agent-contracts-examples

Runnable examples for the trustless-ai verification stack. Each example is zero-dependency and self-describing — the README explains what to run and why.

verify/ — recompute and verify proofs yourself, trusting nothing

The core claim of the stack: every verdict is recomputable from public data. These examples show you how to verify a single proof and how to re-derive the entire public ledger without trusting the issuer's API.

# verify one proof (zero deps, stdlib only)
python verify/invinoveritas_verify.py verify/sample_proof.json

# recompute the entire live ledger from public Nostr relays
python verify/recompute_ledger.py

# machine-readable output
python verify/recompute_ledger.py --json

invinoveritas_verify.py is byte-compatible with verifyProof in @trustless-ai/agent-sdk — both derive the NIP-01 event id via sha256(JSON [0, pubkey, created_at, kind, tags, content]) and verify the BIP-340 schnorr signature against the published key. Run both on the same proof to confirm they agree.

recompute_ledger.py fetches events from public Nostr relays (never the issuer's API), recomputes ids and signatures, and reports which entries independently verified. Entries older than relay retention can be verified via their Bitcoin OpenTimestamps anchor: ots verify -d <event_id> <event_id>.ots.

What these cover in the 5-layer stack

commitment  (ERC-8281)   — commit before outcome  ← truth-anchor/ example lives here
identity    (ERC-8004)   — who signed it
authority   (ERC-8312)   — what it was permitted to do
witnessed   (ERC-8299/8274, OURS) — recomputable verdict ← verify/ examples live here
settle-once (ERC-8275)   — conditional escrow on the proof

The verify layer is the trust anchor everything above depends on: escrow releases on a recomputable proof, not a claim.

recovery-receipt/ — verify an agent receipt on-chain, no oracle

The commit-before-outcome receipt end to end: build it with the SDK, sign it with the agent's own BIP-340 key (the SDK never signs), pack it into the exact calldata the verifier reads, and verify it on-chain — then re-derive the same artifact_hash with a zero-dependency recompute so the SDK itself is auditable rather than trusted. A drift between the two paths is fatal, not a warning.

# 1. local chain + deploy (issuer pinned to the agent's x-only pubkey)
anvil &
cd recovery-receipt/contracts
forge test                                   # 19 passing, incl. the official BIP-340 vectors
ISSUER_PUBKEY=<agent x-only> PRIVATE_KEY=<anvil key> \
  forge script script/Deploy.s.sol:Deploy --rpc-url http://127.0.0.1:8545 --broadcast

# 2. run the quickstart
cd ../app && bun install
AGENT_PRIVKEY=<same agent key> VERIFIER=<deployed addr> bun run quickstart.ts

Ends with valid = true | match = true and the two independently-derived hashes agreeing — release is gated on a recomputable proof, never on a claim.

source-binding-sovereignty/ — why "bare owner-equality" is non-conformant

ERC-8323 says isSourceNFTOwnershipValid MUST accept three ownership shapes (direct holder, the agent's canonical ERC-6551 TBA, or the binding contract) and that a literal ownerOf(source) == ownerOf(agent) check is non-conformant — it force-fails every sovereign agent. This example turns that sentence into a walk: one agent, one source token, four states, both rules evaluated at each.

cd source-binding-sovereignty/contracts
forge test -vv    # 8 passing; states 3 and 4 are where the two rules disagree

States 1-2 (held, then sold) agree — which is why the bug survives review. States 3-4 (source moved into the agent's own canonical TBA, then escrowed under the binding) diverge: conformant true, naive false. Also executable: the canonical account is pinned (a different implementation or salt is a different account), burned-source returns false while a non-existent agent reverts, honest ERC-165 advertising, and re-check-at-action-time.

truth-anchor/ — the ERC-8281 commitment anchor

TruthAnchor is the concrete commitment layer: a permissionless, storage-less record(bytes32) that emits Recorded(bytes32 indexed digest, address indexed committer). An agent action's attestation digest is committed on-chain; anyone reads the event back and recomputes the digest from public data — the event either matches or it doesn't. Deployed unchanged to Ethereum mainnet, Base Sepolia and 0G Galileo (addresses in truth-anchor/README.md); it's the anchor read live by the Recomputable Agents /verify page and indexed by The Graph.

cd truth-anchor
forge test   # unit + fuzz over record()/Recorded, incl. the canonical topic0 check

genesis-self-source/ — a self-sourced ERC-8004 agent registry

A worked reference for the self-source case of Source-Token Agent Binding (ERC-8323): an agent whose provenance source is the agent itself — getSourceNFT(id) → (address(this), id) — minted from scratch, no pre-existing NFT.

Its point is honest ERC-165: a self-sourced agent implements only the read side of source binding (no external collection to boundCollection / registerWithSource), so it advertises the query-only subset IAgentSourceBindingView (0x8b3597c9) and returns false for the full IAgentSourceBinding (0x27eba962) — the test asserts both directions. Advertise only what you implement.

cd genesis-self-source
git submodule update --init --recursive
forge test -vv      # 12 passing

Live + verified on mainnet: 0xe91934aB…4963 — check the honest claim with a single eth_call (see the example README).