X402Guard

    #[account(        mut,        seeds = [SEED_POLICY, vault.key().as_ref()],        bump = policy.bump,        has_one = vault,    )]    pub policy: Box<Account<'info, Policy>>,     #[account(address = vault.usdc_mint)]    pub usdc_mint: Box<Account<'info, Mint>>,     #[account(        mut,        associated_token::mint = usdc_mint,        associated_token::authority = vault,    )]    pub vault_usdc_ata: Box<Account<'info, TokenAccount>>,     /// Recipient's USDC ATA. Must already exist (the upstream x402 facilitator    /// always has one — for now we don't auto-create here to keep the spend    /// instruction lean. Backend tx builder pre-flights this and adds an    /// `init_if_needed` ix in the same tx if necessary.)    #[account(        mut,

1. Line 51 seeds = [SEED_POLICY, vault.key().as_ref()],: Declares the PDA seeds. Anchor re-derives the address and rejects the account if it doesn't match.
2. Line 52 bump = policy.bump,: Uses the bump seed, the extra byte that pushes the derived address off the ed25519 curve.
3. Line 53 has_one = vault,: Checks that a stored pubkey field matches the passed account.
4. Line 67 /// Recipient's USDC ATA. Must already exist (the upstream x402 facilitator: Uses x402, an HTTP 402 pattern where an agent pays per request with an on-chain payment.
5. Line 70 /// `init_if_needed` ix in the same tx if necessary.): Creates the account only if it doesn't exist. Watch for re-initialisation bugs.

        has_one = owner,    )]    pub vault: Box<Account<'info, Vault>>,     #[account(        mut,        seeds = [SEED_POLICY, vault.key().as_ref()],        bump = policy.bump,        has_one = vault,    )]    pub policy: Box<Account<'info, Policy>>,} // ─── pause / resume ─────────────────────────────────────────────────────── pub fn pause(ctx: Context<OwnerOnly>) -> Result<()> {    let policy = &mut ctx.accounts.policy;    policy.paused = true;    emit!(VaultPaused {        vault: ctx.accounts.vault.key(),        ts: Clock::get()?.unix_timestamp,    });    Ok(())}

1. Line 25 has_one = owner,: Checks that a stored pubkey field matches the passed account.
2. Line 31 seeds = [SEED_POLICY, vault.key().as_ref()],: Declares the PDA seeds. Anchor re-derives the address and rejects the account if it doesn't match.
3. Line 32 bump = policy.bump,: Uses the bump seed, the extra byte that pushes the derived address off the ed25519 curve.
4. Line 43 emit!(VaultPaused {: Emits an Anchor event that clients can parse from the logs.
5. Line 45 ts: Clock::get()?.unix_timestamp,: Reads on-chain time from the Clock sysvar.

    pub per_call_cap: u64,     /// `sha256(host)` of each permitted endpoint. Up to `MAX_ALLOWLIST` (8) entries.    pub endpoint_allowlist: Vec<[u8; 32]>,     /// Unix timestamp (seconds). Must be strictly in the future at submit time.    pub expires_at: i64,} #[derive(Accounts)]#[instruction(args: CreateVaultArgs)]pub struct CreateVault<'info> {    #[account(mut)]    pub owner: Signer<'info>,     #[account(        init,        payer = owner,        space = Vault::SIZE,        seeds = [SEED_VAULT, owner.key().as_ref(), &args.agent_id],        bump,    )]    pub vault: Box<Account<'info, Vault>>,

1. Line 38 pub owner: Signer<'info>,: Requires this account to have signed the transaction.
2. Line 41 init,: Creates and pays for a new account. Space and payer must be specified.
3. Line 44 seeds = [SEED_VAULT, owner.key().as_ref(), &args.agent_id],: Declares the PDA seeds. Anchor re-derives the address and rejects the account if it doesn't match.
4. Line 45 bump,: Uses the bump seed, the extra byte that pushes the derived address off the ed25519 curve.

    /// User who owns this vault. Only this signer can pause / resume / clawback / update policy.    pub owner: Pubkey,    /// Application-defined agent identifier, supplied by the owner at creation.    /// Lets one user own multiple distinct vaults (e.g. one per agent persona).    pub agent_id: [u8; 32],    /// USDC mint this vault holds. Locked at creation so the policy can't be evaded    /// by swapping in a different SPL mint later.    pub usdc_mint: Pubkey,    pub bump: u8,    pub created_at: i64,} impl Vault {    /// 8-byte discriminator + struct fields.    pub const SIZE: usize = 8 + 32 + 32 + 32 + 1 + 8;} #[account]#[derive(Debug)]pub struct Policy {    pub vault: Pubkey,    /// Ed25519 public key allowed to authorise `spend` ixs. Held by the x402guard    /// backend session for the hackathon; v2 will move this to user-side WebAuthn.    pub delegation_key: Pubkey,

1. Line 33 pub bump: u8,: Uses the bump seed, the extra byte that pushes the derived address off the ed25519 curve.
2. Line 46 /// Ed25519 public key allowed to authorise `spend` ixs. Held by the x402guard: Uses x402, an HTTP 402 pattern where an agent pays per request with an on-chain payment.