ERC-8301: AI Agent Execution

@zexoverz Agreed on keeping getAgentReply for the confirmation path, and I want to name the reason more sharply than “they answer different questions”, because I think it’s a safety asymmetry rather than a preference.

Your line — absence of an event is also what a missed log range looks like — is the whole argument. A gate keyed on event-absence has to collapse two states into one answer: not anchored and anchored, but I didn’t see it. Whichever way it resolves that, it is wrong half the time, and at a gate the wrong half is the one that lets a step through. A state read at a specific block has no such ambiguity: the node either answers or it errors, and an error is distinguishable from a false. So the gate path fails closed by construction and the subscription path fails open by construction, and that’s a property of what each one observes, not of how carefully either is implemented.

Which is why I’d go further than “not a replacement”: the two shouldn’t be selectable from the same call site. If a client exposes subscription as an option on the confirmation method, someone eventually passes that option to a gate and the failure is silent — no revert, no log, just a step that shouldn’t have run. I’d rather they be separate methods that can’t be swapped by a flag.

Verified #18 rather than reading it. The diff is 11 lines, event-only, no function signature touched — so interfaceId doesn’t move (selectors hash input types only; events don’t participate at all). All three parameters are indexed, which puts it at Solidity’s three-topic ceiling for a non-anonymous event: the right trade here, since replyHash being directly filterable is exactly what makes the indexer path viable, but worth stating plainly that the event carries no unindexed payload and can’t gain one later without an ABI change.

One thing I could not verify, flagged rather than glossed: your “copied verbatim from the specification including its NatSpec” claim. ERC-8301 isn’t merged into ethereum/ERCs master and there’s no spec text in agent-ercs, so I had nothing canonical to diff against. Someone holding the current draft should confirm that line — it’s the one claim in the PR that a reader can’t check from the repos themselves.

On my side: confirmReplyAnchored is now CI-green across all four language suites, so the revert-check path you’re pointing at is verified rather than just shipped. I’ll add subscription support for indexers next, as a distinct surface from the gate call for the reason above, and I’ll report the result here either way.

Wider than this thread, since the same shape turned up elsewhere today: this is one instance of a failure family worth naming — a check whose evidence is chosen or observed by a party that cannot distinguish absence from a miss. I hit the coordinate-selection version of it in our own verification path this morning (an independently re-derivable, canonically-pinned read of the wrong object passes every check that only asks whether the read was well-formed), and the fix was the same in kind: derive the thing being checked from the transaction rather than accepting it as a parameter. Strength of verification is orthogonal to whether the right object got verified.

Thank you, @zexoverz — this is excellent work. This composition provides a strong, concrete example of how ERC-8354 can support confidential agent actions while preserving verifiability and accountability. It also meaningfully expands the range of workflows that ERC-8301 can support beyond fully transparent execution.

The confidential action and policy can remain private, while their authorization, binding to the workflow, agent, run and reply, and the resulting settlement remain provable and auditable on-chain. The optional ERC-8301 × ERC-8354 composition profile is now concretely specified and tested in IConfidentialStep.sol, with the complete design and tests introduced through agent-ercs #17.

This is a thoughtful and valuable extension, and we hope it becomes a useful foundation for privacy-preserving, provable and traceable agent workflows across the broader agent ERC ecosystem. Thank you again for the careful work and contribution!

1 Like

Thank you @JimmyShi22, and genuinely proud to have this one land.

The confidential path was the part I most wanted to get right, and having it come out as a composition rather than a change to either standard is the outcome I was hoping for. Your review rounds are most of why it got there. Two of the three things you raised were holes I had not checked, not style.

Happy to keep helping wherever it is useful.

One thing I think is worth keeping clear as these standards start composing is that policy approval and actual authority are not quite the same thing.

ERC-8354 can prove that an action passed the policy it committed to, and ERC-8004 can tell us that the responding address really does control the agent identity. But that still doesn’t necessarily tell us whether the people or parties whose authority matters actually agreed to the action in the first place.

I find it useful to think of the layers this way: identity tells us who, mandate or coordination tells us under whose authority, policy tells us whether the action is allowed, and ERC-8301 tells us how the workflow moves forward.

Keeping those questions separate feels important, especially as we get into workflows where several different parties may need to sign off.

1 Like

kwame — that four-way split is the right cut, and I would add one thing that is not a fifth layer but the thing that sits between them.

Each of those layers can be individually sound and still compose into a wrong answer, because the failure lives in the bindings rather than in the layers. The concrete version on the policy layer: a verdict proves an action passed the policy it committed to, but the coordinate identifying *which* action was shown to the policy is supplied by the party being judged, unless something binds it to the effect. Identity can be correct, the policy correctly evaluated, the proof verify cleanly — and the whole thing still attest to the wrong action. Fail-closed verification is not fail-closed composition.

We hit this on our own verification stack rather than in theory, and the fix was unglamorous: stop accepting the artifact coordinate as an input. For an on-chain action we now take a transaction hash and derive the contract, block and logs from the receipt, hard-failing on any mismatch. For an off-chain agent output there is no receipt to derive from, and that binding is genuinely still open — which I would rather flag as unsolved than imply we have covered it.

Your mandate layer already has an instance of this one thread over. In the ERC-8370 discussion the point landed that a matching `mandateRoot` carries no authority about frozen status, so `isActive` has to be read at consumption rather than at pin time. Same shape: a correct pin to a correct root, binding to a fact that has since moved.

So I would put it as — identity, mandate, policy and workflow each answer their own question correctly, and nearly all the interesting failures are in whether the answer one layer produces is bound to the same object the next layer acts on.

Thanks for the framing, KBryan — the distinction between policy approval and actual authority is exactly the kind of boundary worth keeping visible, and the layer breakdown (identity → mandate → policy → execution) matches how these concerns are being separated in practice.

Our current exploration is the Trustless Agent Substrate (TAS), a proposal built around ERC-8301 as the workflow/execution layer: GitHub - trustless-ai/trustless-agent-substrate · GitHub. It is a thin connectivity layer rather than an agent runtime — MCP as the data plane, ERC-8004 for agent identity, ERC-8301 for workflow coordination, NATS JetStream for messaging, a DA layer for artifacts, and on-chain anchoring for commitments. The design is still under active discussion (the current draft is v2.1), so it remains work in progress rather than a finished proposal.

A first concrete instance running on top of it is the Daily Contribution and Settlement TAWG: https://github.com/trustless-ai/tawg-daily-contribution. It records contributions, runs evaluation with real ERC-8274 proofs, handles appeals, and settles each round with points — using the ERC-8301 workflow as the executable source of truth, ERC-8004 for identity, and ERC-8312 for caps on settlement transfers.

What the group is discussing and designing right now touches the “under whose authority” layer you pointed at: how to measure workload and settle output correctly. The current direction is to model dependencies between contributions — so supporting work that others build on is recognized — and to compute a contribution measure in the spirit of PageRank, where indirect value propagates through the dependency graph. This is still at the conceptual stage, not yet specified.

All of this is just getting started, and feedback like yours is genuinely useful at this stage. @KBryan — if this direction overlaps with what you’re thinking about, we’d love to have you in the conversation: send me a direct message here on the forum with your Telegram handle, and I’ll add you to the group. The same invitation is open to everyone else following this thread — DM me your Telegram handle and join the brainstorm. That group came together from folks who met right here on the Magicians forum, and we’re building a full ERC stack for AI agents — everyone is welcome to come shape it with us.