Protocol bindings

The rules

Names live here only

Nothing above a binding knows which protocol was used, which is what lets one change without anything upstream noticing.

No hard dependencies

Chain access, HTTP, signature checks and wallet libraries are injected. A binding that dragged a web3 library into the money path would spread its risk across everything.

Mirror, do not absorb

We match a protocol's shape at the edge. We do not wire a draft's internal model into our own authorisation path, because then its instability becomes ours.

Identity and trust

The trusted-agent binding implements agent recognition over signed HTTP requests. It rides beneath checkout on the card rails, it does not settle, and the payment container is handed to the merchant's existing processor. The signing layer is proven byte-exact against the published samples; production trust additionally needs an enrolment that is not open yet.

The onchain agent registries are read and never written. What comes back is reported alongside how much of it is verifiable, because when we measured, most registered identities did not resolve to a live endpoint and a large share of the feedback showed coordinated inauthentic behaviour. Publishing the number next to the data is the only honest way to use a registry in that state.

Authority

Delegated authority is verified in two substrates behind one seam: contract-enforced delegation, where the real chain link is walked and the readable constraints are projected onto our permission model, and credential-based delegation as a signed capability, where attenuation is checked at every hop so a child can never exceed its parent.

Commerce and payment

Both commerce standards are supported behind one shared machine: discover, quote, authorise, settle. The mandate format from the agent payments standard is verified inbound, honouring its signatures, hashes and expiry exactly as defined, and emitted outbound when the counterparty speaks it. The web-request payment schemes and the Lightning scheme are bound as rails, each leaving the node or the network client as an injected seam.

Coordination and delivery

Agent-to-agent work is handled as a projection, reusing the card discovery and signature verification that already existed rather than rebuilding it. Encrypted messaging is an ingest route only: it decodes an open transaction-reference content type, re-verifies the amount and asset onchain from the transaction hash, dedupes, and hands a proposed instruction to the gate. It is authoritative over nothing and never settles.

Records

Our enforcement record and its log membership are rendered into the standard signed-statement and receipt shapes the ecosystem is converging on. That layer changes no trust root and adds none: the transparency log stays the source of truth and this only re-expresses its proofs in the format other people's tools already read.