Spend protocol
A LIVE hop is not authorization. The grant is a 15-second, single-use ticket bound to POST /job/v1/jobs/{job_id}/bind-only. Redeem must present that same write. bind-and-issue and issue are not this scanner.
SHA-256( canonical_json({
method, path, job_id, spend_kind
}) )
Hash the write you are about to forward. Do not copy the fingerprint off the ticket and forward a different path. Spec: spend-protocol.json.
spend_write_not_in_protocol — hop asked for bind-and-issue or issue. No ticket.
spend_write_required — redeem omitted method + path.
ticket_spend_mismatch — the write being forwarded is not the write the ticket printed.
Worker: cloudflare-worker-bind.js. Intercepts every bind write. Only bind-only can redeem. Everything else is a halt, including a LIVE hop with the wrong path.