_NETWORKS", raising=False)
+
+    config = load_exact_facilitator_config_from_env()
+
+    assert config.network_profile == "ARC-TESTNET"
+    assert config.rpc_url == "https://rpc.testnet.arc.network"
+    assert config.networks == ("eip155:5042002",)
+
+
+def test_build_exact_asset_amount_for_arc():
+    profile = resolve_exact_settlement_network_profile("ARC-TESTNET")
+
+    result = build_exact_asset_amount(
+        profile=profile,
+        decimal_amount=Decimal("0.25"),
+        network="eip155:5042002",
+    )
+
+    assert isinstance(result, AssetAmount)
+    assert result.amount == "250000"
+    assert result.asset == "0x3600000000000000000000000000000000000000"
+    assert result.extra == {"name": "USDC", "version": "2"}
+
+
+def test_build_exact_asset_amount_ignores_other_networks():
+    profile = resolve_exact_settlement_network_profile("ARC-TESTNET")
+
+    result = build_exact_asset_amount(
+        profile=profile,
+        decimal_amount="0.25",
+        network="eip155:84532",
+    )
+
+    assert result is None
diff --git a/tests/test_facilitator_e2e.py b/tests/test_facilitator_e2e.py
index 0108b83..c0eb7ae 100644
--- a/tests/test_facilitator_e2e.py
+++ b/tests/test_facilitator_e2e.py
@@ -4,12 +4,18 @@
 This tests the actual HTTP flow to verify the facilitator integration works.
 """
 
+import json
+
 import httpx
 import pytest
 
 from omniclaw.seller import create_facilitator, create_seller
 
 
+def json_from_request(request: httpx.Request):
+    return json.loads(request.content.decode())
+
+
 class MockFacilitatorServer:
     """Mock facilitator server for testing."""
 
@@ -130,7 +136,7 @@ async def test_facilitator_settle_endpoint():
 def test_all_facilitators_have_correct_interface():
     """Verify all facilitators implement the same interface."""
 
-    providers = ["circle", "coinbase", "ordern", "rbx", "thirdweb"]
+    providers = ["circle", "coinbase", "ordern", "rbx", "thirdweb", "omniclaw"]
 
     for provider in providers:
         f = create_facilitator(provider=provider, api_key="test_key")
@@ -160,7 +166,8 @@ def test_facilitator_urls_for_testnet():
         "coinbase": "https://api.cdp.coinbase.com/platform",
         "ordern": "https://api.testnet.ordern.ai",
         "rbx": "https://api.testnet.rbx.io",
-        "thirdweb": "https://gateway.thirdweb-test.com",
+        "thirdweb": "https://api.thirdweb.com",
+        "omniclaw": "http://127.0.0.1:4022",
     }
 
     for provider, expected_url in facilitators.items():
@@ -176,7 +183,8 @@ def test_facilitator_urls_for_mainnet():
         "coinbase": "https://api.cdp.coinbase.com/platform",
         "ordern": "https://api.ordern.ai",
         "rbx": "https://api.rbx.io",
-        "thirdweb": "https://gateway.thirdweb.com",
+        "thirdweb": "https://api.thirdweb.com",
+        "omniclaw": "http://127.0.0.1:4022",
     }
 
     for provider, expected_url in facilitators.items():
@@ -184,6 +192,296 @@ def test_facilitator_urls_for_mainnet():
         assert f.base_url == expected_url, f"{provider}: expected {expected_url}, got {f.base_url}"
 
