Agent frameworks handle discovery, negotiation and messaging off-chain. Escrow lives on-chain. What is missing is the plane between them: proof that the work actually happened. This paper describes that plane — a block-header network reading 62 chains, committed under one cryptographic root, the six-layer proof format built on it, and the coordination primitives that let escrow release on evidence instead of expiry. Coordination here has a test, not a mood: it is the point where n independent parties must converge on one value. Below that point everything is aggregation — mechanical, per-chain, needing nobody’s agreement; above it everything inherits. The defensible gap, stated honestly for August 2026: proof-of-delivery is now a recognised, populated space — seller self-report, trusted arbiters, notarization, domain oracles — but no shipped system releases funds on a property of the delivery that the buyer can verify without trusting the seller, the facilitator, or a human. x402 built the escrow and left the release condition blank. We are the condition — and the only one that can see the other chain.
In 2026 two failures converged. In April, $292M left a liquid-staking protocol because a bridge's verification layer could not prove what it had verified — compromised RPC endpoints fed a verifier running a 1-of-1 configuration, and nothing in the system could distinguish a real attestation from a fabricated one after the fact. Roughly 47% of applications on that messaging layer were running the same single-verifier configuration when it happened.
Separately, autonomous agents began transacting at scale. Agent commerce protocols passed hundreds of millions in annualized volume, with escrow releasing on the judgment of a language model rather than on cryptographic evidence. A paid API call between agents is pay-then-pray: there is no refund path when the paid result is wrong, and no mechanism by which a third party can later reconstruct what was actually delivered.
These look like different problems. They are the same problem observed from two directions. In both cases a party is asked to believe a claim about something that happened somewhere else, and in both cases the infrastructure that should have produced evidence produced only assertions.
It is no longer true that this space is empty, and this paper does not claim it is. By mid-2026 delivery verification is attempted four ways: the seller attests their own work; a trusted arbiter (human or LLM) judges it; a notary timestamps it; a domain oracle scores it. Each releases money on trust in someone — the seller, the facilitator, or a human in the loop. The claim this paper defends is narrower and testable: none of the shipped systems releases funds on a property of the delivery that the buyer can verify independently. That property is what a coordination layer exists to produce.
Agent work and blockchain settlement operate on incompatible clocks. This is the central design constraint, and most agent infrastructure ignores it.
Work that outlives a block: discovery, negotiation, multi-day execution. Its natural unit is progress. It is unobservable to a contract, and its failure mode is silent stalling — a job that claims to be running and is not.
The moment value moves: escrow, release, dispute. Its natural unit is the transaction. It is fully observable but has no memory of anything that happened off-chain, and its failure mode is releasing against a claim nobody verified.
The seam between them is where value is lost. An SLA denominated in minutes cannot express a three-day job. An expiry timer is not a completion signal — it is a guess that the deadline meant something. And when a job is disputed, the two parties present competing narratives because no artifact exists that either could point at.
The coordination layer is the plane that spans the seam. It gives off-chain work an on-chain-verifiable heartbeat, and gives on-chain settlement an evidentiary basis for release. Concretely, two primitives:
A provider posts a hash of its state at a fixed cadence. Each checkpoint is committed into the root and returned with an inclusion proof. The job's whole history becomes an attestation chain any party can replay — so liveness is verifiable while the work is still running, not only when it ends.
# open a task (buyer agent) POST /v5/tasks {description, buyer_agent_id, sla_minutes} # prove progress (provider agent, hourly) POST /v5/tasks/{id}/checkpoints {payload_hash, sequence_n} → MMR proof # audit the run (anyone: buyer, evaluator, arbitrator) GET /v5/tasks/{id}/attestation → full checkpoint chain
The deliverable event is proven into the root, and the resulting proof blob is what releases escrow. The contract does not trust the provider, the buyer, or an oracle — it verifies a commitment it already holds. A dispute then produces an evidence bundle: the delivery trace plus the event proofs, which an arbitrator reads rather than adjudicating between two stories.
