Agents have identities. Identities have permissions. Payments have proofs.
Bounded agent payments with Whitechain, World and ENSv2.
Open app · Demo & transactions · Pitch deck · Research paper · Build locally
An autonomous agent should be able to request a purchase without receiving unrestricted control of a treasury. Countersign binds each protected payment to exact signed terms and an owner-configured spending policy. Sensitive payments additionally require fresh World sandbox authentication, an attestor assertion and the owner's signature.
| Whitechain | World | ENSv2 |
|---|---|---|
| Enforce the payment. Mandates, merchant payout binding, limits, replay protection and official-USDT settlement. | Authenticate the human. Fresh sandbox authentication, session/subject binding and a separate exact-payment approval. | Discover the agent. Hierarchical identity, scoped resolver permissions and inspectable policy references. |
| Financial authority lives in the payment contract. | A login alone cannot authorize a transfer. | Editing identity metadata cannot grant spending rights. |
Evidence first. This is a testnet systems-security implementation. Local tests, recorded transactions and unverified integration paths are labeled separately. It is not independently audited or production-ready. Badge counts are recorded checkpoints, not live CI status.
Navigate: How it works · Architecture · Deployments · Security · Research · Disclosures
| Track | What we built for it | Proof |
|---|---|---|
| Whitechain · Stablecoin Payments / Payments Nobody Notices | Mandate + MerchantRegistry contracts (verified) enforce per-payment cap, period budget, merchant allowlist, expiry, pause and epoch. The agent holds 0 USDT / 0 WBT; the relayer sponsors gas under GasGuard limits; payments settle in official testnet USDT in seconds. | Payment 0xefc8692e… · pause / unpause |
| World · Agent Pass | Payments above the threshold require fresh World Agent Pass sign-in (OIDC, PKCE S256, max_age=0, CIMD public client), then the owner signs the exact payment and a separate attestor co-signs. |
World-approved 1.50 USDT · proof |
| ENS · Best Use of ENSv2 | countersign.eth with our own UserRegistry; agent1.countersign.eth with its own PermissionedResolver, ENSIP-26 agent records, policy text records and scoped role grants. The live app compares every ENS policy field against the Whitechain contract (7/8 MATCH). |
Live passport · ENS transactions |
Three protocols, three jobs, one payment that cannot go wrong. Each one does what it is best at, and none can move money alone.
 The contract is the judge. |
 A real human, on the exact payment. |
 Agents get a name and a public policy. |
|
What we built
Why Whitechain EVM-compatible and fast, with fees low enough that 50-cent agent purchases make sense: payments nobody notices, enforced by code nobody can bypass. |
What we built
Why World A login is not a payment approval. World proves a unique human is present, and we bind that proof to one amount, one merchant, one order. |
What we built
Why ENSv2 Hierarchical registries and resource-scoped permissions turn a name into a verifiable agent passport that anyone can audit against the contract. |
| Layer | Technologies |
|---|---|
| Smart contracts | Solidity 0.8.30, Foundry 1.9, OpenZeppelin Contracts 5.4, EIP-712, ERC-1271 |
| Chains | Whitechain Sepolia (1874) for settlement · Ethereum Sepolia for ENSv2 |
| Backend | Node.js 24, viem 2.35, SQLite, WebSocket events, HMAC webhooks, separate attestor process |
| Identity | World Agent Pass (OIDC, PKCE, CIMD), ENSv2 UserRegistry + PermissionedResolver, ENSIP-26 |
| Frontend | Next.js 16, React, Tailwind CSS, comic and manhwa design system |
| Hosting | Cloudflare Workers (OpenNext) · Render (Docker) · Vercel mirror |
| Quality | Foundry unit, invariant and adversarial tests · Node test runner · Playwright · GitHub Actions secret scan |
Local implementation and recorded testnet evidence exist. End-to-end release acceptance is incomplete. The latest recorded regression results are 157 Node tests, 131 Solidity test executions, three shared digest vectors, JWT fixtures, lint, TypeScript and contract formatting passing. Solidity executions include inherited repetitions; fixture tests are not live integration tests.
