Recon

Demo

About

RECON — Mandate Reconciliation for AI Agents Everyone is putting leashes on AI agents (spending caps, allowlists, session keys), but almost nobody verifies that the leash actually holds. RECON is a reconciliation layer that answers that question, rather than being yet another agent wallet. RECON reconciles three views of the same agent activity and turns any disagreement into independently re-verifiable evidence: - Claimed — what the agent says it did (query, payment, action), recorded as HCS messages with canonical hashes. - Actual — what really happened on-chain, read from PolicyVault execution events and Hedera transactions. - Allowed — the mandate that was in effect at the moment of execution: budget cap, recipient allowlist, and deadline. Five deterministic rules (R1–R5) compare these three columns using one shared pure-TypeScript core: replaying a The Graph query at a pinned deployment and final block, checking each executed action against the mandate valid at that moment, verifying the claimed vs. actual executed set, validating HCS message ordering via a correlation state machine, and matching payment claims against settlement receipts. Any inconsistency produces a MISMATCH with a deterministically derived evidenceHash; a down external service produces UNVERIFIABLE rather than being silently passed or failed. The agent runs on a restricted signer with no owner keys: it performs a live The Graph query, pays an x402-gated RECON verify-query API settled on Hedera testnet, selects a bounded action, executes through an on-chain PolicyVault (HBAR budget, allowlist, deadline, stake), and publishes its evidence to an HCS topic under a single correlation ID. A public verifier — the same code the agent used — then replays everything from the Hedera mirror node, the Graph gateway, and payment receipts, and presents the Claimed / Actual / Allowed reconciliation in both a CLI and a React panel. Everything runs live against real services (real HCS messages, real vault transactions, real 402 payments) with no mocks presented as evidence.

How it's made

RECON is TypeScript end to end, with one Solidity contract. The central design decision is that verification is a pure function: src/core holds the canonicalization, SHA-256 hashing (via @noble/hashes), correlation state machine, and the R1–R5 reconciliation rules, and it never touches the network, environment variables, wallets, or the UI. Vendor behavior lives behind narrow adapters (src/adapters/thegraph, src/adapters/blocky402, src/adapters/hcs), and module boundaries are enforced by ESLint import rules. The payoff: the agent and the public verifier literally run the same code, so CLI/Web parity is structural rather than something we tested into existence by hand. The on-chain side is a PolicyVault in Solidity 0.8.34, compiled with Hardhat 3 and driven through viem over the Hedera JSON-RPC relay. It separates owner / agent / verifier / operator roles, enforces an HBAR budget cap, recipient allowlist, and deadline before any transfer, isolates the operator's pre-funded stake from the vault principal, and exposes a kill-switch that makes the next agent action revert with NotActive. Seven Solidity tests cover the mandate, roles, stake isolation, slashing, and the freeze. The application layer is strict TypeScript (Node ≥ 22.13) with zod validating every JSON boundary, a Vite 8 + React 19 panel, and tsx-run scripts for probes and the live demo. The browser demo drives the whole loop through a single backend process — Graph query → x402 payment → DeepSeek rationale → vault execute → five HCS events → verify — so no browser wallet is needed; slash and freeze are signed server-side from .env keys. The frontend implements no rules of its own; it renders the same LiveSnapshot the CLI verifier emits. Partner technologies, load-bearing: - Hedera — @hashgraph/sdk publishes the HCS evidence timeline under one correlation ID and reads it back from the mirror node; PolicyVault runs on testnet (chain 296). - The Graph — a GraphQL query drives the agent's decision and is replayed at a pinned deployment + final block as R1 evidence, using the same canonicalization and hash. - x402 / Blocky402 — the verify-query API returns a 402 with exact/hedera:testnet requirements; the agent pays through the Blocky402 facilitator, which verifies and settles, and the response carries the on-chain settlement reference. Payment success is deliberately independent of verification pass. - DeepSeek V4 Flash — picks between bounded EXECUTE_VAULT / STOP and writes a short rationale. The LLM never computes an amount, address, hash, or policy result; that's all deterministic code. Notable/hacky bits: the x402 payment header is generated in memory inside the same code path the web server uses, so the demo needs no separate api:start process or header round-trip. Hedera's public relay rejects wide eth_getLogs spans, so verify:live starts its vault-log scan at the vault's deploy block (resolved from the mirror node). We hit the weibar-vs-tinybar trap — msg.value-style amounts are 18-decimal weibar while calldata amounts are 8-decimal tinybar — and handle both explicitly. And when The Graph gateway prunes historical _meta.block.hash, we record it as null rather than fabricate it. Development was AI-assisted and disclosed; a human set scope and reviewed every change.