The agent
Architecture
Three model layers and one settlement core. One layer designs missions, one judges evidence, one talks to founders. They are split on purpose and do not share state. Underneath them, an on-chain vault computes every amount and enforces every limit — it is the only thing that can release funds.
Why three layers instead of one model
Because a single model that designs the work, judges the work and talks to the customer can be talked out of all three at once. Splitting them means a conversation cannot reach the layer that decides payouts, and a product page cannot reach the layer that decides whether a tester gets paid.
| Layer | What it does | What it is forbidden to do |
|---|---|---|
| Mission Brain | Designs missions from an inspected product — architect, then critic, then a deterministic validation gate | Ship anything the gate rejects. Its output is untrusted until it passes. |
| Payout Brain | Judges tester evidence and proposes pay, review or hold | State an amount. Ever. |
| Concierge | The conversational front door on Telegram and on the web | Do its own money arithmetic, or import the judging layer at all |
The concierge does not import the judging code, so no conversation can perturb the layer that decides payouts. The two share an LLM endpoint and nothing else.
Is there an agent loop running somewhere?
No, and that is deliberate. Autonomy here is a stateless gate with two triggers. A tester submits, and the decision pipeline runs once. Separately, an authenticated sweep re-evaluates pending work, settles matured approvals and pays operator fees on a short cadence, with a lock that makes overlapping ticks harmless.
The pipeline never throws for control flow. Any failure resets the work to pending so the next sweep picks it up — nothing is lost because a request died halfway through.
The settlement core
Each campaign has its own on-chain vault. The vault derives the exact reward from the funded budget, enforces the per-mission cap and the completion limit, rejects replays, and emits the settlement event that is the single source of truth. A model output is a recommendation arriving at a contract that has its own opinion.
The agent proposes. The vault disposes. That sentence is the security model, and it is enforced by a contract rather than by careful behaviour. See Settlement & proof.
The money path
The three layers above are the safety story. This is the capital story — what the system actually does to a dollar, from the moment work is claimed to the moment capital moves against the record it left behind. Each layer is live; follow any of them.
- WitnessThe agent reads the work and gathers its own evidence — in a real browser, on-chain, or from the artifact itself. It refuses what it cannot verify.every judgment, incl. refusals →
- ObligationA verified claim becomes a signed, capped obligation: this person is owed this amount, for this evidence. Rail-agnostic; deterministically compiled from the funder’s own words.how work compiles →
- VaultThe contract derives the exact amount, enforces caps and replays, and can say no. The agent proposes; the vault disposes.what the vault enforces →
- RouterRails are routes, not products: the public tape on GOAT, the private claim on Starknet — a worker collects to any address, including a shielded note — and a fiat adapter as the next door. The funder picks an outcome; the router picks the rail.the private route →
- RecordEvery discharged obligation lands on the earner’s verified work record — inflow, counterparties, tenure, refusal-tested — theirs to share, redact, or prove a floor from without publishing a figure.what a lender sees →
- Capital inThird-party capital advances against the record and repays itself from the next verified payouts — the waterfall, with recourse on the Sage-routed remainder only. Cash-flow lending where the books never existed, because the system wrote the books.does it change outcomes? →
In the markets this is built for, the middle of that picture is the missing infrastructure: the work is real, the books are not. Sage doesn’t read cash flow — it witnesses it, and writes the book as the work happens.
Where crypto cannot go
The router’s third door is a licensed-partner fiat adapter — for the jurisdictions and recipients a chain cannot reach. It is deliberately interface-ready, not live: the contract is real and typed (a partner implementation cannot ship without producing the same credit event — the record anchors to the partner’s disbursement reference instead of a transaction), the corridor arithmetic works today, and the disburse function refuses in words rather than simulating money movement, because a “mark paid via partner” button with no partner is theatre. Activation is a compliance onboarding, not a code change — the registry says exactly that, in one readable module.
Degradation
With no model available, the judging layer falls back to a transparent keyword heuristic that cannot auto-pay anything — it can only hold work for review. The failure mode of losing the model is that money stops moving, never that it moves wrongly.