Replay of the main run, 3 Nov 11:16–11:33 UTC · test money · real Claude decisions

A limit the agent cannot talk past

Purser's entry for the Metal Award.

Each payment, checked on chain

Sourcing agentpays Stockline per stock check, over x402
Its mandate at #24, the first bindcap 0.03 a payment · budget 10.00 · payee Stockline bind ↗
Alta (formerly Metal) checks each paymentagainst cap, budget, payee and expiry

Within the cap: paid#23 · 0.02 *USDZ

Under the 0.03 cap. tx 0x870e…bc8f ↗

Over the cap: refused on chain#24 · 0.04 *USDZ

Over the 0.03 cap: MandateRefused on chain, nothing moved. tx 0x2e92…1871 ↗

Budget and spend, per mandate

One scale, in *USDZ; the terms as the main run ended (3 Nov).

Sourcingspent 1.18 of 14.00 · cap 0.04
Supportspent 0.15 of 4.00 · cap 0.10
Treasuryspent 0.69 of 2.00 · cap 2.00
Customer's agentspent 2.05 of 5.00 · cap 0.10

86 Alta payments, each its own transaction

41sales
41supplier purchases
3refunds
1sweep

Northwind's account ↗ checked one by one ↗

Refused, nothing moved

#24: 0.04 ~~> cap 0.03~~

Our own check was off for this test. Alta refused it on chain; nothing moved.

tx 0x2e92…1871 ↗ decoded ↓

#37

Old mandate, after the replace: refused by Alta's facilitator, no transaction.

The 4 mandates on chain, one per agent

Sourcing
Pays
Stockline
Cap
0.04 a payment ↗
Expires
13 Dec
1.18 of 14.00
Support
Pays
Summit Outfitters
Cap
0.10 a payment ↗
Expires
13 Dec
0.15 of 4.00
Treasury
Pays
Northwind sweep wallet
Cap
2.00 a payment ↗
Expires
13 Dec
0.69 of 2.00
Customer's agent
Pays
Northwind Outdoor
Cap
0.10 a payment ↗
Expires
13 Dec
2.05 of 5.00 recorded 3 Nov

*USDZ, test money.

Spent: a recorded snapshot from 12 Nov (block 26003049), not a live read.

Check it yourself

curl -s https://kit11.max-31b.workers.dev/api/metal/mandates

It reads Alta testnet live when the chain answers: one cached read for everyone every 15 minutes, at most 500 calls a day, read-only. When the chain does not answer, it returns the recorded snapshot from 12 Nov (block 26003049), and its source field says which. With your own Alta testnet RPC: eth_call to 0x6e621D0f1ff6a03cAF1dbFE9747eCEc4513Efefc with mandates(ref), selector 0x01e07972, at the block shown. In a clone: npm run metal-inspect. the check of 12 Nov ↗

Details: every mandate

Each mandate, its cap and its spend

Agent	Cap a payment	Budget	Spent	Payee	Expires	Revoked
Sourcing	0.04 ↗was 0.03: first bind ↗	14.00 (was 10.00)	1.1841 payments	Stockline	13 Dec	no
Support	0.10 ↗	4.00	0.153 payments	Summit Outfitters	13 Dec	no
Treasury	2.00 ↗was 6.00: first bind ↗	2.00 (was 6.00)	0.691 payment	Northwind sweep wallet	13 Dec	no
Customer's agent	0.10 ↗	5.00	2.05recorded 3 Nov	Northwind Outdoor	13 Dec	no, 3 Nov

*USDZ, test money. Each cap links the transaction that set it.

Mandates replaced after Face ID

Face ID
P-0002: the CFO's Face ID and a test passkey approved it in Purser.
New mandates on chain
Treasury 2.00 ↗Sourcing 0.04 ↗
One owner key, held by Purser's runner, signed on chain. The chain did not check Face ID. In a separate 12 Nov run, a passkey account checked both passkeys on chain (the second a labelled test passkey). ↓
Old mandate refused
#37 on the old mandate: refused by Alta's facilitator (mandate_revoked), no transaction.