 
+def test_thirdweb_uses_native_secret_env(monkeypatch):
+    """Thirdweb should not require aliasing its secret key to FACILITATOR_API_KEY."""
+    monkeypatch.delenv("FACILITATOR_API_KEY", raising=False)
+    monkeypatch.delenv("CIRCLE_API_KEY", raising=False)
+    monkeypatch.setenv("THIRDWEB_SECRET_KEY", "thirdweb_secret")
+
+    facilitator = create_facilitator(provider="thirdweb")
+
+    assert facilitator._api_key == "thirdweb_secret"
+
+
+@pytest.mark.asyncio
+async def test_thirdweb_accepts_uses_public_http_api():
+    """Thirdweb seller requirements must come from the documented accepts API."""
+    facilitator = create_facilitator(
+        provider="thirdweb",
+        api_key="thirdweb_secret",
+        server_wallet_address="0x" + "a" * 40,
+        default_network="base-sepolia",
+    )
+    requests = []
+
+    async def handler(request: httpx.Request) -> httpx.Response:
+        requests.append(request)
+        assert str(request.url) == "https://api.thirdweb.com/v1/payments/x402/accepts"
+        assert request.headers["x-secret-key"] == "thirdweb_secret"
+        body = json_from_request(request)
+        assert body["resourceUrl"] == "https://seller.example.com/compute"
+        assert body["method"] == "GET"
+        assert body["network"] == "base-sepolia"
+        assert body["price"] == "$0.01"
+        assert body["serverWalletAddress"] == "0x" + "a" * 40
+        return httpx.Response(
+            200,
+            json={
+                "result": {
+                    "accepts": [
+                        {
+                            "scheme": "exact",
+                            "network": "eip155:84532",
+                            "amount": "10000",
+                            "payTo": "0x" + "b" * 40,
+                            "asset": "0x036CbD53842c5426634e7929541eC2318f3dCF7e",
+                        }
+                    ]
+                }
+            },
+        )
+
+    facilitator._client = httpx.AsyncClient(transport=httpx.MockTransport(handler))
+    try:
+        accepts = await facilitator.create_accepts(
+            resource_url="https://seller.example.com/compute",
+            method="GET",
+            price="$0.01",
+        )
+    finally:
+        await facilitator.close()
+
+    assert len(requests) == 1
+    assert accepts[0]["scheme"] == "exact"
+    assert accepts[0]["network"] == "eip155:84532"
+
+
+@pytest.mark.asyncio
+async def test_thirdweb_verify_uses_public_http_api():
+    """Thirdweb integration must use the public HTTP API directly."""
+    facilitator = create_facilitator(provider="thirdweb", api_key="thirdweb_secret")
+    requests = []
+
+    async def handler(request: httpx.Request) -> httpx.Response:
+        requests.append(request)
+        assert str(request.url) == "https://api.thirdweb.com/v1/payments/x402/verify"
+        assert request.headers["x-secret-key"] == "thirdweb_secret"
+        body = json_from_request(request)
+        assert body["paymentPayload"]["signature"] == "0xsig"
+        assert body["paymentRequirements"]["network"] == "eip155:84532"
+        return httpx.Response(
+            200,
+            json={
+                "result": {
+                    "isValid": True,
+                    "payer": "0xbuyer1234567890abcdef1234567890abcdef12",
+                }
+            },
+        )
+
+    facilitator._client = httpx.AsyncClient(transport=httpx.MockTransport(handler))
+    try:
+        result = await facilitator.verify(
+            {"signature": "0xsig"},
+            {"network": "eip155:84532", "amount": "1000"},
+        )
+    finally:
+        await facilitator.close()
+
+    assert len(requests) == 1
+    assert result.is_valid is True
+    assert result.payer == "0xbuyer1234567890abcdef1234567890abcdef12"
+
+
+@pytest.mark.asyncio
+async def test_thirdweb_settle_uses_public_http_api():
+    """Thirdweb settle must call the documented HTTP endpoint with waitUntil."""
+    facilitator = create_facilitator(provider="thirdweb", api_key="thirdweb_secret")
+    requests = []
+
+    async def handler(request: httpx.Request) -> httpx.Response:
+        requests.append(request)
+        assert str(request.url) == "https://api.thirdweb.com/v1/payments/x402/settle"
+        assert request.headers["x-secret-key"] == "thirdweb_secret"
+        body = json_from_request(request)
+        assert body["paymentPayload"]["signature"] == "0xsig"
+        assert body["paymentRequirements"]["network"] == "eip155:84532"
+        assert body["waitUntil"] == "confirmed"
+        return httpx.Response(
+            200,
+            json={
+                "result": {
+                    "success": True,
+                    "transaction": "0xsettled",
+                    "network": "eip155:84532",
+                    "payer": "0xbuyer1234567890abcdef1234567890abcdef12",
+                }
+            },
+        )
+
+    facilitator._client = httpx.AsyncClient(transport=httpx.MockTransport(handler))
+    try:
+        result = await facilitator.settle(
+            {"signature": "0xsig"},
+            {"network": "eip155:84532", "amount": "1000"},
+        )
+    finally:
+        await facilitator.close()
+
+    assert len(requests) == 1
+    assert result.success is True
+    assert result.transaction == "0xsettled"
+    assert result.network == "eip155:84532"
+
+
+@pytest.mark.asyncio
+async def test_thirdweb_fetch_uses_public_http_api():
+    """Thirdweb fetch support should use the documented HTTP endpoint."""
+    facilitator = create_facilitator(provider="thirdweb", api_key="thirdweb_secret")
+    requests = []
+
+    async def handler(request: httpx.Request) -> httpx.Response:
+        requests.append(request)
+        assert str(request.url).startswith("https://api.thirdweb.com/v1/payments/x402/fetch?")
+        assert request.headers["x-secret-key"] == "thirdweb_secret"
+        params = dict(request.url.params)
+        assert params["url"] == "https://seller.example.com/compute"
+        assert params["from"] == "0x" + "a" * 40
+        assert params["chainId"] == "eip155:84532"
+        return httpx.Response(200, json={"result": {"status": 200, "body": {"ok": True}}})
+
+    facilitator._client = httpx.AsyncClient(transport=httpx.MockTransport(handler))
+    try:
+        result = await facilitator.fetch_with_payment(
+            url="https://seller.example.com/compute",
+            from_address="0x" + "a" * 40,
+            chain_id="eip155:84532",
+        )
+    finally:
+        await facilitator.close()
+
+    assert len(requests) == 1
+    assert result["status"] == 200
+    assert result["body"]["ok"] is True
+
+
+@pytest.mark.asyncio
+async def test_thirdweb_discovery_resources_uses_public_http_api():
+    """Thirdweb discovery support should use the documented resources endpoint."""
+    facilitator = create_facilitator(provider="thirdweb", api_key="thirdweb_secret")
+    requests = []
+
+    async def handler(request: httpx.Request) -> httpx.Response:
+        requests.append(request)
+        assert str(request.url).startswith(
+            "https://api.thirdweb.com/v1/payments/x402/discovery/resources"
+        )
+        assert request.headers["x-secret-key"] == "thirdweb_secret"
+        assert dict(request.url.params)["network"] == "eip155:84532"
+        return httpx.Response(200, json={"result": {"resources": [{"url": "https://api"}]}})
+
+    facilitator._client = httpx.AsyncClient(transport=httpx.MockTransport(handler))
+    try:
+        result = await facilitator.discover_resources(network="eip155:84532")
+    finally:
+        await facilitator.close()
+
+    assert len(requests) == 1
+    assert result["resources"][0]["url"] == "https://api"
+
+
+def test_omniclaw_self_hosted_does_not_require_api_key(monkeypatch):
+    monkeypatch.delenv("FACILITATOR_API_KEY", raising=False)
+    monkeypatch.delenv("CIRCLE_API_KEY", raising=False)
+
+    facilitator = create_facilitator(
+        provider="omniclaw",
+        base_url="http://127.0.0.1:4022",
+        network_profile="ARC-TESTNET",
+    )
+
+    assert facilitator.name == "omniclaw"
+    assert facilitator.base_url == "http://127.0.0.1:4022"
+
+
+@pytest.mark.asyncio
+async def test_omniclaw_self_hosted_creates_accepts_for_arc():
+    facilitator = create_facilitator(
+        provider="omniclaw",
+        base_url="http://127.0.0.1:4022",
+        network_profile="ARC-TESTNET",
+    )
+    try:
+        accepts = await facilitator.create_accepts(
+            resource_url="https://vendor.example.com/compute",
+            method="GET",
+            price="$0.25",
+            server_wallet_address="0x" + "a" * 40,
+        )
+    finally:
+        await facilitator.close()
+
+    assert accepts == [
+        {
+            "scheme": "exact",
+            "network": "eip155:5042002",
+            "asset": "0x3600000000000000000000000000000000000000",
+            "amount": "250000",
+            "payTo": "0x" + "a" * 40,
+            "maxTimeoutSeconds": 300,
+            "extra": {"name": "USDC", "version": "2"},
+        }
+    ]
+
+
+@pytest.mark.asyncio
+async def test_omniclaw_self_hosted_verify_and_settle_use_local_api():
+    facilitator = create_facilitator(
+        provider="omniclaw",
+        base_url="http://127.0.0.1:4022",
+        network_profile="ARC-TESTNET",
+    )
+    requests = []
+
+    async def handler(request: httpx.Request) -> httpx.Response:
+        requests.append(request)
+        body = json_from_request(request)
+        assert body["x402Version"] == 2
+        assert body["paymentPayload"]["signature"] == "0xsig"
+        assert body["paymentRequirements"]["network"] == "eip155:5042002"
+        if str(request.url).endswith("/verify"):
+            return httpx.Response(200, json={"isValid": True, "payer": "0x" + "b" * 40})
+        if str(request.url).endswith("/settle"):
+            return httpx.Response(
+                200,
+                json={
+                    "success": True,
+                    "transaction": "0xsettled",
+                    "network": "eip155:5042002",
+                    "payer": "0x" + "b" * 40,
+                },
+            )
+        raise AssertionError(f"unexpected URL {request.url}")
+
+    facilitator._client = httpx.AsyncClient(transport=httpx.MockTransport(handler))
+    try:
+        verify = await facilitator.verify(
+            {"signature": "0xsig"},
+            {"network": "eip155:5042002"},
+        )
+        settle = await facilitator.settle(
+            {"signature": "0xsig"},
+            {"network": "eip155:5042002"},
+        )
+    finally:
+        await facilitator.close()
+
+    assert len(requests) == 2
+    assert verify.is_valid is True
+    assert settle.success is True
+    assert settle.transaction == "0xsettled"
+
+
 def test_circle_facilitator_custom_base_url_override():
     """Circle facilitator must honor explicit base_url overrides."""
     custom = "https://gateway-proxy.internal.example"
@@ -201,7 +499,7 @@ def test_seller_with_each_facilitator():
 
