Mithra

Alice and Bob are real agents: their own ERC-8004 identity, their own wallets, and a decision layer that chooses who to hire and whether a price is worth paying. A refusal ends the job and no money moves. That autonomy is walled: the deliverable always runs in 0G, the decision layer never sees a private key, and every decision is re-checked so it can only narrow an outcome. A confused or prompt-injected agent can refuse to trade — it cannot overpay, invent a counterparty, or make an invalid job verify.

What we do not claim: this is not Sybil-proof reputation (inflating it is expensive, not impossible), it does not solve prompt injection (it catches task substitution and input tampering), and we did not build the TEE — 0G did. Most importantly, no TDX host was available to us, so the match check itself runs in unattested code. The client can verify it independently; a stranger cannot yet. That gap is one sentence wide, and with our own attested enclave the recompute would sit inside the seal and nothing else in the pipeline would change.

TypeScript pnpm monorepo, Solidity via Foundry, Next.js dashboard. Four networks, deliberately non-overlapping: Base is the verdict, Hedera is the timeline, The Graph is the read layer, 0G is the compute.

0G Sealed Inference (@0gfoundation/0g-compute-ts-sdk) runs the actual deliverable — the model runs where neither Bob nor the infrastructure sees the data. Getting the TEE signature to verify took measurement rather than assumption, and the two findings are the most useful things we learned. First, the signature does not cover the output text: it covers a pipe-free, colon-joined tuple containing sha256 of the RAW response body. We found this by hashing every candidate against each digest until only the raw-body sha256 matched. The consequence is a real trap — you must hash the raw bytes, because a JSON.parse -> JSON.stringify round trip depends on key order and breaks silently the day the provider reorders fields. Second, chatID comes from the ZG-Res-Key response header, not completion.id; the latter returns chat_id_not_found. We also require teeSignerAcknowledged === true, since TeeML alone is necessary but not sufficient — when it is false, the signer address is the provider's own unvouched claim.

The Graph indexes the ERC-8004 registry plus our own JobVerified and JobRejected events. This is the piece we are happiest with: reputation with no reputation contract, no review UI, and nothing a user can type. verifiedDeliveries can be moved only by a JobVerified event and rejectedAttempts only by JobRejected, so a fraud attempt is permanently visible exactly where hiring decisions get made. Alice is never given an address — discovery is load-bearing, not decorative.

Hedera carries the lifecycle: @hiero-ledger/sdk TopicMessageSubmitTransaction writes commitments only (stage names, hashes, flags — never brief, data or output), and the dashboard reads the timestamps back from the public mirror node rather than displaying our own clock, because a timeline timestamped by the machine that wrote it proves nothing. Payment on that rail is @x402/hedera exact scheme via the blocky402 facilitator. Delegated signing keeps the payment key in a separate signer and out of agent context entirely.

Base Sepolia holds Verifier.sol, which recovers both signatures and requires match == true. The seal signature has a sharp edge: it is 64-byte R||S with v discarded by the wrapper, so we brute-force v over {27,28} off-chain and pass it into the contract. The fraud path uses a lenient entry point that does not revert — it emits JobRejected instead, so the transaction succeeds on Basescan and the subgraph can index the rejection. A reverted transaction would have made the most important moment of the demo invisible to the indexer.

Two things are genuinely hacky and worth naming. Level 0 intent binding: with no TDX host we could not put our recompute inside an attested enclave, so instead we moved one end of the binding into 0G's real enclave. The intentHash is placed at the top of the prompt, the model copies it verbatim into its answer, and the TEE signs the digest of a body containing that answer. A genuine 0G enclave has therefore attested that a response carrying this specific intentHash was produced inside it — a chain Bob cannot forge on his own machine, because the first link is 0G hardware. We measured 5/5 verbatim reproduction and gate it in CI. The echo is checked against the raw output by our own code rather than by the compute backend, since a backend could otherwise claim it inserted the commitment.

Second, moving the ECIES boundary inside the enclave changed the shape of the fraud entirely. Bob can no longer decrypt Alice's brief, so he cannot edit it — his only move is to encrypt a payload he invented and substitute it. That is both the realistic attack and a much stronger story: answering the wrong job without even knowing what was asked.

The agents' decision layer runs Claude locally through the Claude Code CLI in headless mode, which means it authenticates with an existing subscription — no extra API key and no second provider in the stack. Three flags matter: --system-prompt replaces the default coding-agent prompt (measured ~15k tokens of context per call for a question whose answer is one boolean), --allowedTools "" means the brain thinks and never acts, and --strict-mcp-config stops it booting the repo's MCP servers for every judgement. The child process environment is also stripped of every secret, so "it was never given the key" is literally true rather than merely likely.

The dashboard makes all of this checkable: every hash, address, account and topic links through to Basescan, HashScan, 0G Chainscan or the subgraph endpoint. Values that genuinely have no explorer page render as plain text instead of a plausible-looking link — a judge who clicks one dead link stops believing the other nine.