Block headers stream from each covered chain into a collector, batch into 2048-block twigs, and roll up into per-chain Merkle Mountain Ranges. Those per-chain roots merge into a single superroot, recomputed every ten seconds. One commitment covers every chain simultaneously, so a proof about any covered chain is a proof against the same value.
The leaf is a twig root. A leaf of a per-chain MMR is the root of one 2,048-block twig — an always-perfect subtree — not an individual header. Headers prove into their twig (11 siblings, log₂ 2048); twig roots are what the mountain range accumulates. This is the only reading under which the two-level structure documented here exists, and it is what L4 of the proof format means.
Append-only, as a named property. The structure only ever extends: an appended leaf is never rewritten, and growth changes peaks, not history. A challenge in the attestation game retracts an attestation about a root — it never rewrites an appended leaf. The property is executable, not rhetorical: the reference model’s assertion suite (27/27 passing) includes append-only checks under growth, and the same property is asserted for the production MMR as the load-bearing invariant of the design; the merge into the superroot is a binary Merkle fold whose measured depth is 6 siblings, which is why a sibling path exists at all.
One collector is an instrument; a swarm of them is a network. The swarm design — from the original protocol whitepaper (v2.0, March 2026) — answers the question a single-operator root cannot: how do many independent operators produce one canonical commitment without a coordinator, and without wasting each other's work?
The naive design elects one submission — the "best" spinner's superroot becomes canonical, and every other operator's coverage is discarded. That design punishes specialization and throws away chains. The Taifoon rule is the opposite: the canonical superroot is the UNION of all submissions, selecting per chain the submission with the freshest blocks.
# three spinners, each covering what it is good at Spinner 1 {Eth, Arb, Base, OP} 1.0M blocks Spinner 2 {Eth, BSC, Polygon} 0.9M blocks Spinner 3 {Solana, Sui, Aptos} 0.5M blocks # elect-one design: canonical = Spinner 1 → BSC, Polygon, Solana, Sui, Aptos LOST # union design: canonical = UNION(S1, S2, S3) # per chain: freshest submission wins coverage = all 9 chains # every spinner's work counts
The consequences are structural: specialization is rewarded (a spinner covering only Polkadot-family chains contributes exactly what the union lacks), redundancy is the fault-tolerance budget rather than waste, and adding an operator can only widen coverage — never narrow it.
Submissions are bonded. An operator stakes to register; every superroot piece it submits carries a challenge window during which anyone can prove a block-hash mismatch with an MMR inclusion proof against a public RPC. Proven fraud slashes half the stake — half of the slash paying the challenger, half flowing to the honest-operator reward pool. Rewards weight by stake × accuracy × coverage-contribution: what you add to the union, not how loudly you submit.
Above the collection swarm sits the proof-generation swarm — synchronizers that turn root state into consumable proofs. Coordinating hundreds of them uses no message-passing at all: the root itself is the coordinator.
# deterministic self-assignment — no negotiation, no leader election protocol cluster_id = hash(mmr_root ‖ synchronizer_pubkey) mod num_clusters leader = argmin over cluster of hash(mmr_root ‖ pubkey) # per epoch: leader assigns jobs → members prove in parallel # → 2/3 quorum validates → cluster block published
Because assignment is a pure function of the current root, clusters re-form automatically every epoch: no coordination overhead, Byzantine tolerance of up to one third of each cluster, and horizontal scaling — more synchronizers means more clusters means more throughput, with redundancy minimized rather than multiplied. This is the same stigmergic principle as the agent plane: participants never negotiate with each other; they read one shared surface and act.
Every proof is a six-layer blob assembled against the live root. A verifier walks all six layers to answer one question — did this event happen, in this order, finally, on this chain? — without trusting the party presenting it.
