Covenant

Demo

About

Covenant sells a bonded obligation to watch a DeFi lending position. One x402 payment on Hedera opens a watch, evaluations are billed per subgraph deployment actually read, and a 1 HBAR bond moves to the borrower the moment a promised evaluation fails to land. It reads Aave v3, Aave v2, Spark, Compound v3, Compound v2, Morpho Blue, Morpho Aave v3, Moonwell, Venus, MakerDAO, BENQI, Iron Bank and Sonne through one unchanged GraphQL query against Messari standardized subgraphs, measures which deployments actually conform before trusting any of them, and repays debt on Aave v3 Sepolia when a health factor crosses the mandate. Every claim here is a transaction you can open. The service is live at https://covenant-x402.vercel.app, registered on-chain as ERC-8004 agent 120 on Hedera testnet, and its entire billing history is a public Hedera Consensus Service topic (0.0.10510015) that anyone can replay from a free mirror node. THE PROBLEM. A borrower who sleeps through a move gets liquidated. Today they pay for that risk in over-collateralisation, because every alternative is a monitor: it tells you something and owes you nothing. A monitor that misses your liquidation loses nothing. Covenant is the first version of this that is exposed when it fails. THE PRODUCT. The seller posts a bond, the terms live on consensus, and the borrower adjudicates from the public journal without asking the seller for permission or for data. Both outcomes are proven on testnet: a breached covenant moved 1 HBAR to the borrower, and a kept one moved nothing. That single property, a promise with a price and a consequence, is what separates this from every liquidation dashboard in the category. A MACHINE BUSINESS WITH REAL UNIT ECONOMICS. Covenant sells evaluations over x402 on Hedera and buys its own evidence over x402 from The Graph's gateway on Base. Revenue and cost of goods are both on-chain, so the margin on any individual call is recomputable by a third party. It is an agent that runs a business, not an agent that spends an allowance. IT KNOWS WHAT IT DOES NOT KNOW. A $57M Aave position scores 0.821 from the standardized fields, which reads as already liquidatable. It is not: the collateral is sUSDe, whose base maximumLTV is 0, so the position exists only inside e-mode and the real threshold is not in the schema. Covenant names the cause and declines, because a confident wrong number at 3am costs a borrower more than silence. Judgement about when not to answer is the hardest thing to build into a risk service and it is built into this one. ONE QUERY, THIRTEEN PROTOCOLS, ZERO PER-PROTOCOL CODE. Adding a lending market is a single line in a registry. Schema CID QmNnWjciPb8 is byte-identical across five deployments spanning three protocols and four networks: one content hash, one query shape, whole ecosystems of collateral. AND IT ACTS. When the mandate is crossed the guard signs and broadcasts a protective repay, then asserts the health factor actually rose: 1.105 to 1.350, on chain, verifiable.

How it's made

THE DATA LAYER IS ONE QUERY. packages/schema/src/query.ts holds a single GraphQL document that runs unchanged against Messari Lending Protocol schema 2.0.1, 3.0.1 and 3.1.0 across 19 deployments. packages/schema/src/registry.ts is the only file in the repository that names a protocol. There is no per-protocol code anywhere else, so onboarding a new lending market is one line in an array. The proof that the standard earns its keep: schema CID QmNnWjciPb8 is byte-identical across Aave V2 Ethereum, Aave V3 Ethereum, Aave V3 Polygon, Aave V3 Avalanche and Spark Ethereum. RISK BRANCHES ON ONE STANDARDIZED FIELD. LendingProtocol.riskType decides whether an account's positions net together (GLOBAL: Aave, Compound, Spark, Venus, Moonwell) or are scoped per market (ISOLATED: Morpho Blue, MakerDAO). That single field is the entire protocol-awareness of the engine, which is why the thirteenth protocol costs the same as the second. CONFORMANCE IS MEASURED, NOT ASSERTED. scripts/conformance.ts probes every registered deployment for schema coverage and lag against chain head on every run. It caught Spark Lend on Gnosis answering every query correctly while indexing 86.5 days behind, which a hand-written registry would have happily used to price live collateral. The oracle re-measures per request and names anything it excludes. PAYMENTS. @x402/express with ExactHederaScheme, settled through the Blocky402 facilitator on Hedera testnet. Price is a function of the request line: 0.0575 HBAR for the full 19-deployment index, 0.025 HBAR for two protocols, quoted in the 402 before the buyer signs anything. The middleware only ever sees the URL, which is precisely why the quote is knowable in advance. RECEIPTS CLOSE THE LOOP. Every settled request writes an HCS message carrying its own settlement transaction id, so the whole bill replays against the ledger from a free mirror node. Receipts record deploymentsQuoted alongside deploymentsDelivered, so the buyer can audit the meter rather than trust it. THE BOND HAS NO DATABASE. Terms, evaluations and settlements are all messages on one HCS topic, folded into state on read. GET /v1/covenant/:id is free and unauthenticated, because the borrower must be able to check the seller's promise without asking the seller. Adjudication runs on the public journal, so both parties reach the same verdict from the same bytes. IT EXECUTES. scripts/guard-act.ts repays debt on Aave v3 Sepolia through viem, simulating first and then asserting the health factor actually rose. A receipt proves a call landed; only the post-condition proves the position is safer, so the script exits non-zero if it is not. IDENTITY AND DISCOVERY. Registered as ERC-8004 agent 120 on Hedera testnet, with the agent id learned by eth_call against register() before writing so the document is complete in a single transaction. It is stored as a data: URI, so the identity resolves with no hosting dependency at all. GET /v1/catalog is free and unauthenticated, so an agent that has never met the service reads what it sells and what it costs before spending anything. BUILT FOR THE PLATFORM IT RUNS ON. HBAR is absent from @x402/core's DEFAULT_ASSETS, so client spend controls silently reject every HBAR payment until the asset is allowed explicitly. The settlement header decodes to `transaction` while the SDK calls it `transactionId`. Serverless freezes the instance the moment a response is sent, which kills any receipt written in res.on('finish') unless it is held open with waitUntil. Each of these is handled in code, and each is the kind of thing that only shows up under real traffic.