# AgentProof × Vaultfire — Integration Spec + Live Demo

**Status:** Draft RFC with **working reference implementation**. The Vaultfire side of the bridge is deployed and verified end-to-end as of 2026-05-11. Seeking feedback from the AgentProof author ([github.com/dicnunz](https://github.com/dicnunz), [@nicdunz](https://x.com/nicdunz) on X) and community.

**Authors:** ghostkey.base.eth (Vaultfire)
**Last updated:** 2026-05-11
**Canonical home:** gitlawb — `did:key:z6MkryiNsYdFEMHv95wxzSQ1vtFXPyVQQrxXdPw3tE5HpfxV/vaultfire`

---

## TL;DR — see it working

A live, paid AgentProof bridge endpoint is running on Base right now. It fetches a real AgentProof v0.1.0 report, SHA-256-verifies it, and returns a normalized envelope. No mocks.

| Thing | Where |
| --- | --- |
| Live AgentProof report (audit of theloopbreaker.com itself) | [theloopbreaker.com/agentproof-report/](https://theloopbreaker.com/agentproof-report/) |
| Bridge endpoint (x402-paid, $0.02 USDC on Base or Solana) | `GET /api/x402/trust/agentproof-evidence` on [theloopbreaker.com](https://theloopbreaker.com) |
| Unpaid call returns | `HTTP 402` with full x402 envelope |
| Paid call returns | `HTTP 200`, `X-Payment-Verified: true`, normalized AgentProof score + categories |
| Verified report SHA-256 | `0x63d89622d4fd635d9a2b0f4e9c20897179776de096e979820543a997201c03f8` |
| Reference verification (real result) | overall **80/100**, 8 routes crawled, 0 blocking issues |
| Burner that signed the test settles | `0xb7d84310847f5a2288CFE77638B184b0618827c5` |
| CDP facilitator | verified — `X-Payment-Verified: true` on every paid call |

## 0. Why this document exists

[AgentProof](https://github.com/dicnunz/agentproof) (v0.1.0, May 10 2026) produces a **deterministic, local, no-LLM** proof report for AI-built apps and PRs: build/test/lint/typecheck, Playwright crawl with screenshots, accessibility and broken-link checks, and a deterministic 0-100 score across six categories. Output is local files (`agentproof-report/index.html`, `results.json`, `proof-card.svg`, screenshots).

[Vaultfire](https://theloopbreaker.com) is 77 x402 endpoints on Base — accountability and partnership bonds for AI agents. Agents stake ETH and earn distribution when on-chain *Flourishing Metrics* show real impact. No slashing; bonds reward flourishing, not fear.

These two protocols sit at adjacent layers:

| Layer | AgentProof | Vaultfire |
| --- | --- | --- |
| Concern | "Did the agent actually ship working code?" | "Should this agent be trusted / distributed to?" |
| Output | Deterministic score + local artifacts | On-chain bond + Flourishing Metrics + distribution |
| Trust model | Local, reproducible, no LLM judge | On-chain, paid via x402, public |
| Payment | Free CLI + $149 async audit | $0.01 – $0.50 USDC per endpoint |

This spec proposes a **minimal, optional bridge** — nothing inside AgentProof needs to change for v1, and the Vaultfire side is one new read-side endpoint, which is now live.

## 1. Non-goals

To keep this honest:

- **No replacement of the AgentProof deterministic score.** The Vaultfire side never re-weights or "interprets" the score. We treat `results.json` as the source of truth and the report URL/hash as the artifact.
- **No LLM judge anywhere in the loop.** AgentProof is deterministic by design. The Vaultfire bridge logic below is also deterministic and disclosed.
- **No required dependency.** AgentProof works without Vaultfire. Vaultfire works without AgentProof. The bridge is opt-in per bond.
- **No slashing.** Vaultfire bonds reward flourishing; a low AgentProof score never penalizes an agent. It can only *not increase* a metric.
- **No private repo / source upload.** Bridge only consumes public report URLs.
- **No on-chain image data.** Only the report URL hash lands on-chain (via the existing `progressNotesHash` field — see §3.1).

## 2. What the bridge does in one paragraph

When an agent submits Flourishing Metrics to Vaultfire (`submitPartnershipMetricsHashed` or `submitMetrics` on `AIPartnershipBondsV2` / `AIAccountabilityBondsV2`), they can optionally attach a reference to a public AgentProof report. The Vaultfire x402 read endpoint `/api/x402/trust/agentproof-evidence` accepts a report URL + an expected SHA-256, fetches the public `results.json`, verifies the digest, and returns a normalized envelope. The agent (or anyone) can include the URL/hash in the bond's `progressNotesHash` (`bytes32`). Vaultfire's display layer treats verified AgentProof evidence as one input among others — never the only one. Nothing about the agent's on-chain Flourishing Metrics changes; this is read-side only.

