Aetheris

Demo

About

Aetheris is an Autonomous DeAI Agency and Micro-Treasury Operating System on Hedera. An agency holds its own budget, hires named sub-agents, pays each one the moment a task completes, and proves every step on a public audit log that anyone can read. The problem it solves: today an AI agent either gets an open-ended token approval that anyone holding the key can drain, or no funds at all. Payees are bare addresses, nothing caps what can be spent, and "proof of work" is a log on somebody's server. The settlement loop: a client escrows one deposit for a job. The agency contract can never commit more in sub-agent fees than that deposit, and the client can reclaim it until the job settles. Each completed task is paid immediately through the Hedera Token Service system contract (with a plain ERC-20 fallback), and every lifecycle step is anchored to a Hedera Consensus Service topic before the contract call, so on-chain sequence numbers match the mirror node. Mistakes are retracted with append-only correction records, never deleted. The Graph indexes jobs, tasks, settlements, the HTS-vs-ERC-20 rail, a sub-agent leaderboard and daily rollups. The retained margin can only be swept by a human operator who has passed World ID proof of personhood; the proof's nullifier is burned on-chain so one human can only ever claim once. Two roles in the app. Operator: the human running the agency, with Mission Control (pipeline, leaderboard, treasury, audit stream, World-ID-gated margin claim). Client: any wallet that funds a job. Clients sign in with a passkey (embedded wallet), escrow a deposit from the browser, see exactly their jobs and refundable escrow, and can reclaim a deposit until settlement. Everything on screen is live: treasury balances are read from the chain, finality is computed from indexed timestamps, and every panel carries a LIVE or DEMO badge with its reason. Limits are stated plainly: World ID has no router on Hedera so the contract runs in an announced bypass mode; 1inch does not serve Hedera so swap routing is for the operator's EVM wallet; the indexer is self-hosted because Hedera is not on The Graph's hosted network.

How it's made

Contracts: Solidity 0.8.24 on Hedera EVM (chain 296) with Hardhat 2 and OpenZeppelin 5. AetherisAgency drives the job lifecycle (createJob, assignSubAgent, completeTask, settleJob, refundJob, verifyOperator); AetherisTreasury escrows deposits and pays sub-agents. A frozen event interface is implemented by the contracts and indexed by the subgraph so the two can never drift. 37 tests, including one that asserts every event topic against the frozen interface. Hedera: settlement goes through the HTS system contract at 0x167 via a library that decodes int64 response codes. A subtle catch we handle: a call to an empty account returns success with empty returndata, which naively decodes to response code 0 and looks like success, so it is mapped to UNKNOWN to keep the ERC-20 fallback safe on other chains. Locally the precompile does not exist, so the tests install a stateless mock at 0x167 with hardhat_setCode and run the real library unchanged. On testnet the gas profile proves the precompile does real work: 2,360,527 gas for an HTS settlement versus 229,111 for ERC-20. Every step is recorded on an HCS topic (0.0.10518320) before the contract call, and readers honour append-only Correction records. The Graph: Hedera is not in The Graph's hosted registry, so we run graph-node against the Hedera JSON-RPC relay, the path Hedera's own docs prescribe. 17 entities, 10 handlers, Settlement.viaHts makes the rail queryable, AgencyDayData gives time series. Hashio rejects eth_getLogs inside JSON-RPC batches, so every ethers provider runs with batchMaxCount: 1. World ID 4.0: IDKit v4 with a server-signed request context, the raw result verified at the v4 endpoint scoped to our relying party, then relayed on-chain by the server so the RP-scoped nullifier is burned in verifyOperator. A second proof from the same human returns 409. No router exists on Hedera, so the contract emits WorldIdBypassActive rather than hiding it; only the ZK check is skipped, replay protection stays live. 1inch Swap API v6.0 through a server-side proxy (the key never reaches the browser) with live quotes on Arbitrum, Base, Ethereum, Optimism and Polygon. Privy: passkey, email, Google and external-wallet login with embedded wallets on Hedera testnet; the client write path signs approve and createJob through viem against the embedded wallet, with a testnet faucet that drips HBAR and a test token so a fresh passkey wallet can fund a job. ENS names resolved on Ethereum mainnet with a fallback RPC list. Frontend: Next.js 14, Tailwind, framer-motion. Server components read the subgraph and the chain; API routes return typed error envelopes. The Operator/Client role auto-detects from the connected wallet. Hacky but useful: a scroll reveal with a rect-check fail-safe so no content can be stranded invisible, and a single SVG favicon that switches marks with prefers-color-scheme because browsers ignore the media attribute on icon links.