| Area | Implemented and evidenced | Remaining acceptance gap |
|---|---|---|
| ENSv2 identity and permissions | Recorded registry/resolver setup and scoped grants; local passport and permission logic | Deployed-state fork execution, negative-permission and revocation verification |
| Whitechain settlement | Recorded verified contracts and official-USDT payments; local budget, replay and payout-binding tests | Fresh settlement and owner pause/unpause recorded 7 Nov 2026 (see Demo video); full merchant/browser journey still open |
| World human approval | Recorded sandbox-approved payment; local JWT, exact-signature, session and cancellation tests | Fresh integrated sandbox sign-in and browser acceptance; no production identity assurance |
| Passport and policy monitoring | Block-specific reads, effective spending calculations, persistent monitor and strict relay gate tested with fixtures | Complete live authority evidence, monitoring configuration and current policy comparison |
| Independent receipts | Historical receipt, transfer, signature and policy checks tested with fake RPC responses | Real archive-RPC verification and browser upload/download acceptance |
| Browser and hosting | Routes and deployment configuration implemented; lint/types pass | Human laptop build passes; browser fixtures 35 passed / 5 failed (fixes awaiting rerun); reliable public backend not established |
| Full demonstrations | Two historical six-step runs each reached 5/6 | Two fresh complete runs remain NOT_RUN |
| Research | 22-page balanced PDF, 25 references, eight vector figures, clean source rebuild and internal page review | Author/rights/license confirmation and scientific sign-off; local revision not deposited; user-provided Zenodo record not rechecked |
The acceptance matrix is the detailed source of truth. No production-ready claim is made.
| Component | URL | Host |
|---|---|---|
| Web app | https://countersign.someshtalligeri12.workers.dev | Cloudflare Workers (OpenNext), web/wrangler.jsonc |
| API + attestor | https://countersign-api-44lz.onrender.com (readiness) | Render, Docker (apps/api/Dockerfile, deploy/render-start.sh) |
| Mirror | https://web-rouge-one-10.vercel.app | Vercel |
Render's free tier sleeps when idle, so the first request can take about 50 s. Its disk is ephemeral: the observer rebuilds payment state from Whitechain after a restart. Keys are Render secret files, never frontend variables. The API and attestor run as separate processes in one container. That is a testnet convenience; production must isolate the attestor key.
The project records a 3:37 narrated walkthrough, captured on 7 November 2026. Its video link is on the ETHGlobal submission page; no direct video URL is stored here. The recorded Whitechain Sepolia scenes and transaction references are:
| Recorded scene | Evidence / enforcement layer |
|---|---|
Owner connects wallet (mandate owner 0x1079…25c7D) and pauses the mandate |
pause tx 0x1a232e63…f9cc |
| Agent tries to pay while paused | Service refused (inactive_agent_policy); no transfer, not a mined revert |
| Owner unpauses | unpause tx 0x97d66455…4d98 |
| Agent pays 0.50 USDT, gas sponsored by the relayer | payment tx 0xefc8692e…3c3d |
| Tampered amount / redirected payout | Both refused (bad_intent_sig); no transfer, not a mined revert |
| World-approved 1.50 USDT payment | tx 0x98fa814e…b531 (recorded earlier, labelled as such in the video) |
In the recording, the owner wallet is a browser EIP-1193 provider that forwards each request to the owner's local Foundry keystore. The key never enters the browser. Other real payments made on 7 November: 0xc79f0923…bfff, 0x80c41d70…872d, 0x3b7fe78d…09d9.
An agent may request a payment without receiving unrestricted control of the treasury. The owner chooses the agent, merchant allowlist, limits, human threshold and expiry. The agent signs exact payment terms; the contract checks them against current policy before moving official USDT.
- The owner creates a mandate and grants a limited token allowance. Treasury setup still costs gas.
- A dedicated ENSv2 permissioned resolver publishes the agent's identity, endpoint and policy references. Owner-controlled financial records are distinct from agent-editable operational records.