     sellers = {}
 
-    for provider in ["circle", "coinbase", "ordern", "rbx", "thirdweb"]:
+    for provider in ["circle", "coinbase", "ordern", "rbx", "thirdweb", "omniclaw"]:
         facilitator = create_facilitator(provider=provider, api_key="test_key")
 
         seller = create_seller(
diff --git a/tests/test_facilitator_live_integration.py b/tests/test_facilitator_live_integration.py
index dbe00d1..e7276d8 100644
--- a/tests/test_facilitator_live_integration.py
+++ b/tests/test_facilitator_live_integration.py
@@ -416,11 +416,11 @@ async def test_thirdweb_urls():
     from omniclaw.seller import create_facilitator
 
     f_testnet = create_facilitator(provider="thirdweb", api_key=api_key, environment="testnet")
-    assert f_testnet.base_url == "https://gateway.thirdweb-test.com"
+    assert f_testnet.base_url == "https://api.thirdweb.com"
     await f_testnet.close()
 
     f_mainnet = create_facilitator(provider="thirdweb", api_key=api_key, environment="mainnet")
-    assert f_mainnet.base_url == "https://gateway.thirdweb.com"
+    assert f_mainnet.base_url == "https://api.thirdweb.com"
     await f_mainnet.close()
 
     print("\nThirdweb URLs verified successfully")
diff --git a/tests/test_nanopayments_middleware.py b/tests/test_nanopayments_middleware.py
index 6f362d8..67774d7 100644
--- a/tests/test_nanopayments_middleware.py
+++ b/tests/test_nanopayments_middleware.py
@@ -158,6 +158,57 @@ async def test_402_body_has_gateway_wallet_batched(self):
         for accept in body["accepts"]:
             assert accept["extra"]["name"] == "GatewayWalletBatched"
 
