Mithra

One confidential job, end to end

Payment is solved for agents. Execution is solved. Reputation is solved. Nothing connects them — nobody proves that the work you paid for is the work you ordered. Below, one signed intent is carried from payment, through the enclave, to reputation. Then we break it on purpose and let the contract say no.

The Graph · discovery

How Alice finds anyone at all

Alice is given no address. She queries the index by skill and ranks by deliveries a contract confirmed were genuinely the job the client ordered.

block 44,746,487
138
agents indexed
125
verified deliveries
74
rejected attempts
agentskillsverifiedrejected
8429top ranked
0x4f5cd2…fda326
market-analysis12574
8432
0x351c9f…ad7ed6
market-analysis00

Neither column can be written to directly — only the Verifier's events move them. That makes this reputation expensive to inflate, which is a different and smaller claim than Sybil-proof. We do not make the larger one. Query the endpoint yourself ↗

Confidentiality

What happened · what anyone can see

The same job, twice. On the left is the truth. On the right is every byte a chain observer gets.

waiting for a run

Run a job below and both columns fill from that one run.

Live · the thesis

Make Bob cheat

Payment, execution and reputation are each solved for agents. Nothing connects them. This button runs a real job where Bob answers something other than what Alice ordered — and the contract throws it out on chain, so the payment never settles.

Bob cannot decrypt Alice's brief — the key is in the enclave — so he encrypts a job he invented and sends that instead.

Payment rail

Autonomy and a consensus-timestamped trail: the agent quotes, is authorised and settles through the blocky402 facilitator, and every stage lands on HCS. The recipient is a plain account — this run buys no privacy.

This deployment holds no keys, so it cannot spend gas. — a genuine past run with a working Basescan link, clearly labelled as a recording.

The agents' own log lines appear here — the same ones `pnpm demo:base` prints.
Hedera · the timeline

When each step actually happened

Every stage of the job, stamped by Hedera consensus and read back from the public mirror node — not from our own clock.

Reading the topic…

    Verify it yourself

    Don't take our word for any of it

    Download the run and check it in a clean browser with nothing of ours installed. The bundle contains no verdict of ours — only the material to reach your own.

    Run a job below, then come back and check it.

    Proof · four networks

    How each piece is actually used

    One job touches four networks and each does a distinct job — Base is the verdict, Hedera the timeline, The Graph the read layer, 0G the compute. Every identifier below opens on that network's own explorer.

    0G Chainscan

    The analysis Alice buys runs inside a 0G Sealed Inference enclave, so neither Bob nor the infrastructure sees her brief. The output comes back signed by the TEE, and the intent commitment is carried through the enclave inside the signed body.

    @0gfoundation/0g-compute-ts-sdk · createZGComputeNetworkBroker → getServiceMetadata (TeeML) → /chat/completions → processResponse

    Provider we pinned (on 0G Chain)
    0xa48f0128…E67836
    Our compute payer — its ledger txs are on chain
    —
    TEE signature over the response body
    download the bundle to verif…
    Deliverable archive (0G Storage)
    —

    Subgraph Studio

    Alice is never given Bob's address. She queries the subgraph by skill and ranks candidates by deliveries a contract confirmed — and the same index records the fraud attempts, so cheating is permanently visible where hiring decisions are made.

    graph-cli · a subgraph indexing the ERC-8004 registry plus our Verifier's JobVerified / JobRejected events

    Query endpoint (POST the query yourself)
    https://ap…v0.0.3
    ERC-8004 identity registry
    0x8004A818…94BD9e
    Bob's agentId
    8429

    HashScan

    The job's whole lifecycle is timestamped by Hedera consensus — quote, intent, enclave, output, settlement — as commitments only. On the Hedera run the payment itself goes through x402 with the blocky402 facilitator, and settlement is refused unless the contract verified the job first.

    @hiero-ledger/sdk TopicMessageSubmitTransaction · @x402/hedera exact scheme · blocky402 testnet facilitator

    Consensus topic
    0.0.9738448
    Operator account
    0.0.9695366
    Bob's payout account
    0.0.9738447
    x402 facilitator
    https://api.testnet.blocky40…

    Basescan

    Base holds the verdict. The Verifier recovers both signatures — the enclave's seal and Alice's EIP-712 intent — and refuses the job unless they agree and match is true. Payment settles only after JobVerified, and on the Base run the recipient is a fresh ERC-5564 stealth address, so the payout does not name Bob.

    Foundry · Verifier.sol + IntentLib.sol · x402 over USDC · @scopelift/stealth-address-sdk

    Verifier contract
    0x3B116D64…FEEb96
    ERC-8004 registry
    0x8004A818…94BD9e
    USDC (payment asset)
    0x036CbD53…3dCF7e