Mithra
Confidential Agents

One intent, signed once.
Sealed in a TEE,
verified on-chain.

Alice and Bob discover each other through a public registry, then keep the deal private — task, payment, and output bound to a single signed intent. Scroll to follow the proof.

Explore the demoRead the spec
I — Discovery & intent
II — Sealed execution
III — On-chain verdict
Scroll
The problem

Payment, execution and reputation are each solved for agents, but nothing connects them.

We carry one signed intent hash from payment, through the enclave, to reputation — intent-bound verification.

How it works

From strangers to settled, without ever meeting.

  1. 01

    Discover

    Alice finds Bob through the public ERC-8004 registry — skill, endpoint, and encryption pubkey. No prior relationship required.

  2. 02

    Encrypt & pay

    The brief and data are ECIES-encrypted to Bob's pubkey. Alice signs an EIP-712 intent hash and authorises an x402 payment — signed, not yet submitted.

  3. 03

    Verify

    Bob recomputes the hash and signs the match. Verifier.sol recovers both signatures — Alice's intent and Bob's binding key — before a cent moves.

Architecture

One intent. One verdict.

Follow the thread. Every stage checks the one before it, and nothing settles until the chain agrees.

01

Human intent

Alice commits to exactly one job — brief, data, constraints, price — and signs it before a single byte moves.

Client · EIP-712
02

Sealed inference

The intent hash rides at the top of the prompt into 0G Sealed Inference, and the model copies it back verbatim. The infra never sees the data.

0G enclave
03

Cryptographic receipt

0G's enclave signs the fingerprint of the raw response body — the body that carries the echoed hash. One changed byte and the signature stops matching.

0G TEE signature
04

On-chain verifier

Verifier.sol recovers Alice's intent signature and the enclave signer independently, and refuses anything where match is false.

Base Sepolia · Verifier.sol
05

Blockchain execution

Only after JobVerified is emitted does payment settle. The verdict is public; the work behind it never was.

Settled after verification

Base is the verdict · Hedera the timeline · The Graph the read layer · 0G the compute

One enclave, not two. 0G attests the compute and carries the intent through it. The recompute that decides match runs on an ordinary host — no TDX was available to us — so that check is verifiable by the client holding the response, not yet by a stranger. That gap is the whole delta, and nothing else in the pipeline changes.

Verification

Watch an intent become a verdict

An illustrative walkthrough of the same checks Verifier.sol performs on-chain — no wallet, no network call, just the shape of the proof. Step through it yourself.

Intent

Confidential analysis job — signed, encrypted, priced.

Signeralice.eth
SchemeEIP-712
Intent hash0x9f3a…c02e
The fraud path

Substitute the job. Watch it bounce.

The binding catches task substitution and input tampering. Flip the switch and the contract stops agreeing.

Bob answers the job Alice ordered.

Alice signed0x9f3a…c02e
Bob recomputed0x9f3a…c02e
matchtrue
JobVerified
emit JobVerified(intentHash, outputHash)

Settlement releases.

Illustrative values · the same check runs in Verifier.sol on Base Sepolia

Tracks

Three networks. Three jobs. No overlap.

The compute

The model runs inside a TeeML enclave, and the enclave signs its own output. We bind that output to Alice's intent — we did not build the TEE.

  • @0gfoundation/0g-compute-ts-sdk
  • Sealed Inference
  • TeeML

The read layer

A fork of the agent0lab subgraph, deployed live to Subgraph Studio: it indexes the ERC-8004 registry for discovery and JobVerified for verified-delivery count.

  • ERC-8004 registry
  • JobVerified
  • Subgraph Studio

The timeline

x402 exact-scheme payment through the blocky402 testnet facilitator, settled only after verification. HCS records the off-chain timeline as commitments — autonomy, not privacy.

  • @x402/hedera
  • blocky402 testnet
  • HCS