- A merchant returns an HTTP 402 quote. The agent signs its amount, payout, merchant version, order, resource, nonce, epoch and deadline using EIP-712.
- The relayer validates, simulates and reserves bounded GasGuard capacity before submitting. The agent need not hold WBT or USDT.
- At or above the threshold, fresh World sandbox authentication is followed by the exact owner-wallet approval and attestor assertion. Authentication alone is not transaction approval.
- The Mandate executes the protected transfer. The observer derives confirmed status from logs; merchants receive receipts, signed webhooks and history.
The treasury owner creates a Mandate and approves a limited allowance of the official test USDT. MerchantRegistry binds merchant identities to active payout addresses and versions. A signed payment must match both the selected merchant terms and current mandate policy before transferFrom can move funds.
- Exact intent: EIP-712 binds the deployment, chain, merchant, payout, amount, order, resource, nonce, epoch and deadline.
- Bounded execution: per-payment and period limits, an allowlist, expiry, pause, nonce consumption and order deduplication are enforced onchain.
- Sponsored payment gas: the relayer validates and simulates requests before reserving GasGuard capacity. Treasury setup still costs gas.
- Merchant operations: HTTP 402 middleware, an agent client, event-derived receipts, signed webhooks, history, CSV and bounded merchant-funded refunds.
Mandate source · Registry source · Merchant SDK · Agent SDK
At or above the configured threshold, a payment requires an additional human checkpoint. The backend performs OIDC authorization-code authentication with PKCE S256, state/nonce checks, JWKS-backed token validation, subject/session binding and authentication freshness. The owner then signs the exact payment approval; the separate attestor process signs the corresponding assertion.
Authentication, owner consent and execution are separate decisions. Denied, expired, mismatched and cancelled requests are handled explicitly. Local signed JWT fixtures test validation failures; the recorded sandbox-approved payment is a different evidence class. Sandbox identities do not establish production proof of personhood, and cancellation cannot retract an already exported signature.
OIDC implementation · Owner approval · Attestor · Recorded sandbox flow
A database can publish an agent profile; ENSv2 supplies publicly inspectable onchain record-write permissions. Countersign uses a hierarchical UserRegistry and a dedicated PermissionedResolver. Scoped agent grants cover agent-context and agent-endpoint[web], following the current draft ENSIP-26. Custom countersign.* records belong to the application.
Text-key permissions are resolver-wide, so independently administered agents need separate resolvers. The new block-pinned reader checks configured registry/owner/resolver anchors, known root and scoped roles, protected records and owner recovery. It does not enumerate every administrator or prove ancestor/proxy governance.
Whitechain remains financially authoritative. Editing an ENS record cannot rotate the Mandate's signer or invalidate its signatures. The Security Passport shows this boundary explicitly. The historical 7/8 comparison has a missing merchant aggregate because the contract stores an allowlist mapping, not a set hash. Missing administration or name-binding evidence is also left UNVERIFIED; no artificial 8/8 success is produced.
New local features:
- Security Passport: pinned state, explicit mismatch/stale/unavailable results, effective spending calculations and downloadable observations.
- Strict drift monitor: SQLite checkpoints, bounded registry/resolver log backfill, restart recovery, provider disagreement handling and reorg quarantine. The optional relay gate fails closed. Today's partial passports do not pass it. Scope and setup.
- Independent payment verifier:
/verify/[paymentId]and CLI check uploaded integrity, identified receipts, official-token transfers, EOA signatures and reconstructible historical policy. Missing reviewed runtime hashes or ambiguous same-block state stay UNVERIFIED. Ordinary RPC evidence is not a consensus proof. Verification guide. - Owner revocation workflow:
/agent/[name]/revokeprepares pause, epoch invalidation and separate ENS scoped removals. Explicit owner wallet actions include fresh-plan comparison, simulation, durable submission tracking and concurrent-tab protection. Mocked-provider tests pass; real browser/live execution remains unverified. Workflow.
