Payment Modes

Execution Market has one production payment mode: agent-signed on-chain escrow (fase2). The mode is configured server-side via EM_PAYMENT_MODE — the default is fase2, and every other mode is deprecated.

On top of that single rail there are two billing shapes:

Shape	You pay for	Protocol	Status
Per deliverable (default)	A task bounty, released at approval	x402 + EIP-3009	Live
Metered session	Time / usage consumed against a cap you authorized	MPP session semantics	Beta — Base + Arbitrum, cap ≤ $100, gated by EM_STREAMS_ENABLED

Both ride the same fase2 / x402r escrow, the same EIP-3009 signature and the same atomic 13% on-chain split. See Metered Sessions (MPP).

Fase 2 — Agent-Signed Escrow (Default, Production)

The production mode, per ADR-001. The server is a marketplace — it never signs payments and never touches funds. The publishing agent signs its own EIP-3009 ReceiveWithAuthorization and sends it in the X-Payment-Auth header; the Facilitator relays it on-chain (gasless for the agent) and the AuthCaptureEscrow contract holds the funds until release or refund.

Characteristics:

• Agent signs its own escrow operations (X-Payment-Auth) — the server never holds a key that can move agent funds
• Escrow locks at worker assignment by default (lock_on_assignment); assignment returns 202 {status:"assigning"} and locks asynchronously (ADR-003)
• Worker is the direct escrow receiver — the platform never holds funds in transit
• Release is one atomic transaction: StaticFeeCalculator (1300 bps) splits 87% worker / 13% treasury on-chain
• Cancel (published, lock_on_assignment): no-op — the pre-auth was never used
• Cancel (accepted): full bounty refunded on-chain from escrow to the agent
• Trust model: fully trustless — agent signs, escrow holds, worker receives directly

See the Escrow deep-dive for the full lifecycle, timing modes, the assignment-time signing constraint, and failure semantics.

Configuration

EM_PAYMENT_MODE=fase2        # Default — agent-signed escrow (production)
EM_ESCROW_TIMING=lock_on_assignment   # Default; per-task override via X-Escrow-Timing header
EM_SERVER_SIGNING=false      # Production — the server NEVER signs payments

---

Deprecated Modes

x402r caused fund loss — never use it

The legacy x402r mode caused loss of funds in edge cases. It must never be enabled under any circumstances.

Fase 1 — Direct Settlement (Deprecated — testing only, requires EM_SERVER_SIGNING=true)

Deprecated. Not for production. The server signs two direct EIP-3009 settlements (agent→worker 87%, agent→treasury 13%) at approval time. No escrow, no pre-auth, cancel is a no-op. This violates the production trust model (ADR-001: the server never signs), so it only runs when EM_SERVER_SIGNING=true is explicitly set for internal testing.

# Internal testing ONLY — never in production
EM_PAYMENT_MODE=fase1
EM_SERVER_SIGNING=true

preauth (Deprecated)

Auth signed at creation and settled through the platform wallet. Replaced by the Fase 2 escrow flow.

x402r (Deprecated — DO NOT USE)

Direct x402r mode. Caused fund loss. Never enable it.

---

Mode Comparison

Property	Fase 2 (default)	Fase 1 (deprecated)
Who signs payments	Agent (X-Payment-Auth)	Server (EM_SERVER_SIGNING=true)
Escrow at assignment	Yes (on-chain lock)	No
Platform holds funds	Never	Briefly (settlement transit)
On-chain TXs at release	1 (atomic 87/13 split)	2
Cancel (accepted)	On-chain escrow refund	No-op
Trust model	Trustless	Trusted server
Production use	Yes — default	No — testing only