+    @pytest.mark.asyncio
+    async def test_non_circle_facilitator_advertises_standard_exact(self):
+        facilitator = MagicMock()
+        facilitator.name = "coinbase"
+
+        middleware = GatewayMiddleware(
+            seller_address="0x" + "a" * 40,
+            nanopayment_client=_make_client(),
+            supported_kinds=_make_kinds(),
+            facilitator=facilitator,
+        )
+
+        body = await middleware._build_402_response("$0.001")
+
+        for accept in body["accepts"]:
+            assert accept["scheme"] == "exact"
+            assert "extra" not in accept
+
+    async def test_external_facilitator_can_create_accepts(self):
+        facilitator = AsyncMock()
+        facilitator.name = "thirdweb"
+        facilitator.create_accepts.return_value = [
+            {
+                "scheme": "exact",
+                "network": "eip155:84532",
+                "amount": "10000",
+                "payTo": "0x" + "b" * 40,
+                "asset": "0x036CbD53842c5426634e7929541eC2318f3dCF7e",
+            }
+        ]
+        middleware = GatewayMiddleware(
+            seller_address="0x" + "a" * 40,
+            nanopayment_client=None,
+            facilitator=facilitator,
+        )
+
+        body = await middleware._build_402_response(
+            "$0.01",
+            resource_url="https://seller.example.com/compute",
+            method="GET",
+        )
+
+        facilitator.create_accepts.assert_awaited_once_with(
+            resource_url="https://seller.example.com/compute",
+            method="GET",
+            price="$0.01",
+            server_wallet_address="0x" + "a" * 40,
+        )
+        assert body["x402Version"] == 2
+        assert body["accepts"][0]["network"] == "eip155:84532"
+
     async def test_402_body_has_verifying_contract(self):
         middleware = GatewayMiddleware(
             seller_address="0x" + "a" * 40,
@@ -312,3 +363,48 @@ async def test_handle_with_missing_payment_and_no_networks_returns_empty(self):
         body = exc_info.value.detail
         assert body["x402Version"] == 2
         assert body["accepts"] == []
+
+    @pytest.mark.asyncio
+    async def test_non_circle_facilitator_settle_uses_standard_exact_requirements(self):
+        facilitator = AsyncMock()
+        facilitator.name = "coinbase"
+        facilitator.settle.return_value = MagicMock(
+            success=True,
+            transaction="fac-123",
+            payer="0x" + "a" * 40,
+        )
+
+        authorization = EIP3009Authorization.create(
+            from_address="0x" + "a" * 40,
+            to="0x" + "a" * 40,
+            value="1000",
+            valid_before=9999999999,
+            nonce="0x" + "b" * 64,
+        )
+        payload = PaymentPayload(
+            x402_version=2,
+            scheme="exact",
+            network="eip155:5042002",
+            payload=PaymentPayloadInner(
+                signature="0x" + "c" * 130,
+                authorization=authorization,
+            ),
+        )
+        sig_header = base64.b64encode(json.dumps(payload.to_dict()).encode()).decode()
+
+        middleware = GatewayMiddleware(
+            seller_address="0x" + "a" * 40,
+            nanopayment_client=_make_client(),
+            supported_kinds=_make_kinds(),
+            facilitator=facilitator,
+        )
+
+        info = await middleware.handle({"payment-signature": sig_header}, "$0.001")
+
+        assert info.verified is True
+        assert info.transaction == "fac-123"
+        facilitator.settle.assert_awaited_once()
+        _, req_dict = facilitator.settle.await_args.args
+        accepted = req_dict["accepts"][0]
+        assert accepted["scheme"] == "exact"
+        assert "extra" not in accepted
diff --git a/tests/test_seller_side.py b/tests/test_seller_side.py
index 4abd15e..085778c 100644
--- a/tests/test_seller_side.py
+++ b/tests/test_seller_side.py
@@ -238,6 +238,16 @@ def test_gateway_batched_included_with_contract(self, monkeypatch):
         )
         assert gw_accept["extra"]["version"] == "1"
 
+    def test_exact_accept_does_not_advertise_gateway_metadata(self):
+        seller = Seller(
+            seller_address="0x742d35Cc6634C0532925a3b844Bc9e7595f1E123",
+            name="Test",
+        )
+        seller.add_endpoint("/test", "$0.001", schemes=[PaymentScheme.EXACT])
+        accept = seller._create_accepts(seller.get_endpoints()["/test"])[0]
+        assert accept["scheme"] == "exact"
+        assert "extra" not in accept
+
 
 class TestSellerSecurityHardening:
     """Regression tests for seller-side anti-tamper and replay protections."""
diff --git a/tests/test_setup.py b/tests/test_setup.py
index c799d03..0a51e6c 100644
--- a/tests/test_setup.py
+++ b/tests/test_setup.py
@@ -10,12 +10,15 @@
 
 from omniclaw.onboarding import (
     SetupError,
+    auto_setup_entity_secret,
     create_env_file,
     doctor,
     generate_entity_secret,
     load_managed_entity_secret,
     print_doctor_status,
+    quick_setup,
     store_managed_credentials,
+    validate_entity_secret,
     verify_setup,
 )
 
@@ -38,6 +41,23 @@ def test_generates_unique_secrets(self) -> None:
         assert len(set(secrets)) == 10  # All unique
 
 
+class TestValidateEntitySecret:
+    """Tests for validate_entity_secret()."""
+
+    def test_accepts_64_char_hex(self) -> None:
+        secret = "a" * 64
+
+        assert validate_entity_secret(f" {secret}\n") == secret
+
+    def test_rejects_wrong_length(self) -> None:
+        with pytest.raises(SetupError, match="64 hex characters"):
+            validate_entity_secret("a" * 63)
+
+    def test_rejects_non_hex(self) -> None:
+        with pytest.raises(SetupError, match="valid hexadecimal"):
+            validate_entity_secret("z" * 64)
+
+
 class TestCreateEnvFile:
     """Tests for create_env_file()."""
 