L1 Superroot — the one commitment over all chains L2 ChainHeader — the block header the event lives in L3 SuperrootProof — Merkle siblings: chain root → superroot L4 BlockProof — twig siblings: header → its twig root (11, measured) L5 ChainEvent — the encoded tx / receipt / log itself L6 FinalityCommitment — PoS checkpoint, L2 output root, GRANDPA, …
L6 is the layer most systems omit, and it is the one that matters for settlement. Inclusion is not finality. A proof that an event is in a block says nothing about whether that block can still be reorganized away. Each proof therefore carries the chain's native finality signal — proof-of-stake checkpoints for Ethereum, output roots for OP-stack L2s, depth for Bitcoin, GRANDPA rounds for Polkadot-family chains — so a consumer contract knows the event is final by that chain's own rules rather than by a heuristic block count.
Superroots are anchored on Base, where any contract calls isKnownSuperroot(root) and verifyEncoded(blob). That is the on-chain half of the trust chain: the off-chain API assembles evidence, the on-chain anchor makes it checkable by a contract that trusts nothing else. Ten seconds is the recompute cadence — how often a fresh superroot exists. The cadence at which roots are anchored on Base is a separate, slower number that this paper deliberately does not state until it is measured (diligence register, flag 7); it is the anchor cadence, not the recompute rate, that bounds the rewrite window a verifier must reason about.
The hardest part of a multi-chain commitment is not collecting headers — it is that every chain has a different definition of final. A PoS checkpoint, a rollup dispute game, six Bitcoin confirmations, a GRANDPA justification and a Tower BFT supermajority are not interchangeable, and any system that flattens them into "confirmed" is lying by simplification. Taifoon's rule: the layer observes and indexes each chain's native finality — it never attests to finality itself. L6 carries the chain's own signal, encoded per family:
| Family | Chains (examples) | L6 payload — what the oracle actually checks |
|---|---|---|
| PoS checkpoint | Ethereum | epoch · quorum · finalizedBlockHash (Casper FFG, 2-epoch) |
| Rollup dispute game | Base, OP-stack ×8 | disputeGame addr · rootClaim · l2SequenceNo · gameStatus |
| L2 output root | output-root L2s ×5 | outputRoot · l1Block context |
| ZK validity | Linea, Scroll | verifiedRoot · keccak(root‖batch) · l1Block |
| Depth | Bitcoin, Gnosis + fleet ×19 | confirmation depth · anchor hash |
| BSC fast finality | BSC | finalized stateRoot · blockHash (set only after 2/3 BLS vote) |
| GRANDPA | Polkadot, Kusama, Moonbeam, Astar… | setId · round · justificationHash (live-verified CurrentSetId) |
| BoLD | Arbitrum, Robinhood Chain | assertion chain state |
| HotShot / BFT | Flow, HyperEVM, ApeChain, Espresso | viewNumber · quorumCertHash |
| Tower BFT | Solana | slot · bankHash · confirmedSlot (finalized commitment) |
| Instant | Monad, Sei | single-slot finality — tier-capped |
Whether a chain's L6 actually passes the on-chain oracle is measured, not assumed. The evidence base is a live sweep of all 62 registered networks, every payload judged against the exact TaifoonFinalityOracle rules and every L3 fold re-checked against the on-chain Merkle walk. The arc, dated:
# networks VERIFIED end-to-end (L3 fold MATCH + L6 oracle PASS) pre-deploy baseline 6–8 of 62 # zero passed the L3 fold first encoder tranche 34 of 62 encoder saturation 49 of 62 # every emitted type verifies somewhere GRANDPA + HotShot closed 55 of 62 # 2026-08-15, union and single-sweep
Each verified chain is demonstrable with one request — GET /api/v5/verifiable/:chain_id returns the full six-layer blob for that chain's freshest provable block. Real — re-verified at publication: Ethereum (PoS, type 0), Base (dispute game), Bitcoin (depth — a real leading-zeros hash in L2), and Polkadot (GRANDPA — setId, round and justification visible in the payload) all returned complete blobs against the same superroot, in the same minute. Four consensus families, one commitment.
Two operational details make the matrix durable: finality RPC endpoints are resolved through a curated, health-tested pool (the same Cloudflare-blocked relay endpoints that silently failed for weeks were root-caused and replaced with measured working ones), and last-good proofs survive restarts, so a pod cycle does not reset the verified set.
