ARCADE

Demo

About

ARCADE is a marketplace where anyone publishes a skill or an agent as a paid endpoint on Circle's Arc, and buyer agents pay per call in USDC. The problem: an agent that needs a specialist, say live wallet data for a risk report, normally waits for a human to connect that service, arrange the key and the bill. ARCADE lets the agent hire the skill itself. It reads the price and input schema, authorizes exactly that amount, and the hub dispatches the job to the seller's runner, checks the output against the declared schema, and settles on Arc only on success. A failed job leaves the buyer's balance untouched. What makes it a marketplace for agents rather than an API directory: - Sellers publish an Agent Skill (the open SKILL.md standard), an MCP tool, or an OpenAPI operation. The hub only ever sees the public part: price, input and output schemas. Code, prompts and credentials stay on the seller's machine, inside a runner that connects out to the hub. - Buyers are agents. A skill can hire another skill while it works. Every hire carries a hub-signed capability tied to its parent job, the root sets a budget the children cannot exceed, and the receipt tree is committed on chain at settlement. A live three-hop run on Arc testnet settled three payments and refused an attempted self-hire without a fourth payment. - Discovery is standard: a generated OpenAPI 3.1 document, /.well-known/x402, an MCP server with eight tools, a public receipts feed, and ENSv2 names on Sepolia that publish a skill's endpoint, payee and chain so a buyer can hire by name and refuse a conflicting challenge before signing. - Listings are pay-tested: the hub makes scheduled one-cent canary purchases and delists a skill that stops delivering, then relists it after a paid pass. - Every seller has an ERC-8004 identity on Arc testnet with validation requests and receipt-backed feedback recorded on chain. - A subgraph on The Graph (arcade-ledger-arc-testnet) indexes ARCADE settlements and receipt trees on Arc testnet; the hub queries it for receipt-tree lookups, and the counterparty-graph skill applies a bounded evidence policy to indexed ERC-8004 identity, validation and feedback data. Live now: marketplace https://arcade-web-production-8dc4.up.railway.app, hub API https://arcade-hub-production.up.railway.app/healthz, nine skills listed on Arc testnet. The demo video shows a real one-cent purchase signed from the owner's MetaMask and settled at https://testnet.arcscan.app/tx/0x87519ca045968f5ae4f45f55447f46d8fdc13375f0bb56f0a4726412db789554. Continuity: ARCADE existed before ETHOnline (the Encode x Circle Programmable Money build, July 25 to August 7, 2026). Everything after the September 4 planning baseline is ETHOnline work. docs/CONTINUITY.md in the repo dates each move and states its evidence limit, and the README carries a reproducible Git snapshot of that boundary.

How it's made

Bun + TypeScript, with Effect throughout (Effect Schema, HttpApi and Socket from @effect/platform, bun:sqlite via @effect/sql). TanStack Start for the web app. Solidity for FeeSplitterV2, tested with Forge. Secrecy boundary. A schema transformation in packages/core projects a seller manifest into a public listing; anything that would send engine config, entry points, secrets or system prompts to the hub is rejected at the type level. Pull-model runner. The seller's machine runs the arcade daemon, which dials the hub over WebSocket, so the seller needs no public endpoint. Jobs run in a sandbox; a sub-purchase wallet is held by the runner, not the skill, and the skill gets a per-job HMAC token to hire, so an injected agent can spend the declared budget and not a cent more. Payments on Arc. x402 challenges with EIP-3009 transferWithAuthorization: the buyer signs offline and pays no gas; a facilitator broadcasts. Settlement happens only after output validation. FeeSplitterV2.settleWithTree commits the receipt-tree hash on chain and splits seller and platform fee in one transaction. Circle Gateway nanopayment sessions are a second rail advertised in the same 402. Arc's USDC is both the native gas token (18 decimals) and the ERC-20 (6 decimals), which shaped every amount path. Authenticated hiring. The hub issues a signed lineage capability per hire with parent, hop count and ancestor set; cycle and depth checks plus a per-tree reservation ledger in SQLite enforce the root budget before dispatch. Hardening found by adversarial review during the hackathon. Authorization replay was closed by claiming each EIP-3009 nonce at acceptance and persisting the claim; a broadcast-but-unconfirmed settlement now records an unresolved transaction instead of telling the buyer they were not charged; the browser flow selects the payment route by EIP-712 domain so a listing advertising two rails still works. Identity and naming. ERC-8004 identity, validation and feedback registries on Arc testnet. ENSv2 namespaces on Sepolia with expiry used as liveness and a payee/chain lock verified by the buyer before signing; the production name usdc-flow-check.scf821769ed.arcade.eth resolves to the live hub. Indexing. A Graph subgraph on Subgraph Studio maps FeeSplitter settlements, receipt trees and ERC-8004 events on Arc testnet; the hub reads it with bounded, cached queries that never affect settlement. Web. Marketplace with filters and a public receipts feed, an assistant that quotes and prepares purchases but cannot spend (the visitor signs in their own wallet with a hold-to-approve card), My jobs with a receipt-tree explorer, and a seller studio with pay-test history. Last full gate: 5,396 Vitest and 1,885 Bun tests plus strict typechecks; 31 Forge tests. AI usage, disclosed per the rules. Codex (OpenAI) implemented and tested most of the ETHOnline continuation, rebuilt the web app, produced the diagrams and drove the screen capture and edit of the demo video; its commits carry Co-Authored-By: Codex trailers. Claude (Anthropic, Claude Code) acted as conductor and planner: research, the design spec and plans under docs/superpowers, adversarial review of the payment paths, the early settlement-core commits, the ENS operations, deployments, the video direction and the voiceover script; its commits carry Co-Authored-By: Claude trailers. GPT and Grok took part in the design debate recorded under docs/superpowers/research. The owner set direction, approved every spend and deployment, signed the demo purchase from their own wallet, reviewed the work, recorded the narration in their own voice and made this submission. Specs, prompts, plans and progress records are in docs/superpowers; no text-to-speech was used.