Warrant Protocol
Warrant Protocol - My bot acted. I fired every agent under me. Nobody learned who I was.
Demo
About
Warrant is a permission slip for AI agents. You keep your wallet key. Your bot gets a time-limited warrant instead of your identity. It can call services, leave a public note, even hire a helper. Whoever it called still cannot tell who authorized the request. When you are done, you Fire in the tab and every agent under that warrant stops. The problem is simple. Today, if you want a bot to act, you hand it a key or an account. Then whoever the bot called can name you. If it hires helpers, you often lose the ability to shut the whole chain down. Warrant splits those jobs. MetaMask authorizes. The bot carries only a bearer. Hedera pays when a shop requires x402. Fire takes the warrant back. On the hosted product at warrant-beta.vercel.app you authorize a guest warrant (about 30 minutes). Install the skill once into Hermes or another HTTP agent. Paste the warrant. The bot POSTs to Warrant’s agent API. Warrant’s prove worker builds a Groth16 hop proof over Baby Jubjub mandates in a LeanIMT on Base Sepolia (MandateRegistry). The bot never sees the witness or the zkey. The shop verifies the proof and learns a context-scoped nullifier, not you. For the memo demo, Hermes posts to /api/agent/memo. The memo shop on Railway returns 402 until ExactHedera payment settles via Blocky402. A local warrant ready purse on your machine shows /fund so you can send testnet HBAR. After pay, the shop submits the note to Hedera Consensus Service topic 0.0.10416077. The text is public on HashScan. Who asked is not. Fire this warrant (or Fire every) tombstones the hop or bumps the identity so the next call dies with a stale root. The north star: my bot acted, I fired every agent under me, nobody learned who I was.
How it's made
I built Warrant as a pnpm monorepo with hard process boundaries, not one app that does everything. Stack. Circom WarrantHop(20) plus a Groth16 ceremony (artifacts-groth16-v3, pot16). Foundry contracts on Base Sepolia: MandateRegistry (LeanIMT + epoch, no Groth16 in Solidity), generated WarrantVerifier, optional WarrantGate. TypeScript domain in @ronnakamoto/warrant-core (Poseidon, Baby Jubjub / Semaphore identity, witness, snarkjs prove/verify, exactly eight public inputs). Shop middleware in @ronnakamoto/warrant-x402 (policy pipeline, challenge nonce, nullifier seal, ExactHedera pay fallthrough, createWarrantShop + warrantHono). Agent CLI @ronnakamoto/warrant for ready / act and a local fund page. Next.js dashboard (Astryx + Carbon language) on Vercel. Isolated prove worker, translate shop, and memo shop on Railway. The Graph Studio subgraph indexes registry events for the console, not as a second mandate model. How it pieces together. Authorize on the dashboard mints a guest session on prove: 2-hop mandate tree, operator bind into MandateRegistry, bearer = random session id. Hermes installs /skill.md and POSTs to /api/agent/memo with that bearer. The BFF calls prove with the live x402 challenge; prove returns a warrant header. The memo shop verifies Groth16, checks merkleRoot == currentRoot, seals (nullifier, requestHash), then Blocky402 settles HBAR and the service submits the note to Hedera Consensus Service. Fire is an on-chain revoke from the MetaMask that bound the leaf; the next prove fails as root revoked. scripts/check-boundaries.mjs enforces the split: dashboard never imports snarkjs, shops never call prove, prove never imports Hedera or x402. Partner tech. Base Sepolia holds the public revocation and membership root so Fire is real, not a cookie delete. Hedera gives us live x402 settlement (Blocky402 ExactHedera) and a public HCS scar for the demo note, which is the honesty punchline: words public, person private. Semaphore-style LeanIMT / identity primitives let us reuse a known anonymity-set pattern instead of inventing a tree. x402 is the payment extension slot so warrant verify and pay compose in one shop request. Hacky but deliberate. Hosted Copy means Warrant sees the witness so cloud bots never touch a 28MB zkey. Guest tier=0 with a random session tag (no World ID on the land) so strangers can try on real rails. Free calls = 0 forces a real 402. Chat must never invent a Hedera key, so payment is a local purse + /fund on 127.0.0.1. Hire returns a helper skill paste instead of spawning a subagent on camera. The bearer is intentionally not the proof: it is an opaque capability handle into prove’s session store.