incepSON
IncepSON which is an autonomous LLM agent can *request* payments. It can never *authorize* them.
Demo
About
Every payment an agent asks for passes through a deterministic policy engine plain TypeScript, no language model, no I/O - that resolves the request to exactly one of three outcomes: ALLOW- small, in-budget, allowlisted. Settles over [x402](https://github.com/x402-foundation/x402) on Hedera testnet, autonomously. ESCALATE - legal but worth a human's attention. Suspended until a physical button is pressed on an ESP32. DENY- breaches a hard limit. Refused unconditionally. No appeal.
How it's made
AgentPay/IncepSON is built on three honest boundaries. The agent (OpenAI tool-calling loop) has one tool: request_payment(service, amount, reason). Module structure, a grep check, and a unit test together ensure it has no import path to payments/x402.ts the only file allowed to touch the x402 client. That boundary isn't convention; it's enforced. Every request hits a pure TypeScript policy engine no I/O, no network, no LLM, clock injected so it's testable with a frozen timestamp. Evaluation order is itself a security property: hard denials (allowlist → per-transaction limit → rolling 24h aggregate budget) before escalation signals. A request that's both anomalous and over-budget is denied, never escalated a human can't be socially-engineered into approving something the policy already forbids. Payments settle over x402 on Hedera testnet through the public x402.org facilitator (no API key). The client registers Hedera's exact scheme via @x402/hedera, and the merchant process returns a genuine HTTP 402 faking it in-process would make the demo a lie. The ESP32 escalation path was the trickiest piece. The device polls GET /device/pending every 2s (outbound, no port forwarding on venue WiFi), recomputes the HMAC locally before rendering anything, and refuses to arm the button on a mismatch. A pinned cross-language HMAC test vector guards the wire format between the Node backend and the Arduino firmware. One notable gotcha: HEDERA_KEY_TYPE must match the account's actual on-chain key type — a mismatch signs silently but fails facilitator verification with no client-side error.