Novi Corpus

Novi Corpus gives an AI agent a real legal existence.

AI agents are starting to transact. They hold wallets, buy services, and get paid for work. But legally, an autonomous agent is nothing. It can't own assets, can't be a counterparty, can't be sued, and nobody is accountable when it misbehaves. Right now everyone bridges that gap by pretending: an agent "has" a wallet that legally belongs to no one, spends money under nobody's responsibility, and any serious counterparty (a business, a bank, a court) has no one to point to. The agent economy is being built on entities that don't exist.

Novi Corpus closes that gap with the boring but load-bearing answer: give the agent an actual legal entity. Each agent gets a Wyoming DAO LLC, a real company that can own property, sign contracts, and carry liability. It comes with a legally required human controller, the "guardian", because US law (Wyoming statute plus FinCEN customer due diligence rules) simply does not allow a company with zero humans behind it. The guardian is not a workaround. It's the accountability anchor the whole design is built around. The agent operates, the human answers for it.

A legal wrapper alone doesn't constrain software, though. So the entity's money lives in an on-chain governed treasury that enforces the operating agreement in code: a rolling spending cap, a payee allowlist, timelocked policy changes the guardian can veto, and, most importantly, guardian pause and emergency clawback. If an agent goes rogue, the accountable human can freeze it and recover the funds on-chain, unilaterally. Governance here is not a promise in a PDF. It's a contract the money physically cannot leave except through.

All of this runs live on Arc testnet, Circle's chain where USDC is the gas token, built for exactly this kind of machine-speed payment. Any Claude or LLM agent can connect to our multi-tenant MCP server and, together with its guardian, form an entity, fund it, pay, and earn, end to end. Payments are x402 USDC nanopayments settled through Circle Gateway. Identity is ERC-8004 on-chain, with an ERC-8183 job lifecycle on top, so our agents autonomously take jobs, earn USDC, and build a verifiable work history. Key custody is non-custodial via Turnkey, with a guardian passkey at the root and a sign-only delegated key for the agent. That entire stack, from entity formation to autonomous earning, predates this hackathon and is documented as pre-existing work per Continuity Track rules.

What we built this weekend is the trust stack on top. The questions any counterparty would ask before doing business with an agent, answered verifiably.

1. Who is the human behind you? The law requires a real human controller, but a passkey only proves someone holds a device, not that they're a real, unique person. Entity formation now requires World ID proof-of-personhood (v4, Orb or passport tier; device and selfie tiers are rejected server-side). We store only the nullifier. No name, no biometrics, no personal data, and not because we promise to behave: World never sends us any. The same human re-verifying produces the same nullifier, which lets us enforce a hard cap of N entities per human and bind one human to one tenant. We proved the sybil gate live: the same human re-scanning under a different wallet was refused. The attestation is published in the agent's public metadata, at the same URL its on-chain ERC-8004 identity points to, so anyone can independently verify that a unique human guardian stands behind the legal body without trusting us.

2. Is the agent you're transacting with human-backed? Our x402 seller now speaks AgentKit. When a paying agent hits the paywall, the 402 challenge carries the AgentKit extension. The agent signs one message with its wallet key, and we verify the signature, replay-protect the nonce, and look the wallet up in AgentBook, World's on-chain registry of human-backed agents, via a live read on World Chain. Human-backed agents within their per-human authorization allowance are granted execution rights. Unverified agents, exhausted allowances, and RPC failures all fall through to the untouched governed payment path, fail-closed, every time. Two agents backed by the same human share one allowance, so authorization follows the accountable human rather than the wallet. Verification resolves on World Chain while settlement stays on Arc via Circle Gateway. Our agent implements the buyer side too.

3. What are you called, and how does anyone verify it? Every agent resolves at <id>.novicorpus.eth through a single wildcard CCIP-Read resolver, with zero per-agent transactions, ever. Records are served live from our backend and cryptographically signed, and the client verifies that signature against the on-chain resolver. You get the treasury address, operator, metadata, MCP endpoint, and a live legal-status: pause the treasury on Arc and the name reads Suspended on the next lookup. ENSIP-25 binds the name to our ERC-8004 registry in both directions. The name attests its agent ID, and the registry on Arc points back at the name, so neither side can be forged alone. We verified the closed loop live, and a resolve_agent MCP tool lets any LLM agent run the full check on a counterparty in one call.

