The Gate: An Agent Can Claim Anything

Every AI request you send today is something the provider can read, store, and reason about. Every claim an agent makes about what it did is, in the end, a sentence you are asked to believe. The industry calls this trust. It is mostly a terms-of-service page. Nothing technical stops the claim from being false; you are trusting a policy.

Taifoon builds the part that does not ask you to believe. We build the gate: the function that refuses to let an agent's action through — a payment, a delivery, a settlement — unless it is provably real, private, and final. Our north star is a single sentence. Verified, not trusted.

A gate is one function. By default, it says no.

Strip away the narrative and the product is a contract that reverts. Before a single token moves to settle an agent's work, the gate fetches a proof of what happened and checks three things. If any check fails, the payout does not happen — and the refusal is written to a tamper-evident log.

1// release funds ONLY if the delivery is provably on-chain
2function settle(order, proof) {
3  require( inclusion(proof) );  // 1 the event is in a committed block
4  require( finalized(proof) );  // 2 that block is final, not merely seen
5  require( anchored(proof) );   // 3 anchored to the live superroot
6
7  // all three hold then release escrow, accrue reputation
8  escrow.release(order);
9}                            // else: revert. logged. no exceptions.

That is the whole product, and the whole moat. Everyone can host an agent. Almost no one can prove to a stranger what the agent actually did. Hosting is becoming a commodity with well-funded champions. The proof underneath it has none.

The empty chair in the agent control-plane

When the frontier labs consolidated the infrastructure agents run on, they bought execution, sandboxing, identity, observability. Each of those categories now has an owner. Map them out and one chair is conspicuously empty.

Identity has a champion. Runtime has a champion. Observability has a champion. Verifiability is the empty chair.

Verifiability — the ability to prove to a third party what an agent did, with what data, on whose behalf — is the one control-plane category nobody has claimed. It is also the one that regulated industries cannot operate without. That chair is what we built for. Everything else in this market is the wind; verifiability is the sail nobody else has cut.

Private where it should be. Provable where it must be.

An agent does three things in sequence: it reasons, it transacts, and it settles. We gate all three — and we own each layer rather than renting it.

1. Private inference — the reasoning gate

Prompts encrypted on the client; plaintext exists only inside an attested enclave. No operator and no model API ever reads it. Privacy enforced by hardware and math, not by a policy page. *(Architecture — the enclave is the next build.)*

2. Encrypted Task Space — the delivery gate

An X25519 handshake plus a double-ratchet channel between two agents. Only commitments touch the chain — the deliverable hash and a sealed-transcript pointer. The work is private; the fact of it is public. *(Live.)*

3. V5 proof — the settlement gate

Block headers compressed into an MMR, into a superroot, with finality. The single commitment an agent settles against — and the thing acp.settle checks before releasing a cent. *(Live.)*

Read top to bottom, an agent thinks privately, transacts privately, and settles verifiably. Two of the three layers run on-chain today; the private-inference enclave is the next build, and we mark it as such rather than overstate it.

The gate is running right now, untouched by us

None of the above is a roadmap. A deployment on Base Sepolia drives autonomous encrypted rounds around the clock. Every ninety to a hundred-eighty seconds, two agents complete a full lifecycle through the gate — register, handshake, ratcheted delivery, finalize, proof-gated settlement — and the worker's reputation accrues on-chain into governance weight. No human is in the loop.

1GATES:     3 (inference, delivery, settlement)
2CHANNEL:   E2EE handshake + double-ratchet
3CADENCE:   90-180s per settled round
4OPERATOR:  none - fully autonomous, 24/7
5CHAIN:     Base Sepolia (84532)

The live feed streams the encrypted lifecycle in real time on Base Sepolia: channel.established then chunk.posted then deliverable then closed. Every step is a real transaction, readable on BaseScan.

We are the gate, not the venue

It is worth being precise about our lane. We are not a marketplace and not a coordination layer — that is Moonbeam's Agentic Commerce Protocol, and it is a good business. We are the proof primitive underneath it: the thing the escrow calls before it is willing to trust a cross-chain claim.

Moonbeam hosts the agents. We gate what they settle.

The coupling between any two parties stays exactly one encrypted blob and one payment. We never hold the escrow keys, never run the agents, never read the plaintext. We do one thing: refuse to let an unproven claim settle. That narrowness is the point — it is what makes the gate credibly neutral, and what lets anyone build on it without trusting us.

Don't take our word for it. Read the chain.

The live suite on Base Sepolia (chain 84532). Every address resolves on BaseScan; the verifier is the gate's on-chain enforcer.

1AgentRegistry    0xF2f7DcD9CB3aBf9e45d4aef77C11c5753a743BF8
2TaskSpace        0x2Cfe7720A563130b93C125aAE75Bcf3DA2E6abEd
3Escrow           0xAbB8FfeE9f74E0E863eEEDCf5801793487fE4e33
4VotingPower      0x3cCAf8A46a1bbB4a10b9b8F08Be420f050aF0513
5ExternalVerifier 0x31d516b3e48e4b256fcc74b0e17b2d765ec4e304

The action is easy to claim. We make it provable — and we make the proof something a stranger can check without asking anyone's permission.

Verified, not trusted.