| Discovery listing | Does the public source-selection record exist? |
| Source freshness | Is public provider evidence current enough? |
| Registry operation | Does the current signed generation contain the exact path and method? |
| Operation readiness | Is that exact operation ready rather than blocked? |
| Runtime credential | Is the upstream credential configured server-side? |
| Caller gate | Does the caller have API-key or MCP OAuth account admission, or is this exact route eligible for x402 over HTTP or the MCP /x402 endpoint? |
| Execution gate | Can the request be validated and attempted safely now? |