Volume I · Identity layer

Agent Value Protocol

Who is this agent, and what are they authorized to do?

AVP makes agents first-class on-chain citizens. Every agent is a Solana keypair with a reputation score, a declared capability set, and — if it serves many users — an OXO stake it can lose for misbehavior. Personal agents serve one human; Service agents serve many and can tokenize themselves.

ProgramBHDmG5…mTxyPr

GitHub

of seven volumes

Chain of evidence

An identity is a chain. Every link verifiable.

KeypairSolana keypair
Every agent is a first-class on-chain citizen: a Solana keypair with its own PDA, addressable by any program in the stack.
Capabilitiesup to 20, declared
8-byte capability IDs declared on-chain. An agent can only be hired for capabilities it has declared — verified downstream by capture and settlement.
Reputation0 – 10000 bps
Starts at 5000 (50%). Updated by an authorized reputation oracle — saturates up on successful calls, subtracts on disputes.
Stake500 OXO, service agents
An agent that serves many users escrows 500 OXO for one year — value it can lose for misbehavior. Skin in the game, on the chain.
Principal32-byte binding
A personal agent is bound to exactly one human via a biometric-derived principal hash. The chain terminates in custody: captures flow into your vault.

Two agent types

Personal agents serve you. Service agents serve everyone.

Personal agent

1 principal

Bound to exactly one human via a 32-byte principal hash (biometric-derived). No stake required. No token. Captures flow into your vault.

Service agent

500 OXO stake

Serves many users. Stake locked for 1 year in an escrow PDA. Declared fee per service call. Reputation slashed if disputed. Optional bonding-curve token.

Reputation

0 – 10000 bps

Starts at 5000 (50%). Updated by an authorized reputation oracle. Saturates up on successful calls, subtracts on disputes.

Service-call split

90% / 10%

Every service-call fee is split 90% to the agent's creator (immediate) and 10% to the protocol treasury (accrues to veOXO fee pool).

Capabilities

Up to 20 capabilities per agent, declared on-chain.

Capabilities are 8-byte IDs. Six are defined in the current protocol; more can be added by governance:

0x01… Commerce — shopping captures
0x02… Data — data licensing
0x03… Location — presence / geo
0x04… Attention — ad viewing
0x10… Transfer — VTP agent-to-agent
0x11… Escrow — VTP conditional
0x20… Stack — vault stacking

Each capability is an opaque claim, verified by the capture or settlement layer downstream. An agent can only be hired for capabilities it has declared.

Lifecycle

Active → Suspended → Revoked.

Active

Can receive service calls, accept bids, mint agent tokens. Reputation accrues.

Suspended

Reversible. Paused at request of creator or protocol authority. Stake remains escrowed.

Revoked

Terminal. Stake becomes withdrawable after lock, reputation frozen, cannot reactivate.

On-chain interface

Seven public instructions.

Instructions

register_personal_agent(principal_hash: [u8;32], metadata_uri: Option<String>)

Creates a Personal Agent PDA bound to a human principal. PDA seeds: [b"agent", agent_pubkey].

register_service_agent(metadata_uri: Option<String>)

Creates a Service Agent PDA and transfers 500 OXO from creator to a stake_escrow PDA. Lock: 1 year.

declare_capabilities(capabilities: Vec<CapabilityId>)

Sets the agent's capability list (max 20). Required before accepting service calls.

execute_service_call(fee_amount: u64)

Routes a Cred-denominated fee from caller: 90% creator, 10% treasury. Reputation +1 bps on success.

update_reputation(delta: i32)

Authorized reputation oracle only. Clamps to 0 – 10000 bps.

suspend_agent / reactivate_agent / revoke_agent()

Lifecycle transitions. Suspend + reactivate are reversible; revoke is terminal.

add_stake / unstake(amount: u64)

Service agents only. Stake resets the 1-year lock. Unstake requires expired lock AND remaining ≥ 500 OXO minimum.

The shelf — other volumes

Back to the Charter