These are preserved project execution records. This README styling pass did not re-query chain state or independently verify endpoint uptime.
| Item | Recorded evidence |
|---|---|
| Whitechain Sepolia | Chain 1874, official USDT 0xcedfB56113143d55b2358b8CFbB0dEB5Ad2f55a7; decimals read at runtime |
| MerchantRegistry | 0x2686f693A2C959568e650e0A5563E6244f2329E2 |
| Mandate | 0x923298375911A173da34C715da2718c0c9889EbA |
| First 0.50 USDT payment | Settlement transaction |
| World-approved 1.50 USDT payment | Sandbox-approved settlement |
| Source verification | Both Whitechain contracts recorded verified |
| ENS agent | agent1.countersign.eth, Ethereum Sepolia 11155111; registry, resolver, grant and record transactions |
Historical six-step demos each passed 5/6 steps and missed World approval at the time. A later standalone World success does not retroactively complete them. Fresh release run 1 and run 2 are NOT_RUN. The historical live budget rejection was OverPerTx, not OverPeriod. Registry-change-after-approval and current real-wallet browser acceptance remain open.
- Exact EIP-712 domains bind chain and deployment. Token identity is immutable deployment state, not a separate intent field. Owners support ERC-1271; agents and attestors use ECDSA.
- Nonces and order deduplication protect against repeated transfers. Period spending does not reset on policy changes or refunds. There is no lifetime or wallet-wide cap.
- Epoch revocation invalidates older signatures but does not disable fresh signatures from the current agent. Pause blocks while active; unpause alone can revive unused unexpired signatures.
- API approval TTL is 120 seconds; contract authentication freshness is 300 seconds, with the signed deadline also enforced. Cancellation cannot invalidate an already exported signature.
- World sandbox identities are test identities, not production proof of personhood. The separate attestor process trusts shared persisted identity state.
- ENS and Whitechain changes are not atomic. Offchain relay refusal cannot prevent a direct call satisfying Whitechain policy.
- GasGuard constrains the service's requests. It cannot constrain a stolen key used elsewhere. Complete OP data-fee accounting and multiprocess nonce coordination remain limitations.
- Three successor blocks are an application confirmation policy, not irreversible L1 finality. Refunds need merchant funds and authorization; there is no forced reversal.
Security review · Security model · Protocol · Limitations.
| Path | Purpose |
|---|---|
contracts/ |
Mandate, merchant registry and execution/invariant/adversarial tests |
apps/api/, apps/attestor/ |
Settlement, identity, durable relay, observer and separate signing process |
packages/ens/ |
Discovery, scoped permissions, passport, verifier and revocation workflow |
packages/merchant/, packages/agent/ |
Quote/receipt middleware and intent-signing client |
apps/demo-merchant/, apps/demo-agent/ |
Separate merchant integration and payment scenarios |
web/ |
Owner, merchant, approval, receipt and ENS views |
research/ |
Draft manuscript, references, historical raw results and reproduction scripts |
presentation/ |
Seven-slide comic deck, original logo, speaker notes and reproducible layout |
Toolchain: Node 24.10+, Foundry 1.9.0, solc 0.8.30, Prague, viaIR and optimizer 200. OpenZeppelin 5.4.0 and viem 2.35.0 are pinned. Use lockfiles:
npm ci --prefix contracts --ignore-scripts
npm ci --prefix packages/shared --ignore-scripts
npm ci --prefix packages/ens --ignore-scripts
npm ci --prefix apps/api --ignore-scripts
npm ci --prefix web --ignore-scripts
python3 scripts/release-checks.py
npm --prefix web run devConfigure service-local gitignored environment files from examples. Never place signing keys in frontend variables. See deployment plan, stable hosting preparation and browser acceptance commands. Transactions, public infrastructure changes and pushes require review and specific approval.
Run npm run release:verify from a normal network/port-enabled terminal for evidence-preserving local, RPC, fork and browser checks. This command never signs, broadcasts, deploys or publishes. It distinguishes fixture/fork checks from pending live runs.