@@ -105,6 +125,65 @@ def test_includes_network_config(self) -> None:
             content = env_path.read_text()
             assert "OMNICLAW_NETWORK=ARC" in content
 
+    def test_rejects_invalid_entity_secret(self) -> None:
+        with tempfile.TemporaryDirectory() as tmpdir:
+            env_path = Path(tmpdir) / ".env"
+
+            with pytest.raises(SetupError, match="64 hex characters"):
+                create_env_file(
+                    api_key="key",
+                    entity_secret="short",
+                    env_path=env_path,
+                )
+
+
+class TestQuickSetup:
+    """Tests for quick_setup()."""
+
+    def test_uses_existing_entity_secret_without_registering(self) -> None:
+        with tempfile.TemporaryDirectory() as tmpdir:
+            env_path = Path(tmpdir) / ".env"
+            xdg_config_home = Path(tmpdir) / "xdg"
+            existing_secret = "d" * 64
+
+            with (
+                patch.dict(os.environ, {"XDG_CONFIG_HOME": str(xdg_config_home)}, clear=True),
+                patch("omniclaw.onboarding.register_entity_secret") as register_mock,
+            ):
+                result = quick_setup(
+                    api_key="TEST_API_KEY",
+                    entity_secret=existing_secret,
+                    env_path=env_path,
+                )
+
+                register_mock.assert_not_called()
+                assert result["entity_secret"] == existing_secret
+                assert f"ENTITY_SECRET={existing_secret}" in env_path.read_text()
+                assert load_managed_entity_secret("TEST_API_KEY") == existing_secret
+
+    def test_auto_setup_uses_managed_secret_without_registering_new_one(self) -> None:
+        with tempfile.TemporaryDirectory() as tmpdir:
+            xdg_config_home = Path(tmpdir) / "xdg"
+            existing_secret = "e" * 64
+
+            with (
+                patch.dict(os.environ, {"XDG_CONFIG_HOME": str(xdg_config_home)}, clear=True),
+                patch("omniclaw.onboarding.register_entity_secret") as register_mock,
+                patch("omniclaw.onboarding.generate_entity_secret") as generate_mock,
+            ):
+                store_managed_credentials(
+                    "TEST_API_KEY",
+                    existing_secret,
+                    source="test",
+                )
+
+                result = auto_setup_entity_secret("TEST_API_KEY")
+
+                assert result == existing_secret
+                assert os.environ["ENTITY_SECRET"] == existing_secret
+                generate_mock.assert_not_called()
+                register_mock.assert_not_called()
+
 
 class TestVerifySetup:
     """Tests for verify_setup()."""
diff --git a/tests/test_two_agent_demo.py b/tests/test_two_agent_demo.py
index 07ab53e..cfbcbce 100644
--- a/tests/test_two_agent_demo.py
+++ b/tests/test_two_agent_demo.py
@@ -500,9 +500,9 @@ async def run_test():
 
         try:
             pay_resp = await buyer_client.post(
-                "/api/v1/x402/pay",
+                "/api/v1/pay",
                 json={
-                    "url": f"http://localhost:{SELLER_SERVICE_PORT}/api/data",
+                    "recipient": f"http://localhost:{SELLER_SERVICE_PORT}/api/data",
                     "method": "GET",
                 },
                 timeout=60,
diff --git a/tests/test_x402_idempotency.py b/tests/test_x402_idempotency.py
index d188d3c..902f316 100644
--- a/tests/test_x402_idempotency.py
+++ b/tests/test_x402_idempotency.py
@@ -1,57 +1,49 @@
-from decimal import Decimal
-from unittest.mock import AsyncMock, MagicMock
+"""Test that x402 idempotency key derivation is deterministic."""
 