## 3. The two contact points

### 3.1 `progressNotesHash` (already exists on-chain, no contract change)

`AIPartnershipBondsV2.submitPartnershipMetricsHashed(...)` already accepts a final `bytes32 progressNotesHash` parameter. Agents already use it for arbitrary off-chain evidence hashes. This spec proposes a **convention**, not a contract change:

```
progressNotesHash = keccak256(
  utf8(canonical_evidence_url) || ":" || utf8(results_json_sha256)
)
```

Where `canonical_evidence_url` is the public URL of the AgentProof report (e.g. the `agentproof-report/index.html` hosted at a stable URL the agent controls), and `results_json_sha256` is the hex SHA-256 of `agentproof-report/results.json` as written by AgentProof.

This is purely a hashing convention. Any party can recompute and verify it. Nothing in the contract changes.

### 3.2 `/api/x402/trust/agentproof-evidence` (LIVE on Base, $0.02 USDC)

Live x402-paid endpoint on `theloopbreaker.com`. Single purpose: fetch a public AgentProof report, verify against a SHA-256, return a normalized envelope.

```http
GET /api/x402/trust/agentproof-evidence?reportUrl=https://...&expectedSha256=...
```

**Price:** $0.02 USDC (matches existing `trust/flourishing-metrics` tier)
**Networks:** Base (`eip155:8453`) and Solana mainnet — via CDP facilitator
**Pattern:** read-only, no on-chain write
**Discovery:** advertised in `theloopbreaker.com/.well-known/x402.json` (endpoint 75/77)

**Real response (paid, verified 2026-05-11):**

```json
{
  "success": true,
  "reportUrl": "https://theloopbreaker.com/agentproof-report/results.json",
  "resultsJsonSha256": "0x63d89622d4fd635d9a2b0f4e9c20897179776de096e979820543a997201c03f8",
  "agentproofVersion": "0.1.0",
  "generatedAt": "2026-05-11T06:21:21.292Z",
  "score": 80,
  "categories": {
    "reliability":      { "name": "Reliability",          "max": 20, "score": 20 },
    "uiProof":          { "name": "UI proof",             "max": 15, "score": 15 },
    "accessibility":    { "name": "Accessibility",        "max": 15, "score": 11 },
    "docsQuality":      { "name": "Docs/readme quality",  "max": 15, "score": 13 },
    "testBuildHealth":  { "name": "Test/build health",    "max": 20, "score": 12 },
    "launchReadiness":  { "name": "Launch readiness",     "max": 15, "score":  9 }
  },
  "checks": {
    "build": "skipped", "test": "skipped", "lint": "skipped", "typecheck": "skipped",
    "browser": {
      "enabled": true, "routesCrawled": 8,
      "consoleErrors": 0, "visibleErrors": 0, "brokenLinks": 1, "accessibilityFindings": 2
    }
  },
  "deductionCount": 9,
  "blockingIssues": [],
  "verifiedAt": "2026-05-11T06:39:59.809Z",
  "bridge": { "spec": "Vaultfire × AgentProof — draft RFC. Display-layer only. No on-chain writes. No re-scoring." },
  "_x402": { "paid": true, "price": "$0.02 USDC", "service": "vaultfire-trust", "facilitator": "cdp", "pattern": "read (fetch + verify AgentProof report)" }
}
```

The six category keys come straight from AgentProof's published `ScoreCategoryName` (`Reliability`, `UI proof`, `Accessibility`, `Docs/readme quality`, `Test/build health`, `Launch readiness`) — verified against upstream `src/scoring.ts`.

## 4. Optional mapping into Flourishing Metrics

This is the part that needs the most scrutiny. The mapping must be **deterministic, disclosed, and never increase a metric beyond what an agent could prove on their own.**

### 4.1 Partnership bonds (`AIPartnershipBondsV2`)

Five dimensions:
- `humanGrowth`, `humanAutonomy`, `humanDignity`, `tasksMastered`, `creativityScore`

**Proposed bridge:** AgentProof evidence is only relevant to **`tasksMastered`**. The other four are about human-side outcomes that a code audit cannot speak to.

The agent submitting metrics may include AgentProof evidence as supporting context for the `tasksMastered` value they self-report. The Vaultfire indexer will surface a "verified by AgentProof" badge on the bond page when:

1. The `progressNotesHash` matches the keccak256 convention in §3.1
2. The report URL resolves, `results.json` hash matches, and `score >= 75`

Display-layer only. It does not change on-chain values.

### 4.2 Accountability bonds (`AIAccountabilityBondsV2`)

Six dimensions:
- `incomeDistributionScore`, `povertyRateScore`, `healthOutcomesScore`, `mentalHealthScore`, `educationAccessScore`, `purposeAgencyScore`

**Proposed bridge:** **None.** Accountability bonds are about society-level flourishing outcomes. A repo audit has nothing meaningful to say about them. AgentProof evidence is irrelevant here and should not influence display.

This is the kind of restraint that keeps both protocols honest. AgentProof is good at exactly one thing; we shouldn't try to make it do more.

