Maqam Protocol

Demo

About

Maqam Protocol connects live agent discovery to exact, single-use payment authorization. The Graph supplies ERC-8004 registrations on Base Sepolia. The app screens declared capabilities, active status, indexed agent wallets and distinct non-owner feedback reviewers, explaining which candidates can proceed to human review and which are held. A real recorded model analysis uses a fresh Graph snapshot to recommend a candidate, with its complete input and output preserved. For a selected agent, the wallet review refreshes Graph data and binds the agent ID and snapshot hash into the exact payment evidence. The owner independently verifies the invoice and recipient, then signs the token, amount, recipient, executor, expiry, nonce and revocation epoch. A Solidity executor on Arc Testnet enforces those terms and transfers USDC once. Changed recipients or amounts, replay and revoked approvals fail. The demo shows live Graph screening, recorded model reasoning, and a separate mined Arc payment fixture with controlled owner, executor and recipient accounts. The receipt viewer verifies that real payment against live Arc RPC. We do not claim the Graph-discovered third-party agent was hired or paid. Registry claims and feedback do not prove trust or an Arc payment agreement. This is a new ETHOnline application using the existing public MIT maqam@0.3.3 npm library as a disclosed dependency. Its contracts, UI, APIs, Graph integration, assets and tests were created during the event. The initial Continuity classification was corrected to Building from Scratch based on the public-library exception; see BUILD-PROVENANCE.md. This is an unaudited testnet prototype.

How it's made

The Graph is the live data backend for agent selection. A server-side GraphQL request reads the Agent0 ERC-8004 Subgraph on Base Sepolia. Deterministic screening checks active registration, an explicit agent wallet, task keyword matches and a configurable distinct-reviewer threshold. Index errors or data more than 15 minutes behind halt discovery. We retain exact snapshots and hash them; a selected candidate is queried again during payment review, and the snapshot commitment is included in the signed evidence. Packet import checks the snapshot and recipient linkage. A separate real model adapter uses live Graph results for a candidate recommendation; the hosted model panel clearly labels that preserved call as recorded. The Solidity executor uses OpenZeppelin EIP712, SignatureChecker (including ERC-1271), SafeERC20 and ReentrancyGuard. Owner nonces are consumed atomically with transferFrom. Cancellation and epoch invalidation revoke pending approvals. An ethers 6 browser client verifies runtime bytecode, manages exact token allowances and requests typed signatures. The public Cloudflare Worker serves Vite assets and bounded policy/discovery APIs. maqam@0.3.3 is an existing MIT public library used for proposal policy, not claimed as newly authored code. Graph credentials remain server-side. The initial demo uses documented public read-only gateway access distributed by Agent0's SDK; a dedicated Graph Studio key is configurable. Thirty-two automated tests cover contracts, policy, Graph screening and evidence integrity, plus the real UI handlers against a local EVM: exact allowance/signing, settlement, replay, revocation, wallet changes and separate-executor packet import. Clean Linux CI and the production build pass. Pending wallet or input changes invalidate stale reviews; imported packets undergo onchain signature, nonce and epoch validation. Public Chrome checks verify live Graph results, the Arc receipt and a narrow-screen layout. Arc USDC is the settlement asset and gas currency: ERC20 amounts use six decimals, native gas uses eighteen. The fully verified contract and retained 1 USDC fixture prove exact authorization and replay protection. That fixture is separate from Graph-discovered third-party agents. A second Chrome test connected the participant’s MetaMask wallet and settled a 0.10 test-USDC self-payment on Arc (block 61761093). The participant confirmed wallet prompts while Codex operated the app; recipient/amount tampering and replay were rejected through eth_call simulations. Public receipt and consumed-nonce verification are retained in evidence/participant-wallet-test.json. This second test is not a separate-executor or third-party agent payment. AI assistance: OpenAI Codex assisted research, implementation, tests, UI and documentation. Specifications, model prompts, live-query evidence and incremental commits are retained. Participant direction, automated tests, scripted signing, human wallet testing and narration are distinguished honestly in AI-ASSISTANCE.md.