-import pytest
+from omniclaw.core.idempotency import derive_idempotency_key
 
-from omniclaw.protocols.x402 import PaymentRequirements, X402Adapter
 
-
-@pytest.mark.asyncio
-async def test_x402_execute_uses_deterministic_idempotency_for_transfer():
-    config = MagicMock()
-    wallet_service = MagicMock()
-    wallet_service.get_wallet.return_value = MagicMock(blockchain="ETH-SEPOLIA", address="0xabc")
-
-    transfer_result = MagicMock()
-    transfer_result.success = True
-    transfer_result.tx_hash = "0xhash"
-    transfer_result.transaction = MagicMock(id="tx-1")
-    wallet_service.transfer = AsyncMock(return_value=transfer_result)
-
-    adapter = X402Adapter(config=config, wallet_service=wallet_service)
-
-    requirements = PaymentRequirements(
-        scheme="exact",
-        network="eip155:11155111",
-        max_amount_required="1000",
-        resource="https://api.example.com/data",
-        description="test",
-        recipient="0x742d35Cc6634C0532925a3b844Bc9e7595f1E123",
-        extra={},
+def test_x402_idempotency_key_is_deterministic():
+    """Same inputs should always produce the same idempotency key."""
+    key_a = derive_idempotency_key(
+        "x402",
+        "wallet-1",
+        "https://api.example.com/data",
+        "GET",
+        {"query": "a"},
+        None,
+        "eip155:11155111",
     )
-    response_402 = MagicMock(status_code=402)
-    response_200 = MagicMock(status_code=200, headers={})
-    response_200.json.side_effect = ValueError("not json")
-    response_200.text = "ok"
-
-    adapter._request_with_402_check = AsyncMock(return_value=(response_402, requirements))
-    adapter._get_http_client = AsyncMock(
-        return_value=MagicMock(request=AsyncMock(return_value=response_200))
+    key_b = derive_idempotency_key(
+        "x402",
+        "wallet-1",
+        "https://api.example.com/data",
+        "GET",
+        {"query": "a"},
+        None,
+        "eip155:11155111",
     )
-
-    await adapter.execute(
-        wallet_id="wallet-1",
-        recipient="https://api.example.com/data",
-        amount=Decimal("1.00"),
-        request_json={"query": "a"},
+    assert key_a == key_b
+
+
+def test_x402_idempotency_key_changes_with_inputs():
+    """Different inputs should produce different idempotency keys."""
+    key_a = derive_idempotency_key(
+        "x402",
+        "wallet-1",
+        "https://api.example.com/data",
+        "GET",
+        {"query": "a"},
+        None,
+        "eip155:11155111",
     )
-    await adapter.execute(
-        wallet_id="wallet-1",
-        recipient="https://api.example.com/data",
-        amount=Decimal("1.00"),
-        request_json={"query": "a"},
+    key_b = derive_idempotency_key(
+        "x402",
+        "wallet-1",
+        "https://api.example.com/data",
+        "GET",
+        {"query": "b"},
+        None,
+        "eip155:11155111",
     )
-
-    first_key = wallet_service.transfer.await_args_list[0].kwargs["idempotency_key"]
-    second_key = wallet_service.transfer.await_args_list[1].kwargs["idempotency_key"]
-    assert first_key == second_key
+    assert key_a != key_b
diff --git a/tests/test_x402_sdk_adapter.py b/tests/test_x402_sdk_adapter.py
new file mode 100644
index 0000000..d1cdc49
--- /dev/null
+++ b/tests/test_x402_sdk_adapter.py
@@ -0,0 +1,430 @@
+from __future__ import annotations
+
+from decimal import Decimal
+from types import SimpleNamespace
+from unittest.mock import AsyncMock
+
+import httpx
+import pytest
+
+from omniclaw.agent.models import PayRequest
+from omniclaw.agent.routes import _choose_x402_route, pay
+from omniclaw.core.types import Network, PaymentMethod, PaymentResult, PaymentStatus
+from omniclaw.protocols.x402 import X402Adapter
+
+
+def _make_payment_required_header(url: str) -> str:
+    from x402.http import encode_payment_required_header
+    from x402.schemas import PaymentRequired, PaymentRequirements, ResourceInfo
+
+    payment_required = PaymentRequired(
+        error="Payment Required",
+        resource=ResourceInfo(url=url, description="paid resource", mime_type="application/json"),
+        accepts=[
+            PaymentRequirements(
+                scheme="exact",
+                network="eip155:84532",
+                asset="0x036CbD53842c5426634e7929541eC2318f3dCF7e",
+                amount="250000",
+                pay_to="0x742d35Cc6634C0532925a3b844Bc454e4438f44e",
+                max_timeout_seconds=300,
+                extra={"name": "USD Coin", "version": "2"},
+            )
+        ],
+    )
+    return encode_payment_required_header(payment_required)
+
+
+def _make_payment_response_header(*, success: bool, error_reason: str | None = None) -> str:
+    from x402.http import encode_payment_response_header
+    from x402.schemas import SettleResponse
+
+    settle_response = SettleResponse(
+        success=success,
+        error_reason=error_reason,
+        transaction="0xsettlement",
+        network="eip155:84532",
+        payer="0xa6b9b6244A5AD5FC2eF2BEB67ce04b75A0dB91D7",
+    )
+    return encode_payment_response_header(settle_response)
+
+
+def _make_adapter(transport: httpx.MockTransport) -> X402Adapter:
+    config = SimpleNamespace(
+        nanopayments_private_key="0x59c6995e998f97a5a0044976f7d4d0cbafc4b9d96ec4f38f5dc7065f6a7e0c72",
+        payment_strict_settlement=True,
+    )
+    wallet_service = SimpleNamespace(
+        get_wallet=lambda wallet_id: SimpleNamespace(blockchain=Network.BASE_SEPOLIA.value)
+    )
+    http_client = httpx.AsyncClient(transport=transport, timeout=5.0)
+    return X402Adapter(config=config, wallet_service=wallet_service, http_client=http_client)
+
+
+@pytest.mark.asyncio
+async def test_execute_uses_sdk_payment_signature_and_settle_response():
+    url = "https://seller.example/compute"
+    calls: list[httpx.Request] = []
+