The layer is consumed three ways today, each reusing the same blobs.
An independent verifier that publishes what it checked: the RPC quorum consulted, the client build, and the root state at verification time. The April failure worked because verification was unobservable; a receipt-carrying attestation is auditable by construction. The design rule is refusal over guessing — when independent sources disagree, the correct output is no attestation plus an alert, never a majority vote on unequal evidence.
For fund-transfer jobs — the volume driver in agent commerce — an evaluator fetches the event proof for the claimed transfer and votes on cryptographic evidence rather than model judgment, earning a share of every job verified. This is dogfooded twice over: our own autonomous delivery agents anchor each real deliverable on-chain as a round whose proof hash is the deliverable's root, and a settlement-monitor agent runs a live bilateral integration with an external data provider, every cycle citing the superroot hash so a third party can reproduce the reasoning against live chain state.
Intent-based bridging settles when a solver fills an order. Attaching a receipt to each fill turns a solver's claim into an auditable record, and gives the institutional deployments whose compliance teams will ask for evidence trails something to point at.
x402's official auth-capture scheme holds funds and defines the deciding party as a socket:
captureAuthorizer — "the entity authorized to authorize, capture, void, refund, or charge… either the facilitator's EOA, or any smart contract that ends up calling the escrow (e.g., an arbiter contract with dispute logic, a multisig, etc.)."PaymentRequirements names exactly one network — pay on Base, do the work on Solana is not expressible in the protocol.
X402AssuredGate is a captureAuthorizer contract on Base that captures an auth-capture authorization if and only if a six-layer proof shows the agreed delivery event occurred on the delivery chain, bound to this specific payment. The payment never leaves Base; only the evidence crosses. The binding is a correlator the delivery event must carry — H("taifoon.x402.v1" ‖ nonce ‖ payTo ‖ chainId) — without which a gate can be pointed at someone else's event; the reference model's naive command demonstrates exactly that failure, and its adversarial suite (21/21 assertions, 0 of 9 attacks paying out) demonstrates the fix.
# the flow, condensed — buyer on Base, provider on any covered chain 402 PAYMENT-REQUIRED scheme: auth-capture · captureAuthorizer: GATE · extra.taifoon: PREDICATE AUTHORIZE # funds held in escrow — nothing has moved DELIVER # provider acts on the delivery chain, event carries the correlator PROVE # superroot folds the event; root anchored on Base CAPTURE | RECLAIM # gate verifies the blob + correlator → capture; no proof by deadline → buyer reclaims
captureDeadline — a deadline shorter than the delivery chain's window is a payment that can never be captured. Capture is bounded by the anchor cadence on Base, not the ten-second recompute cadence. And liveness failure favours the buyer, deliberately: if the evidence layer stalls, no capture happens and the buyer reclaims — the provider carries that risk, and the provider-facing docs say so in exactly those words.
The tag is Proposed, moving to Building as the gates below pass — each gate has a falsifiable exit condition.
| Gate | Scope | Exit condition |
|---|---|---|
| G0 | Predicate + correlator reference implementation | replay, substitution and wrong-gate attacks all fail in the adversarial suite |
| G1 | Gate on Base Sepolia against the real AuthCaptureEscrow, one delivery chain | a capture and a reclaim, both on testnet, both linkable |
| G2 | auth-capture server + facilitator support — absent from the SDK today | upstream PR or a published package that fills the gap |
| G3 | Three delivery chains live | three captures on mainnet, one per chain |
| G4 | Buyer client with gate allowlist · provider SDK emitting the correlator | an integration a third party completes without us in the room |
G2 is worth naming in any investor conversation: @x402/evm@2.23.0 exports an auth-capture client but no server and no facilitator. The scheme this design depends on is spec-plus-stub — a risk if someone else fills it, a moat if we do.
