Quaestor

Demo

About

Quaestor is a multichain control and observability layer for autonomous trading agents: a routing engine for agents and an Etherscan-style public explorer for everyone else. Owners give each agent a treasury with purpose-scoped allowances for DATA, INFERENCE and EXECUTION. Per-call and per-epoch limits are enforced by smart contracts, so an operator can act quickly but cannot exceed the authority its owner granted. Every successful spend emits a receipt that binds the payment to the keccak256 hash of the agent’s decision record. The public explorer lets anyone inspect the agent, its owner and operator, its policies, payment history, rationale and transaction proof without connecting a wallet. A wallet is only needed when an owner wants to manage an agent. Quaestor also introduces herd-aware routing. When one onboarded tenant reports an attacked venue, that venue’s permit price rises for every other agent. The price is calculated as base × (1 + k × distinct reporters). If the new price exceeds an agent’s owner-set cap, the governor refuses the transaction. This turns shared risk intelligence into an economic signal that agents can consume automatically. The system is live across X Layer, Arc and Base, with paid x402 decisions settled in HBAR on Hedera testnet. The same product exposes risk quotes, policy evaluation, venue comparison, agent histories and verifiable decision receipts through machine-readable routes and a public multichain explorer. Quaestor is entered through ETHOnline’s Continuity / Extend Open Source track. The original X Layer governor, SDK, agent and dashboard existed before the event and are preserved at the public pre-ethonline tag. During ETHOnline, I built the shared risk-pricing hub, Hedera x402 settlement, Arc and Base deployments, The Graph indexing and policy integration, the multichain agent explorer, history-aware agent checks and the supporting verification tools. The complete boundary is documented in CONTINUITY.md.

How it's made

Quaestor is a TypeScript and Solidity monorepo. Quaestor.sol is the enforcement layer. It stores each agent’s owner, operator, guardian, treasury and separate DATA, INFERENCE and EXECUTION policies. Its authorization path checks suspension state, treasury balance, per-call caps and epoch caps before transferring funds or routing a swap. Each payment emits a Receipt containing the agent, category, amount, payee, epoch totals and the hash of the decision that caused it. The contracts are deployed on X Layer testnet, Arc testnet and Base Sepolia. Arc is especially useful because its native gas asset is USDC, so the unchanged governor expresses its limits directly as dollar-denominated caps. A reproducible proof script performs an allowed payment, asks for one wei over the limit, decodes PerCallCapExceeded and verifies the resulting budget change. The service layer uses Node.js, Express, ethers v6 and x402 v2. It exposes free risk quotes and paid routes for threat lookup, route permits, venue comparison and policy evaluation. Hedera testnet provides the x402 settlement rail using @x402/core, @x402/hedera and the Blocky402 facilitator. A real request receives a 402 challenge, signs an HBAR payment, retries the request and returns a settlement receipt that resolves through the Hedera mirror node. Route pricing increases with the number of distinct onboarded tenants that reported a venue. The Graph indexes the Base Sepolia governor. Its mappings derive information that a running on-chain total cannot explain by itself: payment count, largest payment and the time window of spending within each epoch. The policy endpoint reads the agent’s real governor state instead of trusting budget numbers supplied by the caller. Checks that require history fail closed when the subgraph is stale. The same data is available to agents through an MCP server and a Quaestor budget-history skill. The frontend uses React, TypeScript and Vite. I rebuilt it as a public multichain agent explorer with network-aware pages for agents, policies, decisions, routes and deployments. Decision pages retrieve the published rationale and recompute its hash inside the browser before displaying “Hash matches.” Public reads require no wallet; signing is isolated to the owner-management page. The example agent, Cato, purchases a real market signal, evaluates momentum, sizes a trade, checks its own prior spending pattern and submits the action through the governor. Its data purchase and execution produce separate on-chain receipts. If the request exceeds an owner-set boundary, the deployed contract returns a named custom error and no funds move.