Smart contracts
This page follows one thing the whole way down: a promise. It starts as a sentence somebody wrote, becomes terms nobody can edit, gets compiled into code nobody typed, deployed to a public chain, paid through on a live chain, settled by a command, and finally turned into a reputation that decides who gets the next job.
Every address and transaction below is real and opens on a public explorer. You don't need to know anything about crypto to follow it — the first stop assumes you don't.
Sui testnet · Base Sepolia (84532). Nothing here is mainnet — and the page says so.
The whole way down
Read it in order and you'll have followed a single obligation from the moment somebody said it out loud to the moment it changed who the system trusts. Nothing below is a mock-up.
The last stop feeds the first: a settled promise is what decides who is trusted with the next idea.
Start here if you don't do crypto
Forget tokens and wallets for a moment. Strip a smart contract back and it is a very short, very stubborn agreement: these are the terms, this is the one thing that decides whether they were met, and neither can be changed once it starts.
That's the whole idea, and it's the part that's useful whether or not you care about blockchains. Most agreements go wrong not because someone lied, but because the terms quietly moved — the spec grew, the definition of "done" softened, and by the end nobody can say what was actually agreed. A promise recorded this way cannot do that.
No wallet, no tokens, no crypto knowledge required to read that.
The part that is genuinely unusual
Almost every smart contract in the world is hand-written by a human, then audited by other humans hoping to catch what the first one meant but didn't say. Ours isn't written at all. It is compiled — from the same file that defines the platform's brain.
relation promise,
relates maker, # who promised
relates oracle, # who attests
owns terms-hash, # frozen terms
owns proof, # the command
owns promise-state, # 0…4 ratchet
owns strength, # kept → weight
owns resistance; # broken → drag// GENERATED — DO NOT EDIT
module one_generated::promise {
public struct Promise has key {
id: UID,
maker: address,
oracle: address,
terms_hash: String,
promise_state: u64,
...Read the two sides again. Nobody decided that maker and oracle should be blockchain addresses. They are the two roles of a relation, and a rule in the generator turns any role into a typed address. Change the schema, re-run the compiler, and the contract changes with it. Change the contract by hand and the build refuses you: the header says so, and a test pins the emitted lines.
If the compiler ever emits something else, the test goes red and nothing ships.
What the software enforces and what the chain enforces cannot drift. They are the same declaration, read twice.
Why this is a Sui project and not a chain-agnostic one
The compiler above only works because of a correspondence that most chains cannot offer. Our knowledge graph describes the world as objects with owners and relationships between them. Sui's Move describes the world the same way. So the mapping isn't a convention we invented and documented — it falls out of the two models being the same shape:
The fast path. A scoped agent wallet is one — only its controller can move it, and it never queues behind anyone.
A promise binds a maker and an oracle. Both must see the same object, so it is shared — and its roles become typed addresses automatically.
Once a path is a highway, nobody edits it — not us, not the owner. What was proven stays proven.
On an account-based chain there is nothing for a relation to become. You would hand-write a mapping, maintain it forever, and hope it stayed true. Here, a relation is a shared object because that is what a shared object is — a fact several parties hold at once. Sui's object model is not a deployment target we chose. It is the reason the compiler can exist at all.
Where this actually is
The compiled package is live. You can open it right now and read the generated code on chain — it is the one at the top of the list, and it is the only one on this page nobody typed.
Contains promise and substrate — both emitted from schema/sui.tql, neither hand-edited.
Six Sui packages, all on testnet, chain id 4c78adac. Nothing here is mainnet, and this page will say so until the day it isn't. The estate is real, the addresses resolve, the transactions happened — and it is still testnet. Anyone who tells you the difference doesn't matter is selling something.
Proven end-to-end
One tap to pay. About sixty seconds to final settlement. No wallet setup, no seed phrase, no gas — the customer never learns a blockchain was involved. And this is not a demo claim: the verifier is live with its full source published on Basescan, and a real coupon was signed and claimed on-chain. Read the transaction yourself.
How it fits together
A user pays in SUI, ETH, USDC, SOL, or BTC. The worker verifies the payment on the source chain — it stores nothing.
A stateless worker signs a coupon binding the recipient, amount, and payment. On EVM the signature is EIP-712, bound to one contract on one chain.
The user submits the coupon to the destination contract — the Sui verifier or the EVM Universal Verifier.
Signature, supply cap, and anti-replay nonce are all checked on-chain. Only then does it mint ONE or release USDC. Blockchain is the source of truth.
What it unlocks
Look once more at the last two lines of that schema. A promise owns strength and resistance — and those are the exact two numbers every routing path in the system already carries. That is not a coincidence; it is the point.
settles green, and adds weight to the party that made it. The system routes more work toward whoever keeps their word.
settles red, and adds drag. Nobody bans anyone. The work quietly stops arriving — which is how reputation works everywhere else, made explicit.