Most protocol game theory is a diagram. Taifoon's is an executable test suite: every payoff below is measured as an actual balance delta through the settlement contract — never assumed — and every theorem is fuzzed over 256 randomized (price, bond, detection-quality) triples per run, 72/72 passing in nine suites. The game, per side effect: price p escrowed by the buyer, bond b escrowed by the seller, referee detection quality q; seller moves Honest | Cheat | NoShow.
| Theorem | Statement | How it is proven |
|---|---|---|
| T1 · Deterrence frontier | E[Cheat] = q(−b) + (1−q)(+p) ≤ 0 ⇔ b ≥ p(1−q)/q | Fuzzed both directions: any bond above the frontier makes cheating negative-EV; any bond below leaves it profitable. The frontier is tight, not padded. |
| T2 · Honest nets exactly the price | Honest → seller +p, buyer −p; bond round-trips | Fuzzed over p ∈ [1, 10¹²], b ∈ [0, 10¹³]: equality, not inequality — no leakage anywhere in the path. |
| T3 · The victim is over-compensated | Slash → buyer net +b (price refunded, bond awarded) | Fuzzed: a cheated buyer always ends better than whole — deterrence pays the victim, not the house. |
| T4 · The game fails closed | Absent referee → timeout returns both sides whole | Fuzzed: silence steals nothing. A dead referee is an inconvenience, never an exploit. |
| T5 · Dispute rationality bands | truthful dispute rational ⇔ d < p + b | Computed at the live $0.50 dispute fee: see below. |
# shipped default: b = 10p — deters any referee catching more than 1 cheat in 11 q > 1/11 ≈ 9.1% ⇒ cheating strictly negative-EV # T5 at the live $0.50 dispute fee micro-call p = $0.008 → recovery p+b = $0.088 < $0.50 # disputes irrational → automated referee $1 band p = $1.000 → recovery p+b = $11.00 ≫ $0.50 # clears the fee 22× (≈95% of agent-payment volume) spam bound false dispute breaks even only if ε > d/(p+b) = 4.5% # proof referees sit far below
The same discipline extends to the capital layer: the underwriting suite proves on-contract that backing a book is a bet that premiums priced off the failure rate λ outrun claims driven by λ — backers win below the premium rate and lose above it, exits are cooldown-gated and priced at withdrawal, claim replay and forgery are blocked, and fund conservation is itself a fuzzed invariant.
Why this matters beyond security: the frontier is hyperbolic in q. Raising detection from coin-flip to proof-backed collapses the bond every honest participant must lock from 1× to 0.05× the payoff — a twenty-fold reduction in the capital cost of being trusted. Proof infrastructure is not risk reduction at the margin; it is what makes the market cheap enough for many parties to enter. Real — 72/72 in 9 Foundry suites; a demonstration Breach Market on the devnet lets anyone bet an SLA and watch the referee settle it against a proof.
A coordination layer must be cheap to join and expensive to corrupt. Those goals are compatible because the two halves of the system have radically different cost structures.
The principle: a language-model agent is required only where unstructured judgment enters the loop. Everything that collects, proves, meters, escrows or settles is deterministic software whose marginal cost rounds to zero once the machines are running. Revenue concentrates where judgment or capital is consumed.
| Lane | Agent needed? | Marginal cost | Treatment |
|---|---|---|---|
| Header collection · MMR · superroot | Never | ~$0 / block | Subsidized — community operators run it free |
| Proof serving · receipts | Never | ~$0 / proof | Subsidized per call; sold as subscription |
| Verifier attestation | Never | ~$0 / message | Per-message fee ≈ pure margin |
| Checkpoint anchoring | Never | fractions of a cent | Priced per task-day |
| Escrow · settlement | Never | gas only | The tested kernel |
| Referee — mechanical transfers, schemas, attestations | Never | ~$0 / verdict | Evaluator fee at ~100% margin |
| Referee — unstructured deliverable quality, disputes | Yes | ~$0.50–1.50 / verdict | Priced into the dispute fee |
| Delivery swarm | Yes | $0.57–1.50 / delivery | Priced per job; trials bounded |
| Solver bidding | Never | capital at risk | Software + capital, sized by the bond math |
A layer that referees other people's settlement must be able to answer who controls it. We treat that as a published artifact rather than an assurance.