Also on Alta: 6 separate runs

What	When	Proof
Two owners, both must sign	30 Oct	tx ↗	paid with both signatures; one alone reverted
Passkeys as the owners	1 Nov	tx ↗	software passkeys, not a phone
Money from strangers held	30 Oct	tx ↗	held by Alta, then returned
Clearing	29 Oct	tx ↗	one deposit, then each query paid by a signed receipt
Send policy	30 Oct	tx ↗	Purser's own contract, not Alta's
Hold for an approved amount	10 Nov	tx ↗	held, then captured to the supplier on 12 Nov

Both refusals, decoded

event MandateRefused(bytes32 indexed ref, address indexed to, bytes20 l3aDigest, bytes agentKey, uint256 amount, uint8 reason) (topic 0 0x4084f1f1447ac5e65f441c04fd31a9d7e5874a7d4d1d4853f5bb5211b9717116).

#24, 3 Nov, block 14150386 tx ↗

Our own check was off for this one test. Alta's facilitator answered 402; a second call had Alta record the refusal on chain: 0.04 *USDZ over the cap at the time, 0.03. Nothing moved.

On the explorer: log #0 is Alta's MandateRefused event (undecoded there); topic 1 is the Sourcing mandate 0x11734e…9901 and its data carries 0.04.

ref: 0x11734e63d21f6fdeba4000a76e82440ea2705ca5ec2c436c77f13e8bf58c9901
to: 0x1936e1869FadF65a53B8492fb6ccCf21200d42ED
l3aDigest: 0xc2532f0a770471081e5d46278277a53a1f0dffe2
agentKey: 0x01ecd7a9c185e1d297d51fda311acfdbbff9885e94a90eff0ff1752b1d225b2a3fe660cc630948cef938b11784923cbb6940cc3b32d57945457bf8bb63334dd4e8
amount: 0.04 *USDZ
reason: 8 (OverPerPaymentCap)

address 0x6e621d0f1ff6a03caf1dbfe9747ecec4513efefc
topic 0 0x4084f1f1447ac5e65f441c04fd31a9d7e5874a7d4d1d4853f5bb5211b9717116
topic 1 0x11734e63d21f6fdeba4000a76e82440ea2705ca5ec2c436c77f13e8bf58c9901
topic 2 0x0000000000000000000000001936e1869fadf65a53b8492fb6cccf21200d42ed
data 0xc2532f0a770471081e5d46278277a53a1f0dffe20000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000008e1bc9bf0400000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000004101ecd7a9c185e1d297d51fda311acfdbbff9885e94a90eff0ff1752b1d225b2a3fe660cc630948cef938b11784923cbb6940cc3b32d57945457bf8bb63334dd4e800000000000000000000000000000000000000000000000000000000000000

A revoked credential, 30 Oct, a separate run, block 10099272 tx ↗

ref: 0x27dbcea7632ded60102c8a610a5a2b9b719f2d54707e53cdaa539843a2c4c5a7
to: 0x706813f343dBE1Df0ad9F5dE8B4E9E789d71B13A
l3aDigest: 0xb941811b01d99f29b787e6c26241f230c2b2eda5
agentKey: 0x015468b2567bd56c240071656d6d4ef179513e09908881c74a2d42376686dee37b60d470fed0f1d6536e5b428188698bfaddccf34984afa7236d67cfc8cea2852e
amount: 0.05 *USDZ
reason: 2 (Revoked)

address 0x15eb7c1322952e0c549b7da0b57d35171518a41a
topic 0 0x4084f1f1447ac5e65f441c04fd31a9d7e5874a7d4d1d4853f5bb5211b9717116
topic 1 0x27dbcea7632ded60102c8a610a5a2b9b719f2d54707e53cdaa539843a2c4c5a7
topic 2 0x000000000000000000000000706813f343dbe1df0ad9f5de8b4e9e789d71b13a
data 0xb941811b01d99f29b787e6c26241f230c2b2eda5000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000b1a2bc2ec5000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000041015468b2567bd56c240071656d6d4ef179513e09908881c74a2d42376686dee37b60d470fed0f1d6536e5b428188698bfaddccf34984afa7236d67cfc8cea2852e00000000000000000000000000000000000000000000000000000000000000

npm run metal-inspect -- refusal 0x2e92f9cb4549246f58b9b888881c258bf117c6233c1d8f126f4833ae6ae41871