## 5. Reverse direction: AgentProof reading Vaultfire reputation

Symmetric option, also optional. AgentProof reports could include a "this agent's Vaultfire reputation" footer block when the agent provides their `agent_did` or `walletAddress` to the CLI:

```
agentproof audit . --vaultfire-agent 0xfA15...813C
```

Vaultfire already exposes what's needed as public x402 endpoints:

| Read | Existing Vaultfire endpoint |
| --- | --- |
| Agent's bond list | `/api/x402/bonds/agent-bond-status?address=0x...` |
| Aggregate Flourishing Metrics | `/api/x402/trust/flourishing-metrics?metricId=...` |
| Protocol-wide bond pulse | `/api/x402/bonds/overview` |

AgentProof would append a verbatim section: "Agent has N active Vaultfire bonds. Aggregate Flourishing Metrics on `${date}`. Not interpreted by AgentProof — informational only."

No coupling at the score level. AgentProof's own score stays untouched.

## 6. Security & honesty rules (all implemented in the live endpoint)

1. **Never accept private keys.** Private-key-shaped values are rejected. The 64-hex `expectedSha256` parameter is explicitly excluded from that check because it's intentionally 64 hex chars by spec.
2. **Public URLs only.** The endpoint rejects `file://`, `localhost`, RFC1918 (`10/8`, `172.16-31`, `192.168/16`), loopback (`127/8`, `::1`), and link-local (`169.254/16`, `fe80::/10`, `fc00::/7`). SSRF lockdown.
3. **Hash-pinned.** The `expectedSha256` parameter is required. If the fetched `results.json` does not match, the response is `success: false` with both fetched and expected hashes for diagnosis.
4. **Size-capped fetch.** `results.json` is streamed with a 256 KB hard cap; oversized payloads are refused.
5. **Timeout.** Outbound fetch is bounded to 8 seconds.
6. **No write side.** This endpoint never writes on-chain. The only on-chain artifact is the `progressNotesHash` the agent already submits to the bond contract.
7. **No re-scoring.** The endpoint surfaces what AgentProof produced. It does not adjust, normalize, or "interpret" the score.
8. **No telemetry.** Matches AgentProof's local-first posture. Vaultfire's existing endpoints run without telemetry beyond standard x402 billing logs (CDP facilitator).

## 7. Reference contracts (Base mainnet)

For anyone wanting to verify the bond contracts referenced above:

| Contract | Address |
| --- | --- |
| `AIPartnershipBondsV2` | `0x01C479F0c039fEC40c0Cf1c5C921bab457d57441` |
| `AIAccountabilityBondsV2` | `0x6750D28865434344e04e1D0a6044394b726C3dfE` |
| `ReputationRegistry` (ERC-8004) | `0x98afd1440B2238D73c1394720277a6d031fCbbD0` |
| `ValidationRegistry` (ERC-8004) | `0x8D3495772EAcAdB7dC09F1784eF06F2D109fb8a5` |

Also deployed on Avalanche, Arbitrum, and Polygon. Same selectors.

Bond protocol live state as of 2026-05-11: 36 active bonds, 77 x402 endpoints (75 priced + 2 free), CDP-listed.

## 8. What we'd like feedback on

In rough priority order:

1. **Is the schema bridge in §3.1 acceptable?** Does it conflict with anything AgentProof might want to add to `results.json` later? If `results.json` grew a canonical content hash field, we'd use that and drop the local SHA-256 step.
2. **The §4.2 "no bridge for accountability bonds" call.** Conservative on purpose. If you see a meaningful link, happy to revisit.
3. **The reverse direction in §5.** Useful or noise? Easy to drop.
4. **Naming.** `agentproof-evidence` works for us, but if you prefer a different convention for tools consuming AgentProof reports, we'll follow it.
5. **Anything in the live envelope shape (§3.2) that you'd want differently** — happy to change it before anyone starts depending on it.

## 9. Implementation status

| Step | Status |
| --- | --- |
| Add `/api/x402/trust/agentproof-evidence` x402 read endpoint | **Live** on theloopbreaker.com |
| Preview deploy + smoke test | Done — endpoint returns HTTP 402 unpaid, HTTP 200 paid |
| Real CDP-facilitated payment settle | Done — 3 settles, all `X-Payment-Verified: true`, real USDC on-chain |
| `public/.well-known/x402.json` advertises the endpoint | Done — 77 total / 75 priced |
| Source pushed to gitlawb canonical | Done — see canonical-home field above |
| Bonds dashboard "Verified by AgentProof" badge | Not yet — gated on this spec being accepted |
| AgentProof CLI `--vaultfire-agent` flag (§5) | Upstream call — not built |

No changes to live bond contracts. No redeploy. No risk to the existing 36 bonds.

## 10. License & attribution

This spec is CC0 / public-domain. AgentProof is MIT-licensed; Vaultfire's spec materials are CC0. Either side can fork, ignore, or rewrite any of this without asking.

---

**Contact:** ghostkey316@proton.me · telegram [@ghostkey316](https://t.me/ghostkey316) · ghostkey.base.eth
**AgentProof:** [github.com/dicnunz/agentproof](https://github.com/dicnunz/agentproof)
**Vaultfire:** [theloopbreaker.com](https://theloopbreaker.com)
