Thenar

Demo

About

Physical AI is short of data, not compute. Thenar pays people to record robot arm demonstrations, and sells what they record to AI agents as training data. Anyone can drive a six-axis robot arm from a browser. Each task (put the spoon and the mug into the crate, stack the blocks) runs in a 3D station with a MuJoCo physics check. When the object settles, the run is scored on placement (55%), smoothness (25%) and efficiency (20%), and an accepted run is paid on the spot in USDC from a bounty held in escrow. The easy attack on a bounty market is one person with a hundred wallets. Thenar signs a run only for a wallet that has passed a World ID Selfie Check: one face scan per human for this action, bound to one wallet. A wallet with no proof is refused (HTTP 403) before anything is paid. Robotics labs fund the bounties. A lab's budget sits in a Privy server wallet whose policy only lets it fund Thenar tasks, up to 1 USDC. Ask that wallet to send money anywhere else and Privy refuses to sign. Operators sign in with just an email, and Privy creates their wallet. The recordings are sold over HTTP 402 on Hedera. An agent asks for a task's data, pays 0.5 HBAR with x402 (settled by the Blocky402 facilitator, which pays the network fee) and receives the file. Every sale is written to a Hedera Consensus Service topic (0.0.10519262) with the SHA-256 of the exact file served, so the buyer can check its copy against the mirror node. World AgentKit checks AgentBook on World Chain first: an agent with a verified human behind it downloads for free. The corpus itself is a security issued through Hedera's Asset Tokenization Studio: Thenar Robot Corpus (THNRC, ISIN USTHNRCRP019, 0.0.10520394). Holders must be on its whitelist, and the token itself refuses an address that isn't (AccountIsBlocked). Shares are issued into a treasury reserve and a dividend has been declared, so the dataset people build can be owned in shares. Everything in the demo is a real testnet transaction, captured from the running app: a bounty funded and paid on Arc, a data sale settled on Hedera and logged to HCS, ten new shares issued through the Tokenization Studio, and a real Selfie Check.

How it's made

Next.js 16 (App Router) and React 19, with wagmi and viem on the client, SQLite for off-chain state and Foundry for the contracts. The station is React Three Fiber: inverse kinematics on a six-axis arm, with MuJoCo compiled to WebAssembly checking the physics in the browser. The recorded trajectory goes to the server, whose verifier signs an EIP-712 verdict; the Thenar protocol contract on Arc Testnet checks that signature and pays USDC in the same transaction that records the run. Ten contracts are deployed and source-verified on Sourcify and Arcscan, and a CorpusManifest contract commits a Merkle root of each task's recordings. Hedera sells and tokenizes the data. The data endpoint uses @x402/next with @x402/hedera (exact scheme, 0.5 HBAR), and Blocky402 is the facilitator, so the buying agent needs only a funded account. After settlement the server submits the served file's SHA-256 to an HCS topic with @hashgraph/sdk, and the buyer reads it back from the mirror node. The corpus is an Asset Tokenization Studio security with a whitelist control list, reserve issuance and a dividend, and its proxy is source-verified on Sourcify (exact match). When a run is paid on Arc, the server issues that contributor's corpus shares on Hedera, but only if they hold a World ID proof, so the chains meet at one verified human. World: IDKit 4 with the Selfie Check credential, on an action capped at one verification per human. The server verifies the proof, binds the nullifier to the wallet through a signature over a server nonce, and will not sign a run without it. World AgentKit checks AgentBook on World Chain for a human behind the buying agent. Privy: email login with embedded wallets, and a server wallet under a policy (only the Thenar protocol contract, only chain 5042002, up to 1 USDC) for lab budgets. Notable hacks: - AgentKit's client reads the payment offer from the response body, while x402 v2 sends it in a header, so the server copies the decoded offer into the body. - AgentKit's challenge failed with extension_echo_mismatch until its nonce and timestamps were declared dynamic. - One secp256k1 key signs the AgentKit challenge and is also the Hedera account's ECDSA alias, so the agent has a single identity on World Chain and Hedera. - Privy signs but will not broadcast on Arc Testnet, so the app broadcasts the transaction Privy signed. - The ATS SDK only signs through MetaMask, HashPack or a custodian, so Thenar calls the ATS contracts directly with viem through Hashio JSON-RPC. - Sourcify verification of the ATS proxy rebuilds the compiler input, because the npm package ships without build-info. - The demo video was recorded by a Playwright script driving a Chrome DevTools screenshot loop at 1920x1080, narrated with Kokoro TTS.