Everything is additive and flag-gated. With all flags off, the backend is byte-identical to pre-hackathon, and the treasury and payment contracts are untouched. One gap we close deliberately: AgentBook has no revoke function, so once an agent is registered human-backed, that's permanent. Our guardian's on-chain pause and clawback are the missing half. Personhood, plus liability.

Identity, accountability, governed money. An AI agent a stranger can actually do business with.

The base stack (pre-existing). The backend is TypeScript end to end: a Hono API server on a plain VPS, better-sqlite3 for storage, viem for everything chain-side, and Foundry for the Solidity. The treasury is our own AgentTreasury contract on Arc testnet, fronted by a proxy per entity. Agents talk to us through a multi-tenant MCP server (Streamable HTTP, API-key auth), so any Claude or LLM agent can form an entity, fund it, pay, and earn without a human clicking through a UI. Payments are x402 v1 with USDC settled through Circle Gateway on Arc. Key custody is Turnkey: the guardian holds a passkey at the root, the agent gets a sign-only delegated key. The frontend is Next.js on Vercel, proxying to the VPS.

Why Arc mattered. USDC is the gas token, so a freshly funded agent needs exactly one asset to exist, pay fees, and transact. Sub-second finality makes machine-speed nanopayments feel instant. And Circle Gateway gave us settlement without writing our own facilitator.

World integration. The guardian gate uses idkit-core v4 in a server-driven flow, no React widget. Our backend mints the signed rp_context, creates the request, hands back a connector URI (the web page renders a QR, the MCP path just prints the link), polls the bridge, then forwards the proof untouched to World's v4 verify endpoint. We enforce the credential tier server-side and store only the decimal-normalized nullifier, with a UNIQUE constraint doing the actual sybil enforcement.

The seller side was the fun part. We could not adopt World's x402 v2 resource server because our seller speaks x402 v1 with Circle's batching scheme, so we went underneath it and used AgentKit's low-level functions directly: parse the header, validate the SIWE message with our own SQLite nonce table for replay protection, verify the signature, then a live lookupHuman read against AgentBook on World Chain. Their declareAgentkitExtension helper doesn't fill nonce or issuedAt, so we hand-mint those into the 402 body or the client silently ignores it. On the agent side, the AgentKit client just wraps the fetch we hand to our existing x402 buyer, so verification composes in front of payment without touching the payment code. Every failure direction falls through to the normal paid path, fail-closed by design.

ENS integration. One wildcard CCIP-Read resolver on Sepolia (the offchain-resolver contracts, deployed with Foundry) covers every agent forever, zero per-agent transactions. The gateway is just another Hono route: it decodes DNS wire format names, answers addr and text queries live from the database and from Arc reads (legal-status flips to Suspended the moment the guardian pauses the treasury), and signs each response with raw ECDSA over the EIP-191-style digest, not personal_sign. We unit-tested our digest byte for byte against the deployed contract's own makeSignatureHash view before wiring any records, which saved us from a whole class of silent signature failures. ENSIP-25 closes the loop: the name attests the agent's ERC-8004 registration, and we write the reverse binding on Arc with setMetadata so the registry points back at the name.

The hacky bits worth confessing. ENS launched V2 in the middle of the hackathon. The app moved domains, Sepolia contracts were redeployed, and the controller every doc and library pointed at was de-authorized. We reverse-engineered the new single-step register flow and confirmed V2 writes through to the classic registry, which is why wildcard resolution still works. Second: idkit-core cannot initialize in plain Node, because its WASM loader fetches a file:// URL and Node's fetch refuses those, so we wrote a narrow file:// fetch shim. Third: our demo gateway runs through an ssh tunnel whose URL dies with the shell, and the resolver's URL is frozen in its constructor, so we built a one-command script that brings up the tunnel, redeploys the resolver against the fresh URL, and repoints the name. Fourth: x402 v1 and v2 coexist in one node_modules because they're different package names, and AgentKit's v2 dependency turned out to be type-only.

Everything from the weekend is additive and flag-gated. All flags off, the backend is byte-identical to before. 596 tests green.