+    async def handler(request: httpx.Request) -> httpx.Response:
+        calls.append(request)
+        if "PAYMENT-SIGNATURE" not in request.headers:
+            return httpx.Response(
+                402,
+                headers={"PAYMENT-REQUIRED": _make_payment_required_header(url)},
+                json={"error": "Payment Required"},
+            )
+
+        assert request.headers["PAYMENT-SIGNATURE"]
+        return httpx.Response(
+            200,
+            headers={"PAYMENT-RESPONSE": _make_payment_response_header(success=True)},
+            json={"ok": True, "job": "done"},
+        )
+
+    adapter = _make_adapter(httpx.MockTransport(handler))
+    result = await adapter.execute(
+        wallet_id="buyer-wallet",
+        recipient=url,
+        amount=Decimal("0.25"),
+        method="POST",
+        request_body=b'{"task":"prime-count"}',
+        request_headers={"x-trace-id": "abc123"},
+    )
+
+    assert result.success is True
+    assert result.method == PaymentMethod.X402
+    assert result.status == PaymentStatus.SETTLED
+    assert result.transaction_id == "0xsettlement"
+    assert result.blockchain_tx == "0xsettlement"
+    assert result.amount == Decimal("0.25")
+    assert result.resource_data == {"ok": True, "job": "done"}
+    assert len(calls) == 2
+    assert calls[0].headers["x-trace-id"] == "abc123"
+    assert calls[1].headers["x-trace-id"] == "abc123"
+    assert calls[1].method == "POST"
+
+
+@pytest.mark.asyncio
+async def test_execute_returns_failed_final_when_seller_rejects_payment():
+    url = "https://seller.example/compute"
+
+    async def handler(request: httpx.Request) -> httpx.Response:
+        if "PAYMENT-SIGNATURE" not in request.headers:
+            return httpx.Response(
+                402,
+                headers={"PAYMENT-REQUIRED": _make_payment_required_header(url)},
+                json={"error": "Payment Required"},
+            )
+
+        return httpx.Response(
+            402,
+            headers={
+                "PAYMENT-RESPONSE": _make_payment_response_header(
+                    success=False,
+                    error_reason="insufficient balance",
+                )
+            },
+            json={"error": "insufficient balance"},
+        )
+
+    adapter = _make_adapter(httpx.MockTransport(handler))
+    result = await adapter.execute(
+        wallet_id="buyer-wallet",
+        recipient=url,
+        amount=Decimal("0.25"),
+    )
+
+    assert result.success is False
+    assert result.status == PaymentStatus.FAILED_FINAL
+    assert "insufficient balance" in (result.error or "")
+    assert result.transaction_id == "0xsettlement"
+
+
+@pytest.mark.asyncio
+async def test_pay_route_uses_seller_declared_amount_for_url_payments(monkeypatch: pytest.MonkeyPatch):
+    payment_result = PaymentResult(
+        success=True,
+        transaction_id="tx-2",
+        blockchain_tx="0xdef",
+        amount=Decimal("0.25"),
+        recipient="https://seller.example/compute",
+        method=PaymentMethod.X402,
+        status=PaymentStatus.SETTLED,
+        resource_data={"ok": True},
+        metadata={},
+    )
+    client = SimpleNamespace(pay=AsyncMock(return_value=payment_result))
+    selected_kind = SimpleNamespace(get_amount_usdc=lambda: Decimal("0.25"))
+
+    async def fake_inspect_x402_target(**kwargs):
+        return {
+            "ok": True,
+            "requires_payment": True,
+            "selected_kind": selected_kind,
+            "selected_route": "x402",
+        }
+
+    monkeypatch.setattr(
+        "omniclaw.agent.routes._inspect_x402_target",
+        fake_inspect_x402_target,
+    )
+    request = PayRequest(
+        recipient="https://seller.example/compute",
+        amount=None,
+        method="POST",
+        body='{"task":"prime-count"}',
+        headers={"x-trace-id": "abc123"},
+    )
+    agent = SimpleNamespace(wallet_id="buyer-wallet")
+    wallet_mgr = SimpleNamespace()
+    policy_mgr = SimpleNamespace(
+        is_valid_recipient=lambda recipient, wallet_id: True,
+        check_limits=lambda amount, wallet_id: (True, None),
+    )
+
+    response = await pay(
+        request=request,
+        agent=agent,
+        wallet_mgr=wallet_mgr,
+        policy_mgr=policy_mgr,
+        client=client,
+    )
+
+    client.pay.assert_awaited_once_with(
+        wallet_id="buyer-wallet",
+        recipient="https://seller.example/compute",
+        amount="0.25",
+        purpose=None,
+        idempotency_key=None,
+        destination_chain=None,
+        fee_level=None,
+        check_trust=False,
+        skip_guards=False,
+        method="POST",
+        request_body='{"task":"prime-count"}',
+        request_headers={"x-trace-id": "abc123"},
+        metadata={
+            "method": "POST",
+            "body": '{"task":"prime-count"}',
+            "headers": {"x-trace-id": "abc123"},
+        },
+        preferred_url_route="x402",
+    )
+    assert response.success is True
+    assert response.method == "x402"
+    assert response.amount == "0.25"
+
+
+@pytest.mark.asyncio
+async def test_pay_route_uses_zero_amount_for_free_url(monkeypatch: pytest.MonkeyPatch):
+    payment_result = PaymentResult(
+        success=True,
+        transaction_id=None,
+        blockchain_tx=None,
+        amount=Decimal("0"),
+        recipient="https://seller.example/free",
+        method=PaymentMethod.X402,
+        status=PaymentStatus.COMPLETED,
+        resource_data={"ok": True},
+        metadata={"http_status": 200},
+    )
+    client = SimpleNamespace(pay=AsyncMock(return_value=payment_result))
+
+    async def fake_inspect_x402_target(**kwargs):
+        return {
+            "ok": True,
+            "requires_payment": False,
+            "reason": "Endpoint does not currently require payment",
+        }
+
+    monkeypatch.setattr(
+        "omniclaw.agent.routes._inspect_x402_target",
