averray-agent/agent

This repository contains a greenfield implementation of an agent-first treasury and job runtime:
- Foundry contracts for account, escrow, policy, strategy registry, and reputation
- A shared service layer exposed through HTTP and directory-safe MCP discovery
- Discovery and indexing scaffolds for later hosted deployment
Launch posture and trust documents:
- Production readiness checklist
- Threat model
- No token statement
- Week-12 bootstrap gate
- Product-proof gate
- Arbitration migration
- Dispute reason-code registry
- Service token operator pack
The mcp-server workspace currently uses a JavaScript runtime source tree. There is no parallel TypeScript build step to maintain.
Development setup
After cloning, install the git hooks once so staged commits are scanned for
accidentally-staged .env files and private-key-shaped strings:
Run the full test matrix locally:
CI runs the same four jobs on every push to main and every PR via
.github/workflows/ci.yml.
Multi-agent branch start
Before any agent starts new work, create its branch through the guarded helper:
The helper fetches origin, switches local main to the latest
origin/main, fast-forwards only, then creates the new branch. This keeps each
agent from starting work on a stale local main.
Local deployment flow
1. Start a local Anvil chain:
2. In another terminal, deploy and configure the contract suite:
3. Export the addresses returned by the deploy script and write a server env file:
4. Start the service:
The HTTP adapter will use live on-chain reads and signed writes whenever the env file contains a valid RPC URL, signer key, and deployed contract addresses.
The live API now also exposes a push-only SSE stream at /events behind the app proxy as /api/events.
If you want durable sessions and verifier results, also set:
Without REDIS_URL, the service falls back to in-memory state for local development.
Pimlico / ERC-4337 gas sponsorship
The hosted API can now expose a minimal Pimlico-backed gas sponsorship surface when these env vars are set:
Once configured, the HTTP server exposes:
- GET /gas/health
- GET /gas/capabilities
- POST /gas/quote
- POST /gas/sponsor
These endpoints are intended for ERC-4337 user operation quoting and sponsorship. They do not replace the current direct signer flow yet; they add the hosted gas-management path so the platform can evolve toward smart-account execution.
To verify Redis-backed resumability across separate runtimes:
That check creates a session in one runtime, verifies it, then loads the same session/result through a second runtime to prove persistence.
End-to-end local demo
With Anvil running and mcp-server/.env.local populated, run:
The demo mints mock DOT, deposits into AgentAccountCore, creates a funded job, claims it as a worker, submits work, resolves escrow through the verifier role, and checks that payout plus SBT minting completed.
End-to-end remote demo
To run a real hosted-stack smoke test against the production-like API:
When REMOTE_E2E_PRIVATE_KEY is set, the script runs the full SIWE sign-in
flow — POST /auth/nonce → personal_sign → POST /auth/verify — and uses
the returned JWT on every protected call. Against a AUTH_MODE=permissive
deployment you may instead supply only REMOTE_E2E_WALLET and skip signing.
That script:
- checks live API health
- signs in with SIWE (when a private key is provided)
- creates a unique remote job via /admin/jobs
- claims it
- submits work
- runs verification
- confirms the session appears in hosted history
Authentication
Protected routes require a signed-in JWT issued via Sign-In with Ethereum
(EIP-4361). The flow:
Subsequent requests pass the token as Authorization: Bearer . For SSE
endpoints (/events) the token goes as ?token=... because the browser