So an agent's track record is not a star rating we control and could edit. It is the accumulated settlement history of promises it made in public, on a chain we cannot rewrite, in the same vocabulary the router reads when it decides who does the next job. An agent that has never worked for you can still arrive with a record you can check — and one that breaks its word cannot start again under a new name with a clean one.
Deliver, and the system sends you more work. Break your word, and the work routes away.
Reputation handles the agent that breaks its word. It does nothing about the agent that means well and spends your money anyway. So the budget is not a setting in our software — it is a separate contract on the same chain, and the transaction that would breach it does not get refused politely. It fails.
lives in the application, is enforced by the application, and is exactly as trustworthy as the application. Which is to say: as trustworthy as whoever can deploy it.
is enforced by the chain. We cannot raise it on your behalf, an agent cannot argue with it, and a bug in our code cannot get past it. AI safety as infrastructure, not intention.
Why it matters
These aren't a science project. They're the plumbing for getting paid, selling online, and putting AI agents to work — without a middleman taking a cut or holding your money.
One pattern runs through all of them: replace "trust our dashboard" with "read the chain." An affiliate program without a blockchain is a black box — partners see the commissions the merchant chooses to show them, and have to take the payout on faith. A payment link in someone's database can be re-pointed after you share it. A spending limit in an admin panel is a suggestion. Put those rules on a public chain and both sides can verify them — nobody has to trust, and nobody can cheat.
A concrete example
They pay in one tap. About a minute later the money is sitting in a wallet only you control — no bank, no chargebacks, no 3% processor fee. The customer never had to learn what a crypto wallet is.
You keep 99%, not 97%
The gateway takes a 1% fee, not 2.9% + 30¢. On a $49 sale you keep $48.51 instead of $47.28.
Payment Gateway
Paid in ~60 seconds, for good
Settlement is instant and final on-chain — no 2–7 day hold, and no chargebacks to fight months later.
Claim Verifier
Zero crypto knowledge required
You sponsor the tiny network fee, so the customer just pays. No wallet setup, no seed phrase, no drop-off.
Merchant Auth
The money is yours
Funds land in a wallet you hold the keys to — not a processor account that can freeze or claw them back.
ONE Token · your wallet
Example math: the deployed gateway's 1% fee vs a typical 2.9% + $0.30 card rate. On 1,000 sales a month that gap is roughly $14,000 a year you keep. Testnet today — the fee logic is the shipped contract.
Get paid from anywhere on earth and keep 99%. Prepaid credits, sponsored fees, and settlement in a minute — no bank, no chargebacks.
Gateway · Verifier · Credits
Launch a subscription, course, or product that manages its own access and can be resold on a secondary market — no Stripe Billing, no cron jobs.
Entity · Subscription · Market
Give an agent a hard spending limit it physically cannot exceed, and make every promise it makes provable on-chain.
Spend Cap · Promise · Service
Chain-neutral
Live today on two very different chains — and built so the next one is an addition, not a migration. The coupon design separates where customers pay from where value settles, so no ecosystem is a lock-in.
Six Move packages: token, gateway, commerce, reputation. Ownership, receipts, and capabilities are real objects here, not ledger entries — the protocol's natural habitat.
6 packages · object-native
The coupon flow rewritten for the EVM: EIP-712 signatures, source-verified on Basescan, claimed live. One deployment away from Ethereum, Base mainnet, or any EVM chain.
Base Sepolia · source-verified · claimed
Customers already pay in SUI, ETH, USDC, SOL, or BTC. Adding a chain is a signer and a verifier, not a rewrite — the destination is a choice, not a commitment.
5 payment currencies · N destination chains
Security
The estate went through two adversarial security passes. Findings were fixed, republished, and — for the payment coupon flow — proven on-chain. The open items that remain are tracked in the open, not hidden.
3 criticals and 8+ highs fixed and republished to testnet: guaranteed-asset-loss in the marketplace, an ungated promise settle, a split-brain double-mint in the verifier, a permissionless rewards mint, gateway fee and overflow bugs, subscription price gaming, and registry-bound admin capabilities.
EIP-712 domain binding shipped to production so a payment coupon can't be replayed across contracts or chains; a merchant daily-limit bypass closed; a supply-floor and a fee bound added on Sui. The verifier fix was deployed and claimed live on Base Sepolia.
Everything here is on testnet, so no real money is at risk today. A handful of items are known and open — on-chain enforcement of a promise's self-oracle rule, agent-ceiling uniqueness, and moving capability custody to a multisig before mainnet. The single-key custody theme is the explicit gate to a mainnet launch. We'd rather name that than paint a green checkmark over it.
Tap any contract to see what it does for your business, why it needs a blockchain, and the live code that proves it.
The list above is what is deployed. This is what it means. Every node below is a declaration in
schema/sui.tql, and its colour is the on-chain disposition —
the disjointness decision Sui executes against, not decoration. Change the schema, run codegen, and this
picture, the Move module and the TypeScript client all move together.
Every address above is live. Open any explorer link, read the source, verify the claims yourself — then start building.