+        fake_inspect_x402_target,
+    )
+    request = PayRequest(recipient="https://seller.example/free", amount=None)
+    agent = SimpleNamespace(wallet_id="buyer-wallet")
+    wallet_mgr = SimpleNamespace()
+    policy_mgr = SimpleNamespace(
+        is_valid_recipient=lambda recipient, wallet_id: True,
+        check_limits=lambda amount, wallet_id: (True, None),
+    )
+
+    response = await pay(
+        request=request,
+        agent=agent,
+        wallet_mgr=wallet_mgr,
+        policy_mgr=policy_mgr,
+        client=client,
+    )
+
+    client.pay.assert_awaited_once_with(
+        wallet_id="buyer-wallet",
+        recipient="https://seller.example/free",
+        amount="0.00",
+        purpose=None,
+        idempotency_key=None,
+        destination_chain=None,
+        fee_level=None,
+        check_trust=False,
+        skip_guards=False,
+        method="GET",
+        request_body=None,
+        request_headers=None,
+        metadata={"method": "GET"},
+        preferred_url_route=None,
+    )
+    assert response.success is True
+    assert response.amount == "0.00"
+
+
+@pytest.mark.asyncio
+async def test_choose_x402_route_prefers_exact_when_gateway_is_unfunded():
+    exact_kind = SimpleNamespace(
+        amount_atomic=250000,
+        is_gateway_batched=False,
+        get_amount_usdc=lambda: Decimal("0.25"),
+    )
+    gateway_kind = SimpleNamespace(
+        amount_atomic=250000,
+        is_gateway_batched=True,
+        get_amount_usdc=lambda: Decimal("0.25"),
+    )
+    requirements = SimpleNamespace(
+        select_preferred_kind=lambda *, prefer_gateway, source_network: (
+            gateway_kind if prefer_gateway else exact_kind
+        )
+    )
+    client = SimpleNamespace(
+        _nano_adapter=object(),
+        get_gateway_balance=AsyncMock(
+            return_value=SimpleNamespace(
+                available=0,
+                formatted_available="0.00",
+            )
+        ),
+    )
+    x402_adapter = SimpleNamespace(
+        _resolve_agent_network=lambda wallet_id, destination_chain: "eip155:84532"
+    )
+
+    route = await _choose_x402_route(
+        client=client,
+        wallet_id="buyer-wallet",
+        x402_adapter=x402_adapter,
+        requirements=requirements,
+    )
+
+    assert route["selected_route"] == "x402"
+    assert route["payment_source"] == "direct_wallet"
+    assert route["selected_kind"] is exact_kind
+    assert route["gateway_ready"] is False
+    assert route["gateway_available_balance"] == "0.00"
+
+
+@pytest.mark.asyncio
+async def test_choose_x402_route_keeps_gateway_when_it_is_the_only_option():
+    gateway_kind = SimpleNamespace(
+        amount_atomic=250000,
+        is_gateway_batched=True,
+        get_amount_usdc=lambda: Decimal("0.25"),
+    )
+    requirements = SimpleNamespace(
+        select_preferred_kind=lambda *, prefer_gateway, source_network: (
+            gateway_kind if prefer_gateway else None
+        )
+    )
+    client = SimpleNamespace(
+        _nano_adapter=object(),
+        get_gateway_balance=AsyncMock(
+            return_value=SimpleNamespace(
+                available=0,
+                formatted_available="0.00",
+            )
+        ),
+    )
+    x402_adapter = SimpleNamespace(
+        _resolve_agent_network=lambda wallet_id, destination_chain: "eip155:84532"
+    )
+
+    route = await _choose_x402_route(
+        client=client,
+        wallet_id="buyer-wallet",
+        x402_adapter=x402_adapter,
+        requirements=requirements,
+    )
+
+    assert route["selected_route"] == "nanopayment"
+    assert route["payment_source"] == "gateway_balance"
+    assert route["selected_kind"] is gateway_kind
+    assert route["gateway_ready"] is False
+
+
+@pytest.mark.asyncio
+async def test_pay_route_inspects_url_even_when_amount_is_supplied(
+    monkeypatch: pytest.MonkeyPatch,
+):
+    payment_result = PaymentResult(
+        success=True,
+        transaction_id="tx-3",
+        blockchain_tx="0x987",
+        amount=Decimal("0.25"),
+        recipient="https://seller.example/compute",
+        method=PaymentMethod.X402,
+        status=PaymentStatus.SETTLED,
+        resource_data={"ok": True},
+        metadata={},
+    )
+    client = SimpleNamespace(pay=AsyncMock(return_value=payment_result))
+    selected_kind = SimpleNamespace(get_amount_usdc=lambda: Decimal("0.25"))
+
+    async def fake_inspect_x402_target(**kwargs):
+        return {
+            "ok": True,
+            "requires_payment": True,
+            "selected_kind": selected_kind,
+            "selected_route": "x402",
+        }
+
+    monkeypatch.setattr(
+        "omniclaw.agent.routes._inspect_x402_target",
+        fake_inspect_x402_target,
+    )
+    request = PayRequest(
+        recipient="https://seller.example/compute",
+        amount="0.25",
+        method="GET",
+    )
+    agent = SimpleNamespace(wallet_id="buyer-wallet")
+    wallet_mgr = SimpleNamespace()
+    policy_mgr = SimpleNamespace(
+        is_valid_recipient=lambda recipient, wallet_id: True,
+        check_limits=lambda amount, wallet_id: (True, None),
+    )
+
+    response = await pay(
+        request=request,
+        agent=agent,
+        wallet_mgr=wallet_mgr,
+        policy_mgr=policy_mgr,
+        client=client,
+    )
+
+    client.pay.assert_awaited_once_with(
+        wallet_id="buyer-wallet",
+        recipient="https://seller.example/compute",
+        amount="0.25",
+        purpose=None,
+        idempotency_key=None,
+        destination_chain=None,
+        fee_level=None,
+        check_trust=False,
+        skip_guards=False,
+        method="GET",
+        request_body=None,
+        request_headers=None,
+        metadata={"method": "GET"},
+        preferred_url_route="x402",
+    )
+    assert response.success is True
+    assert response.method == "x402"