The data agent's live leash.policy cap is 5 USDC (raw 5000000, 6 decimals).
How verification works · Sepolia + Hedera testnet
How LEASH works, and the evidence.
LEASH puts a spend-control plane around agents you already run. The facilitator LEASH runs reads the org’s ENS-declared policy before it settles a payment, Hedera x402 settles it gas-free, and Privy is the independent rail on funding. The chain stores the policy and the revocation; it does not itself stop a payment. Every statement below points to a resolvable on-chain record, recomputable with npm run verify:claims.
Deployed contracts
sandboxRegistry0xB45830aeaf0A00367A450635a110cffA6878A679
policyResolver0xdC460cd7151D679CF5D1e34595e1ac890A5E4978
orgParentRegistry0xb36e0ede0Ed38653c5aB8222B409a6b2Ba78b409
What each integration does
Three integrations carry the spend-control plane. Each card states what an integration does and links to the resolvable on-chain record behind it.
ENS
ENS holds the org policy on-chain. The facilitator reads it before it settles a payment, and one on-chain write clears it to cut an agent off.
The payments agent's live leash.policy cap is 25 USDC (raw 25000000, 6 decimals).
Revocation is a real Sepolia transaction: clearPolicy on the data agent removes its leash.policy record on-chain (the org kill switch).
On-chain-resolved external-identity binding: register resolves the ERC-8004 owner live via the canonical Sepolia Identity Registry (0x8004A818BFB912233c491871b3d84c89A494BD9e) and writes agent.erc8004 (CAIP) + agent.address; a mismatched owner errors and does not register. Labeled on-chain-resolved, NOT verified (ownerOf is not proof-of-control).
PENDING — Group V / VM-3
Hedera x402
Hedera x402 settles the payment gas-free for the agent and writes every ALLOW or DENY decision to an immutable HCS audit topic.
Hedera x402 settlement is gas-free for the agent: the agent (0.0.10497601) pays 0 HBAR gas while the facilitator fee-payer (0.0.10487802) covers the tx fee (native x402 fee-payer scheme). The agent is only debited the 3 USDC transfer.
Every gate decision is written to an immutable HCS audit topic: an ALLOW (seq#1) and a DENY OVER_CAP (seq#2) are both on-chain.
A co-signed, in-cap x402 pay SETTLES on the 2-of-2 KeyList[agentPub, leashCoSignerPub] threshold-2 spending account: the agent's 1-of-2 plus LEASH's post-gate co-signature produce a real Hedera settle tx. Control = TRUE, facilitator-trusted co-sign, NOT chain-enforced trustlessness.
PENDING — settle txId lands from agent/vm3.live.ts (Group V)
Agent-alone cannot spend: the agent's valid 1-of-2 payload submitted WITHOUT LEASH's co-signature yields NO settle and a clean MISSING_COSIGN gate reason, never a caught Hedera INVALID_SIGNATURE.
PENDING — Group V / VM-3
Operator/LEASH-alone cannot move the agent's funds: LEASH holds only LEASH_COSIGNER_KEY + the agent's PUBLIC key (never agentPriv, SR-1), so an operator+cosigner-only move does NOT settle. Facilitator-trusted, NOT trustless.
PENDING — Group V / VM-3 + facilitator import-graph
Rolling daily/weekly cap DENY (SOFT budget): with dailyCap/weeklyCap declared, a pay that pushes the rolling ALLOW total (HCS via mirror, windowed by consensus_timestamp) over the cap returns OVER_DAILY_CAP/OVER_WEEKLY_CAP and does NOT settle. Soft budget on a lagging mirror index — NOT trustless/exact/settle-authoritative; worst case approx C x maxPerCall under concurrency.
PENDING — Group V / VM-3
Outside-window DENY: with allowedWindows declared, a pay whose mirror consensus_timestamp falls outside the window returns OUTSIDE_WINDOW (stateless gate) and does NOT settle.
PENDING — Group V / VM-3
Mirror-down => RPC_ERROR DENY (fail-closed): when a cap is declared and the mirror node is unreachable, spend-rollup throws (never defaults to 0), so the pay ABORTS with RPC_ERROR and NEVER settles — a dropped/unavailable index cannot silently un-cap.
PENDING — Group V / VM-3
Privy
Privy is the independent funding rail. It funds the account and fails an over-fund closed before it goes out.
The Privy funding rail fails closed: an over-fundingCap transfer from a P-256-owned treasury returns FUNDING_DENIED (Privy policy_violation) with no txHash, before broadcast.
in-cap transfer ↗over-cap FUNDING_DENIED returns no txHash by design (fails closed pre-broadcast)
ENS agent identity (advisory)
Each agent child carries advisory ENS text records alongside its enforcement record leash.policy: agent.type, agent.description, avatar, and an optional erc8004 pointer. These are for humans and directories only. The facilitator’s enforcement path imports no identity reader (INVARIANT #13, asserted by an import-graph test), so identity can never change a spend decision. Live on each card in /demo and /app.
Govern existing agents
LEASH binds agents that already exist and puts a spend-control plane around them. Each property below is honest about its boundary: LEASH co-controls spend, but the limit is enforced by the facilitator LEASH runs deciding to co-sign. The chain stores the policy, it does not itself stop a payment.
2-of-2 co-signed spending account
The agent holds one Hedera key, LEASH the other. The agent alone can’t spend (
MISSING_COSIGN); LEASH alone can’t move the agent’s funds. It never holds the agent’s private key. Facilitator-trusted co-sign.On-chain-resolved external identity
Register resolves an ERC-8004
agentId/ EVM address against the Identity Registry (0x8004A818…) and writes advisory ENS records. Labeled “on-chain-resolved”, not “verified”.ownerOfis not proof-of-control.Rolling & window limits
Rolling daily / weekly caps (
OVER_DAILY_CAP/OVER_WEEKLY_CAP) and a stateless UTC time-window (OUTSIDE_WINDOW). The rolling caps are soft budgets over the lagging HCS mirror index; the per-call cap stays the hard bound.
Full write-up: submission/proof.md. Machine ledger: docs/pipeline/claims.json.