Custody runs through a council vault with an explicit lifecycle — registration, infrastructure, seat allocation, funding, genesis — and a chain-verified ownership manifest served live, mapping every contract to its current owner. Assets built on the rail inherit that governance: a BTC-backed asset minted only against a full six-layer proof, and a finality-reward asset on the roadmap, both council-governed.
Measured against live production on 2026-08-16.
| Component | Status | Evidence |
|---|---|---|
| Header network | Real | 62 collecting live · 287.8M blocks under root (Σ block_count, 2026-08-21) · advancing live |
| Superroot | Real | one commitment over every registered chain · recomputed every 10s |
| Six-layer proofs | Real | all layers verified on Ethereum; single-digit-second response |
| End-to-end verified matrix | Real | 55 of 62 networks pass L3 fold + L6 oracle (union, measured 2026-08-15); GET /api/v5/verifiable/:chain_id — re-verified at publication in 4 consensus families |
| L2 provable window | Building | header retention being widened beyond the near-tip band |
| On-chain verifier + anchor | Real | verifier, superroot anchor and relayer deployed on Base |
| Protocol decoding | Real | 14 protocols decoded; 11 streaming live events |
| Long-haul checkpointing | Real | in production, priced per task-day |
| Settlement kernel | Real | 72/72 Foundry tests in 9 suites, fuzzed measured payoffs; demo contract live on devnet |
| Independent verifier role | Building | contracts + worker packaged; listing not yet submitted |
| Solver role | Proposed | designed against live auction interfaces; not deployed |
| Assurance gate | Proposed | first build item; specified, not shipped |
The consumption modes in §5 are technology. This section is the commercial ladder built on them, with each rung's cost stated next to its upside — including the one we decided not to build.
Agent trading is arriving on mainstream platforms — brokerages and exchanges of the Alpaca and Kraken class — and the platform, not the agent, carries the obligation to say what actually happened on it. That is a verification-layer sale where our technology is the whole product rather than a feature: receipt-carrying verification of agent activity, evidence trails a compliance team can hand to a regulator, and settlement that releases on a property of the delivery the account holder can verify. One platform integration reaches the hundreds of fintechs built on it and the millions of accounts they carry, and regulation is moving toward exactly this evidence standard.
The cost, stated: a 6–12 month enterprise sales cycle. That is longer than an unfunded company survives, which is why this rung and the raise are the same conversation.
Our own trading agent's real runs, each scored three ways: the agent's self-report, an LLM judge, and proof-based verification against the chain. We publish the divergence — including every run where our own bot looks bad under the honest method. It runs on infrastructure that already exists, costs days rather than quarters, and it is the credibility artifact nobody selling trust can copy: a vendor that publishes its own agent's failures under its own verification standard has nothing left to hide about the method.
A proof-backed score for agents makes us the reference point rather than a vendor, and only the party holding the root can compute it. It is sequenced after the first platform customer, not before: an empty scoreboard persuades nobody, and Agent Market Arena already occupies the unverified version of the idea. The differentiated version — scores that are proofs, not opinions — needs live customer flow to be worth reading.
Considered and cut. It spends engineering on engagement rather than on evidence, and neither the platform buyer nor the protocol integrator is moved by it. Listed here because a roadmap is also the record of what it declined.
Platforms are the distribution rung; agentic protocols are the native rail. x402's escrow gains its release condition (§5), agent-commerce settlement consumes evidence bundles instead of testimony, and every settlement mints a receipt back into the corpus. The lattice — the one Proposed layer — then turns the root itself from computed by one operator into agreed by many, at which point the coordination layer is not a vendor's product but a piece of infrastructure whose verdicts no single party, including us, can quietly change. That is the end state the ladder climbs toward: first the platforms buy verification, then the protocols build on it, then the layer outgrows its operator.