The live proof, with every tx

86 Alta payments + 1 card charge, all inside the limits: 41 sales + 41 supplier purchases + 3 refunds + 1 sweep on Alta, and 1 card charge at Airwallex.
Refused by Alta: Stockline at 0.04, over the cap at the time, 0.03 (mandate_cap_exceeded); nothing moved. tx 0x2e92…1871 ↗We switched off our own check once to prove the chain holds the line: Purser refuses an over-cap purchase before signing; with that check off for one purchase, Alta refused it anyway.
Refused by Alta: Stockline, the old mandate was revoked by its replacement; nothing moved
New mandate on chain after two signatures: Treasury agent, cap 2.00, budget 2.00 tx 0x789a…ebbc ↗
New mandate on chain after two signatures: Sourcing agent, cap 0.04, budget 14.00 tx 0x2a91…e790 ↗
Paid per request (x402), with a signed order: 41 stock checks sold, each paid under the customer's mandate and settled by Alta's facilitator 0x2cc5a16e…2fc7 ↗
The agent buys from its supplier: 41 purchases, each under the Sourcing agent's mandate 0x64d22177…4c7d ↗
Refunds as mandate pulls: 3 refunds, 0.15 test USD, back to the paying account only, each under its own payment id 0xe4bf7962…c89d ↗
Sweep, after finality: earnings moved once their block (14153316) was finalized (14153325); booked at Airwallex exactly once 0x86936a5b…ccb4 ↗

All 86 transactions

Each with its link to the explorer ↗

The Alta features we use, and their docs

A mandate per agent: Mandates ↗
Replace and revoke, after Face ID: Binding, replacing and revoking ↗
Pay per request (x402), with a signed order: x402 on Alta ↗ · Signed orders ↗
Settled by Alta's facilitator, or refused: Facilitator ↗ · Refusal reasons ↗
Refunds as mandate pulls: How a payment is checked ↗ · Payouts ↗
Sweep after finality: Settlement and finality ↗
Four eyes on chain: Smart account ↗

What is simulated

Test money on Alta testnet only (*USDZ).
Stockline, the supplier, and Summit, the customer whose agent buys from us, are simulated; their payments are real testnet transactions.
The second approver on the mandate change is a labelled test passkey; in production it is a second person.
Passkeys as the account's owners ran on 1 November with software passkeys, not a phone.

Passkeys sign on chain (P-256)

12 November: the agent's limit changed only with 2 passkeys, checked on chain.

Alta testnet · test money · second signer: labelled virtual test passkey · CFO's device as stated by the owner · run record ↗

Prototype

Invoice token (prototype)

12 November, a separate Alta testnet run. An invoice the CFO approved with a passkey on 7 November became a token. A simulated financier bought it for 2.35 test USD; the debtor paid its holder 2.40. Amounts are scaled down 100× for testnet.

Chain record verified

7 transactions

Deploy PurserInvoiceToken 0xd4c4…9b91 ↗
Mint to the creditor 0xefc6…b575 ↗
Offer to the financier 0xc3ac…56cf ↗
Financier approves the price 0xebd6…8ae0 ↗
Financier accepts: advance to the creditor 0xef3c…32be ↗
Debtor approves the face value 0xcf02…ab4e ↗
Debtor settles: face value to the holder, token burned 0xc277…6fad ↗

Prototype · test money · 46 requests to Alta testnet of a budget of 60 · run record ↗

All the proof