The latest local regression checks are in gap-closure checks. Four acceptance-runner tests also pass. Gap-closure report and blockers. The human laptop acceptance run passed the production build and executed browser fixtures: 35 passed, 5 failed, zero skipped. Four alert-selector failures and a homepage contrast issue have source fixes pending rerun. ENS fork compilation passes, but RPC HTTP errors blocked execution in that run. Current project summary. New monitor, verifier and wallet tests explicitly use fixtures.
npm test
forge test --root contracts --offline -vvv
npm --prefix apps/api run test:world-fixtures
npm --prefix packages/shared test
npm --prefix web run lint
web/node_modules/.bin/tsc --project web/tsconfig.json --noEmit
python3 scripts/secret-scan.py --self-testThe paper and its build package are described in Research draft. Application tests and manuscript compilation are separate checks.
Official ENS requirements accept Sepolia for Best Use of ENSv2 and require a functional live demo and accessible source. The separate Continuity integration category requires mainnet. Track mapping records Whitechain Operate/Scale and World requirements. Universal gasless onboarding is not implemented; treasury setup still costs gas. No award, endorsement or eligibility determination is claimed.
Prior work: supplied chupke and EzPayz-derived code were recorded as removed/rewritten; generic starter configuration and provenance appear in the inventory. Creation dates, rights and event eligibility require author confirmation. Git dates alone do not establish originality. No project-wide license grant is inferred; dependency licenses remain applicable.
AI assistance: OpenAI Codex assisted with implementation, debugging, tests, coordinated review, evidence handling, literature discovery, diagrams and manuscript preparation. Human authors remain responsible for code, claims, references and distribution rights. No model is listed as an author.
Countersign: Transaction-Bound Agent Payments with Whitechain, World and ENSv2
A systems-security implementation and evaluation with balanced coverage of settlement, human authentication and delegated identity. The local revision contains 22 pages, 25 cited references and eight vector figures. It compiles from the packaged sources and has undergone internal visual review; that is not independent scientific peer review.
| Read | Reproduce | Inspect |
|---|---|---|
| Research PDF | Build instructions | Quality report |
| Prepared Zenodo bundle | LaTeX source archive | Three-protocol revision |
Gas figures are single-case local mock-token call-region measurements, excluding intrinsic gas, setup, network fees and human time. They are not Whitechain mainnet/public-testnet benchmarks. Historical measurements and test checkpoints remain distinct from later application runs; no new cryptographic primitive is claimed.
The project owner supplied Zenodo record 24025815. Its deposited file/version was not independently retrieved in this pass; the balanced local revision has not been uploaded by this agent. Publication status records that distinction. No arXiv submission occurred.
Displayed author: Somesh S. Talligeri, subject to final contributor consent, author order, rights, separate manuscript licensing and scientific sign-off. Related work.
Maintainer profile: SomeshTalligeriDEV. This identifies the GitHub project owner; manuscript author order and contributor consent are separate publication decisions.
Suggested GitHub topics:
whitechain world-id ens ensv2 ethereum solidity agent-identity
stablecoin-payments delegated-authorization eip-712 erc-1271
security-research reproducible-research ethglobal
These are discovery labels, not sponsor endorsements, release tags or certification. Repository description and topic settings are prepared locally. Public GitHub metadata and the remote branch have not been changed by this documentation update.
Seven-slide PowerPoint · PDF · Offline deck and notes · Original transparent logo.
The seven-slide manhwa-inspired deck explains the problem, architecture, ENS permissions, automatic payment journey, World checkpoint, security checks and evidence. Editable labels and diagrams sit alongside original illustrative artwork. Whitechain, World and ENS receive equal architectural attention. Illustrations explain the story; they are not product screenshots or live-chain evidence. The notes distinguish current local tests, historical transactions and open verification gaps.
Preview the seven-slide presentation
Illustrative artwork, not application screenshots or proof of live execution. See the slide notes for sources and limitations.
Identity through ENSv2. Human authentication through World. Financial enforcement through Whitechain.