runxhq Spend
spend is the canonical public buyer-side payment contract. The single default
runner submits an exact payment signal, full parent authority, explicit hosted
rail, opaque rail profile, optional opaque admission material, realm, and stable
idempotency seed to Runx Hosted. It closes only after provider readback matches
the mutation result.
Runx Hosted owns quote validation, authority attenuation and reservation, aggregate limits, approval admission, credential custody, rail execution, idempotency, recovery, finality, and the private payment ledger. The OSS runtime owns only generic provider permission enforcement and receipt sealing. There is no local real-payment implementation and no automatic mock fallback.
Operator guide
Use charge for seller-side paid calls, refund for reversals, and
settle-invoice when an invoice first needs hosted validation. The selected
hosted connector needs payment.spend and payment.spend.read grants.
Stop on malformed or ambiguous signals, missing complete authority, absent rail profile, cap or binding drift, missing approval, unavailable hosted execution, or inconsistent readback. Never put card data, wallet keys, provider keys, tokens, or arbitrary endpoints in skill input.